OFFROADPAL PRIVACY POLICY

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using our table of contents below to find the section you are looking for.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use.
• Do we process any sensitive personal information? Yes. Precise geolocation, ride and fitness information, and health data you choose to share from Apple Health may be considered sensitive in some jurisdictions. We process this information to provide features you request, with your permission, or as otherwise permitted by applicable law.
• Do we use your location in the background? Yes, but only while you are recording a ride and only if you grant background location permission. Ride recording is something you start and stop. We do not track your location when you are not recording.
• Do we use your health data for advertising? Never. Apple Health data, heart rate, and fitness data are used solely to provide the features you ask for. We do not use them for advertising or marketing, we do not sell them, and we do not share them with advertisers or data brokers.
• Do we collect any information from third parties? We receive limited subscription and attribution information from the Apple App Store and from our analytics and attribution providers. We do not purchase personal information about you from data brokers.
• How do we process your information? To provide, improve, and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.
• In what situations and with which parties do we share personal information? With service providers who process information on our behalf, with other users where you choose to share content publicly, and where required by law. See Section 4.
• Do we sell your personal information? We do not sell personal information for money. Our use of advertising and attribution tools may be treated as "sharing" for cross-context behavioral advertising under some US state laws, and you can opt out. See Section 11.
• What are your rights? Depending on where you live, you may have rights to access, correct, delete, or port your information, and to opt out of certain processing. See Section 9.
• How do you exercise your rights? Delete your account in the app under Settings, use our account deletion request page, or email contact@ridepal.app.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
7. HOW LONG DO WE KEEP YOUR INFORMATION?
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. CONTROLS FOR DO-NOT-TRACK FEATURES
11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
13. DO WE COLLECT INFORMATION FROM MINORS?
14. DO WE MAKE UPDATES TO THIS NOTICE?
15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register for OffRoadPal, participate in activities in the app, or contact us.

Personal Information Provided by You.

• name and display name
• email address
• username
• password (stored only as a salted hash by our authentication provider; we never see your plaintext password)
• profile photo and profile details, including the vehicle types you ride and your riding preferences
• ride, route, trail, and activity information
• photos, reviews, ratings, comments, waypoints, and support communications
• trail reports and corrections you submit

Sensitive Information.

With your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• precise geolocation and recorded route data
• fitness and activity data, including heart rate where you choose to provide it
• health data you authorize us to read from Apple Health

Payment Data.

OffRoadPal does not receive or store your full payment card number or card security code. The Apple App Store processes subscription payments. OffRoadPal and our subscription infrastructure provider, Superwall, receive limited transaction and entitlement information needed to activate OffRoadPal Pro, prevent fraud, provide support, and maintain accounting records. This may include a store transaction identifier, product identifier, subscription status, purchase and expiration dates, price, currency, and a pseudonymous OffRoadPal account identifier. For more information, review the privacy notices for Apple and Superwall.

Social Login Data.

We offer registration using Sign in with Apple, Google Sign-In, and Facebook Login. If you use one of these, we receive the account information the provider makes available with your authorization, as described in Section 5.

Application data and device permissions

If you use our application, we may collect the following if you grant access or permission. You can change any of these at any time in your device settings.

• Location (While Using and Always). We use your location to show nearby trails and riding areas, center the map, and record your ride. If you grant "Always" permission, we continue recording your route while the app is in the background or your phone is locked — this is what makes a ride recording continuous rather than full of gaps. Background collection happens only while a ride recording is active.
• Motion & Fitness. Used to improve elevation and activity accuracy during rides.
• Camera and Photo Library. Used so you can take or upload photos for rides, trails, waypoints, and your profile, and so you can save exported ride videos to your library.
• Health (Apple Health). Optional. See "Apple Health and fitness data" below.
• Notifications. Used to send ride, social, and account notifications. You can turn these off in device settings or in the app.
• App Tracking Transparency. We ask for permission to measure advertising performance. If you decline, we do not access your device's advertising identifier. See Section 11.
• Device Data. We automatically collect device model, operating system and version, device and application identifiers, language and region, mobile carrier or network information, and IP address.

Information automatically collected

In Short: Some information — such as your IP address and device characteristics — is collected automatically when you use our Services.

• Log and Usage Data. Diagnostic, usage, and performance information our servers record automatically, including date and time stamps, screens and features used, searches, actions taken, and error reports and crash logs.
• Device Data. Information about the device you use to access the Services, as described above.
• Location Data. Precise or imprecise location depending on your device settings and the permission you granted. You can disable this in your device settings, though some features will not work without it.

