Skip to content
DustRide

Privacy policy

Last changed: 8 November 2026

This policy explains how DustRide (the Android and iOS apps and app.dustride.pl) processes personal data. DustRide shows no ads, uses no analytics, does not track you and never sells your data.

Who is responsible

The controller of your personal data is Adventure Zbigniew Tarnawski (NIP 7681534840, ul. Berberysów 21, 40-750 Katowice) ("we", "us"). For anything about your data, including your rights, write to admin@dustride.pl. We have no data protection officer, as the law does not require one.

What we process, why, on what basis and for how long

The legal bases are those of Article 6(1) GDPR: (b) the contract, that is providing DustRide to you; (c) a legal obligation; (f) our legitimate interest, named each time.

  • Your account: email address, password (only as an irreversible hash), the name the group sees, role, sign-in sessions. If our administrators invited you, they gave us your email address. Basis (b). Kept until the account is deleted.
  • Sharing your position in a ride: position, heading, speed and time, with your name and a random identifier of the app's installation. Basis (b). Passed live to the ride, not stored.
  • Your last position in a ride, so the group sees where you were last heard from: only the latest one, each overwriting the one before. Basis (b). Deleted when you leave the ride, within a day after the ride ends, and when the account is deleted.
  • Alerts and short messages: content, name, position and time. Basis (b). Relayed live, not stored by us; riders' phones keep alerts with a position for the next 20 rides.
  • A ride's chat: messages, name, time, replies and mentions, account identifier. Basis (b). Kept until the author deletes their account; organizers and administrators can take a message down.
  • Notifications of new chat messages: each phone's notification token and platform, account identifier, and the notification (ride, author, start of the message), which passes through Google or Apple. Basis (b). Kept until you sign out on that phone, the token expires or the account is deleted. You can mute them in the app.
  • Rides, routes and your ride history: ride code, name, times, organizers, the route file (GPX) with what it contains; which rides you joined and when. Basis (b). Kept until the account is deleted, and at most a day longer; then only the ride's code remains, linked to nobody.
  • Settings: map and display settings, language, time zone. Basis (b). Kept until the account is deleted, and at most a day longer.
  • Record of accepting the terms: version, and when and where it was accepted. Basis (f), showing what was agreed and defending claims. Kept 6 years from the end of the year in which the account is deleted.
  • The map: your IP address and the map area fetched, which MapTiler receives. Basis (b). Not kept by us.
  • Routes shared from Google Maps: the route's points or addresses, vehicle type, the app's identifier and IP address, which the app sends to Google. Basis (b). Not kept by us.
  • Asking for a route on Android Auto: your position at that moment and the place you are heading for, vehicle type, the app's identifier and IP address, which the app sends to Google, also outside a ride, and again if you leave that route. Basis (b). Not kept by us.
  • A ride's chat on Android Auto: Android Auto, a Google service under Google's own rules, reads messages aloud and turns a spoken reply into text. DustRide itself never records sound.
  • Website sign-in and cookies: a session cookie, until the browser closes; a sign-in cookie, with a session holding your IP address and browser identifier, until you sign out and at most 30 days unused or 90 days; on the live ride page, a random identifier in the browser's storage. Basis (b), and (f) protecting accounts. All are necessary for the website to work, so need no consent; none tracks you.
  • Account emails: sign-up and password codes, invitations and notices of changes. Basis (b); the notices (c). The sending log is deleted after 45 days.
  • Writing to us: complaints, data requests, content reports and appeals: basis (c) and (f), defending claims; kept 6 years from the end of the year the matter closed. Other questions: basis (f), answering you; kept 24 months.
  • Server and sign-in logs: IP address, request, time. Basis (f), security and finding faults. Kept at most 90 days.
  • Crash reports: what went wrong and where, the app version, phone model and system, the app's state, a random installation identifier; never your position, name, email address, account identifier or IP address. Basis (f), fixing faults. Kept 30 days.
  • Backups: the database as it was that day. Basis (f), restoring the service after a failure. Kept at most 90 days.
  • Reading a QR code: the camera image is read on the phone only, never stored or sent. On Android, Google's ML Kit may send Google diagnostic data about itself (not the image), as a separate controller.

