Last draft update: 2026-05-31
This Privacy Policy describes how the operator of the RoadVane motorcycle riding app ("RoadVane", "we", "us", "our") collects, uses, shares, and safeguards your personal data when you use the RoadVane mobile application and the website at roadvane.com (collectively, the "Service"). RoadVane is a safety-adjacent product — it handles particularly sensitive categories of data, including precise location, motion / crash sensor data, and emergency contact relationships. Please read this Policy carefully.
Who Operates RoadVane
RoadVane is currently operated as a sole proprietorship by Seifeldean Ahmed, based in Cairo, Egypt. References to "we" / "us" / "our" / "the operator" in this Policy refer to that sole proprietor.
The operator intends to incorporate a limited-liability company (provisionally referred to as "RoadVane LLC") in the near future and to transfer the Service, its data, and the rights and obligations under this Policy to that entity. When that transfer takes effect this Policy will be reissued to identify the company as the controller. The protections in this Policy will continue uninterrupted across that transfer.
Where RoadVane Is Offered
RoadVane is offered in Egypt, the Gulf Cooperation Council countries (United Arab Emirates, Kingdom of Saudi Arabia, Kuwait, Bahrain, Oman, Qatar), and selected other non-EU and non-UK markets where the Apple App Store and Google Play make the app available.
RoadVane is not currently offered to residents of the European Union, the European Economic Area, the United Kingdom, or Switzerland. We do not market the Service to those territories and we do not intend to act as a data controller for residents of those territories at this time. Geographic availability is enforced at the App Store and Google Play level. We will update this Policy and add a GDPR / UK GDPR-compliant supplement before offering the Service in those markets.
Data We Collect
- Account data: email address through Supabase Auth, display name, rider handle, avatar URL, authentication identifiers, and session data.
- Profile and bike data: experience level, riding style, bike model, year, engine size, plate, mileage, maintenance records, and mileage correction events.
- Social data: groups, group membership, join-code activity, friend requests, accepted friendships, blocked riders, emergency friend selections, ride invites, ride polls, and activity notifications.
- Ride and route data: planned rides, saved route templates, route stops, stop labels, ride sessions, live ride participation, ride history, route previews, distance, duration, speed, heading, and sampled GPS positions.
- Location data: foreground current location, ride tracking location, background ride-tracking location while a live ride is active, last-known profile location used for nearby crash alert eligibility, crash/SOS location, and map/routing search coordinates.
- Voice channel data: when push-to-talk or group voice channels are active, audio is transmitted in real time between the active members of the channel. Audio is not recorded or stored on RoadVane's servers and is not retained beyond the live session.
- Device and sensor data: push tokens, notification permissions/status, platform, app version, accelerometer and gyroscope readings used by the Crash Assistance feature, and local app storage.
- Notifications and delivery records: in-app notification events, push delivery attempts, token health, notification preferences, and badge/opened/cleared state.
- Support and diagnostics: optional Sentry DSN is present in environment documentation but the active implementation must be verified before disclosure.
How We Use Data
- To create and maintain rider accounts and profiles.
- To plan rides, save routes, invite riders, and manage groups.
- To provide live ride location sharing to joined riders or selected friends.
- To compute ride distance, route history, maintenance mileage, and reminders.
- To send ride, friend, activity, maintenance, and SOS notifications.
- To operate Crash Assistance, the SOS countdown, emergency-friend notifications, and nearby rider crash alerts.
- To determine whether another rider is within the configured nearby crash alert radius.
- To carry voice channel audio between active members of a channel in real time.
- To prevent abuse, enforce blocking, diagnose notification delivery, and operate account deletion.
Voice Channels
When you join an active voice channel inside a ride or group, RoadVane transmits your microphone audio in real time to the other members of that channel and plays back their audio to you. We treat voice transmission as ephemeral: audio is not recorded, transcribed, or stored on RoadVane servers, and we do not retain it beyond the moment of transmission. If we ever introduce on-server recording or transcription we will update this Policy, change in-app permissions, and obtain fresh consent before activating that processing.
You are responsible for the content of what you say in a voice channel and for the consent of any third party whose voice you cause to be transmitted.
Location Sharing
RoadVane uses location for ride planning, live rides, route history, and safety features. During a live ride, RoadVane may collect GPS samples, speed, heading, and timestamps so authorized ride participants can see each other and so the rider can later view ride history.
