Privacy policy

1. Who the controller is

The controller of your personal data is Bomberace s.r.o. (“we”), which operates the Ride2G app and the ride2g.com website.

For anything to do with data protection — and to exercise any of the rights below — write to us at petr.vavros@bomberace.com. We are not required to appoint a data protection officer and have not appointed one; that address handles requests.

2. What data we process

We process only what the app needs in order to work:

• Account. E-mail address, display name, an optional profile photo, language and currency, and the dates the account was created and the address confirmed. We do not keep your password — only a cryptographic hash of it, from which the password cannot be recovered.
• Bank details for settling up. Your account number or IBAN, if you fill them in. They are used solely to generate a QR payment and are disclosed only to the participant who owes you that particular amount. They never appear in a list of participants or in a public profile.
• Trips. Name, activity, date, description and notes, the planned route uploaded as a GPX, the list of participants, invitations and join codes.
• Position. Latitude and longitude, accuracy, altitude, speed, heading, the device’s battery level and the time of the fix — and only while you switch position sharing on yourself, on your own device.
• Messages. The content of a trip’s chat, the time it was sent, and who has read it.
• Expenses and settlements. Amounts, descriptions, how a cost is split between participants, optional photos of receipts, and whether it has been paid.
• SOS. The time of the alert, an optional note, the position and battery level at that moment, and who acknowledged or resolved it.
• Devices and sign-ins. Device name and platform, the token used to deliver push notifications, when it was last used, and sign-in tokens stored only as a hash.
• Operational data. IP address and the identification of the app or browser in server logs and for rate limiting (protection against abuse), a request identifier, and an internal record of significant changes to an account (who did what, and when).

We do not ask for and do not process special categories of personal data under art. 9 GDPR (health data, for instance) — unless you write them into a text yourself, such as a note on a trip or a chat message.

Neither the app nor the website contains advertising systems, third-party analytics or tracking cookies. ride2g.com stores nothing in your browser; signing in to the app is based on tokens, not on advertising identifiers of your device.

3. Why we process it, and on what basis

• Running your account, signing in, confirming your address and resetting your password — performance of our contract with you, art. 6(1)(b) GDPR.
• Creating trips, invitations, chat, the planned route, expenses and QR payment — performance of the contract, art. 6(1)(b).
• Sharing your live position with the participants of a trip — performance of the contract, art. 6(1)(b). On top of that, access to your position is granted by you in your phone’s system dialog and can be withdrawn at any time; sharing then stops working, while the rest of the app keeps working.
• SOS alerts to the other participants — performance of the contract, art. 6(1)(b), and in the extreme case protection of vital interests, art. 6(1)(d).
• Push notifications about a trip, messages and SOS — performance of the contract, art. 6(1)(b); delivery is permitted by you in your phone’s system dialog and can be switched off there at any time.
• Security, prevention of abuse, rate limiting, operational logs, auditing and fixing faults — our legitimate interest in running the service safely and reliably, art. 6(1)(f).
• Answering questions and requests to exercise your rights, and complying with legal obligations — art. 6(1)(c) and (f).

We do not use your data for automated decision-making or for profiling with legal effects for you, and we do not sell it.

4. Position sharing in detail

Your position is the most sensitive data the app processes, so it is treated differently from the rest:

• Your position is always sent by your device, and only while you have started sharing yourself. No feature lets another participant — or the organiser — start or resume sharing on your behalf.
• Your position is visible only to the other participants of the same trip. Nobody else.
• Every position carries its own age, so that neither the app nor the other participants can mistake an old fix for a current one.
• Sharing ends when you end it, when you sign out, or when the organiser finishes the trip — which ends sharing for everybody on it.
• The detailed track (the individual points) is deleted automatically after 90 days. Trip summaries, expenses and messages remain.

5. Who we share data with

We do not sell your data and we do not share it for advertising. The following categories of processors run parts of the service for us, and may work with the data only on our instructions:

• the hosting and application platform provider (Vercel);
• the database provider (Neon);
• the object storage provider for profile photos, receipts and GPX files (S3-compatible storage, Backblaze B2 by default);
• the outgoing mail (SMTP) provider, for address confirmation, password resets and invitations;
• push notification services (Apple Push Notification service by Apple Inc. on iOS, Firebase Cloud Messaging by Google LLC on Android) — what goes to them is the device token and the text of the notification;
• the route planning and search service (Mapy.com, Seznam.cz, a.s.) — the query contains coordinates or search text, not your identity;
• map data © OpenStreetMap contributors.

