Privacy policy

RidePulse is made and operated by Bitfuzed (PVT) LTD (“BitFuzed”, “we”, “us”). This policy covers the RidePulse app on Android and iPhone and this website, and explains what happens to your information.

1. What stays on your phone

RidePulse keeps these in storage on your phone, where only the app can read them:

• Raw recordings. During a test the app reads the phone’s accelerometer and gyroscope many times a second, and GPS once a second for speed and position. It saves these readings, compressed, so it can work out your results and show them again later.
• Your garage and history. The cars you add (make, model, year, tyre size, odometer readings, a nickname and any notes), your runs, their scores, findings and charts, and your settings.
• Phone calibration. A short measurement of your phone’s sensor noise, taken with the phone flat on a table.

You can export a copy of your own data as JSON and CSV files at any time (Settings → Your data → Export). The export is made on your phone.

Even as a guest, the app downloads public information from our server: updates to the vehicle catalogue, and comparison statistics for a car model. To ask for a comparison it sends the model, tyre size, test type and phone placement, but no account, car or run ID. Your own result is placed among those statistics on your phone.

2. Data sharing levels

You decide how much leaves your phone. When you create an account you pick a level, and you can change it at any time in Settings → Data sharing. Private backup is selected unless you choose otherwise.

Lowering your level stops uploads at the higher level from then on. Statistics already worked out from earlier uploads stay, because they can’t be traced back to you. Deleting a run in the app also deletes its road events, road passes and raw recording from our server. To remove everything you shared, delete your account or write to us.

3. Your account

Signing in is optional. You can sign in with Google, with Apple, or with an email address and password. We use Firebase Authentication, a Google service, to run sign-in. It keeps your email address, a user ID, the sign-in method and, with Google, your Google account’s name and profile picture. With Sign in with Apple you choose what Apple shares; if you pick Hide My Email, we get a private relay address from Apple. Firebase stores email passwords in a form nobody can read back, including us.

Our server keeps, under your user ID: the date the account was created, a display name if your sign-in gives one, the country your phone is set to (to group statistics by market) and your data sharing level.

4. Backup (every signed-in account)

While you’re signed in, the app backs up your data to our server so it comes back on a new phone and after you sign out and in again. The backup holds:

• Your cars: make, model, generation, engine, fuel, year, tyre size, odometer reading, nickname and any modification notes you type.
• Your phones: platform, model, operating system version, the fastest sensor rate the phone reports, and its calibration.
• Your runs: test type, where the phone was placed, the date and time, how long it took, the sensor rate, the odometer reading, quality notes (for example “the phone moved”), the app and analysis versions, and whether you let the run count toward comparisons.
• Results: comfort and idle scores, vibration levels per direction, frequency peaks and bands, the cabin noise level if you measured it, and findings.

The backup contains no location and no raw recordings. It’s stored on Cloudflare under your user ID. Our server is the only way to reach it, and it only ever returns your rows to your signed-in account. We don’t look at backed-up data, except when you ask us to help with a problem.

If a backup fails, the app says so in Settings. Signing out first makes sure everything is backed up, then removes your data from the phone; signing in again brings it back.

5. Shared metrics and the road map (“Share anonymous metrics” and above)

Comparisons

Results from runs you let count toward comparisons are combined with other cars of the same make, model, generation and engine into percentiles (for example, the middle value and the range of the smoothest and roughest 10%). Each car counts once, using the middle of its recent runs. A group is only shown when at least 20 different cars are in it. Other users see only these group statistics, never your car, your runs or your account.

Road events and road passes

After a drive, the app uploads two kinds of road data:

• Road events: a sharp bump such as a pothole, with its position, how hard the hit was, your speed and the time.
• Road passes: for each stretch of road, the square of roughly 150 × 150 m you drove through, your direction, speed band, how rough it felt and the time.

Before anything is uploaded, your phone removes the first and last 300 m of every drive, so the places where drives usually start and end, such as home and work, aren’t sent. The rows are stored with your user ID and the run they came from, so we can delete them with your account, and they are never shown to anyone one by one. Every night our server combines them into the public road map, which shows only road squares measured by at least 5 different cars and potholes reported by at least 3 different people. The individual rows are deleted after 12 months, once they are part of the map.