RoadVane also stores a last-known foreground presence location when the app is active and foreground location permission is available. This is used to decide whether the rider should receive nearby crash alerts. The production implementation stores this in private profile presence storage and exposes a clear control in the Profile safety section, but deployment and RLS behavior still need production verification before publication.
Background location is configured in the app for live ride tracking. Store disclosures, OS permission prompts, and any background-location declarations must accurately describe that use.
Crash, SOS, And Nearby Alerts
Crash Assistance, SOS alerts, and nearby crash alerts are beta assistance features. They do not detect crashes reliably, do not contact emergency services, do not dispatch responders, and do not guarantee that help will arrive. RoadVane makes no promise that any of these features will function in any specific situation. If a rider may be in danger, users should call the applicable local emergency number first.
When SOS is triggered, RoadVane may share a crash or SOS location, approximate distance, trigger type, first name or rider label, status, and timestamps with eligible emergency friends, joined ride participants, and nearby riders depending on user settings and ride context.
What We Share
- With ride participants: live ride position and ride/session status needed for the shared ride.
- With accepted friends: profile information and safe bike summaries shown in friend surfaces.
- With emergency friends: SOS/crash alerts where the rider selected an applicable crash audience.
- With nearby riders: nearby crash alerts where the rider selected public crash broadcasting and the recipient is eligible.
- With voice channel members: live audio transmitted in real time during a channel session.
- With service providers: Supabase, Expo/EAS and Expo Push, Apple Push Notification Service, Firebase Cloud Messaging/Google services, Photon/Komoot geocoding, LocationIQ when configured, OSRM public routing, and platform vendors as needed to operate the app.
RoadVane does not sell personal data, does not rent it to data brokers, and does not use it for behavioural advertising or cross-site tracking.
User Controls
Users can manage crash audience, nearby crash alert receipt, notification preferences, emergency friends, blocked riders, profile data, bike data, ride history visibility, saved routes, and account deletion from in-app surfaces where implemented.
The production app should include working links to this policy, Terms of Service, safety disclaimers, and support/contact channels before submission.
Retention And Deletion
Retention must be confirmed against the production database. The repository contains retention mechanisms for some notification records, push tokens, ride history deletion, SOS TTL resolution, and archived ride positions, but not every personal data category has an active retention schedule in current migrations.
Users may request deletion in the app by typing the required confirmation phrase in the Delete Account dialog. Production deletion behavior must be verified with a throwaway account before publication.
Children
RoadVane is intended for licensed adult motorcycle riders. The minimum age to use the Service is 18 years. We do not knowingly collect personal data from anyone under 18. If we become aware that we hold personal data of a person under 18 we will delete it.
Age is currently confirmed by self-declaration at sign-up. We may introduce stronger age-verification measures in markets that require them.
Data-Subject Rights (Local Law)
This Policy is drafted with the Egyptian Personal Data Protection Law (Law #151 of 2020), the UAE Personal Data Protection Law (Federal Decree-Law #45 of 2021), and the Saudi Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) in mind. Subject to those laws, you have the following rights and may exercise them by contacting RoadVane at the addresses below:
- Access: request a copy of the personal data held about you. The in-app Export Data feature delivers this as a JSON file covering every table the system holds for you.
- Rectification: correct inaccurate or incomplete data via the in-app profile.
- Erasure: request deletion of the account. The in-app Delete Account flow initiates this process.
- Restriction: ask us to limit how we use your data in specific circumstances.
- Portability: receive your data in a structured, commonly used, machine-readable format (the JSON export).
- Objection: object to processing based on legitimate interests.
- Withdraw consent: where processing relies on consent, withdraw it at any time without affecting prior lawful processing.
- Complaint: lodge a complaint with the relevant data protection authority — the Egyptian Data Protection Centre, the UAE Data Office, or the Saudi Data and Artificial Intelligence Authority (SDAIA).
Proposed response window: 30 days, extendable by an additional 60 days for complex requests.
International Transfers
RoadVane's processors (notably Supabase and Expo) operate infrastructure in the United States and other jurisdictions outside Egypt. Where personal data is transferred from Egypt, the UAE, or Saudi Arabia to a country whose laws may not provide an equivalent level of protection, we rely on standard contractual safeguards in our agreements with those processors, including transfer clauses and confidentiality terms.
