MotoCast — Privacy Policy

Last updated: 24 June 2026 · Version: Draft 1.0

1. Who we are

MotoCast ("MotoCast", "we", "us", "our") is a weather-intelligent motorcycle route planner and navigation app for the United Kingdom, available as an Android app on Google Play and as an installable web app at https://motocast-v2.vercel.app.

For the purposes of UK and EU data protection law, the data controller is:

• FILL IN — your full legal / trading name
• FILL IN — sole trader / limited company — and, if a company, company number and registered address
• Contact for privacy matters: admin@motocast.app
• ICO registration number: FILL IN — ICO registration number

Note on ICO registration. As a controller of personal data in the UK, you almost certainly need to be registered with the Information Commissioner's Office and pay the annual data protection fee (for a small operation this is typically the lowest tier). Register at https://ico.org.uk/registration and insert the reference here.

This policy explains what personal data we collect, why, what we do with it, who we share it with, how long we keep it, and the rights you have.

2. Which laws apply

We are based in the UK and the app is designed for riding in the UK. The processing of personal data described here is governed by:

• the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025; and
• the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, for information stored on or read from your device.

If you use the app while in the European Economic Area, or we are otherwise found to be offering the service to or monitoring people in the EEA, the EU GDPR also applies to that processing, and the equivalent EU rights in Section 12 are available to you. Personal data transferred from the EEA to us in the UK is covered by the European Commission's UK adequacy decision (renewed 19 December 2025).

3. Quick summary

4. The personal data we collect

We only collect what we need to run the features you use.

If you create an account or sign in

• Email address — for the magic-link sign-in, or the basic profile (name, email, Google account identifier) returned by Google sign-in on Android when you choose "Continue with Google".
• Your settings — units, ride-time window, weather limits, and an optional "home base" location if you choose to set one.
• Your saved items — saved routes, saved places, and "dream" rides (including an optional share token if you create a public link).

When you plan or navigate a ride (with or without an account)

• Location data — your device's location, with your permission, while you use those features (see Section 6). We do not store a location history.
• Route information — start, destination, waypoints and the route itself, which we process to return the map, weather scoring, suggested stops and turn-by-turn guidance.

Automatically, to keep the service working

• Anonymous usage events (e.g. "app started", "navigation started", "map edited") via our analytics tool, with no email or account ID attached (Section 7).
• Error and diagnostic data if the app crashes or errors — error messages, stack traces, breadcrumbs and basic technical request context (Section 7).
• Standard server logs generated by our hosting provider when your device contacts our servers (e.g. IP address, timestamp, the request made), used for security and reliability.

If you contact us

• The contents of your message and your contact details, so we can reply and keep a record.

We do not intentionally collect special category data (such as health or political opinions), and we ask you not to include it in free-text fields.

5. Why we use your data, and our lawful bases

Under UK and EU GDPR we must have a "lawful basis" for each use. Here is ours.

Where we rely on legitimate interests, we have considered your rights and interests and concluded our processing is proportionate and what you would reasonably expect. You can ask us for more detail, and you can object (Section 12).

We do not use your personal data for advertising, and we do not sell it.

6. Location data (please read)

Location is central to a navigation app, so we want to be clear.

• With your permission, your device location is used to show your position, plan and navigate routes, fetch the weather along your route, and find nearby fuel and speed cameras.
• To answer those requests, your live coordinates are sent to our routing provider (TomTom), our mapping and place-search provider (Stadia Maps) and our weather provider (Open-Meteo) for the moment the request is made.
• We do not keep a location history. The only location we store is your chosen "home base", and only if you set one in Settings.
• You can grant, limit or withdraw location permission at any time in your device settings. Some features won't work without it.

On Android, before location is used we show an in-app explanation and request your consent and the relevant runtime permission, as required by Google Play. You stay in control.

7. Information stored on your device, and analytics (cookies / PECR)

Like most apps, MotoCast stores small amounts of information on your device so it can work — for example to keep you signed in and to remember your settings. Under PECR (as amended by the DUAA in February 2026) we handle this as follows.

