Hairpin · Legal
Privacy notice
This notice explains what personal data Hairpin processes, why, and what you can do about it. It covers the Hairpin app for Android, the web app at app.hairpinride.com and this website.
The short version
- We process what we need to plan your routes and read your rides back to you: your account, your rides and your routes.
- Your rides are yours. We never sell data, show ads or build profiles for anyone else.
- There is no tracking or analytics on this website or in the apps.
- A ride is recorded only when you start a recording.
- You can download your rides as GPX files and delete your account, with everything in it, whenever you like.
1. Who we are
The controller of your personal data is:
Vector Engineering Kft.
2483 Gárdony, Barabás Miklós u. 10., Hungary
Company registration number: 07-09-035496
EU VAT ID: HU32484522
Privacy questions and requests: privacy@hairpinride.com
Anything else: hello@hairpinride.com
More about the company in the legal notice.
2. What we process and why
Your account
- Data
- Username, email address, password (stored only as a salted hash), language and app settings, whether your email address is confirmed, and a profile picture if you add one.
- Why
- To create and run your account, sign you in and keep it secure, and to send you account emails: confirming your address and resetting your password. We don't send newsletters or marketing.
- Legal basis
- Performing our contract with you (GDPR Article 6(1)(b)).
- Kept
- Until you delete your account.
Your rides
- Data
- The recordings you start: precise location (GPS), time, speed and motion-sensor data from your phone and, if you connect one, a RaceBox; the phone model and app version that made the recording; photos you attach; and what we compute from them: corners, lean angles, coaching notes, ride statistics, the weather at the time and place names along the way.
- Why
- To show you your ride, read every corner back to you and track your progress. A ride is recorded only after you press Start, and your phone shows a notification for as long as it records.
- Legal basis
- Performing our contract with you (Article 6(1)(b)).
- Kept
- Until you delete the ride or your account.
Routes, places and your garage
- Data
- The stops and routes you plan and save, the places you save (such as Home) and the motorcycles you add to your garage: make, model, tyre sizes and fuel range.
- Why
- To plan routes, guide you along them and estimate where to stop for fuel.
- Legal basis
- Performing our contract with you (Article 6(1)(b)).
- Kept
- Until you delete them or your account.
AI analysis, only if you use it
- Data
- When you open the AI analysis of a ride or ask a question about it, we send a compact summary of that ride to our AI provider, Anthropic: corner statistics, the coaching verdicts and place names along the route, together with your question. We never send your raw GPS track, your photos, your email address or your name.
- Why
- To write the ride summary and answer your questions. The answers are advice about your riding; nothing is decided about you automatically.
- Legal basis
- Performing our contract with you (Article 6(1)(b)). Using it is your choice.
- Kept
- The analysis and the conversation stay with the ride until you delete it. Under its commercial terms, Anthropic may not use this data to train its models and deletes it after a short retention period.
Crash reports, only if you switch them on
- Data
- Technical details when the app crashes: app and Android version, phone model, the error and memory figures. No location track.
- Why
- To find and fix bugs.
- Legal basis
- Your consent, which you give by switching on Send crash reports in the app under Settings → Privacy & data (Article 6(1)(a)). Switch it off at any time.
- Kept
- Until the problem is fixed, and no longer than 12 months.
Security and abuse prevention
- Data
- Your IP address, browser or app details and the result of Cloudflare's bot check when you sign in, sign up or reset your password, and a count of recent attempts from each IP address.
- Why
- To keep bots and password guessing away from accounts.
- Legal basis
- Our legitimate interest in keeping the service and your account safe (Article 6(1)(f)).
- Kept
- Attempt counts are held in memory for up to an hour. We don't store IP addresses with your account.
This website
- Data
- hairpinride.com uses no tracking cookies, no analytics and no ads. Its one cookie, hp_lang, is set only when you pick English or Hungarian with the language switch, and remembers that choice for a year. Cloudflare, which hosts it, processes connection data such as your IP address to deliver the pages and protect them from attacks.