We will refine these safeguards as the Egyptian PDPL Executive Regulations are issued and as the UAE / Saudi PDPL secondary regulations mature.
Security
We apply the following technical and organisational measures designed to protect personal data:
- Transport-layer encryption (TLS 1.2 or higher) for all client-to-server traffic.
- Encryption at rest for tables containing personal data.
- Role-based access control (support, operations, owner tiers) for any administrative access, with every privileged action audit-logged in an append-only table.
- Default redaction of sensitive fields (email, phone, push tokens, exact coordinates) in administrative views.
- Row-level security (RLS) policies on the underlying database.
- Periodic review of deployment, dependencies, and access patterns.
No system is perfectly secure. Suspected vulnerabilities or unauthorised access should be reported to security@roadvane.com.
Changes To This Policy
We may update this Privacy Policy from time to time. Material updates will be communicated to riders with reasonable advance notice through email or in-app notification. The "Last draft update" date at the top of this Policy will change whenever the document is updated.
Contact
- Privacy contact: privacy@roadvane.com
- Support contact: support@roadvane.com
- Security disclosures: security@roadvane.com
- Legal: legal@roadvane.com
- Operator: Seifeldean Ahmed (sole proprietor), Cairo, Egypt
Appendix A · Data retention
Last draft update: 2026-05-31
This Policy maps repository-observed data to proposed retention and deletion positions. Production retention must be verified against the live database, backups, logs, analytics, and third-party processors before publication.
User-Visible Deletion
RoadVane includes an in-app Delete Account flow that requires the user to type DELETE. The Edge Function validates the authenticated user, calls a service-role cleanup helper, and deletes the Supabase Auth user. The cleanup helper currently appears in archived migrations, so production / fresh-environment availability must be verified.
Observed Retention Mechanisms
- Ride positions: repository policy text references 90 days; migration includes an archive function for old ride positions but scheduling was not verified.
- Ride history: hidden/deleted history rows may be hard-purged after 30 days by a cron function.
- SOS events: stale active events may resolve by TTL; indefinite retention and owner deletion need legal confirmation.
- Notifications: cleanup function supports notification, push attempt, and stale token retention windows.
- Push tokens: disabled token cleanup exists in notification cleanup logic.
- Last-known location: stored in private profile presence storage, overwritten by foreground heartbeat, cleared through account deletion, and clearable from the Profile safety section.
- Friend requests, friendships, blocks, emergency selections: hard-delete / cascade behaviour exists in migrations and functions.
- Saved routes and ride plans: deletion / account cleanup paths must be verified.
Proposed Retention Table
| Data category | Proposed retention | Repository evidence | Status |
|---|---|---|---|
| Account/profile/auth | Account lifetime plus required legal/security retention | profiles, Supabase Auth, delete-account function | Partial, live cleanup unverified |
| Live ride GPS samples | 90 days before archive/purge decision | archive_old_ride_positions() | Partial, schedule unverified |
| Last-known location | Until overwritten, cleared, or account deleted | profile_presence, heartbeat service, clear RPC | Partial, production deployment unverified |
| SOS events | Define legal retention before launch; proposed at least 24 months | sos_events, TTL resolve cron | Unverified |
| Notification events | 180 days for opened/cleared (SQL default) | cleanup_old_notification_records() | Partial |
| Push delivery attempts | 30 days (SQL default) | cleanup_old_notification_records() | Partial |
| Disabled push tokens | 120 days (SQL default) | cleanup_old_notification_records() | Partial |
| Ride plans/routes/saved templates | Account lifetime unless deleted | service/migrations | Partial |
| Maintenance/mileage | Account lifetime unless deleted | bike and maintenance tables | Partial |
| Blocks | Account lifetime unless removed/deleted | blocks table | Partial |
| Admin audit log | At least 24 months | admin_audit_log table | Confirmed in current deployment |
| Voice channel audio | Not retained — ephemeral real-time transmission only | n/a | Confirmed |
Required Pre-Launch Verification
- Prove account deletion in production using a throwaway account.
- Confirm active migrations can rebuild all deletion helpers.
- Confirm backup / log retention and any deletion exceptions agreed with Supabase.
- Publish a user request path for deletion and privacy requests.
- Confirm all App Store / Play Store privacy forms match the actual retained data.
