Privacy Policy

2. Information We Collect

We collect different types of information depending on how you interact with our platform:

• Account data: email address, display name, profile photo, and authentication credentials via Firebase Authentication (including Google and Apple sign-in).
• Event data: event details, registrations, participant information, track data, and results stored in Firebase Firestore.
• Location data: real-time GPS coordinates, speed, heading, and altitude during rally events when using the tripmaster feature. Checkpoint detection data and route recordings.
• Usage and device data: analytics and performance metrics collected via Firebase Analytics and Firebase Performance Monitoring, including pages visited, feature usage, and device information.
• Mobile offline data: the mobile app may temporarily store account-scoped profile data, event and route definitions, offline map packs, and unsynced track data on your device so core features can work without a network connection.

3. How We Use Your Information

Your information is used to provide and improve our rally management services:

• Event management: creating, organizing, and running navigation rally events, managing registrations and participant lists.
• Navigation and tracking: powering the tripmaster tool with real-time GPS tracking, checkpoint detection, distance calculations, and average speed monitoring.
• Results and scoring: calculating rally results, generating scoreboards, and providing live timing data to event organizers.
• Communication: sending event-related notifications, account verification emails, and password reset requests.

4. Data Storage & Security

Your data is stored securely using Google Firebase infrastructure hosted within the European Union. All data in transit is encrypted using TLS/SSL. Data at rest in Firebase Firestore and Firebase Storage is encrypted by default. The mobile app also keeps a local offline-first database and, when enabled, offline map packs so it can continue operating without a network connection; these local copies are account-scoped and are cleared by the account sign-out/deletion cleanup. We implement role-based access controls, secure session management with signed cookies, and Firebase App Check to prevent unauthorized API access. Only authorized administrators and event organizers can access relevant event data.

5. GPS & Location Data

Location data is a core part of the rally experience. Here is how we handle it:

• GPS data is only collected during active rally events when you explicitly start the tripmaster feature and grant location permission in the web browser or mobile app.
• Real-time location data is used for live tracking, checkpoint detection, distance measurement, and regularity timing during events.
• Event organizers can view participant locations on the live map during active events for safety and event management purposes.
• Route recordings and track logs are stored as part of the event data and can be exported in GPX format. The mobile app may buffer track data locally while offline; it is synchronized only when the account is active and connectivity is restored. You can request deletion of your location data at any time.

6. Cookies & Analytics

We use cookies and similar technologies to operate and improve our platform:

• Essential cookies: authentication session cookies (HMAC-SHA256 signed) required for secure sign-in and role-based access control.
• Analytics: Firebase Analytics and Google Analytics collect anonymized usage data to help us understand how the platform is used and improve the user experience.
• Performance monitoring: Firebase Performance Monitoring tracks page load times and network request performance to ensure a smooth experience.

7. Data Sharing

We do not sell, rent, or trade your personal data. Your data may be shared in the following limited circumstances: with event organizers for events you have registered for (the event registration details you submit, participant name, registration status, and results; and, only when you explicitly start live tracking, your live event position); with Google Firebase services for infrastructure, authentication, analytics, and storage; and with Mapbox for map rendering and geocoding (no personal data is shared, only map tile requests). We may also disclose data if required by Belgian or EU law or court order.

8. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access: request a copy of all personal data we hold about you.
• Right to rectification: correct any inaccurate or incomplete personal data.
• Right to erasure: request deletion of your account and all associated personal data.
• Right to data portability: receive your data in a structured, machine-readable format (e.g., GPX export for route data).
• Right to object: object to the processing of your personal data for specific purposes, including analytics.

9. Data Retention

Account data is retained for as long as your account is active. You can delete your account at any time, which starts the deletion and recovery process described below. Personal registration details, private profile data, and account-scoped mobile data are removed during that process. Event results, historical records, and aggregate metrics may be retained in a profile-unlinked form for event operations, security, legal obligations, or statistical reporting. Analytics data is retained according to Google Firebase's standard retention periods.

10. Account Deletion and Event Records

When you request account deletion, access to your account is withdrawn immediately and your account enters a 30-day recovery period. During this period, you may sign in again and explicitly choose to restore the account; eligible event registrations, private track data, and private profile storage can then be restored. Your avatar and account-owned Storage objects are removed from active views and their old download URLs stop working while the request is pending; they are held only in a server-only recovery area. Live registrations are withdrawn from organizer views while the request is pending. The mobile app will not automatically restore the account after a restart or offline reconciliation: restoration requires an explicit confirmation. To keep event history and counts accurate, organizers and administrators may see an event-scoped record labelled "Deleted participant". This record is not linked to your profile and does not contain your email address, contact details, registration form responses, or live GPS locations. A limited, profile-unlinked summary of a track may be retained for event history. If the recovery period expires, Firebase Authentication, your profile, private account data, personal registration data, local account-scoped mobile data, and the private recovery area are permanently deleted or cleared. Event results, historical records, audit records, and aggregate deletion metrics may remain in a form that is not linked to your profile where needed for event operations, security, legal obligations, or statistical reporting.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of significant changes by posting a notice on our platform or sending you an email. The "Last updated" date at the top of this page indicates the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at privacy@breine.be. Our data processing activities are governed by Belgian law, and any disputes will be subject to the jurisdiction of the courts of Brussels, Belgium.