Privacy Policy
Last updated: June 21, 2026
Carve Roads ("the app", "we") is a social app for driving enthusiasts to record, share and discover driving routes. This policy explains what data we collect, why, the legal basis for it, and what your rights are.
Who we are
The data controller responsible for your personal data is Juan M. Fajardo. For any question about this policy or your data, contact us at [email protected].
Data we collect
- Account — email address and the profile you create (username, name, bio, location, avatar).
- Routes — GPS traces you record (coordinates, speed, altitude, timestamps) and the metadata you add (title, description, photos, tags, car). You choose each route's visibility: public, followers or private.
- Garage — cars and car photos you add.
- Social activity — follows, likes, comments, blocks and reports.
- Device — a push notification token, if you grant permission.
- Usage analytics — anonymous product events (screens, feature usage) processed by PostHog on EU servers.
- Waitlist — if you join the beta waitlist on this website, your email address, used solely to send the invite.
Location data
Location is only recorded while you are actively recording a drive, including in the background so the trace survives screen-off. Recording stops when you stop it. We never track your location outside an active recording.
How we use it
- To provide the service: store and display your routes, profile and social activity to the audiences you choose.
- To send notifications you'd expect (likes, comments, follows) if you enable them.
- To keep the platform safe: reported content is reviewed with the help of automated moderation and by our team.
- To improve the product, using aggregated, anonymous analytics.
We do not sell your data. We do not show ads.
Legal basis
Under the GDPR we rely on the following legal bases to process your data:
- Performance of a contract — your account, profile, routes and social features. Without this data the app cannot work.
- Your consent — recording your location, sending push notifications and usage analytics. You can withdraw consent at any time from the app or your device settings, without affecting processing already carried out.
- Our legitimate interests — keeping the platform safe (reviewing reports, moderation, blocks) and securing the service, balanced against your rights and freedoms.
- Legal obligations — where the law requires us to retain or disclose data.
Moderation is assisted by automated tools but reviewed by our team: we do not make decisions with legal or similarly significant effects about you based solely on automated processing.
Where it lives
Data is stored with Supabase (database, storage, authentication). Maps are rendered by Mapbox. Push notifications are delivered through Expo. Analytics by PostHog (EU). Automated moderation uses Anthropic's Claude — only reported content is sent for review. Account emails (sign-up confirmation, password reset, email change) are sent via Resend (EU). When you view the weather on one of your routes, the coordinates and times of that route are sent to Open-Meteo to fetch historical conditions — no account information is shared with it.
International transfers
Some of these providers may process data outside the European Economic Area (for example in the United States), including Supabase, Expo, Mapbox and Anthropic; PostHog and Resend operate within the EU. Where data leaves the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
Retention & deletion
Your data is kept while your account exists. You can delete your account at any time from Profile inside the app — this permanently removes your account and all associated data (routes, photos, comments, social activity) from our servers. Waitlist emails are deleted after the beta ends.
Your rights
Under the GDPR and equivalent laws you have the right to access, rectify, port, erase, restrict or object to the processing of your data, and to withdraw consent at any time. Most of this you can do directly in the app; for anything else, email us at [email protected].
You also have the right to lodge a complaint with your data protection authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es).
Children
Carve Roads is not intended for children under 16, or the minimum age of digital consent in your country. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.