Ride recordings

When you record a ride, we collect the GPS trace of your route along with derived metrics such as distance, duration, moving time, speed, elevation gain and loss, and timestamps. If you have connected Apple Health or a compatible heart-rate source, heart-rate data may be recorded alongside the ride.

Ride recordings are private to you by default. They become visible to others only if you choose to share a ride, post it to a feed, attach a photo from it to a trail, or start a live-sharing session.

If you use live ride sharing, the link you generate exposes your in-progress location to anyone who has the link, for the duration of the session. Treat that link as public and share it only with people you intend to see your position.

Apple Health and fitness data

If you choose to connect Apple Health, OffRoadPal can read workout and heart-rate data you authorize, and can write completed rides and workout summaries back to Apple Health. You control this access in the Health app and in OffRoadPal settings, and you can revoke it at any time.

We use Apple Health data solely to provide the features you request. We never use Apple Health or other health and fitness data for advertising, marketing, or similar purposes; we never sell it; we never use it for any purpose other than improving your health and fitness experience in the app; and we never share it with advertisers, data brokers, or any third party except as required to provide a feature you requested or as required by law. We do not store Apple Health data outside your device except where it forms part of a ride you have saved to your account.

Maps, land access, and weather information

OffRoadPal shows trail, public land, private land, cell coverage, weather, and wildfire information on a map. Rendering these maps requires sending your approximate map view — and, when you center the map on yourself, your location — to our mapping provider, Mapbox, so that the correct tiles can be returned. Weather information is retrieved using Apple WeatherKit based on the location you are viewing.

Land ownership, land management, and access information shown in OffRoadPal is derived from government and public data sources and is provided for general orientation only. It is not a survey, not legal advice, and may be out of date or incorrect. Always confirm access and legality on the ground and with the relevant land manager before riding.

Public content

OffRoadPal is built around a shared trail map, and some content you contribute is public by design. Trail reviews, ratings, trail photos, submitted trails, trail reports and corrections, and leaderboard entries are visible to other OffRoadPal users, and may be visible on our public website where they can appear in search-engine results and link previews. Public content is attributed to your OffRoadPal display name.

Photos you upload may contain embedded metadata such as the location and time they were taken. We display photos publicly; think before uploading images you would not want public, particularly images that reveal a private or sensitive location.

If you delete a photo or review, we remove it from trail pages. If you delete your account, your reviews and photos are deleted or disassociated from your identity, but trail map contributions such as trail locations, names, geometry, and corrections remain part of the OffRoadPal trail database — like edits to a shared map, they cannot be meaningfully returned once merged.

Social features

If you use OffRoadPal's social features, we process your follows and followers, feed posts and their comments and reactions, group rides and events you join, and any invitations you send. People you follow, and people who follow you, can see the activity you choose to share.

Companion experiences

OffRoadPal supports CarPlay, Apple Watch, and iOS Live Activities. These surfaces display ride information from the device you are already using and do not collect additional categories of personal information beyond what is described in this notice.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law.

• To create and manage your account and authenticate you.
• To deliver the features you request, including trail discovery, ride recording, route building, offline maps, and coverage and land-access layers.
• To show you nearby and relevant trails and riding areas based on your location.
• To save your rides, routes, waypoints, and offline map regions to your account and sync them across your devices.
• To operate social features, including feeds, follows, comments, leaderboards, and group rides.
• To process subscriptions, activate entitlements, restore purchases, and prevent purchase fraud.
• To decide which subscription offer or paywall to present to you, which may take into account information such as the features you have used and the preferences you selected during onboarding.
• To send you administrative information, including changes to our terms and policies.
• To send you marketing and promotional communications where permitted by law and in line with your preferences. You can opt out at any time.
• To measure and attribute marketing, including measuring the effectiveness of advertising campaigns and attributing app installs. We do not use health, fitness, ride, or precise location data for advertising or marketing purposes.
• To respond to your inquiries and provide support.
• To identify usage trends and to evaluate and improve our Services.
• To diagnose crashes, debug problems, and maintain the security, integrity, and reliability of the Services.
• To protect our Services and our users, including detecting and preventing abuse, spam, and fraudulent or unlawful activity.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

3. WHAT LEGAL BASES DO WE RELY ON?

In Short: We only process your personal information when we have a valid legal reason to do so.