Uploads at this level carry a Firebase App Check token (section 10), so that scripts can’t fill the shared statistics with fake data.

6. Raw recordings (“Share metrics and raw data” only)

At this level the app also uploads the raw recording of each run’s motion sensors (accelerometer and gyroscope readings), compressed. Raw recordings don’t include your GPS position. They are stored on Cloudflare under your user ID and used only to test and improve how RidePulse analyses vibration. We keep them until you delete your account or ask us to delete them.

7. Location

• During tests, the app uses GPS for your speed (the steady-speed and braking tests, and to check the car is parked for the idle test) and to place road events and road passes. It asks for location access while you use the app before the first test that needs it.
• Automatic drive recording is an optional feature that is off until you turn it on. It notices when you start driving using your phone’s activity recognition (“Physical activity” on Android, “Motion & Fitness” on iPhone) and records the drive in the background, so it needs location access “all the time”. On Android a notification shows while it records. You can turn it off at any time in the app or remove the permission in your phone’s settings. Activity recognition results stay on your phone.
• Location only leaves your phone as the road events and road passes in section 5, and only at the “Share anonymous metrics” level or above. As a guest or with a private backup, your location stays on your phone.

8. Microphone (optional)

If you turn on the cabin noise score, the app uses the microphone during steady-speed tests to measure how loud the cabin is, in decibels. The sound itself is never recorded, stored or sent anywhere: only the noise level (a number) is kept with the run, and in your backup if you have one. The app works fully without microphone access.

9. Purchases

RidePulse Pro (a monthly or yearly subscription) and the single pre-purchase check report are sold and billed by Google Play or the App Store. We never see your name on the store account, your card or your payment details.

When you buy or restore, the app sends our server the store’s proof of purchase (Google Play’s purchase token or the App Store’s signed transaction) and a random identifier for this installation. Buying never needs an account. If you’re signed in, the app also sends your sign-in token, and the purchase is linked to your account so Pro works on your other phones too. The server checks the purchase with Google Play or Apple and keeps: which product it is, when it ends, whether it’s in a trial, the App Store transaction ID or a fingerprint of the Google Play token (with the token itself, so it can check renewals and refunds), the installation identifiers it was checked on, and the user ID it’s linked to. Google Play and Apple tell our server when a subscription renews, ends or is refunded.

Signing out removes account-linked Pro from that phone; a subscription paid for by the phone’s own store account keeps working on it. Another account signed in on the same phone doesn’t get your Pro.

10. App Check, crash reports and usage statistics

• Firebase App Check uses Google Play Integrity (Android) or Apple’s App Attest (iPhone) to confirm that uploads come from a genuine copy of RidePulse on a real device. Google or Apple check the app and device for this; our server receives only a token that says whether the check passed.
• Firebase Crashlytics reports crashes and errors with technical details: the phone model, operating system version, app version, an installation identifier and the error itself.
• Firebase Analytics records how the app is used, for example which screens are opened, which tests are started and finished, whether a purchase screen was opened and from where, and purchases started and completed (the product and price), with the phone model, operating system version, app version, approximate country and an app-instance identifier.

Crashlytics and Analytics run only in copies of the app installed from Google Play or the App Store, not in test builds. They don’t include your location, your recordings, your car details or your email address. Firebase doesn’t collect your phone’s advertising ID, and nothing it records is used for advertising.

11. Measuring our ads (Meta)

We advertise RidePulse on Facebook and Instagram. To learn which ads bring people in, the app includes Meta’s App Events SDK, run by Meta Platforms. It sends Meta:

• that the app was installed and opened;
• purchases of RidePulse Pro (including the start of a free trial) and of the pre-purchase report (the product, price and currency, from Google Play or the App Store);
• device details such as the phone model, operating system, app version, language and IP address, and on Android only your phone’s advertising ID.

It never sends anything about your cars, runs, results, recordings or location, and no name, email address, user ID or sign-in. On iPhone the app never asks to track you and doesn’t collect the advertising identifier (IDFA); Meta counts installs through Apple’s SKAdNetwork, which doesn’t identify you. Only copies installed from Google Play or the App Store send anything, not test builds.

