Arcroute — Privacy Policy
⚠️ DRAFT — NOT LEGAL ADVICE. This document was drafted as a starting point and reflects Arcroute’s data practices as implemented in the app. It must be reviewed by a qualified lawyer (ideally one familiar with EU/GDPR and app-store requirements) before publication. Text in
[SQUARE BRACKETS]needs your input. It is the source for the futurearcroute.app/privacyweb page.
Last updated: [DATE]
Effective: [DATE]
1. Who we are
Arcroute (“Arcroute”, “we”, “us”, “our”) is a motorcycle navigation app for iOS. The data controller responsible for your personal data is:
[LEGAL ENTITY / OPERATOR NAME][REGISTERED ADDRESS][COUNTRY]·[COMPANY / VAT ID, if any]Contact: support@arcroute.app
If you are in the EEA/UK, you can also contact us about anything in this policy at the address
above. [If you appoint an EU/UK representative or DPO, name them here.]
2. Scope
This policy explains what personal data the Arcroute iOS app collects, why, who we share it with, how long we keep it, and the rights you have. It applies to your use of the app and the services it connects to. It does not cover third-party services you reach through the app (e.g. the Apple App Store), which have their own policies.
3. The data we collect
We collect only what the app needs to function. Specifically:
| Category | What | When / why |
|---|---|---|
| Account | Your name and email address from Sign in with Apple (you may choose Apple’s “Hide My Email” relay). A user identifier. | Required to create your account, secure your rides, and sync across devices. |
| Location | Precise GPS location, including in the background while recording or navigating (position, heading, speed, altitude, timestamps). | Core to navigation, ride recording, and your personal heatmap. Background access is used only while you are actively navigating or recording a ride. |
| Ride & route data | Planned routes, saved and recorded rides, waypoints, routing preferences, per-point telemetry (speed/altitude/time), a derived personal heatmap, and an optional profile avatar image. | To provide, save, and sync the rides and stats you create. |
| Search & routing queries | Places you search for and the coordinates of your start/stops/destination. | Sent to our routing and search providers (see §5) to return routes and results. |
| Subscription | Your subscription status and Apple transaction identifiers. We never see or store your payment-card details — Apple processes all payments. | To unlock the app for active subscribers and show your plan in Settings. |
| Diagnostics & support | Basic crash/diagnostic information [confirm what, if any, is collected — e.g. via Apple's opt-in analytics] and any messages you send us. | To keep the app working and to answer you. |
We do not sell your personal data, and we do not use it for third-party advertising.
4. Why we use it, and our legal bases (GDPR Art. 6)
- To provide the service you subscribed to — navigation, routing, ride recording, sync, account management. Legal basis: performance of a contract (Art. 6(1)(b)).
- To operate background location during active rides. Legal basis: contract, plus your device-level permission which you can withdraw in iOS Settings at any time.
- To keep the app secure and working (diagnostics, abuse prevention, rate-limiting our routing/search keys). Legal basis: our legitimate interests (Art. 6(1)(f)).
- To process your subscription. Legal basis: contract; billing itself is handled by Apple.
- Any optional analytics
[only if enabled]. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw.
5. Who we share it with (sub-processors) and where it goes
We use a small number of service providers to run Arcroute. They process data on our behalf, or as independent controllers where noted:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Apple | Sign in with Apple; App Store subscription billing; iOS platform services. | Account identity, payment (by Apple), device services. | Global / [US/EU] — see Apple’s privacy policy. |
| Supabase | Cloud database + storage that syncs your rides, profile, and avatar. | Account, ride & route data, avatar. | [SUPABASE PROJECT REGION — confirm] |
| Mapbox | Map tiles and place/address search. | Approximate/precise location and search queries when you use the map or search. | United States (Mapbox is a US company). |
| Self-hosted routing (GraphHopper) | Our own routing server that computes routes. | Start/stop/destination coordinates and routing preferences for each route request. | [HOSTING REGION — e.g. Hetzner, Germany (EU)] |
International transfers. Where a provider processes data outside the EEA/UK (e.g. Mapbox in
the US), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
[Confirm the transfer mechanism for each provider with your lawyer.]
We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety, or property of Arcroute, our users, or the public.
6. How long we keep it
We keep your personal data for as long as your account is active. When you delete your account
in the app (Settings → Delete account), we delete your account, profile, and rides from our
systems [confirm deletion propagation to Supabase + storage]. Some data may persist briefly in
encrypted backups before being overwritten. We may retain limited records where the law requires
it (e.g. tax/records related to your subscription — note that billing records are held by Apple).
7. Your rights
Subject to applicable law (and in full if you are in the EEA/UK under the GDPR), you have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent. You will not be discriminated against for exercising these rights.
- You can delete your account and rides directly in the app at any time.
- For any other request, contact support@arcroute.app. We aim to respond within 30 days.
- You have the right to lodge a complaint with a supervisory authority — in the Czech
Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ)
[adjust to your jurisdiction].
8. Location data — specifics
Arcroute requests location permission to work. “When in use” covers planning and active navigation; “Always”/background is used only while you are actively recording or navigating a ride, so your route can be recorded and guidance can continue with the screen off. You can change or revoke this at any time in iOS Settings → Privacy & Security → Location Services → Arcroute. Revoking it will limit navigation and recording.
9. Security
We use industry-standard measures to protect your data, including encryption in transit, scoped access to your own rows (row-level security), and platform keychain storage for your session. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Children
Arcroute is intended for adult motorcyclists and is not directed to children under
[16 / the age of digital consent in your country]. We do not knowingly collect data from
children. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified in the app or by updating the “Last updated” date above. Continued use after an update means you accept the revised policy, to the extent permitted by law.
12. Contact
Questions or requests: support@arcroute.app ·
[LEGAL ENTITY, ADDRESS].