← Drafto
Privacy Policy — Drafto
Last updated: 19 August 2026
1. Data collected
- GPS — Location data (GPS): position during rides, used for tracking and mapping. Collection only during active rides.
- Account — Account data: email, display name, username, avatar (optional)
- Performance — Performance data: distance, speed, elevation, duration, heart rate (if sensor connected), power, cadence
- Photos — Ride photos: optional, stored securely
- Analytics — Usage data: opt-in analytics via PostHog (anonymized)
- Diagnostics — Diagnostic log: device model, OS version, current screen, battery level, network type and technical error messages — emails, tokens and GPS coordinates stripped before sending
2. Data NOT collected
- Financial or banking data
- Phone contacts
- SMS or call history
- Web browsing history
- Personal files
3. Use of data
- Tracking and displaying bike rides
- Calculating statistics and personal records
- Ghost Racing (comparison with previous times)
- Leaderboards and segments
- Social feed (sharing between users)
- App improvement (anonymized analytics)
4. Storage and security
- Data stored on Supabase (secure cloud infrastructure)
- HTTPS/TLS encryption for all communications
- Authentication tokens stored in Secure Keychain (iOS) / EncryptedSharedPreferences (Android)
- Row Level Security (RLS) on all tables — each user only accesses their own data
5. Third-party services
| Service | Usage | Data shared |
|---|---|---|
| Supabase | Backend & database | Account and ride data |
| RevenueCat | Subscription management | User ID, subscription status |
| PostHog | Analytics (opt-in) | Anonymized events, no PII |
| Sentry | Crash reports | Stack traces, no personal data |
| Expo | Push notifications | Notification token |
| Trace Apps | Technical diagnostic log (private server, European Union) | Device, OS, screen, error message. No identity, no email, no location. Kept 30 days then deleted automatically |
No data is sold to third parties.
6. Cycling Club
Joining a Cycling Club is your choice. A club president may invite you; you only join once you have accepted the invitation. You can leave at any time.
- What club members see: your totals — distance, elevation and number of rides over the week, month or season — along with your name and photo if your profile is public.
- What club members do NOT see: your individual rides, your GPS traces, your start points, your heart rate, your weight, or any health data.
- Your private rides count towards those totals, but are never individually viewable. With a private profile, you appear in the leaderboard without being named.
- When you leave a club, your totals disappear from its leaderboard immediately. Your rides remain yours and are not deleted.
7. User rights (GDPR)
- Right of access: export all your data from the app (Profile → Settings → Export my data)
- Right of deletion: delete your account and all associated data (Profile → Settings → Delete account)
- Right of rectification: modify your profile information at any time
- Right of objection: disable analytics in settings
8. Data retention
- Data is retained as long as the account is active
- After account deletion: all data is irreversibly deleted within 48 hours
- Backups are purged within 30 days
- Technical diagnostic logs are deleted automatically after 30 days
9. Minors
Drafto is not intended for children under 13. We do not knowingly collect data from minors.
10. Contact
For any questions regarding your personal data:
Email: traceappdrafto@gmail.com