Privacy Policy

This Privacy Policy describes, with full transparency, how the STRIFTEROI application collects, uses, stores and protects your personal data, in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679), Greek Law 4624/2019 and applicable Greek legislation. The application is provided exclusively for entertainment and social purposes. For details regarding the Terms of Service, please visit the Terms of Service page.

1. Data Controller

2. Data We Collect

2.1 Account Data

• Name or nickname
• Email address (via Google or Apple Sign-In)
• Profile photo (optional, stored in cloud storage)
• Area / city of residence
• Instagram handle (optional)
• Account creation date
• Date and time of last activity (online status)
• Date of GDPR consent provision

2.2 Motorcycle Data (Garage)

Some of the following constitute personally identifiable data and are stored exclusively in your own account, without public access.

• Make, model, year and engine displacement (cc) of the motorcycle
• Motorcycle nickname
• Current mileage
• License plate number
• Insurance expiry date
• Roadworthiness test (KTEO) expiry date
• Service history (type of work, mileage, date, notes)

2.3 Ride, GPS & Explore Data

• GPS points (latitude, longitude) with timestamp — recorded during each ride
• Speed (km/h), average and maximum speed
• Motorcycle lean angle — measured by the device's accelerometer and gyroscope
• Lateral and vertical G-force — measured by the device's sensors
• Heading, distance (km), duration (minutes)
• Ride start point and destination (GPS coordinates + location name)
• Live location (latitude, longitude, speed, heading) during an active group ride — visible exclusively to the participants of the same ride
• Background collection: When you start a ride recording or live tracking, your precise location is collected even when the screen is locked or the app is in the background, via a service that displays a persistent notification for the duration of the ride. Collection stops automatically as soon as you end the ride or live tracking.
• Public link / tracking code: If you choose to create a live tracking link or code, your real-time location becomes visible to anyone who has the link or code, without needing to log in to the application. This exposure is not limited to your friends; share the link only with people you trust. The data is deleted when the ride or session ends.
• Public routes (Explore): If you choose to share a route via the Explore feature, its GPS data (points, statistics) becomes visible to the community. This sharing is always voluntary and carried out by the exclusive action of the user.

2.4 Social Networking Data

• Friend connections (user IDs)
• Ratings of other users (score 1–5 + comment)
• List of blocked users
• Reports against users or rides
• Ride invitations (IDs, names)
• Feed posts and stories
• Record of viewers and "hearts" on your stories (who viewed them and who liked them)
• Profile visitor list (who visited your profile)

2.5 Messages & Communication

Messages are stored in a secure cloud database. End-to-end encryption is not applied at the database level.

• Direct Messages between users
• Group ride chat messages (including SOS, fuel requests, pauses)
• Public city channel messages (City Channels)
• Marketplace messages between buyer/seller

2.6 Marketplace Data

• Listing details (make, model, price, description, city, condition)
• Listing photos (stored in cloud storage)
• IDs of users who have saved a listing
• Number of listing views

2.7 Technical, Diagnostic & Analytics Data

• Crash reports: Contain device information and a stack trace for identifying and fixing errors. They do not contain personal data under normal circumstances. Stored for 90 days via a third-party diagnostic analysis service.
• Usage analytics data (screen analytics): The application records pseudonymized data regarding the time spent in each section of the application (e.g., time on the ride screen, marketplace, etc.), exclusively for the purpose of improving the user experience. This data is not shared with third parties and is not used for commercial purposes.
• Device identifier: Used for sending push notifications.
• Online status / presence: The application updates the connection status (online/offline) during use, visible to friends within the application.

2.8 Voice Chat Data

The application offers live voice communication (hands-free) in group rides and in separate voice rooms within the "Kouventoula" (Chat) feature. Regarding the data and your rights:

• Microphone permission: The application requests access to your device's microphone only when you explicitly choose to connect to a voice channel. Before first use, the operating system's permission dialog appears. You can revoke the permission at any time from your device's settings.
• Real-time audio transmission: The audio stream is transmitted encrypted in real time, without being stored.
• We do NOT record & do NOT store audio: The application and our servers do not record, store or process the content of voice conversations. No audio file, transcript or any recording is created.
• Session data (metadata): Only the following is stored for operational reasons: list of participants in an active room, session start/end time. It is deleted automatically when the session ends.
• Safety: The use of a hands-free device, helmet intercom or Bluetooth device is recommended. Do not operate the device while riding.

