ChronoDash Privacy Policy

1. Introduction

ChronoDash is a lap timer for motorcyclists made of a device that mounts on the bike and a smartphone app that downloads, analyses and compares your track sessions. This Privacy Policy explains which personal data we process through the app, the device and this website, for which purposes, who we share it with, how long we keep it and what rights you have.

2. Data We Process

2.1 Account and profile

• Email address and account identifier
• The name you appear under in the app (chosen by you, it does not need to be your real name)
• Your profile photo, if you choose to upload one
• A cryptographic fingerprint (hash) of your email, which lets friends find you if they already know your address without the address itself being visible
• The privacy and notification settings you choose

If you sign in with Google or Apple we receive from them only your name, email address (with Apple, the "Hide My Email" relay address if you choose it) and an account identifier; we never receive your password.

2.2 Garage

Make, model and class of the motorcycles you add to your garage, and which one you are riding.

2.3 Sessions and telemetry data

• GPS position and racing line on track, recorded by the ChronoDash device
• Speed, acceleration, braking and lean angle
• Lap times, track, date and motorcycle of each session, and the statistics we derive from them
• Mount calibration: the tilt the device reads with the bike upright, so we can warn you if it is mounted crooked

Sessions stay on your phone. In the cloud we store your best laps for the leaderboards and, if you are a Pro subscriber, a full backup of your sessions.

2.4 Leaderboards and social features

• Your best time on each track, with motorcycle, class, name and photo, and the telemetry slice of that lap
• Your best time of the day and your race number for the day (daily leaderboards, Pro only)
• Friend requests, friends, challenges and activity feed events (for example a new personal best)

Who can see this data is explained in section 4.

2.5 ChronoDash device and phone

• The device serial number, model and firmware version, when you link it to your account for the included Pro trial (see 2.6)
• Your phone model (for example "iPhone 16 Pro"), which the app sends to the device over Bluetooth so it can show it in the list of paired phones. It stays on the device and never reaches our servers
• Your phone's location, once and only when you ask to centre the map on where you are while creating a custom track. We never track it in the background
• A push notification token for each phone you sign in with

2.6 Pro subscription and included trial

If you subscribe to ChronoDash Pro we process the plan you chose, the store (App Store or Google Play), the transaction identifier or purchase token, the start and expiry dates and the renewal status. We verify them directly with Apple or Google to unlock Pro features. Payment is handled by the store: we never see or store your card or payment method details.

Every new ChronoDash includes one month of Pro, which can be redeemed only once per device and once per account. To enforce this we record the device serial number together with the account that redeemed the trial, the date, the model and the firmware version.

2.7 Maintenance Data (optional Pro feature)

Only if you are a Pro subscriber and turn on the Maintenance feature, we process for each motorcycle in your garage:

• Maintenance items (default or created by you) and their intervals in kilometres
• The estimated kilometres of each session, with the session date and the code that identifies it
• Kilometres you enter manually and the dates of the services you mark as done
• The riding level you choose (amateur, fast amateur, racer, pro) and the status of each item (OK, due soon, overdue)

We use this data only to show you how far each service is and to send you maintenance push notifications, unless you have turned them off. The data is private: it is not visible to other users and is not used for leaderboards. The lap time you can enter to work out your riding level is processed on your phone only and is not saved. If you turn the feature off we stop updating this data; it is kept until you delete the motorcycle or your account, or until you ask us to delete it at info@chronodash.it.

2.8 Technical and security data

• App crash reports (Firebase Crashlytics): phone model and operating system, app version, technical details of the error and a random installation identifier
• App integrity checks (Firebase App Check, via Google Play Integrity, Apple DeviceCheck and, on the web, reCAPTCHA Enterprise), which confirm that requests come from the genuine app
• Technical logs on our servers (for example the identifier of the account that performed an operation), used for security and troubleshooting

The app contains no advertising and no behavioural analytics or profiling tools.

2.9 Website, email and newsletter

If you sign up for the newsletter or write to us through the website we process your email address and what you send us. We also send you service emails, such as the confirmation of an account deletion request. For the website's cookies see the Cookie Policy.

3. Purposes and Legal Bases

• Performance of a contract (Art. 6(1)(b) GDPR) — running your account, downloading and analysing your sessions, storing them in the cloud, publishing your times on the leaderboards, running friends, challenges and the activity feed, working out maintenance reminders, sending push notifications, managing your Pro subscription and included trial, and service emails
• Legitimate interests (Art. 6(1)(f) GDPR) — protecting the service from abuse and unauthorised access (App Check, technical logs), fixing app errors (Crashlytics) and preventing the included Pro trial from being redeemed more than once on the same device
• Consent (Art. 6(1)(a) GDPR) — the newsletter and website statistics. You can withdraw your consent at any time, without affecting processing already carried out
• Legal obligation (Art. 6(1)(c) GDPR) — responding to requests from authorities and complying with legal obligations

Push notifications are sent only if you allow them in your phone settings, and you can turn each type off in the app (challenges, friend requests, mount check, maintenance). We do not use your data for automated decisions that produce legal effects on you.

