Privacy

1What data we process

• Account: email and password (the password only in encrypted form that we can’t read).
• Profile: name, username, colour and, optionally, a profile photo.
• Garage: vehicle names, their type and, optionally, the licence plate.
• Friends and groups: who you’re friends with and which groups you’re in.
• Rides: route, stops, chat messages, shared expenses and stats (kilometres, time).
• Location: only during a ride you’ve joined. Others on the ride can see your location, and we store the points of your track for the ride recap.
• Technical data: the app language and standard server logs (e.g. IP address and request time) to protect against abuse.

2Why

• To make the app work: sign-in, group rides, navigation, chat and recaps (performance of a contract, Art. 6(1)(b) GDPR).
• Security and abuse prevention, e.g. limiting the number of sign-in attempts (legitimate interest, Art. 6(1)(f) GDPR).
• We don’t show ads, we don’t track you across websites, and we don’t sell data.

3Where the data is and who sees it

• The database runs on our own server in a data centre in the EU (netcup GmbH).
• Your name, colour and location during a ride are visible only to people on the same ride; your profile and username are visible to your friends and members of your groups.
• To calculate routes, search places and show maps we use open services built on OpenStreetMap (Valhalla by FOSSGIS, Photon by komoot, OpenFreeMap). They receive only coordinates or the search text, never your name or account.
• Aerial maps are loaded from the public services of ÚGKK SR (ZBGIS), ČÚZK and EOX, and traffic information from TomTom. They see only a standard map request (e.g. your IP address).
• We send emails (e.g. the code for a new password) through an email provider based in the EU.
• Voice guidance is generated on your phone itself.

4How long

• For as long as you have an account. When you delete it, we delete your data from the database immediately.
• It disappears from backups within 14 days at the latest.
• Groups that also have other people in them aren’t removed – we hand them over to another member.

5Your rights

• Access and portability: in the app, go to Profile → Account & privacy → Download my data to get everything in one file.
• Rectification: change your name, username, photo, email and password in the app.
• Erasure: in the app, go to Profile → Account & privacy → Delete account.
• You can object to processing based on legitimate interest, and you have the right to lodge a complaint with your local data protection authority (in Slovakia: Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).

6The kruz.sk website

• The website uses no advertising or analytics cookies. Your browser only remembers small things, such as that you closed the offer to switch language.
• For the “Where to today?” planner, we send your starting point to our server so we can plan a loop. We don’t link it to any account.

7Children

Kruz is not intended for children under 16.

8Changes

If we change this policy, we’ll update the date above and, for bigger changes, let you know in the app.