Privacy Policy

for the MotoLap app (iOS and Android) · Deutsche Fassung (the German version prevails)

In short

MotoLap has no ads and no trackers. Your rides and GPS tracks stay on your phone – unless you switch on cloud backup in your rider account. Network connections are used for map imagery, track search and place search in the track map and – if you choose to create a rider account – for sign-in, your rider profile, leaderboards, crew and linking to subscription management.

1. Controller

ZG Media, Gianluca Zgur
Am Fendlbach 13 A, 82211 Herrsching am Ammersee, Germany
Email: support@kitetheworld.net · Legal notice

2. What the app processes on your device

This data is not transmitted to us; we have no access to it. Legal basis: Art. 6(1)(b) GDPR. Access to location and notifications is strictly necessary for these features and additionally requires your permission in the operating system, which you can revoke at any time.

2a. Rider account (optional)

If you create an account, we process your email address, password (stored only as a hash by the sign-in service), online name, name, nationality, optionally your home track, your bikes (make and model) and your consents with timestamp. Rides and GPS tracks are not part of it unless you switch on cloud backup. Google (Firebase Authentication and Cloud Firestore; Google Ireland Limited and Google LLC, USA) stores access and profile, with the database in Frankfurt. RevenueCat, Inc. (USA) receives account ID, email, name, online name, nationality, home track and bikes so that a subscription is tied to your account rather than your device. Legal basis: Art. 6(1)(b) GDPR; for “Public rider profile” and “News by email” your consent under Art. 6(1)(a) GDPR, revocable in the app at any time. Both providers act as processors (Art. 28 GDPR); transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR). “Rider account → Delete account” immediately and completely deletes all your data (see section 6).

2b. Cloud backup of rides (optional, off by default)

If you switch on “Back up rides to the cloud” in your rider account, the app stores each ride (laps, sector times, finish line, GPS track, date, track name) compressed in Cloud Firestore (Google, Frankfurt, europe-west3) so you can restore it on another device. Only your account can access it. Legal basis: Art. 6(1)(b) GDPR. Switching it off stops uploads; “Delete cloud copy” or “Delete account” removes all backed-up rides immediately. “Delete all data” only clears the device and switches backup off.

2c. “Pro” subscription (optional)

Payment is handled exclusively by the App Store (Apple) or Google Play; we never receive payment details. If you buy Pro, the app sends the store receipt (product, time, term, transaction ID) together with a customer ID – your account ID if you have a rider account, otherwise a random one – to RevenueCat, Inc. (USA), which validates the receipt with the store and tells the app whether Pro is active. Legal basis: Art. 6(1)(b) GDPR; retention of receipts as required by commercial and tax law under Art. 6(1)(c) GDPR. RevenueCat acts as processor (Art. 28 GDPR); transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR). You can cancel at any time in your store’s subscription settings.

2d. Sign in with Apple or Google (optional)

If you choose “Sign in with Apple” or “Sign in with Google”, Apple (Apple Distribution International, Ireland) or Google (Google Ireland Limited) confirms your identity to us and passes on your email address and, where applicable, your name – with Apple, on request only a relay address. We do not learn what else you do there. For the sign-in itself Apple and Google are independent controllers; their privacy notices apply. Legal basis: Art. 6(1)(b) GDPR.

2e. Two-factor by email (optional, off by default)

If you switch it on, for each code we store only a hash, the purpose, the expiry time and the number of attempts – deleted after 10 minutes or on confirmation. We also remember which sign-ins (time of sign-in, up to 10) are confirmed. The email with the code is sent by our Cloud Functions (Google, Frankfurt) through an email service provider as processor (Art. 28 GDPR, under a data processing agreement; if it is based or hosted outside the EU, only with safeguards under Chapter V GDPR); it receives your email address and the code, nothing else. Legal basis: Art. 6(1)(b) GDPR (protecting your account) while the feature is on; switching it off deletes the remembered sign-ins.

2f. Rider profile, leaderboards, likes and ghosts (optional)

Rider profile: profile and cover picture (downscaled to 384 × 384 and 1280 × 720 pixels), rides, laps, top speed, highest jump and the shape of your favourite lap – without coordinates and without email. They are stored in Cloud Firestore (Google, Frankfurt) so your pictures are back on a new phone. Other riders only see your profile if you switch on “Public rider profile”; demo rides never count. Legal basis: Art. 6(1)(b) GDPR; for making the profile public your consent under Art. 6(1)(a) GDPR, revocable at any time.

Ghosts (off until you switch on “Share racing line as ghost”): per track your fastest lap as a racing line – positions and speed from finish line to finish line, at most 400 points – plus lap time, date, online name, flag and bike. No route to the track, no paddock, no time of day. Only signed-in riders can see it, by overlaying it on their own lap in the analysis. Legal basis: Art. 6(1)(a) GDPR, revocable at any time; when you switch it off or delete your account we remove all your ghosts immediately.

Leaderboards and likes: With a rider account your times appear with online name and flag in the track's leaderboards; likes are linked to your account. Legal basis: Art. 6(1)(b) GDPR. “Delete account” removes your entries and likes.

