Privacy Policy — ForgeRiders
Last updated: July 7, 2026
This Privacy Policy describes how the ForgeRiders app ("we", "the
app") collects, uses, stores, and shares your personal data, in
compliance with the Brazilian General Data Protection Law (Law No.
13,709/2018 — "LGPD") and the requirements of Google Play and the Apple
App Store. The Portuguese version
(politica-de-privacidade.pt-BR.md) is the authoritative text.
Data controller: ForgeRiders Contact: guidoraguiar@gmail.com
1. Data we collect
1.1 Data you provide
- Account: email and password (encrypted by Firebase Authentication), or the basic data provided by Google or Apple sign-in (name and email associated with the account).
- Profile: display name, @handle, bio, free-text location, and avatar photo.
- Garage: your motorcycles' data (make, model, year, color, plate, mileage, photos) and maintenance records you log.
- Clubs: join requests, role/title in the club, posts, comments, and clubs you follow.
- Events: events you create (including location, dates, and cover photo), events you join, and photos you upload to event galleries.
- Club finances: financial entries created by club staff may reference members (e.g., dues paid) and include photographed receipts. This data is entered and managed by each club's administration.
1.2 Data collected with your permission (device sensors)
- Location (including in the background): when recording a ride, the app continuously collects your GPS position — including while the app is in the background — to record your route, speed, and distance. Collection happens only during a recording you start manually, and to show your position when the map screen is open. We never collect location outside those contexts.
- Motion sensors (accelerometer/gyroscope): used during ride recording to compute real-time lean angle and g-force.
- Camera and photo library: accessed only when you choose to upload a photo (avatar, bike, club, event, receipt).
Important — telemetry is local by default: recorded rides (route, speed, lean, g-force) are stored on your device only. They are uploaded to our servers only if you tap "share", and at that moment you can hide your top speed and/or route before upload.
1.3 Data collected automatically
- Crash data: we use Firebase Crashlytics to receive error reports containing device model, OS version, and the technical stack trace. They do not include your name or content.
- Basic Firebase operational metadata required for the services to work (authentication, sync).
The app does not use advertising SDKs, shows no ads, and does not sell personal data.
2. Purposes and legal bases (LGPD)
| Data | Purpose | Legal basis |
|---|---|---|
| Account and profile | Create and maintain your account; identify you in the community | Contract performance (art. 7, V) |
| Garage and maintenance | Bike management features and reminders | Contract performance |
| Clubs, events, posts | The app's social features | Contract performance |
| Location and sensors | Ride recording you request | Consent (art. 7, I) — revocable in system permissions |
| Photos | Displaying content you upload | Consent |
| Crash data | Diagnosing and fixing errors; security | Legitimate interest (art. 7, IX) |
| Club finances | The club's own internal financial management | Contract performance / the club's legitimate interest |
3. Data sharing
- With other users: your public profile (name, handle, avatar, bio), your posts, and your club/event participation are visible according to each club's visibility rules (public or private). Club financial data is visible only to the club's authorized staff. Shared rides are visible according to the privacy options you choose when sharing.
- With processors: we use Google LLC / Firebase services (Authentication, Cloud Firestore, Cloud Storage, and Crashlytics) for authentication, database, file storage, and crash reporting. Servers may be located outside Brazil; international transfer relies on Google's contractual safeguards under LGPD arts. 33+. If you use social sign-in, Google or Apple process authentication under their own policies.
- With authorities: only under legal obligation or court order.
We do not share data with third parties for marketing purposes.
4. Retention and deletion
- Your data is kept for as long as your account exists.
- You can delete your account at any time inside the app (Profile → Settings → Delete account). Deletion removes your user document, bikes, rides, club memberships, posts, and follows, plus your avatar and bike photos in storage, and deletes your authentication account.
- Residual content: photos you uploaded to collective event galleries and historical financial entries created by clubs may remain, as they are part of third-party records (the club/event). You can request removal via the contact above.
- If you own a club, you must transfer or delete the club before deleting your account.
- Crash reports are retained by Crashlytics for Google's standard period (90 days for detailed crash data).
5. Your rights (LGPD art. 18)
You may request at any time: confirmation that processing occurs; access to your data; correction; anonymization, blocking, or deletion; portability; information about sharing; and withdrawal of consent (location, sensor, and photo permissions can be revoked directly in the OS settings without affecting the app's other features).
To exercise your rights, write to guidoraguiar@gmail.com.
6. Security
Data is encrypted in transit (TLS) and database access is restricted by per-user, per-role security rules (e.g., club finances are accessible only to the club's authorized staff). No system is 100% secure; relevant incidents will be communicated as required by the LGPD.
7. Children
ForgeRiders is intended for licensed riders and is not directed at anyone under 18. We do not knowingly collect data from minors; accounts identified as belonging to minors will be deleted.
8. Changes to this policy
We may update this policy. Material changes will be announced in the app and the "last updated" date above will be revised. Continued use after an update constitutes awareness of the new version.
9. Contact
Privacy questions, requests, or complaints: guidoraguiar@gmail.com.
You may also contact the Brazilian Data Protection Authority (ANPD) — https://www.gov.br/anpd.