- Re-verify these mechanisms after the planned RoadVane LLC incorporation, since some processor contracts may need to be assigned to the new entity.
Appendix B · Location sharing
Last draft update: 2026-05-31
RoadVane uses location to power ride planning, live rides, route history, map context, crash/SOS alerts, and nearby crash alert eligibility.
When Location Is Collected
- When the app requests current location for map, planner, or foreground features.
- During a live ride, including background ride tracking where enabled by OS permission and app configuration.
- When the app is active and records a last-known foreground location for nearby crash alert eligibility.
- When a crash or manual SOS event is created.
- When route search, reverse geocoding, or routing services are used.
Who May See Location
- Joined ride participants or selected friends may see live ride location in shared ride contexts.
- Emergency friends and joined ride participants may receive crash/SOS location information.
- Nearby riders may receive nearby crash alert information when the rider has selected public crash broadcasting.
- Service providers may process location to operate mapping, routing, geocoding, backend storage, push delivery, or safety features.
Important Limitations
RoadVane's location and nearby computations may be inaccurate, stale, delayed, or unavailable. A nearby crash alert does not mean a rider is safe to approach, that emergency services have been contacted, or that the location is exact.
Controls
Users can manage OS location permissions, ride-sharing mode, crash audience, nearby crash alert receipt, and account deletion. Production deployment must verify these controls before publication.
Suggested In-App Short Copy
RoadVane uses your location for live rides, routes, ride history, and safety alerts. Live rides may use background location. Nearby crash alerts use your last-known location to decide whether an alert is relevant.
Contact
- Privacy questions about location data: privacy@roadvane.com
Appendix C · Third-party services
Last draft update: 2026-05-31
RoadVane uses third-party services to operate authentication, storage, notifications, maps, routing, geocoding, builds, updates, and platform delivery. This Disclosure must be reconciled with production vendor settings before publication.
Observed Services
| Service | Observed purpose | Data likely processed | Repository evidence |
|---|---|---|---|
| Supabase | Auth, Postgres database, Edge Functions, storage of app data | Account identifiers, profiles, ride data, location, SOS, social graph, notifications | lib/supabase.ts, supabase/ |
| Expo / EAS / Expo Updates | App build/update project, push token generation, OTA updates | App/project identifiers, push tokens, device/app metadata | app.json, hooks/useNotifications.ts |
| Expo Push Notification Service | Push notification dispatch | Push tokens, notification titles/body/data | supabase/functions/*fanout*, hooks/useNotifications.ts |
| Apple Push Notification Service | iOS push delivery | Device push delivery metadata and notification payloads | iOS notification setup |
| Firebase Cloud Messaging / Google services | Android push delivery | Device push delivery metadata and notification payloads | google-services.json, Expo notifications |
| Photon / Komoot | Default address search/geocoding | Search query, approximate map bias coordinates | services/mapbox/geocodingService.ts |
| LocationIQ | Optional deeper geocoding/autocomplete/reverse geocoding | Query text, coordinates, token, search context | .env.example, services/mapbox/locationiq*.ts |
| OSRM public router | Route preview | Route coordinates and stops | services/routing/osrmService.ts |
| Google Maps deep links | Open crash location in maps | Crash coordinates passed to external maps app/web | app/sos/[id].tsx |
| Sentry | Optional error monitoring | Errors, device/app metadata, possibly contextual data if configured | .env.example only; implementation unverified |
| Apple / Google app stores | App distribution, reviews, privacy labels/forms | Store metadata, crash reports if configured, app package metadata | app config |
Disclosure Requirements
The published Privacy Policy, App Store / Play Store privacy forms, and in-app disclosures should describe third-party processing for location, identifiers, diagnostics, push notifications, and safety alerts. Vendor regions, subprocessors, data processing agreements, and retention terms must be confirmed outside the repository.
Items To Verify Before Publication
- Production Supabase region and backup retention.
- Whether Sentry or any analytics/crash-reporting SDK is active in production.
- Exact Expo/EAS push and OTA settings.
- Whether LocationIQ is configured in production.
- Whether OSRM public router use is acceptable for production route volume and privacy expectations.
- Confirm none of the above processors will be transferred / re-region-located during the planned RoadVane LLC incorporation.
Contact
- Privacy questions about processors: privacy@roadvane.com