• Strictly necessary storage — needed to provide the app you've asked for (sign-in/session, remembering your selections) and to keep it secure and detect faults. This includes our crash and error reporting. No consent is required for these, and they cannot be switched off without breaking the app.
• Analytics for service improvement — we use PostHog purely to collect anonymous, aggregate statistics about how the app is used (e.g. which screens and features are used). It is configured for explicit-event capture only: autocapture, pageview/heatmap tracking, session recording and surveys are off, and we never link events to your email or account ID. Because this is used solely for statistical purposes to improve the service, it falls within the DUAA's PECR exemption from prior consent — but you still have a simple, free way to opt out: Settings → Privacy → Analytics. We will respect that choice.

We do not use advertising or cross-site tracking technologies of any kind.

Configuration detail (for transparency). PostHog: person_profiles: 'identified_only' with identify() never called, so no identifiable profile is created. Sentry: error monitoring only — no Session Replay, no performance/tracing (tracesSampleRate: 0), no profiling.

8. Who we share data with

We don't sell your data. We share it only with the service providers that make the app work, and only as needed. Most act as our processors (they handle data on our instructions); TripAdvisor acts as an independent recipient for the specific request.

We may also disclose personal data where we are legally required to (for example, to comply with a court order or a lawful request from an authority), or to establish, exercise or defend legal claims.

A current list of our sub-processors is available on request, and we will update this policy if we add a new one. (If you later add Firebase Cloud Messaging for push notifications, add it here with the device push token it processes.)

9. Sending data outside the UK / EEA (international transfers)

Some of our providers are based outside the UK (for example in the United States). When personal data is transferred outside the UK, we make sure it is protected by an approved safeguard, which will be one of:

• a UK adequacy decision for the destination country; or
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard permitted under UK GDPR, supported where appropriate by a transfer risk assessment under the DUAA "data protection test".

For transfers in scope of the EU GDPR, we rely on EU adequacy or the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular provider.

10. How long we keep your data

11. How we keep your data secure

• All traffic between the app and our servers uses encrypted (HTTPS) connections.
• The database enforces Row-Level Security, so each rider can only access their own records.
• Privileged keys (database service-role key, routing and TripAdvisor keys, the scheduler secret) are held server-side only and are never shipped to the browser or app.
• Access to systems is limited to what is necessary to operate the service.

No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to a service of this size. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO (and, where required, you) in line with our legal obligations.

12. Your rights

Under UK and EU GDPR you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability — receive certain data in a portable format;
• withdraw consent at any time where we rely on consent (this doesn't affect prior processing); and
• not be subject to solely automated decisions producing legal or similarly significant effects (we don't make such decisions).

To exercise any of these, contact us at admin@motocast.app. We will respond without undue delay and within one month. We may need to verify your identity first (which can pause the time limit), and we are only required to carry out a reasonable and proportionate search for your data. These rights are usually free; we may charge a reasonable fee or decline only where a request is manifestly unfounded or excessive.

You can also delete your account and data yourself at any time: Settings → Delete account → Delete permanently. This is irreversible. If you have uninstalled the app, see https://motocast-v2.vercel.app/account-deletion.html.

Complaints

If you're unhappy with how we've handled your personal data, please tell us first at admin@motocast.app so we can try to put it right. In line with the DUAA, we will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at https://ico.org.uk/make-a-complaint or 0303 123 1113. If you are in the EEA, you may instead complain to your local data protection authority.

13. Children

MotoCast is intended for adults (18+) who ride or plan motorcycle journeys. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Sharing a ride publicly

If you create a share link for a saved "dream" ride (/d/<token>), that page is public: anyone with the link can open it with no app and no login, and it shows the route map, the ride's name/description, the stops, and live TripAdvisor ratings/photos for those stops. The page is looked up by a random token and returns only safe public fields — never your account identifier or other personal data. Sharing is opt-in: you create the link, and you can stop sharing it at any time.

15. Changes to this policy

We may update this policy as the app and the law evolve. We'll change the "Last updated" date above and, for significant changes, bring it to your attention in the app. Please check back from time to time.

16. Contact us

• Privacy / data protection: admin@motocast.app
• General support: admin@motocast.app
• Controller: FILL IN — your full legal / trading name, FILL IN — registered address (only if a company)

MotoCast — Privacy Policy. This document is provided as a drafting aid and is not legal advice.