- Legal basis
- Our legitimate interest in running a secure website (Article 6(1)(f)).
3. What stays on your phone
Some things never reach our server:
- Offline maps and routing packs you download.
- Trails you import, such as Trans Euro Trail GPX files. They never leave your phone.
- The emergency contact for crash alerts. If an alert goes off, the text message with your location goes from your phone straight to that contact, not through us.
- The copy of your rides kept for offline viewing. It is removed when you sign out.
4. Who else handles data
Providers working for us
These providers process personal data on our behalf, under data processing terms:
- Cloudflare, Inc. (USA) hosts this website, carries the traffic between you and our server, runs the bot check and forwards email sent to @hairpinride.com addresses. Transfers to the USA rely on the EU–US Data Privacy Framework.
- Brevo (Sendinblue SAS, France) sends account emails: address confirmation and password reset.
- Anthropic, PBC (USA) writes the AI analysis, only when you use it. Transfers rely on the European Commission's standard contractual clauses.
Services our server asks
Our server sends these services only what the question needs. They see our server, not you or your account:
- OpenStreetMap Nominatim and komoot Photon: the place names you search for, and coordinates we turn into place names.
- Overpass API (OpenStreetMap data): fuel stations, speed limits, speed cameras and other places near a route or position.
- Open-Meteo: the weather at the time and place of a ride.
- Útinform (Hungarian Public Roads): road closures and roadworks. Nothing about you is sent.
Map images your device loads
As with any online map, your phone or browser loads map images directly from these services, so they see your device's IP address and the part of the map you are looking at: OpenFreeMap (street and dark maps), OpenTopoMap (terrain), Esri (satellite) and Amazon Web Services (elevation data for the trail map's hill shading).
We don't sell or rent personal data, and we pass it to nobody else unless the law requires it, for example a court order.
5. Where your data is stored
Your account and your rides are stored on our own server in Hungary, run by Vector Engineering Kft. Data leaves the European Economic Area only as described in section 4.
6. How long we keep data
- Your account and everything in it: until you delete it.
- A single ride, route, place, bike or photo: until you delete it.
- Links in account emails: 48 hours to confirm your address, 1 hour to reset your password.
- Backups: deleted data drops out of our backups within 30 days.
7. Deleting your account
You can delete your account at any time:
- in the Android app: Settings → Account → Delete account;
- in the web app at app.hairpinride.com: Profile → Delete account;
- or by writing to privacy@hairpinride.com from the email address on your account.
Deleting your account removes your profile and all your rides, routes, saved places, bikes, photos, AI conversations, crash reports and everything computed from them, immediately and for good. Copies in our backups expire within 30 days. Before you delete, you can download any ride as a GPX file.
8. Your rights
Under the GDPR you can ask us to:
- give you a copy of your data (access) and hand it over in a machine-readable format (portability). You can already download your rides as GPX files;
- correct it (rectification);
- delete it (erasure);
- restrict how we use it, or object to processing based on our legitimate interest;
- and you can withdraw your consent to crash reports at any time, without affecting what happened before.
Write to privacy@hairpinride.com. We answer within one month, free of charge. We may ask you to confirm who you are, usually by writing from your account's email address.
If you think we have got something wrong, please tell us first: we want to put it right. You also have the right to complain to the Hungarian data protection authority, or to the authority of the EU country where you live, and to go to court.
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Hungarian National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9–11., Hungary · Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400 · ugyfelszolgalat@naih.hu · naih.hu
9. Security
- All traffic to and from Hairpin is encrypted (HTTPS).
- Passwords are stored only as salted hashes.
- The app keeps its sign-in token encrypted on your phone.
- Each rider sees only their own rides. Our administrators open a ride only when that is needed to fix a problem with it.
10. Age limit
Hairpin is for riders aged 16 and over. We don't knowingly collect data from anyone younger. If you think a child has signed up, tell us and we will delete the account.
11. Changes to this notice
If we change this notice, we update it here and change the date at the top. If a change affects how we use your data, we tell you in the app or by email before it applies.