2.9 Meetups & Events Data

• Title, location (name + optional coordinates), date/time and description of the meetup
• Attendance declarations (Going / Maybe / Not going)
• Group chat messages within the meetup
• Organizer details (name, photo) when you create a meetup

2.10 Forum Data (Kouventoula)

• Discussion rooms you create (title, category, description)
• Messages you send in forum rooms or voice rooms
• Favorite / muted rooms (stored in your profile)
• City channel rooms you have preferred

2.11 Block System

You have the ability to block other users at any time from their profile or from settings. When a block is activated:

• The block relationship (your own UID, the user's UID and the date) is stored on our servers so that the system can apply the filtering.
• The block is mutual and absolute: neither of the two users sees content, messages or notifications from the other, in any feature of the application.
• You can view the list of blocked users and undo a block from the application settings.

2.12 Subscription Data (STRIFTEROI PRO)

If you purchase the optional premium subscription, the payment is processed exclusively through the App Store (Apple) or Google Play (Google). We do not see, receive or store your card or bank account details.

• To confirm the purchase, the application sends our servers the purchase receipt/token and the product ID provided by the store.
• We store your subscription status: whether you are premium, the expiry date, the platform (iOS/Android), the product ID and the transaction ID — exclusively to unlock the PRO features.
• This data is used to manage your subscription and to fulfill tax/accounting obligations.

2.13 Speed Camera Data

The "Cameras" feature displays fixed, publicly known speed cameras on a map. If you choose to submit a camera:

• The coordinates (latitude/longitude) of the camera, your identifier (UID) as the user who submitted it, the approval status and the timestamp are stored.
• After review/approval, the camera's location (not your identity) becomes visible to other users.
• We do not record your own location during simple navigation of the camera map.

2.14 Giveaways Data

• Your participation in a giveaway (which giveaway, timestamp) and the result (whether you were selected as a winner) are recorded.
• In case of winning, contact or shipping details may be requested for the delivery of the prize — they are requested explicitly and used exclusively for that purpose.

2.15 Clubs Data

• Clubs you create or participate in (club name, member/admin role).
• Messages you send in the club's group chat.

2.16 Data We Do NOT Collect

• Card or bank account details (subscription payments are processed entirely by Apple / Google — we never see them)
• Identity card or passport number
• Health data
• Mobile contacts (used temporarily for an emergency contact, not stored on the server)
• Background location outside an active ride (background location is collected only during a ride or live tracking that you start, with a persistent notification, see section 10)
• Recordings or transcripts of voice communication

2.17 Advertising & Sponsored Content

The application displays advertisements and sponsored content from partner businesses in the motorcycle sector. Specifically:

• Banner advertisements: Displayed on the home page, the messages screen and the marketplace listings.
• Sponsored Posts: Displayed from time to time in the feed with a clear "Sponsored" / "Χορηγούμενο" label.
• Offers section: Exclusive offers from partner stores.
• We do not collect personal data for ad targeting: Advertisements are displayed in the same way to all users — there is no personalized advertising based on personal characteristics, interests or usage history.
• We do not share user data with advertisers: Partner businesses do not have access to a user list, contact details or activity data.
• Click tracking: The number of impressions and the number of clicks are recorded in anonymous form, exclusively for the advertiser's statistical purposes.

2.18 Cookies (strifteroi.gr Website)

Our website uses cookies to improve the browsing experience. On your first visit, a consent banner (cookie banner) appears where you can choose which categories of cookies you accept:

• Necessary cookies: Website operation, retention of consent choices. Always active.
• Statistics cookies: Anonymous analytics to improve the experience (optional).
• Marketing cookies: Not used. No personalized advertisements are displayed on our website.

You can revoke your consent at any time by clearing cookies from your browser settings.

3. Purpose & Legal Basis of Processing

Purpose	Data	Legal Basis (GDPR)
Account creation & management	Email, name, photo	Performance of a contract (Article 6(1)(b))
Provision of ride services	GPS, speed, lean angle, G-force	Performance of a contract (Article 6(1)(b))
Live location sharing in a group ride	Real-time GPS	Consent (Article 6(1)(a))
Public route sharing (Explore)	GPS points, route statistics	Consent (Article 6(1)(a))
Garage & motorcycle tracking	License plate, insurance, KTEO, service	Performance of a contract (Article 6(1)(b))
Social features (friends, chat)	IDs, messages, ratings	Performance of a contract (Article 6(1)(b))
Push notifications	Notification identifier, preferences	Consent (Article 6(1)(a))
Marketplace listings	Listing details, photos	Performance of a contract (Article 6(1)(b))
Voice communication (voice chat)	Microphone access, session metadata	Consent (Article 6(1)(a))
Meetups & events	Title, location, RSVP, chat messages	Performance of a contract (Article 6(1)(b))
Forum / Kouventoula	Rooms, messages, favorites	Performance of a contract (Article 6(1)(b))
Block system	User UIDs, block date	Legitimate interest (Article 6(1)(f))
Application usage analysis	Screen analytics (pseudonymized)	Legitimate interest (Article 6(1)(f))
Diagnostics & error handling	Crash reports	Legitimate interest (Article 6(1)(f))
Security & abuse prevention	Block list, reports, authenticity check	Legitimate interest (Article 6(1)(f))
Advertising & sponsored content	Impressions & clicks (anonymous)	Legitimate interest (Article 6(1)(f))
STRIFTEROI PRO subscription	Subscription status, purchase receipt/token, product ID	Performance of a contract (Article 6(1)(b)) & Legal obligation — tax (Article 6(1)(c))
Speed camera submission	Camera coordinates, user UID, approval status	Legitimate interest (Article 6(1)(f))
Giveaways & member draws	Participation, result, winner's contact details	Consent (Article 6(1)(a)) & Performance of a contract (Article 6(1)(b))
Clubs	Club members, group chat messages	Performance of a contract (Article 6(1)(b))
strifteroi.gr website cookies	Session cookies, analytics	Consent (Article 6(1)(a)) / Legitimate interest (necessary)
Maintenance of GDPR consent record	Date of terms acceptance	Legal obligation (Article 6(1)(c))