2g. Crew and notifications to your crew (optional)

Up to three people you invite yourself see your online name, flag and every lap with time, delta and, if you wish, sectors. With “Notify crew” they learn once per ride that you are on track – with “Reveal where” also which track, its country and its location for getting there (the track, not your exact position). Without “Reveal where”, neither track name nor location goes to your crew. Whoever watches decides per rider which notifications arrive; for this we store that setting and a device token for push notifications (via Apple Push or Google's Firebase Cloud Messaging). You can switch both off at any time. Legal basis: Art. 6(1)(a) GDPR, revocable via the switches under Crew › I'm riding.

3. Map tiles (OpenFreeMap)

When online, the ride analysis and the track map load map tiles from OpenFreeMap (Hyperknot Software Kft., Hungary), delivered via Cloudflare, Inc. (USA). Your IP address, device/browser details and the requested map area are transmitted – never your rides or times. According to OpenFreeMap, IP addresses are only kept in error logs for up to 7 days; no cookies are used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working map view). Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR), under which Cloudflare is certified.

3a. Track search (OpenStreetMap)

If a saved ride does not belong to a known track, the app asks public Overpass servers of the OpenStreetMap community (including FOSSGIS e. V., Germany) whether there is a motocross track at its start point, provided you are online. Your IP address and the start point rounded to about 100 m are transmitted – never your GPS trace, times or account data. Tracks found (name, location) are stored locally. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in naming the track). You can switch the search off in the app under “Privacy → Search tracks online”. Track data © OpenStreetMap contributors, ODbL.

3b. Track profile and place search in the track map

Track profile: When you open a track while online, the app loads once its info (opening hours, contact) and mapped layout from the same Overpass servers. Only your IP address and the track's position or ID are transmitted – nothing about you, your rides or your location. Afterwards both are stored offline on the device. Legal basis: Art. 6(1)(f) GDPR.

Place search: If you type at least three characters into the track map's search field while online, the search text and your IP address go to Photon by komoot GmbH (Germany) to find matching places. Your location is not transmitted. Legal basis: Art. 6(1)(f) GDPR. Place data © OpenStreetMap contributors, ODbL.

4. Export and watch

An export file is only created when you start it; you choose the recipient via the share sheet. Pit Board notifications are mirrored to your watch by the operating system through your watch maker's pairing (e.g. Apple, Google, Garmin); their privacy terms apply.

4a. Reporting and blocking

On every rider card and leaderboard entry, the “⋯” menu lets you report a rider (offensive picture, abusive name, cheating/implausible time, other) or block them. A rider account is required.

Reports: We store the reported rider's UID and online name, the reason, your optional comment (up to 500 characters), where you reported (leaderboard, profile or crew), your UID and the time. The app never reads reports back. Purpose: protecting the community and reviewing violations; legal basis Art. 6(1)(f) GDPR (legitimate interest in an abuse-free platform, as required by Apple's and Google's rules for user-generated content). We usually review reports within 24 hours; violations lead to a ban. Reports are deleted no later than 12 months after the review is completed; if a report leads to a ban, only for as long as a legal obligation requires. Reports by you and about you remain for that period even after you delete your account, because we need them to prevent abuse and for documentation.

Blocking: Your block list (UID, online name and time of the blocked riders) can only be read by you. The blocked rider is not told. Their times, pictures and likes are hidden everywhere in your app. You can lift a block anytime under “Account › Privacy → Blocked riders”. The list is deleted with your account.

5. Usage data & errors only with consent, no advertising

No advertising SDKs, no advertising ID, no cross-app tracking. We do not sell or share personal information. Only if you switch on “Usage data & errors” in Settings (revocable any time) we store in Google Firestore (Frankfurt) which screens you open, which features you use and which errors occur, with your account ID, app version and platform. No locations, no ride data. Usage data is deleted after 180 days, error reports after 30 days, everything immediately with your account.

6. Retention and deletion

Rides stay on the device until you delete them in the history, use “Privacy → Delete all data”, or uninstall the app. Device backups (iCloud, Google) may contain app data and are managed in your account with that provider.

Deleting your account: “Account → Rider account → Delete account” immediately and completely removes everything we store about you in the cloud: sign-in, profile, online name, rider card with profile and cover picture, cloud backup, leaderboard entries and ghost laps, the likes you gave and the likes on your rides, your crew, your memberships in other crews, live status, follow settings, push devices, block list and two-factor data. There is no grace period and no backup copy. Not included is your customer record at RevenueCat (purchase history and the details listed in section 2a): we delete it at RevenueCat on request by email. Purchase receipts are retained by Apple, Google and RevenueCat as required by commercial and tax law; an active subscription must be cancelled with the store.

7. Children

MotoLap is not directed at children under 13 (USA) or under 16 (EU). A rider account is intended for people aged 16 or older; we do not knowingly collect data from children under 16. Without a rider account we receive no data from you. If we learn that an account belongs to a person under 16, we delete it.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability (Art. 15–20 GDPR) and to object to processing based on Art. 6(1)(f) (Art. 21 GDPR). Most rights can be exercised directly in the app (export, delete); otherwise email us. You may lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany. No automated decision-making takes place.

9. Changes

If the app changes how data is processed (e.g. by adding new online features), we will update this policy beforehand.

Last updated: 26 October 2026