Privacy Policy

1. Information We Collect

We collect information directly from you, automatically through your active participation in group rides, and through integrated cloud infrastructure:

A. Precise & Background Location Data (Restricted Permission Disclosure)

Because CRUVO's core functionality is real-time squad tracking and rider safety, the app requests access to high-accuracy location services:

• Precise GPS Telemetry: Latitude, Longitude, Heading (direction of travel), and Instantaneous Speed.
• Prominent Background Location Collection: When you start or join an Active Group Ride, CRUVO collects your precise location data even when the app is closed or not in use. This ensures your position marker remains updated on your squad's live map if you minimize the app to check turn-by-turn navigation, answer phone calls, or lock your device.
• Route & Waypoint Coordinates: Ride start locations, planned stops, checkpoints, and destination coordinates.
• Incident & Stop Flags: Coordinates and categories of stops flagged during trips (Fuel, Food, Rest Break, General, Road Hazard/Issue).

B. Account & Profile Information

• User Credentials: Username, Email address, Display Name, and encrypted password hash (or Google OAuth profile tokens).
• Rider Profile Details (Optional): Biography, Contact Phone Number, City, Motorcycle Make and Model, Riding Style (Adventure, Sport, Touring, Cruise, Commute), Experience Level (Beginner, Intermediate, Veteran, Expert), and Profile Avatar image.

C. Device & Notification Identifiers

• Push Notification Tokens: Device push registration tokens (via Expo Push Services & Firebase Cloud Messaging) utilized strictly to deliver real-time stop hazard alerts, squad invites, and friend notifications.

2. How Your Information Is Used

Your data is processed strictly to provide the features you explicitly invoke:

• Real-Time Squad Synchronization: To stream sub-second position coordinates to your joined squad members on the active ride map.
• Route & Navigation Intelligence: To compute route distances, durations, elevation profiles, and polyline directions via mapping APIs (TomTom API).
• Squad Safety Alerts: To notify all ride participants when a squad member flags a fuel stop, rest break, or emergency breakdown.
• Account Authentication: To establish secure login sessions and process verification OTP emails.

3. Third-Party Service Providers & Data Sharing

We share specific technical data only with reputable service providers necessary to deliver core app functionality. We do not sell or broker personal data:

4. Data Retention & Lifecycle Policy

5. Security & Storage Standards

• Transit & Rest Encryption: All client-to-server communications use HTTPS/WSS with TLS 1.3 encryption. Database storage is protected with volume encryption.
• Device-Level Security: Authentication tokens are stored in hardware-backed secure storage on mobile devices (via OS keychain / Keystore).
• Zero Third-Party Advertising: No behavioral tracking, advertising SDKs, or commercial data brokers are integrated into the application.

6. User Controls, Permissions & Account Deletion

You have full autonomy over your data and device permissions:

• Location Permission Management: You can grant or revoke foreground and background location permissions at any time through your device operating system settings.
• Profile Visibility Controls: You can choose whether your email and phone number are visible to friends or kept strictly private in the Profile Edit screen.

7. Compliance with Digital Personal Data Protection Act, 2023 (India)

For users residing in India, CRUVO processes personal data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act):

• Unbundled, Specific Consent: Consent for sensitive telemetry (such as background and foreground GPS location) is collected separately from general account terms, for specified, clear purposes only.
• Right to Withdraw Consent: Under Section 6(4) of the DPDP Act, you may withdraw your consent for location tracking or data processing at any time directly through the app settings or by contacting us. The ease of withdrawal matches the ease of giving consent.
• Right to Access Summary: You may request a summary of the personal data being processed and the processing activities undertaken by CRUVO.
• Right to Correction & Erasure: You have the statutory right to rectify inaccurate personal data, complete incomplete records, or request complete erasure of your profile and telemetry logs.
• Right to Nominate: You have the right to nominate any individual who shall, in the event of death or incapacity, exercise your data rights.
• Designated Grievance Redressal Officer: In compliance with Section 6(2)(i) and Section 12 of the DPDP Act, we have designated an official Grievance Officer for privacy matters:

  Grievance Officer: Data Protection & Privacy Desk

  Platform: CRUVO Telemetry Engine

  Email: cruvobs@gmail.com

  Registered Jurisdiction: New Delhi, Delhi, India

  Statutory SLA: Grievance requests acknowledged within 48 hours and resolved within 30 calendar days.

  Escalation: If you are unsatisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India (DPBI).

8. Compliance with General Data Protection Regulation (GDPR - EU/EEA)

For users within the European Economic Area (EEA) and the United Kingdom, CRUVO operates as the Data Controller under the GDPR:

• Lawful Bases for Processing:
  • Explicit Consent (Art. 6(1)(a)): For active and background GPS location telemetry and push notifications.
  • Performance of Contract (Art. 6(1)(b)): To operate user accounts, group rides, and route calculations.
  • Legitimate Interests (Art. 6(1)(f)): To maintain security, verify accounts, and prevent platform misuse.
• Your GDPR Rights:
  • Right of Access (Art. 15): Request a complete copy of all personal data held about you in portable JSON format.
  • Right to Rectification (Art. 16): Update any inaccurate data in your garage profile.
  • Right to Erasure / Right to be Forgotten (Art. 17): Permanently delete your account and ride logs via the app or email.
  • Right to Restriction & Objection (Arts. 18, 21): Object to processing of specific data categories.
  • Right to Data Portability (Art. 20): Receive your ride history and telemetry in a structured, machine-readable format.
• Supervisory Authority: You have the right to lodge a complaint with your local EU Data Protection Authority if you believe our data processing breaches applicable laws.

9. Contact & Official Inquiries

If you have any questions, concerns, or inquiries regarding this Privacy Policy or our data handling practices, please contact our team: