RiderSynkEspañol
Privacy policy
Version 1 · effective date pending · Applies to the RiderSynk Android app and to ridersynk.com. The Spanish version prevails.
UNPUBLISHED DRAFT. Written from what the app and the server really do (September 2026). Before publishing, a lawyer must review it and the fields in square brackets must be filled in.
RiderSynk is an app for riders: meetups, a map of parks, the Rider Card, chat, crews and tools (Synk+). Here we explain, with no small print, what data of yours we process, why, for how long and what you can do about it. We do not sell data, there are no ads and we do not build profiles for advertisers.
1. Who is responsible
Controller: [FULL NAME OR COMPANY NAME], [TAX ID], [ADDRESS].
Privacy contact: [PRIVACY EMAIL]
Where the data lives: on our own server located in Spain.
2. What works without an account and never leaves your phone
Many parts of RiderSynk send nothing to our server: the Synk+ tools (music, mixer, camera, private gallery, notes, PDF, calculator and the rest), the profiles of your Bluetooth devices, settings and the local technical history. All of that stays on your phone unless you choose to share something.
- Private gallery and Notes+: encrypted on the phone itself. We do not have the key.
- Bluetooth and nearby Wi-Fi: used to connect the remote, skates and sessions between nearby phones. That link goes from phone to phone.
- Microphone: only when you turn on a voice feature. Session voice goes to the participants and is not stored on our server.
3. What data we process if you use Community
| Data | Why | Legal basis |
|---|---|---|
| Google account: identifier, email, name and photo. | Create your account and recognise you when you sign in. Your email is never published. | Contract (Art. 6.1.b GDPR). |
| Profile and Rider Card: name or alias, @, photo, city, discipline, social links and anything you add. Each field has its own visibility (public, friends or only you). | Show your card to whoever you choose. | Contract. |
| Age band: under 14, 14 to 17 or adult. We do not keep your year or date of birth. | Protect minors (see section 6). | Legal obligation and legitimate interest in safety (Art. 6.1.c and f). |
| What you publish: meetups, photos, votes, park entries, Epic Photos, giveaway entries. | Run Community. A meetup shows the meeting point you choose to anyone, even without an account. | Contract. |
| Friends, follows, blocks, groups, rooms and crews. | Make them work. | Contract. |
| Private chats: your messages and attachments. | Deliver them. They are stored on the server so they arrive even if the other person is offline. They are not moderated or analysed: only a message someone reports is reviewed. | Contract. |
| Online status. | Show who is connected. You can turn it off in Edit profile. | Contract. |
| Nearby alerts: an area and a radius. | Tell you about meetups nearby. The location is stored rounded to about 1 km, never exact. | Consent (you turn it on). |
| Phone location. | Sort places by distance on your own phone. It is not sent as tracking. | Consent (Android permission). |
| Notifications: an identifier of your phone for push alerts. | Send you message and meetup alerts. | Consent (notification permission). |
| Safety (Shield): reports, blocks, moderation decisions and appeals. | Keep Community safe and respond to abuse. | Legitimate interest and, where there is a crime or a risk to a minor, legal obligation. |
| Crash reports (Crashlytics): version, phone model and the technical trace of the crash. | Fix bugs. Off until you turn it on. Never includes your name, your email or your content. | Consent. |
| Server technical logs. | Detect outages and attacks. | Legitimate interest. |
4. How Shield reviews public content
Shield is the RiderSynk safety system and it runs on our own server, without sending photos or texts to third parties or to external artificial intelligence services.
- Public photos are reviewed before they are shown and are published without camera data (EXIF) or GPS. The original stays in a private inbox.
- Public texts are analysed and deleted after the analysis; they are only kept if they open a case.
- If in doubt and a minor may appear, a person on the team decides. Nobody is sanctioned by a machine alone without being able to appeal.
- Private chats do not go through Shield. Your phone only warns you about a dangerous link, without sending it anywhere.
5. How long we keep data
| What | How long |
|---|---|
| Your account and what you publish | While you keep the account. When you delete it, everything is deleted (section 8). |
| Meetup albums | Closed and deleted 48 hours after the meetup. |
| Photos rejected by Shield | 48 hours. |
| Shield cases with no breach | 30 days. |
| Shield cases with a breach | Between 6 months and 2 years depending on severity, unless the law requires longer. |
| Server technical logs | 45 days. |
| Backups | Overwritten within at most [30] days. Deleted data disappears from them within that period. |
| Record of deleted accounts | Only the date and how many items were deleted, with no name or email, so we can prove we handled your request. |
6. Minors
- RiderSynk is not available until you are 14. Anyone who tells us they are under 14 cannot use the social part (friends, chats, rooms, public photos and meetups). Tools that share nothing with anyone work the same. There is no parental permission that unlocks it.
- Age is required to add friends, send private messages, join a room or a crew. Until you tell us, we treat you as a minor: nobody can message you first.
- From 14 to 17: no adult can start a private chat with a minor or add them; the minor can write to anyone. For their public photos, any doubt is reviewed by a person.
- The band can only be changed to a more protected one.
7. Who we share data with
Only with those needed for the app to work, and never for advertising:
- Google (Ireland and USA): Google sign-in, push notifications (Firebase Cloud Messaging) and, only if you turn it on, crash reports (Firebase Crashlytics).
- Cloudflare (USA and EU): the connection between the app and our server goes through its network, which sees your IP address and protects the server from attacks.
- Maps and radio: maps (OpenStreetMap and OpenFreeMap) and the radio directory (Radio Browser) are downloaded by your phone directly from those services, which see your IP address.
- Authorities: only when the law requires it, for example in a crime against a minor.
Transfers to the USA rely on the EU-US Data Privacy Framework or on the European Commission standard contractual clauses. [PENDING: confirm the mechanism for each provider with the lawyer.]
Other people see what you publish and what you mark as visible on your Rider Card, depending on who they are (anyone, friends or nobody).
8. Your rights and how to use them
- Download your data (access and portability): in the app, Community › your account › Delete account › Download my data first. You get a ZIP with a readable JSON file containing everything the server keeps about you, your photos and what lives on your phone.
- Delete your account (erasure): in the app, Community › your account › Delete account. It is immediate and everything of yours is deleted: profile, Rider Card, friends, meetups, photos, alerts and the rest. Your groups and crews pass to another admin, or close if nobody is left. In chats with other people your texts show as a deleted rider and your photos, voice notes and locations are removed. Your files are removed from storage by an automatic process shortly afterwards. If Shield has an open report, that evidence is kept without your name only as long as the law requires.
- Rectify: edit your profile whenever you like.
- Object, restrict or withdraw consent: turn off alerts, notifications or crash reports in the app, or write to us. Withdrawing does not affect what was done before.
- For any other request, write to [PRIVACY EMAIL]. We reply within one month at most.
- If you disagree with our answer, you can complain to the Spanish Data Protection Agency (AEPD) or to the authority of your country.
9. Security
- Your session is stored encrypted on the phone with a key from the system itself (Android Keystore).
- Everything travels encrypted (HTTPS) between the app and the server.
- On the server, each person can only read their own data and what others let them see; the team only accesses what its role needs, and every look at Shield evidence is logged.
- Screens with your account data and the private folders do not allow screenshots.
10. Changes
If we change anything important in this policy, we will tell you in the app before it applies.
RiderSynk · ridersynk.com