← Drafto

Privacy Policy

Last updated: September 16, 2026

If a translation differs from the French version, the French version prevails, without depriving you of the rights granted by the law of your country of residence.

Drafto (“we”, “our” or “the app”) is an app that records and analyzes your bike rides. It is published by Gradly-concept, in Salornay-sur-Guye (France), which is the controller of your personal data. This privacy policy explains what data we collect, why and on what legal basis, who it is shared with, how long we keep it and how to exercise your rights.

1. Data We Collect

  • GPS location data — the precise location of your phone, recorded during a ride you have started, including with the screen off, until you stop it: it is used to draw your route and to calculate speed, distance and elevation gain. At your request, your location is also used to generate a route around you and to show the weather.
  • Account information — the email address you use to sign in. If you choose to sign in with Google or Apple, that provider sends us your email address and, where applicable, your name, never your password.
  • Profile information — username, display name, bio, profile photo, city, region, country, club and rider type, which you choose to provide. Your weight, if you enter it, stays on your phone.
  • Ride photos — photos you attach to your rides or post in a club feed.
  • Performance data — your ride statistics (speed, duration, distance, elevation gain, estimated calories) and, if you pair a Bluetooth sensor, heart rate, power and cadence. Heart rate is health data: it is only recorded with your explicit consent, given by answering a dedicated question, and it is never shown to anyone but you.
  • Technical Data — your device model and operating system, app version, language, battery level, network type and technical details of errors, sent in crash reports and diagnostic logs without your email address or precise coordinates; notification token; anonymous device identifier for remote configuration; and, only if you agree, app usage events.

2. How We Use Your Data

We use your data for the following purposes, each with its legal basis under the GDPR:

  • Recording your rides and calculating your statistics, history, records and progress — performance of the contract (our terms of service).
  • Running the Ghost, challenges, segments, leaderboards, detection of the climbs you have ridden, route generation, turn-by-turn navigation, weather and the live tracking you share — performance of the contract.
  • Running friends and cycling clubs: leaderboards, club feed, club rides and shared routes — performance of the contract.
  • Managing your trial and your Drafto Premium and Club Premium subscriptions — performance of the contract.
  • Sending you notifications, which you can turn off in the app or in your phone settings — performance of the contract.
  • Answering your support messages — performance of the contract; handling requests to exercise your rights — legal obligation.
  • Measuring app usage to improve it — your consent, which you can give or withdraw at any time in Settings (“Share usage data”).
  • Processing your heart rate — your explicit consent (Article 9 GDPR), given by answering a dedicated question, asked outside any ride when you pair a heart rate sensor or, if a sensor is already paired, on your next visit to the home or sensors screen; without it, your heart rate is displayed during the ride but neither recorded nor exported, and the same applies to files and activities you import. We keep a time-stamped record of each consent and each withdrawal. You can withdraw your consent at any time in Settings, and then erase heart rate from your past rides.
  • Diagnosing and fixing crashes and errors, and remotely disabling a faulty feature — our legitimate interest in providing a reliable service. You can turn off diagnostic logs in Settings (“Share diagnostic logs”).
  • Securing the service, fighting cheating on leaderboards, handling reports and moderating content — our legitimate interest in ensuring fair leaderboards and a safe space.

We never use your data for advertising.

3. Data Storage & Security

Your data is stored with Supabase, our database host, in the European Union, on Amazon Web Services (AWS) infrastructure.

  • All data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our host.
  • Your sign-in tokens are kept in your phone’s secure storage.
  • Access rules enforced by the database itself prevent other users from reading anything other than what you have chosen to make visible (see section 4 and the “Cycling Club” section).
  • When a provider processes data outside the European Union (see section 5), the transfer is covered by the safeguards provided for by the GDPR, in particular the European Commission’s standard contractual clauses.

4. Data Sharing

Drafto has no public activity feed, no likes and no comments. Your data is only visible to other people in the following cases:

  • Public rides — a ride marked “public” is visible to other Drafto users, with its route, statistics and photos. The first and last 200 meters of the track are hidden from them, on screen and in exports, so as not to reveal your home. A ride marked “private” is visible only to you, except in the totals described in the “Cycling Club” section.
  • Public profile — your username, display name, photo, totals and the Ghosts others can challenge are visible to other users, who can find you by searching. A private profile does not appear in search results.
  • Friends and challenges — your friends see your place in the friends leaderboard. A friend you challenge receives your Ghost: your track and your time on the route.
  • Leaderboards — your times on segments and routes may appear in their leaderboards, with your name and photo if your profile is public.
  • Cycling Club — what the members of your clubs see is detailed in the “Cycling Club” section.
  • Live tracking — if you share the link to your live ride, anyone who receives that link sees your position during the ride.
  • Moderation — a reported ride or post may be reviewed by Drafto’s moderators.

