Privacy Policy

This is a draft. A lawyer has not reviewed it yet, and the final policy will replace it before Reblaze is released on the App Store.

This version applies while Reblaze is being tested through TestFlight. Reblaze is an app for people who ride motorcycles and for people who drive cars.

What Reblaze collects

• Your phone number, if you sign in with it or add it to your profile. We send your sign-in codes to it by text message.
• Your email address, if you sign in with it or add it to your profile, and your password, if you sign in with email. The password is stored only as a secure hash on our server.
• If you sign in with Apple: your Apple account identifier, and your first name if you choose to share it. When Apple provides a token, we keep it encrypted and use it to disconnect your Apple ID from Reblaze when you delete your account.
• If you sign in with Google: Google gives us your Google account identifier and email address. We check that Google has verified the address, and we keep only the identifier.
• Your profile: your name and surname, date of birth, country and city, photo, short bio, experience level, riding style and the languages you speak. Your date of birth is used to check that you are 18 or older.
• Your garage: the brand, model, year and engine size of each car or motorcycle you add.
• Your language and an identifier for this device, so that the app answers in your language and your sign-in stays on this device.
• Crash and error reports, sent to Sentry in the European Union. Phone numbers and map coordinates are removed from them before they leave your phone.

Why

To sign you in, to keep your profile and garage the same on all your devices, and to find and fix problems in the app.

Who sends your codes

• Email is sent by Google, from Reblaze's mailbox. Google receives your email address and the message with your code.
• Text messages are sent by UBill, an SMS provider in Georgia. Reblaze sends text messages only to Georgian mobile numbers. UBill receives your phone number and the message with your code.

We give them nothing else about you.

Where your data is kept

While the TestFlight test lasts, Reblaze runs on a test server in the European Union. Your data is kept on that server, in its backups and on your phone. We do not sell your data.

The server is backed up every night, and each backup is kept for 14 days. An encrypted copy of each backup is also kept off the server, in Cloudflare's storage, for the same 14 days at most. Only Reblaze holds the key to it.

Your choices

You can change your profile and your garage at any time in Settings.

Deleting your account

You can delete your account yourself, in the app: Settings → Privacy → Delete Account. You don't need to contact us.

• At once, your access ends on every device, and your account, profile, garage, settings and sign-in methods are deleted from our server.
• At the same time, your club memberships and join requests, your sign-ups for rides, your comments and your pinned announcements are deleted. Replies other people wrote to your comments stay.
• A club that only you lead is closed for all its members, and its upcoming rides are cancelled. The people signed up for them get a notification. A club that has another leader stays, just without you.
• Rides you lead are deleted, past ones too, with every comment on them, including other people's. An upcoming ride is cancelled first, and the people signed up for it get a notification.
• Within 48 hours, your photo file and the records of the sign-in codes you asked for are deleted. Those records hold your phone number or email address and your network address only in hashed form, and we keep them only to limit how many codes can be requested.

What stays after deletion

• Backups, for up to 14 days. Backups made before you deleted your account still hold your data until they are deleted, 14 days after they were made. If we ever have to restore one, accounts deleted after it was made are deleted again as soon as Reblaze runs again.
• A record of the deletion: a random ID and the time, with no name and no contact details. We keep it so that restoring a backup can't bring your account back.
• A request to Apple to disconnect your Apple ID, if you signed in with Apple. It holds only Apple's token, and we retry it until Apple accepts it, for up to 30 days.
• Notifications sent to other people, including those about rides cancelled because you deleted your account. They can hold the title of a ride you led or the first 100 characters of an announcement you pinned, but they don't say who wrote it. Our server keeps them for up to 7 days after they were sent, and its backups for up to 14 days after that. A notification already on someone's phone stays there until they clear it.
• Crash and error reports already sent to Sentry. They are linked to this installation of the app, not to your account, and Sentry deletes them when its retention period ends.
• Feedback you sent through TestFlight, which Apple keeps for Reblaze in App Store Connect.

Contact

While the test lasts, write to us through TestFlight: open Reblaze in the TestFlight app and send your feedback with Send Beta Feedback. Apple passes us your message, any screenshot you add and details of your device, and your email address only if you choose to include it.