Other users see your data only as far as a feature requires: your name and photo are visible to the participants of your trips and to the people you are connected with; your position only to the participants of the trip you are sharing on; your bank details only to the debtor of a specific settlement.

We may also pass data to public authorities where the law requires it, and to our legal or accounting advisers where necessary.

Some processors may process data outside the European Economic Area (mainly in the USA). Where they do, the transfer relies on the European Commission’s standard contractual clauses, or on another instrument under art. 46 GDPR.

6. How long we keep it

• Your account and its content — for as long as the account exists. Deleting the account starts the process described in the next section.
• Detailed GPS track points — 90 days from the moment the server received them, after which a scheduled job deletes them. The last known position is held only while you are sharing.
• Messages, expenses and settlements — for as long as the trip they belong to exists.
• Sign-in tokens — until they expire, and at most 30 days after expiry or revocation; then they are deleted.
• Links sent by e-mail — a confirmation link is valid for 48 hours, a password reset link for 60 minutes.
• Server operational logs — short-term, in the order of days to weeks depending on the hosting configuration; they are there to resolve incidents.
• Internal audit records — for as long as the account exists, so that a significant change to it can be traced.
• Database backups — overwritten on the database provider’s ordinary cycle, so deleted data disappears from them with a delay.

7. Deleting your account

You can delete your account yourself in the app (from your profile), or write to us at petr.vavros@bomberace.com. For safety, the app asks for your password again before deleting.

Deleting the account removes:

• your e-mail address, display name and profile photo;
• your bank details and password;
• your devices, push notification tokens and every sign-in;
• your links to other users (friendships and pending requests);
• every position point you have ever sent.

Records of expenses and settlements and chat messages stay with the trip, but with nothing identifying you. That is deliberate, not an oversight: deleting a payer would change who owes whom, and removing one side of a conversation would leave everybody else’s replies answering nothing. What remains of the account is an anonymous record with no data that could identify you.

8. Your rights

In relation to your data, you have the right to:

• know what data we process about you and get access to it (art. 15);
• have inaccurate data corrected (art. 16) — most of it you can edit in your profile directly;
• have your data erased (art. 17), with the exceptions described in the section on deleting your account;
• have processing restricted (art. 18);
• receive the data you gave us in a machine-readable format and pass it elsewhere (art. 20) — we will send you a copy by e-mail on request;
• object to processing based on legitimate interest (art. 21);
• withdraw consent where processing rests on it — for your position and for notifications this is the system permission on your phone, which you can withdraw at any time.

You can exercise any of these rights with us by e-mail at petr.vavros@bomberace.com. We will reply within one month at the latest; in more complex cases we will tell you within that month that it will take longer. If we cannot verify that the request comes from the owner of the account, we may ask for further information — otherwise we would hand your data to anybody who knows your address.

If you are not satisfied with how we handle it, you can turn to the supervisory authority: Úřad pro ochranu osobních údajů (the Czech Data Protection Authority), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.cz.

9. Security

• All communication between the app and the server is encrypted (HTTPS/TLS).
• Passwords are stored only as a salted hash (scrypt); sign-in tokens are stored only as a hash too, so neither can be read out of the database.
• Trip data — positions, messages, expenses and tracks — is available only to that trip’s participants. Bank details only to the debtor of a specific settlement.
• Access to the production database is limited to a small number of people, and only to the extent operating the service requires.

No measure is absolute. If a security breach does happen and it poses a risk to your rights, we will report it to the supervisory authority within 72 hours, and to you as well where the risk is high.

10. Children

The app is not intended for anyone under 15, and they should not create an account. If we find that an account belongs to a child under 15 without their legal guardian’s consent, we will delete the data. If you are a legal guardian and believe that has happened, write to us at petr.vavros@bomberace.com.

11. Changes to this policy

We may amend this policy when the app or the legal requirements change. The current version is always at this address, and the effective date is at the top. We will tell you about substantial changes in the app or by e-mail before they take effect.