A photo that has already been shared may remain accessible through its direct address, even after you have made the ride private.

We do not sell, rent or share your personal data with advertisers.

5. Third-Party Services

To run Drafto, we use the following providers, who only receive the data they need for their task:

  • Supabase, on Amazon Web Services (European Union) — database, accounts, photo storage and server functions.
  • Sentry (European Union) — crash and performance reports, linked to your account’s internal identifier, without your email address or precise coordinates.
  • Hostinger (European Union) — hosting of our diagnostic log server and of Drafto’s web pages, including the live tracking page.
  • PostHog (European Union) — remote configuration, with an anonymous device identifier, and usage measurement, only with your consent.
  • RevenueCat (United States), Apple’s App Store and Google Play — purchases and subscriptions. We never see your bank details.
  • Expo (United States), with Apple’s and Google’s notification services — sending notifications.
  • Google and Apple — signing in to your account, if you choose to, and displaying maps (Google Maps on Android, Apple Maps on iPhone), which receive the map area displayed.
  • GraphHopper — route generation and address search: receives, through our server, the route points and the text searched, without your identity.
  • openrouteservice (HeiGIT gGmbH, Germany) — mountain bike and gravel route calculation: receives, through our server, the route points, without your identity.
  • OSRM (router.project-osrm.org) — matching your tracks to the road network: receives the track coordinates, without your identity.
  • Open-Meteo and Open-Elevation — weather and altitude: receive coordinates rounded to about 1 km for the weather, and the coordinates of a route for altitude.
  • OpenStreetMap (tile servers and Overpass API) — offline maps and climb search: receive the area concerned, without your identity.

Services called directly from your phone receive your IP address, like any website.

File imports: a Strava archive or a FIT, GPX or TCX file (Garmin, Komoot, Wahoo…) is read on your phone, and only the rides you choose are saved to your account. Drafto does not connect to your Strava, Garmin or Komoot account. If you connected your Strava account in a previous version of the app, Drafto may receive your rides from it until that connection is revoked; you can revoke it in your Strava account settings or by writing to us.

Each provider applies its own privacy policy. Transfers outside the European Union are covered as described in section 3.

Cycling Club

Joining a cycling club is your choice: a president can invite you, you only join after accepting, and you can leave at any time.

Club members see your TOTALS — distance, elevation gain and number of rides over the week, month or season — as well as your name and photo if your profile is public.

They do NOT see your individual rides, your GPS tracks, your starting points, your heart rate, your weight or any health data.

Your private rides count toward these totals without ever being viewable individually. With a private profile, you appear on the leaderboard without being named.

What you publish yourself in the club is visible to all its members: your posts and photos in the club feed, the club rides you create and the routes you share with the club, starting point included — often your home. If you are the club’s president, your “President’s Ghost” is offered to members, who can challenge it.

When you leave a club, your totals disappear from its leaderboard immediately. Your rides remain yours and are not deleted.

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act (“Informatique et Libertés”), you have the following rights:

  • Access — obtain a copy of your personal data. You can also download it yourself in Settings (“Export my data”).
  • Rectification — correct inaccurate data, directly in your profile or by writing to us.
  • Erasure — delete your account and all associated data, from Settings or by writing to us.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on our legitimate interest, such as diagnostic logs.
  • Restriction — ask for the use of your data to be suspended, for example while a dispute is being checked.
  • Withdrawal of consent — withdraw any consent you have given (usage measurement, heart rate) at any time, directly in Settings or by writing to us, without affecting processing already carried out.
  • Instructions after death — decide what happens to your data after your death.

To exercise these rights, write to us at the email address given at the end of this policy. We reply within one month, which may be extended by two months for a complex request; we may ask you to confirm that the request really comes from the account holder.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the data protection authority of your country of residence.

If you use Drafto from a country outside the European Union, your data is processed under this policy, and you also benefit from the rights granted by the law of your country of residence: write to us to exercise them.

7. Data Retention

We keep your data for as long as your account exists.

  • Account deletion — it is scheduled: you have 30 days to cancel it by signing back in. After that period, your personal data, rides, photos and associated content are permanently erased, and your totals disappear from leaderboards.
  • Diagnostic logs — kept for 90 days at most.
  • Club Premium — this subscription belongs to the club, not to the person who pays for it: it stays with the club after you leave or delete your account.

8. Children’s Privacy

Drafto is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes via the app or email. Continued use of Drafto after changes constitutes acceptance of the updated policy.

10. Contact Us

For any question about this privacy policy or to exercise your rights, write to the controller, Gradly-concept (Salornay-sur-Guye, France), at:

traceappdrafto@gmail.com