You can turn this off at any time in Settings → Your data → Share installs with Meta; from then on the app sends Meta nothing. On Android you can also reset or delete your advertising ID in your phone’s settings. Meta uses this information under its own privacy policy, which includes using it to measure and improve ads.

12. Other technical information

• Connections. Our server runs on Cloudflare, which receives the IP address of every request, as any website does. We don’t store IP addresses with your data.
• Daily limits. To stop abuse, our server counts uploads per account per day.
• Vehicle suggestions. If you suggest a car that’s missing from the catalogue, we keep the suggestion with your user ID until it has been reviewed and added.
• Maps. When you open the road map, the app loads map pictures from MapTiler, which receives your IP address and the area of the map you’re looking at, and asks our server for the road quality in that area without saying who you are.

13. This website

This website is hosted on Firebase Hosting, a Google service, which receives your IP address to serve the pages. It uses no cookies, no analytics and no tracking.

14. If you contact us

If you write to us, we keep your email address and message to answer you and to help with similar questions.

15. What we don’t do

• No ads in the app. On iPhone the app never asks to track you and doesn’t use the advertising identifier; on Android the only use of the advertising ID is the Meta ad measurement in section 11, which you can turn off.
• We don’t sell or rent your information, and your cars, runs, results, recordings and location are never shared for marketing or advertising.
• We never show your individual runs, road events or location to other users.

16. Who processes your information for us

They process information only to provide these services to us. Your information may therefore be processed outside the country where you live, under the safeguards these providers offer (such as the European Commission’s standard contractual clauses).

17. Why we use your information (legal bases)

Where laws such as the EU and UK GDPR apply: we run your account, your backup and your purchases because you asked us to (performance of a contract). We use shared metrics, road data, raw recordings, background location and the microphone because you turned them on (consent, which you can withdraw at any time in the app). We use crash reports, usage statistics, App Check and daily limits to keep RidePulse working, secure and fair (legitimate interests). We measure our ads with Meta (section 11) because we have a legitimate interest in knowing which ads work; you can object at any time with the “Share installs with Meta” switch. We keep purchase records as the law requires.

18. How long we keep it

• On your phone: until you delete it in the app, sign out (after it’s backed up) or uninstall the app.
• Your account and backup: until you delete your account.
• Road events and road passes: 12 months, then deleted. The road map and comparison statistics made from them are kept, because they can’t be traced back to anyone.
• Raw recordings: until you delete your account or ask us to delete them.
• Purchase records: while the purchase is active and for as long as needed for refunds and the law; their link to your account is removed when you delete it.
• Crash reports: 90 days. Usage statistics: up to 14 months.
• What Meta receives for ad measurement (section 11): kept by Meta under its own privacy policy.

19. Deleting your account

In the app, open Settings → Account → Delete account. You confirm it’s you first (with Apple, Google or your password). We then delete your rows from both of our databases (your backup, your road events and road passes, and your account details), your raw recordings, the link between your purchases and your account, and your Firebase sign-in account, and the app wipes your data from the phone. Statistics already combined from many cars remain, because they can’t be traced back to you. See how to delete your account, including by email. Deleting your account doesn’t cancel a subscription: cancel it in your Google Play or App Store account.

20. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your information, to object to or restrict how we use it, and to withdraw consent. You can export your data in the app (Settings → Your data → Export), change your sharing level, and delete your account yourself. For anything else, write to contact@bitfuzed.com and we’ll answer within 30 days. You can also complain to your local data protection authority. We don’t sell personal information. Sending app opens, purchases and (on Android) the advertising ID to Meta to measure our ads may count as “sharing” for cross-context behavioral advertising under California law; you can opt out at any time with the “Share installs with Meta” switch in the app’s Settings.

21. Children

RidePulse isn’t directed at children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, write to us and we’ll delete it.

22. Security

Everything travels over encrypted connections. Nobody can read our databases directly: our server checks every request’s sign-in and only returns an account’s own rows. Purchase tokens stay on our server, and access to our systems is limited to the people who run RidePulse.

23. Changes

If this policy changes, we’ll update the date above and, for significant changes, tell you in the app before they take effect.

24. Contact

Bitfuzed (PVT) LTD · contact@bitfuzed.com