Privacy Policy

Last updated: 20 October 2026

1. About AcrossRide Group

AcrossRide Group is a mobile application designed to help motorcycle riders, cyclists, sailors and other groups organize journeys, communicate, share routes and coordinate group activities.

The application may also appear under the name RideLink Group in certain app versions or store listings.

This Privacy Policy explains how personal information is collected, used, stored, shared and protected when using the application.

Certain features and safeguards may depend on the installed application version and the activation of the relevant backend services.

Data Controller

Tobia Ciarulli
Independent Developer — AcrossRide Group
Switzerland

Privacy and Support:

2. Information We Collect

Depending on the functions used, AcrossRide Group may process:

• Account information: Firebase user identifiers and profile information.
• Trip information: Trip names, descriptions, invitation codes, organizers and participants.
• Communications: Chat messages, photographs, files and documents voluntarily shared by participants.
• Routes and itineraries: GPX files, stages and other trip-related information.
• Notification information: Device tokens required to send chat, SOS and trip notifications.
• Location information: Precise GPS coordinates when location sharing is enabled, together with authorized session information and timestamps.
• Technical information: Limited diagnostic, service and security information necessary to maintain and protect the application.

The information processed depends on the application’s functionality, user choices and applicable device permissions.

3. GPS, Consent and Live Tracking

GPS location sharing is voluntary.

AcrossRide Group requests the applicable Privacy/GPS consent and device permissions before enabling GPS sharing.

Accepting the Privacy Policy does not automatically activate location sharing. Users must explicitly activate GPS sharing using the ON control.

When GPS sharing is active, the user’s location is transmitted through the application’s services and made available to authorized participants of the same trip.

Depending on device permissions and operating-system restrictions, location updates may continue while the application is in the background or the device screen is off.

GPS OFF and revocation

Users can disable GPS sharing without leaving their trip.

When the server confirms that sharing has been disabled, authorization to publish the user’s position is revoked and the current shared location is removed from the realtime database.

If the device is offline or the network is unavailable, local tracking stops, but server-side revocation and removal may remain pending until confirmation.

The application does not treat an unconfirmed server revocation as completed.

GPS OFF does not remove previously received information, screenshots or copies independently retained by other devices.

Users can continue accessing supported trip features without actively sharing their GPS position.

The SOS, Active and Pause functions operate separately from GPS sharing. Sending an SOS does not automatically enable location sharing.

Authorized Access and GPS Sessions

GPS sharing is restricted through server-managed authorization.

Only appropriately authorized participants of an active trip may access shared locations.

Publishing GPS information requires the applicable authorization, valid consent and an active sharing session.

Authorization sessions may expire, be renewed or be revoked. Expired or revoked sessions are not permitted to publish new coordinates.

Removing a participant or closing a trip may trigger revocation and cleanup procedures, subject to the availability and activation of the applicable services.

Viewing the Live Map

Users may access supported trip and map functions even when their own GPS sharing is disabled.

Displaying the device’s local position is subject to applicable privacy consent and operating-system permissions.

Opening the Dashboard or Live Map does not automatically reactivate voluntary GPS sharing.

AcrossRide Group does not sell location information or use live GPS data for advertising or profiling.

4. How We Use Information

AcrossRide Group processes information to:

• Create, organize and manage group trips.
• Allow participants to join trips through invitation codes.
• Display authorized participants on the Live Map.
• Deliver chat messages, SOS alerts and trip notifications.
• Store routes, itineraries, GPX files and shared trip content.
• Maintain service reliability and protect against unauthorized access.
• Investigate technical problems and respond to support requests.
• Comply with applicable legal obligations.

Where the GDPR applies, the legal basis for processing depends on the purpose and may include performance of the service, consent for optional processing, legitimate interests in maintaining security and reliability, or compliance with legal obligations.

Information necessary to operate an account or requested feature may be required for that feature to function. Optional location sharing can be disabled through the available controls.

5. Data Storage and Service Providers

AcrossRide Group uses Google Firebase services, including:

• Firebase Authentication
• Cloud Firestore
• Firebase Realtime Database
• Firebase Cloud Storage
• Firebase Cloud Messaging

Google Maps services may also be used for mapping and navigation-related functions.

Information may be processed on infrastructure operated by these providers, including infrastructure located outside Switzerland or the user’s country of residence.

Applicable international data transfers are subject to the relevant legal requirements and the safeguards provided by the services concerned.

Technical service and security logs may be generated independently of trip records.

The updated application version described by the F01 privacy notice does not include the Firebase Crashlytics SDK. Other providers or previous application versions may nevertheless generate or retain technical diagnostic information.

6. Data Retention

Personal information is retained according to its purpose, applicable technical requirements and legal obligations.