4. Storage, Security & Infrastructure

Data is stored via cloud infrastructures of third-party providers that fully comply with the GDPR and provide data processing agreements (DPAs). The primary servers are located within the European Union.

We use external cloud services for:

• Identity management and user authentication (sign-in with Google or Apple)
• Cloud database (profiles, rides, messages, motorcycles)
• Cloud storage of photos (profile, marketplace, chat)
• Sending push notifications
• Crash reports for improving the application
• Verifying application authenticity and protection against abuse
• Purchase verification and management of PRO subscription status

We additionally use mapping and location services for displaying maps, searching for locations, navigation directions and converting GPS into city names.

For live voice communication (voice chat in group rides and voice rooms), the audio stream is transmitted encrypted via a GDPR-compliant external cloud infrastructure, without being stored.

We apply technical protection measures: encryption in transit, database security rules, application authenticity checks and secure encrypted local storage.

Data breach: In the event of a personal data breach that may endanger your rights and freedoms, we notify the HDPA within 72 hours and, where required, the affected users without undue delay, in accordance with Articles 33-34 GDPR.

Data Protection Officer (DPO): There is no legal obligation to appoint a DPO for the present processing. The contact person for any personal data matter is the data controller, at the details in section 1.

5. Data Retention Period

Category	Retention Period
Account data	Until deletion from the application Settings or by request via email
Solo ride history (GPS routes)	Indefinitely, until account deletion
Group ride data	2 years from completion of the ride
Live location (live sharing)	Deleted when the active ride ends
Motorcycle data (garage)	Until deletion by the user or of the account
Messages (DMs, chat, city channels)	Indefinitely, until account deletion
Marketplace listings	Indefinitely, until archiving/deletion by the user
Public routes (Explore)	Until revocation by the user or account deletion
User ratings	Indefinitely (public)
Voice chat audio content	Not stored — transmitted only in real time
Voice chat session metadata	Deleted when the session ends
Meetups & RSVP	Until deletion by the creator or of the account
Forum / Kouventoula messages	Indefinitely, until account deletion
Stories	24 hours from publication (automatic deletion)
Block relationships	Until removed by the user who applied the block
Screen analytics (usage analysis)	90 days
Error diagnostic data	90 days
Subscription status & PRO purchase records	Up to 5 years from the end of the financial year (tax/accounting obligation)
Speed camera submissions	Indefinitely (public map data), until deletion/rejection or account deletion
Giveaway participations	Up to 1 year after the end of the giveaway (or as long as required for selection & prize delivery)
Clubs & club messages	Indefinitely, until leaving/deleting the club or account deletion
GDPR consent record	3 years (legal obligation)

6. Disclosure of Data to Third Parties

We do not sell, rent or trade your personal data. For the operation of the service, certain data is transmitted to the following recipients / processors, based on data processing agreements (DPAs) and in compliance with the GDPR:

• Google (Firebase / Google Cloud): user authentication, database, file storage, delivery of push notifications, crash reports, application authenticity verification.
• Google Sign-In and Apple (Sign in with Apple): authentication providers, when you choose to sign in via Google or Apple respectively.
• Mapbox: display of maps, tiles and navigation (receives location data).
• Google Maps Platform: geocoding, location search and route directions (receives coordinates and the search text you type).
• LiveKit: real-time transmission of voice communication (receives the encrypted audio stream and connection metadata; does not store any recording).
• Apple App Store & Google Play: processing of PRO subscription payments (seller of the subscription). Card/payment details are handled exclusively by them; we receive only purchase confirmation and subscription status, not card details.
• Notification delivery services (Google's Firebase Cloud Messaging and Apple Push Notification service): delivery of push notifications to your device.
• Map & weather providers (Open-Meteo, OpenStreetMap, Esri/ArcGIS): for weather forecasts and map tiles; they receive a coordinates request and your IP address.
• Other users of the application: Your name, photo, area and rating are visible to other users. Live GPS location is shared only during an active group ride, exclusively with the participants of the same ride (or, if you so choose, with anyone who has the public tracking link/code). Voice communication is audible only to participants of the same room/ride. Explore routes are visible only if you voluntarily choose so.
• Authorities / Courts: Where required by law, court order or for the protection of rights and safety.

