Draft — under review

Privacy policy

Effective [EFFECTIVE DATE]

NextBend records your motorcycle journeys. That means it handles your location, so this policy says plainly what the app and our server collect, why, where it is kept, for how long, and what you can do about it.

• No ads
• No selling your data
• No tracking across apps

Who we are

NextBend is run by [LEGAL NAME / ADDRESS] (“NextBend”, “we”, “us”). We decide how your data is used, which makes us the data fiduciary under India’s Digital Personal Data Protection Act, 2023. This policy covers the NextBend iPhone app, our server at api.nextbend.app and this website. NextBend is in a private alpha, so the app changes often; we keep this policy in step with it.

What we collect

Your account (only if you sign in)

Signing in is optional. Without an account, your journeys stay only on your phone. If you sign in:

• Sign in with Apple: your Apple user ID, your email address if Apple shares one (this may be a private relay address from Hide My Email), and your name, which Apple shares only the first time you sign in.
• Sign in with Google: your Google user ID, email address, name and a link to your profile picture.
• We keep your display name (you can change it in the app), your email address and which sign-in methods are linked to your account.
• For Sign in with Apple we also keep a token from Apple, encrypted, so we can revoke NextBend’s access to your Apple ID when you delete your account.
• To keep you signed in we store only hashed (unreadable) versions of your sign-in tokens, never the tokens themselves.

Location and journeys

• Only while you record. The app uses GPS only while a journey is being recorded. If you allow “Always”, it keeps recording while the phone is locked or the app is in the background, and it can restart recording if iOS closes the app mid-journey. While a journey is paused it watches for larger movements (an area of about 150 m and iOS “significant location changes”) so it can resume. When no journey is active, the app doesn’t use your location.
• Your route. Each location reading: latitude, longitude, altitude, accuracy, speed, heading and time — including readings the app rejects as inaccurate — and where any gap in the signal started and ended.
• The journey. Its title, start and end times, distance, moving time, why it paused, whether you rode or were a pillion, and which bike you rode.
• Stops. Where and when you stopped, the kind of stop (fuel, food, stay, view or break) and the nearby place chosen for it (its Google place ID, name, type and distance).
• Place suggestions. To suggest a place for a stop, the app sends the stop’s location (a point and a 100 m radius) from your phone directly to Google Places. This happens only while the app is open.
• Maps and Google sign-in. Maps in the app are drawn by the Google Maps SDK, which connects to Google from your phone. Google’s Maps and Sign-In SDKs also collect some device, usage and diagnostic data for Google’s own purposes, as described in Google’s privacy policy.

Everything is saved on your phone first and uploaded to your account when you are signed in and online.

Your bikes

Make, model, nickname, year, tank size, whether you own, rent or borrow it, and its status (main bike, sold or archived). The app doesn’t take or upload photos of your bikes.

Device and diagnostics

• Device: your iPhone model (for example “iPhone17,1”), iOS version, app version and a device identifier. The identifier is Apple’s “identifier for vendor”, which is specific to our app on your phone; it is not the advertising identifier.
• Battery and device state: battery level, whether it is charging, Low Power Mode and the phone’s thermal state, sampled while the app is running (also outside journeys), so we can keep battery use low.
• Diagnostic events: what the app and the recording did — for example the app opening or closing, permission changes, recording pausing or resuming, and upload results. Some events include a location. They never contain your email address or sign-in tokens.
• Ride reports: a technical summary of how each journey was recorded.
• Crash and error reports from the app and our server, sent to Sentry. They are scrubbed before they leave: no email addresses, sign-in tokens or screenshots, and you are identified only by your account ID.
• Server logs: when the app talks to our server, the server logs the request, including your IP address, device identifier, account ID and the app’s user agent.

When you contact us

Your email address and whatever you write to us.

What we don’t collect

• No advertising identifier, no tracking across other companies’ apps or websites, and no advertising or analytics SDKs of our own in the app.
• No access to your contacts, photos, camera, microphone or health data.
• This website sets no cookies and runs no analytics or trackers. Our web host processes the usual request data (such as your IP address) to deliver the pages.

Why we use it

• To run NextBend: record, store and sync your journeys and stops, show your garage and each bike’s history, and sign you in.
• To suggest places for your stops.
• To make recording reliable and keep battery use low: battery samples, diagnostic events and ride reports.
• To fix problems: crash and error reports, and server logs.
• To keep your account secure: sign-in sessions, the device identifier and server logs.
• To reply to you when you write to us, including alpha invitations.

We use your data only for these purposes. We don’t use it for advertising, we don’t sell it, and we don’t share it with data brokers. If we ever want to use it for something new, we will ask you first.

Who processes it, and where

Your account and journey data is stored on servers in Mumbai, India (Amazon Web Services, region ap-south-1). These companies process data for us:

Crash reports sent to Sentry, and data handled by Google and Apple, may be processed outside India. We don’t share your data with anyone else, unless the law requires us to.

How long we keep it

• Your account, journeys, stops, bikes, events, battery samples and ride reports: until you delete your account. Journeys and stops you delete in the app are hidden straight away and removed for good when the account is deleted. Bikes you delete keep their place in the history of journeys ridden on them until then.
• When you delete your account: it is removed from our database immediately. Copies in our daily backups are deleted automatically after 14 days, so everything is gone within 15 days.
• Device record: after an account is deleted, a record of the device remains — its model, iOS and app version, device identifier and when it was last seen — no longer linked to you or to any account.
• Server logs: kept for a limited time and overwritten as new logs come in.
• Crash and error reports: kept by Sentry for a limited period, then deleted automatically.
• Emails to us: as long as we need them to help you.
• On your phone: until you sign out (which clears your account’s data from the phone) or delete the app. Journeys recorded without an account stay on the phone until you delete them or the app.

Your choices and rights

• Location: change NextBend’s location permission at any time in iOS Settings. “Always” is optional; without it, recording may stop if iOS closes the app.
• See and export your data: share any journey from the app as a GPX file or a JSON report. For a full export of your account (account details, bikes and every journey with its GPX track), email us.
• Correct it: change your name, bikes and journey titles in the app. Email us for anything else.
• Delete it: you can delete your account and everything in it — see Delete your account.
• Withdraw consent: stop recording, turn off location access, or delete your account. Withdrawing consent doesn’t affect what we did with your data before.
• Ask or complain: write to us at [CONTACT EMAIL].

Security

Everything between the app and our server travels over HTTPS. Sign-in tokens are stored hashed, the Apple token is encrypted, and our database isn’t reachable from the internet. On your phone, sign-in tokens are kept in the iOS Keychain and journey data in the app’s private storage, protected by iOS data protection. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Under 18s

NextBend is not for anyone under 18. We don’t knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.

India’s DPDP Act

Under the Digital Personal Data Protection Act, 2023:

• Consent: you give consent when you sign in and when you allow location access in iOS, for the purposes listed in Why we use it. You can withdraw it at any time as described above.
• Purpose limitation: we use your data only for those purposes, and keep it only as long as described in How long we keep it.
• Your rights: to get a summary of your data and how it is used, to have it corrected, completed or erased, to have your grievances addressed, and to nominate someone to exercise these rights if you die or can’t act yourself.
• Grievances: contact our grievance officer at [CONTACT EMAIL]. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Changes

When this policy changes we will update the effective date above. If a change matters, we will tell you in the app or by email before it applies.

Contact

[LEGAL NAME / ADDRESS]
Email: [CONTACT EMAIL]