If you are located in the EEA or UK, the General Data Protection Regulation and UK GDPR require us to explain the legal bases we rely on:

• Consent. Where you have given us permission — for example, for precise location, Apple Health access, notifications, advertising measurement, or marketing email. You may withdraw consent at any time.
• Performance of a Contract. Where processing is necessary to provide the Services you have requested or to fulfill our obligations under our terms.
• Legitimate Interests. Where processing is in our legitimate interests and those interests are not overridden by your rights — for example, to improve the Services, to keep them secure, and to prevent fraud.
• Legal Obligations. Where processing is necessary to comply with law or to respond to lawful requests.
• Vital Interests. Where processing is necessary to protect the vital interests of you or another person, such as in a safety emergency.

If you are located in Canada, we process your information with your express or implied consent, which you may withdraw at any time. In some limited cases we may be legally permitted to process without consent, such as for investigations, fraud detection and prevention, or where collection is clearly in your interests and consent cannot be obtained in a timely way.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with service providers who process it on our behalf, with other users where you choose to make content public, and where required by law.

Service providers

We use the following categories of third-party providers to operate OffRoadPal. They process personal information on our behalf and are contractually restricted from using it for their own purposes, except where their own notice states otherwise.

• Google (Firebase). Account authentication, database storage, file storage, server functions, push notification delivery, app integrity verification, crash reporting, and analytics. See the Firebase privacy documentation and Google Privacy Policy.
• Mapbox. Map tiles, map styles, geocoding, and route directions. Your approximate map view and, where relevant, your location are sent to Mapbox to render maps and calculate routes. See the Mapbox Privacy Policy.
• Apple. App distribution, Sign in with Apple, subscription purchases and receipts, push notification delivery, WeatherKit weather data, and (on your device) HealthKit. See the Apple Privacy Policy.
• Superwall. Paywall presentation, subscription entitlement management, and purchase analytics. See the Superwall Privacy Policy.
• Mixpanel. Product analytics, used to understand which features are used and how the app performs. See the Mixpanel Privacy Policy.
• Meta Platforms (Facebook SDK). Facebook Login, install attribution, and advertising measurement. Advertising measurement uses your device advertising identifier only where you have granted App Tracking Transparency permission. See the Meta Privacy Policy.
• Attribution providers. We use marketing attribution tooling to understand which campaigns lead to app installs. This processes device and campaign identifiers, not your ride, health, or precise location data.

We may also share information with professional advisers, auditors, and insurers, and in connection with a merger, acquisition, financing, or sale of assets, in which case we will continue to protect your information and will notify you before it becomes subject to a different privacy notice.

Other users and the public

Content you choose to make public — reviews, ratings, trail photos, trail submissions and corrections, leaderboard entries, feed posts, and comments — is visible to other users and may be visible on our public website. Live ride share links are visible to anyone holding the link.

Legal and safety

We may disclose information where we believe in good faith it is necessary to comply with applicable law or a lawful request, to enforce our terms, to detect or prevent fraud or security issues, or to protect the rights, property, or safety of OffRoadPal, our users, or the public.

5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you register using a social account, we receive limited profile information from that provider.

OffRoadPal offers Sign in with Apple, Google Sign-In, and Facebook Login. When you use one of these, the provider gives us profile information you have authorized — typically your name, email address, and profile picture. Sign in with Apple allows you to hide your email address, in which case we receive a private relay address instead; this is fully supported and you can use OffRoadPal normally.

We use the information we receive only for the purposes described in this notice. We do not control, and are not responsible for, how the social provider uses your personal information; review their privacy notice for details.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use limited tracking technologies in our app and on our website.

The OffRoadPal mobile app does not use browser cookies. It does use device and installation identifiers, and software development kits from the providers listed in Section 4, to operate the app, measure performance, diagnose crashes, and measure advertising.

Our website uses cookies and similar technologies that are necessary for the site to function, together with limited analytics. Where required by law, we request consent before setting non-essential cookies. You can control cookies through your browser settings.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes in this notice, unless a longer period is required by law.

We keep your account information and the content associated with it for as long as your account remains active. When you delete your account, we delete or de-identify your personal information within 30 days, except where we must retain it to comply with a legal obligation, resolve disputes, prevent fraud or abuse, or enforce our agreements. Backup copies are purged on our ordinary backup rotation.

As described in Section 1, contributions merged into the shared trail map — trail geometry, names, and corrections — are retained as part of the map after account deletion, disassociated from your identity.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use organizational and technical measures to protect your personal information.

