The short version: We collect your email so you can sign in, and the session/points data you generate by using the app. We don't sell your data. Other users can see your posted sessions and roughly how many riders are in each one, but not your email address. You can ask us to delete your account and data at any time.
[YOUR FULL LEGAL NAME] ("we", "us"), operating Hi-8ctane from Amsterdam, the Netherlands, is the data controller for the personal data described below. Contact: hello@hi8ctane.com. A natural person can be a valid GDPR data controller — no registered company is required for this to be legally sound, though if this becomes a registered business (e.g. via KVK), this section should be updated to name that entity instead.
| Data | Why | Legal basis |
|---|---|---|
| Email address | Account sign-in (magic link), the only way we can contact you | Contract (providing the service you signed up for) |
| Display name | Shown to other users on sessions you post or join | Contract |
| Sessions you post (sport, location, time, notes) | Core function of the app — this is what other users see and join | Contract |
| Sessions you join, and attendance confirmations | Points and rewards system | Contract |
| Reports you submit | Safety and moderation | Legitimate interest (keeping the platform safe) |
| Login timestamps, basic technical logs | Security, debugging | Legitimate interest |
We don't collect payment information, government ID, precise GPS location, or health data. If future versions add any of these, this policy needs to be updated before that data is collected.
Other users can see: your display name, sessions you've posted or joined, and rider counts on sessions. Other users cannot see your email address through the app. Reports you submit are visible to us, not to the person you reported.
We use Supabase (built on AWS/Postgres infrastructure) to store account and app data. [Confirm which Supabase region you select when creating the project — EU region keeps data inside the EU, which simplifies GDPR compliance; a non-EU region requires an international transfer mechanism like Standard Contractual Clauses.] Supabase acts as our data processor under a standard data processing agreement.
We keep account data for as long as your account is active. If you delete your account, we remove your personal identifying data (email, display name) within [30 days]. Session and points history may be retained in anonymized/aggregated form for basic usage statistics.
Under GDPR, you can ask us to:
To exercise any of these, contact hello@hi8ctane.com. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe your data has been mishandled.
The app uses only the essential session/auth cookie set by Supabase to keep you signed in. No analytics, advertising, or third-party tracking cookies are used in this version. [Update this section if you add analytics later — that would require a cookie consent banner under EU ePrivacy rules.]
This app is not intended for use by anyone under 18. Given the physical risk of the activities involved (motocross, kitesurf, and similar), we've set this higher than the GDPR minimum, and it isn't verified beyond self-declaration at signup. We do not knowingly collect data from children below that age.
We may update this policy as the app evolves. Material changes will be communicated via the app or email before they take effect.
This document is a starting draft, not legal advice. It assumes a standard Supabase setup with no third-party analytics or payment processing. Have it reviewed by a lawyer before launch, and update it immediately if you add anything (payments, push notifications, precise location, analytics, ID verification) that changes what data you collect.