4. What Other Users Can See

ChronoDash is a social app: some of your data is visible to other people. Here is which data, and to whom:

• Your name, profile photo and account type (Free or Pro) are visible to all registered users, even with a private profile: they are what lets friends find and add you
• Your rider statistics and garage are visible to other users only if your profile is public
• The overall leaderboard of each track in the app shows your best time, motorcycle, class, name and photo. Pro subscribers can open the racing line and telemetry of that lap (only that lap, not your full sessions)
• The overall leaderboards are also published on chronodash.it, visible to anyone: time and motorcycle always, your name only if your profile is public
• Daily leaderboards are visible to Pro subscribers, with name and race number. You can appear anonymously by turning on the option in the settings: your name and number are then not stored at all. The website only shows how many riders were out that day
• Your friends see the activity feed events about you (for example a new personal best) and the challenges you take part in together
• Your email address is never visible to other users

If you share a result with the app's share feature, the image goes to the app you choose and from then on follows that service's rules.

5. Providers and Recipients

We do not sell your personal data and we do not pass it to third parties for their own marketing purposes. We do, however, rely on providers who process data on our behalf as processors under Article 28 GDPR:

• Google Ireland Ltd. / Google LLC (Firebase, Google Cloud) — authentication, database, storage of photos and sessions, processing of leaderboards and subscriptions, push notifications (Firebase Cloud Messaging), crash reports (Crashlytics) and integrity checks (App Check)
• Brevo (Sendinblue SAS) — service emails and newsletter management; servers are located in France
• Vercel Inc. — hosting of this website and performance metrics
• Google Analytics / Google Tag Manager — website usage statistics, activated only with your prior consent through the cookie banner

Some other parties receive certain data as independent controllers, under their own privacy policies:

• Apple Inc. / Google LLC — Sign in with Apple or Google; purchase, renewal and refund of the Pro subscription through the App Store and Google Play, which confirm the purchase to our servers
• CARTO — provides the map images shown in the app: your phone downloads them directly, sending its IP address and the map area being viewed
• OpenStreetMap Foundation (Nominatim) — when you search for a place to create a custom track, your phone sends the search text and its IP address to the OpenStreetMap search service

We may also disclose your data where we are required to do so by law or by a request from a competent authority.

6. Where Your Data Is Stored and International Transfers

6.1 Data Location

The app database — profiles, garage, records and leaderboards, friendships, challenges, subscriptions and maintenance data — is stored in Google Cloud Firestore in the European multi-region eur3, with data centres in Belgium and the Netherlands. A Firestore database location is chosen at creation time and is immutable.

Files — profile photos, session files stored in the cloud and telemetry slices of leaderboard laps — are stored in Firebase Storage in the us-central1 region, in the United States.

6.2 Transfers Outside the European Union

In addition to the file storage described above, some processing takes place in the United States: the serverless functions (Google Cloud Functions, us-central1 region) that update leaderboards, verify subscriptions, send notifications or delete accounts read from and write to the European database for the time needed to complete the operation, and Crashlytics reports are processed on Google servers in the United States. These are transfers of personal data within the meaning of Chapter V of the GDPR.

The transfer takes place on the basis of the Google Cloud Platform Data Processing Addendum, which incorporates the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914. Google LLC is also certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

Vercel Inc., which hosts this website, is also established in the United States and processes data on the basis of the Standard Contractual Clauses included in its data processing agreement. The OpenStreetMap Foundation is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. You can request a copy of the safeguards applied to these transfers by writing to info@chronodash.it.

7. How Long We Keep Your Data

• Account, profile, garage, records, friendships, challenges, cloud sessions and maintenance data: for as long as the account exists; you can delete motorcycles in the app and write to us to delete individual data. Sessions already stored in the cloud remain available even if your Pro subscription ends
• Daily leaderboards: the day's record is kept for as long as the account exists
• Push notification tokens: for as long as you stay signed in on that phone
• Crash reports: 90 days
• Server technical logs: normally 30 days
• Serial numbers of devices that received the Pro trial: for the lifetime of the service, including after the account is deleted (see 8.2)
• Newsletter: until you unsubscribe

8. Your Rights

8.1 Your Rights

Under Articles 15-22 GDPR you have the right to:

• Access your personal data
• Rectification of inaccurate data
• Deletion of your data
• Restriction of processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw your consent, where processing is based on consent

To exercise them write to info@chronodash.it: we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live.

8.2 Account Deletion

8.3 Data Control

In the app you can make your profile public or private, appear anonymously on daily leaderboards, choose which notifications to receive, turn the Maintenance feature on or off, change your name and photo, and delete motorcycles from your garage. For anything else you can contact us.

9. Minors

ChronoDash is intended for adults. If you are under 18 you may use it only with the consent of a parent or legal guardian. If we find out that we have collected data from a child under 14 without that consent, we delete it.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure or destruction.

11. Contact

For questions about this Privacy Policy or your personal data, contact us:

• Email: info@chronodash.it
• Website: chronodash.it

12. Changes to Privacy Policy

We reserve the right to update this Privacy Policy. We will notify you of any significant changes via email or app notification.