Data is transmitted over encrypted connections and stored with our infrastructure providers using encryption at rest. Access to production systems is restricted to authorized personnel, and app requests are verified using device attestation to reduce abuse. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorized third parties will not defeat our security and improperly collect, access, steal, or modify your information. You access the Services at your own risk, and should access them within a secure environment.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing.

To exercise a right, delete your account in the app under Settings, use our account deletion request page, or email contact@ridepal.app. We will respond in accordance with applicable law. We do not charge a fee for a first request, and we do not discriminate against you for exercising a right.

Withdrawing consent. Where we rely on your consent, you may withdraw it at any time — by revoking a permission in your device settings, disconnecting Apple Health, turning off notifications, or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Marketing. You can unsubscribe from marketing emails using the link in any such email, or by contacting us. We will still send you service-related messages necessary to administer your account.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you may complain to your local supervisory authority or the UK Information Commissioner's Office. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT browser signals. Where a legally recognized opt-out preference signal such as Global Privacy Control is required to be honored, we honor it. On iOS, App Tracking Transparency gives you direct control over advertising identifier access, and we respect your choice.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of a US state with a comprehensive privacy law, you may have additional rights.

These states currently include California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Depending on your state, you may have the right to:

• Know whether we process your personal information, and access it
• Request a copy of your personal information in a portable format
• Correct inaccurate personal information
• Request deletion of your personal information
• Opt out of the processing of your personal information for targeted advertising, its sale, or profiling with legal or similarly significant effects
• Limit the use and disclosure of sensitive personal information
• Appeal a decision we make about your request

Categories we collect

In the preceding twelve months we have collected: identifiers (such as name, email, username, device and account identifiers, and IP address); commercial information (subscription and transaction records); internet and network activity (app usage and diagnostics); precise geolocation; sensory data (photos you upload); and sensitive personal information (precise geolocation, and health and fitness data where you choose to provide it). We collect this information from you directly, from your device, and from our service providers.

Sale and sharing

We do not sell your personal information for money. Our use of advertising measurement and attribution tools may be considered "sharing" for cross-context behavioral advertising, or a "sale" under the broad definitions in some state laws. This applies only to identifiers and app-usage events. We do not sell or share health, fitness, ride, or precise location data, and we do not use those categories for advertising.

You can opt out of advertising measurement by declining the App Tracking Transparency prompt, by turning off "Allow Apps to Request to Track" in iOS Settings, or by emailing contact@ridepal.app.

Sensitive personal information

We use sensitive personal information only for purposes permitted without a right to limit — to provide the features you request, to ensure security and integrity, and to maintain the quality of our Services. We do not use or disclose sensitive personal information to infer characteristics about you.

Verification and appeals

To protect you, we will verify your identity before acting on a request, generally by matching information you provide against information already in our records. If you have an account, we may ask you to authenticate. If we decline a request, you may appeal by replying to our decision or emailing contact@ridepal.app with "Privacy Appeal" in the subject line. You may also designate an authorized agent to make a request on your behalf.

California "Shine the Light." California residents may request, once a year and free of charge, information about personal information we disclosed to third parties for their direct marketing purposes in the preceding calendar year. We do not make such disclosures.

12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights if you are located in Australia, New Zealand, Canada, the EEA, the UK, or Switzerland.

We collect and process your personal information under the obligations and conditions set by applicable local privacy law. This notice satisfies the notice requirements defined by those laws, in particular what personal information we collect from you, from which sources, for which purposes, and with whom we share it.

Our servers and those of our service providers are located primarily in the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for these transfers.

13. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 13 years of age.

OffRoadPal is not directed to children under 13, and we do not knowingly collect personal information from them. By using the Services, you represent that you are at least 13 years old, or that you are the parent or guardian of a minor and consent to that minor's use of the Services. If we learn that we have collected personal information from a user under 13, we will deactivate the account and take reasonable steps to promptly delete that information. If you believe we may have collected information from a child under 13, please contact us at contact@ridepal.app.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page and will be effective as soon as it is accessible. If we make material changes, we will notify you either by prominently posting a notice or by sending you a direct notification. We encourage you to review this notice periodically.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us at contact@ridepal.app, or by post at:

RidePal LLC
Attn: Privacy
United States

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, to correct it, or to delete it.

You can delete your account and its associated data directly in the app under Settings, or by using our account deletion request page. To request access to or correction of your information, email contact@ridepal.app.