Different categories of information may have different retention periods.

Live GPS information

Live GPS coordinates represent the current shared position and are not intended to constitute a permanent movement history.

When GPS sharing is disabled and the server confirms revocation, the current shared position is removed from the realtime database.

Residual coordinates associated with expired sessions may require periodic cleanup.

Certain timestamps and authorization information may be retained temporarily or separately for session management, security and inactivity calculations.

Trip Information

Trip records, messages, itineraries, stages and shared attachments may remain available after a trip ends.

The intended lifecycle provides for automatic trip closure after a defined period of verified inactivity and for deletion of trip-related information after a subsequent retention period.

These automated closure and deletion procedures are not currently enabled as general production retention guarantees.

In particular, automatic deletion exactly 30 days after trip closure must not be assumed until the relevant services have been activated and verified.

Trip deletion may also be requested or initiated through supported application procedures.

Technical and Security Records

Limited records may remain after trip data is deleted to support authorization security, prevent obsolete access permissions from being restored, document completed operations or investigate incomplete cleanup.

Such records may include trip and organizer identifiers, authorization state, version information, closure timestamps and references to relevant technical operations.

Some records do not currently have automatic expiration periods.

Technical logs, provider security records, migration receipts and deletion journals may have retention periods independent of trip information.

Attachments and Storage Recovery

Deleting trip information may include requesting removal of associated photographs, chat attachments and other files from Firebase Storage.

Incomplete removal operations may require further processing or retry.

Firebase Storage may retain deleted objects temporarily under its configured recovery or Soft Delete settings.

The storage configuration previously verified for the service included a seven-day recovery period after deletion. This setting may change and is not a guarantee that every file will always remain recoverable for exactly seven days.

Files downloaded, copied or independently retained by other participants cannot necessarily be deleted remotely.

7. Chat and Shared Content

Users may voluntarily share messages, photographs, documents and other information with participants in their trips.

Shared content may be accessible to authorized participants according to the applicable trip permissions.

Users should avoid sharing unnecessary sensitive personal information.

Content may remain available after a trip has ended, subject to the applicable retention and deletion procedures.

Users are responsible for the information they choose to share, in accordance with the Terms of Use and applicable law.

8. Notifications and SOS

AcrossRide Group may send notifications concerning:

• Group messages.
• SOS alerts.
• Participant activity.
• Trip-related events.

Notification permissions can be managed through the device settings.

The SOS function is intended to support communication and coordination between trip participants.

AcrossRide Group is not an emergency-response service.

SOS notifications do not guarantee immediate delivery, continuous connectivity, emergency-service intervention or successful assistance.

Users should contact the appropriate emergency services directly when necessary.

Sending or receiving an SOS does not automatically activate GPS sharing.

9. Data Sharing

AcrossRide Group does not sell personal information or location data.

Information may be shared with:

• Authorized participants of the relevant trip.
• Technical service providers necessary to operate the application.
• Competent authorities where disclosure is required by applicable law.

Location access and sharing remain subject to the application’s applicable authorization and consent controls.

10. Data Security

AcrossRide Group uses technical and organizational measures intended to protect personal information against unauthorized access, alteration, disclosure and loss.

These include server-managed GPS authorization, access controls, session management and revocation mechanisms.

However, no mobile application, internet service or electronic storage system can guarantee absolute security.

Users should protect their devices, account access and private trip invitation information.

11. Your Privacy Rights

Depending on applicable law, users may have the right to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Withdraw consent where processing is based on consent.
• Request restriction of, or object to, certain processing activities.
• Request data portability where applicable.
• Lodge a complaint with the relevant data protection authority.

Requests may be sent to:

Certain information may need to be retained where required for legal, security or legitimate operational reasons.

12. Account and Data Deletion

Users may request account deletion and deletion of related personal information by contacting:

Requests will be handled in accordance with applicable law and the relevant technical procedures.

Deletion of trip-related information may require separate operations affecting database records, user references, invitations, realtime information and stored attachments.

Incomplete deletion procedures may require further processing.

An operation is not considered technically complete until the required cleanup has been confirmed.

Certain minimal security records, provider-managed recovery information, technical logs or information independently retained by other users may remain subject to the limitations described in this Policy.

13. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes in application functionality, technical infrastructure, applicable law or privacy requirements.

Material changes may require an updated privacy notice or renewed consent where applicable.

The effective date will be published at the beginning of this Policy when the final version takes effect.

14. Contact and Data Controller

For questions concerning privacy, data protection, account deletion or personal information, contact:

Tobia Ciarulli
Independent Developer — AcrossRide Group
Switzerland

AcrossRide Group may also be identified as RideLink Group in certain application versions or store listings.