Who sees your position

Your position is shared only during a ride, also with the app in the background (Android shows a notification, iOS its location indicator): with the ride's riders and, on the website, with its organizers who ride in it and DustRide's administrators. Sharing stops when you leave the ride or sign out. The one exception is asking for a route on Android Auto (see above), which gives Google your position at that moment, also outside a ride. An alert or message marked "organizer only" reaches only the ride's organizers, and the administrators on the website.

Who receives your data

  • Riders in the same ride see your name, position, the alerts and messages you send, and the ride's chat.
  • Organizers see the same for their rides. An organizer who uses DustRide in their business is a separate controller of what they see.
  • DustRide's administrators, people we authorise, see accounts (email address, name, role), rides with their routes and any ride live, only for support, fixing faults and running the service. Basis (f).
  • Service providers processing data for us under data processing agreements:
    • Our IT contractor in Poland: builds and runs DustRide. It engages the providers below, other than cyber_Folks, as sub-processors, with our consent.
    • Supabase Pte. Ltd. (Singapore), with support from Supabase, Inc. (USA): database, sign-in, files and live relay; data in Frankfurt, live relay on its worldwide network.
    • DigitalOcean, LLC (USA): the website's server, in Frankfurt.
    • AC PM, LLC (Postmark, USA): sending emails, in the USA.
    • Functional Software, Inc. (Sentry, USA): crash reports, in Frankfurt.
    • cyber_Folks S.A. (Poland): our mailbox and domain, in Poland.
    • Google Ireland Limited (Firebase Cloud Messaging) and Apple Distribution International Ltd. (Apple Push Notification service): notifications.
  • Separate controllers: MapTiler AG (Switzerland) for the map, under its own rules; Google Ireland Limited for routes shared from Google Maps, routes asked for on Android Auto and, on Android, ML Kit's diagnostic data.
  • Public authorities, when the law requires it.

Transfers outside the European Economic Area

  • Supabase: its staff may reach the data from Singapore, the USA and elsewhere, and live data passes through its servers worldwide, under the standard contractual clauses (Commission Implementing Decision (EU) 2021/914).
  • DigitalOcean, Postmark, Sentry and the notifications of Google and Apple: the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), with standard contractual clauses in the agreements as a fallback.
  • MapTiler: the Commission's decision that Switzerland protects data adequately (2000/518/EC).

Write to us for a copy of the clauses. Certifications are listed at dataprivacyframework.gov.

On your phone

The app keeps on the phone what it needs: your session, settings and name, recent rides, your trail and distances, alert pins, blocked riders, the route, an installation identifier and the map for use without signal. Signing out or deleting the account removes all of it except that map and the app's language. On Android the app's data is left out of backups; on iOS it may be in your device's backup. Uninstalling the app removes everything.

Deleting your account

In the app: menu, "Your account", "Delete my account", and confirm. Without the app: see app.dustride.pl/delete-account. Then:

  • straight away we delete your email address, name, password, sessions, chat messages, notification tokens and last positions;
  • within a day we delete everything else tied to the account; only each ride's code remains, linked to nobody, so that it is never reused;
  • we keep the record of accepting the terms for 6 years, as above; backups expire within 90 days, the email sending log after 45 days, and logs within 90 days.

Your rights

You may ask for access to your data and a copy, rectification, erasure, restriction of processing, and the data you gave us in a machine-readable format (portability). Write to admin@dustride.pl from your account's address; we answer within a month.

Your right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (the record of accepting the terms, writing to us, website sign-in security, administrators' access, logs, crash reports and backups). We then stop, unless we show compelling legitimate grounds or need the data for legal claims.

Complaining to a supervisory authority

You can complain to the President of the Personal Data Protection Office (UODO, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl) or to the supervisory authority of the EU country where you live, work or where the infringement took place.

What you must give us

An email address, a password and the name the group sees are needed to make the agreement; without them you cannot use DustRide. The name need not be your real name. Location access is needed to share your position, and the camera only to read a QR code.

Automated decisions

We take no automated decisions about you and do not profile you. The app masks swear words on the phone, from a fixed list of words.

Age

DustRide is for adults only (18 or older).

Security

Everything is encrypted in transit (HTTPS), passwords are stored only as irreversible hashes, and a ride's data is open only to its riders, its organizers and our administrators. If a breach puts you at high risk, we will tell you.

Changes

When our processing changes, we update this page and its date, and email account holders about significant changes before they take effect.