We do not use third-party advertising networks and we do not share data with advertisers.

7. International Data Transfers

Some of the above recipients process data outside the European Economic Area, in particular in the United States (e.g., Google, Mapbox, LiveKit, Apple). These transfers are covered either by an adequacy decision under the EU-US Data Privacy Framework, where the recipient is certified, or by the Standard Contractual Clauses (SCCs) of the European Commission, with supplementary protection measures.

8. Your Rights (GDPR)

Under the GDPR you have the following rights:

• Right of access (Article 15): To receive a copy of all your data.
• Right to rectification (Article 16): To correct inaccurate or incomplete information.
• Right to erasure (Article 17 — "right to be forgotten"): To request the deletion of your account and your data. The request is made from the application Settings or via email at strifteroi@gmail.com.
• Right to restriction of processing (Article 18): To request restriction of processing in specific cases.
• Right to data portability (Article 20): To receive your data in a structured, commonly used format.
• Right to object (Article 21): To object to processing for legitimate interest purposes.
• Withdrawal of consent: At any time (e.g., disabling GPS, notifications) — this does not affect prior lawful processing.

To exercise your rights, send an email to strifteroi@gmail.com. We respond within 30 calendar days.

You also have the right to lodge a complaint with the Greek Hellenic Data Protection Authority (HDPA): www.dpa.gr, tel. 210 6475600.

Automated decision-making: No automated decision-making with legal or similarly significant effects for you takes place, nor profiling with such effects (Article 22 GDPR).

Portability: As there is no automatic data export within the application, you can exercise the rights of access and portability by email at strifteroi@gmail.com and you will receive your data in a structured, commonly used and machine-readable format.

9. Push Notifications

The application sends notifications (new rides, messages, invitations, SOS alerts, announcements, polls, insurance/KTEO reminders) via Firebase Cloud Messaging (Google) on Android and Apple Push Notification service on iOS. For this purpose, a notification identifier (push token) of your device is retained. You can manage or disable notifications from the application Settings or your device Settings.

10. Sensors & Device Permissions

The application may request the following permissions, exclusively for the corresponding features:

• Location (GPS), including background: During a ride, for route recording and live sharing in group rides. Location is collected only when you start a ride or live tracking, and continues even when the screen is locked or the app is in the background, via a service with a persistent notification. It stops automatically as soon as you end the ride. You can grant or revoke the background location permission from your device settings.
• Accelerometer & Gyroscope: For calculating lean angle and G-force during an active ride. No explicit permission is required on Android/iOS.
• Microphone: Exclusively when you explicitly connect to a voice channel (group ride voice chat or "Kouventoula" voice room). Before first use, the operating system's permission dialog appears. We do NOT record audio — the stream is transmitted only in real time.
• Bluetooth: For connecting to wireless helmet headphones or an intercom during voice chat use. We do not collect pairing data — the connection is made through your device's operating system.
• Camera & Photos: For posting photos/video to the feed, stories, marketplace listings and profile photo.
• Notifications (Push): For updates regarding rides, messages, friend requests and reminders.
• Mobile contacts: Optionally, only for selecting an emergency contact — they are not stored on the server.

All permissions are requested upon the first activation of each feature and you can revoke them at any time from your device settings.

11. Local Storage (Device)

The application stores locally on your device (without transfer to a server) the following information: application settings, date of terms acceptance, connection status, map cache data (14 days). We use secure encrypted storage for sensitive data.

12. Mobile Contacts

The application may request access to your mobile contacts exclusively for the selection of an emergency contact. The contact's details (name, phone number) are stored only locally on your device and are not transferred to our servers.

13. Protection of Minors

The application is intended exclusively for persons over 18 years of age. By using the application, you declare that you are at least 18 years old. We do not knowingly collect data of minors. If it is found that an account belongs to a minor, the account is immediately removed and its data is deleted. If you believe that a minor has created an account, contact us immediately at strifteroi@gmail.com.

14. Changes to the Policy

We may update this policy periodically. In the event of material changes, you will be notified via push notification and the application will request explicit acceptance again before continued use.

15. Contact