Privacy policy

Last updated: 25 October 2026

1. Who we are

RoadCom (“we”, “us”) is a free community app for car and motorcycle enthusiasts. The data controller is Robert-Gabriel Giolu (an individual), Barnet, London, UK. Contact: team@roadcom.co.uk.

2. What we collect

• Account details: email address, or your Apple or Google account ID and name if you sign in with them. Your password is handled by our sign-in provider and we never see it in plain text.
• Profile: display name, vehicle type (car or motorcycle), any social links (Instagram or TikTok) you choose to add, and an optional vehicle number plate. The number plate is optional personal data: if you add it, only you can see it. You can remove it at any time in your profile.
• Content you add: places (stops such as coffee shops), photo spots, routes, photos of your car or bike, comments, likes, saves and reports.
• Location: your device location is used on your phone only, while you use the map, to centre it on you and let you add places nearby. It is never sent to our servers or stored, and we do not track you in the background. (If you add a place, the place’s map position is saved as part of that place, but not where you were standing.)
• Contacts (optional): if you choose “find friends”, the email addresses in your phone contacts are turned into one-way hashed values on your device, and only those hashes are sent to our server to be matched against other users. We only show you people who already use RoadCom. We never receive your raw contact list or contact names. The hashes you send are used for that one lookup only and are then discarded: they are not saved or logged. We keep only a count of how many hashes you sent that day, for the abuse limit below. Hashed values are not anonymous, so we treat them as personal data. Matching is by email only, not phone numbers. Matches show only the username and display name of existing RoadCom users who have a confirmed email and have chosen to be found by contacts. To prevent abuse, each request is limited to 100 hashes and each person to 2,000 hashes per day. To make matching possible, our database compares the hashes it receives against hashes it calculates on the fly from account emails; we do not store a hash of your email. This is opt-in: “let others find me by contacts” is off by default, so others can find you through their contacts only if you turn it on in Edit profile, and you can turn it off again at any time.
• Technical data: your IP address and basic request logs held by our hosting providers, used to keep the app working and secure. We do not use analytics or advertising trackers.

3. Why we use it, and our legal basis (UK GDPR)

• To run your account and the app (contract).
• To show the map, places, photos and friends (contract).
• To suggest friends from your contacts (consent, which you can withdraw in your phone settings).
• To use your location (consent via the phone permission).
• To keep the app safe, handle reports and prevent abuse (legitimate interests).
• To meet legal obligations (legal obligation).

We do not sell your data and do not show third-party advertising.

4. Who we share it with

• Other users: your profile, linked socials and content you post are visible to other users as set in the app. Places and photos you add are public.
• Service providers: Supabase (database, sign-in and photo storage), Apple (Sign in with Apple, Apple Maps), Google (Sign in with Google, Google Maps on Android and route directions), Expo (app delivery and updates), Resend (sending sign-up and account emails). They process data only on our behalf.
• Authorities: if the law requires it.

5. International transfers

Some providers may process data outside the UK/EEA. Where they do, we rely on approved safeguards such as the UK International Data Transfer Addendum or adequacy rules. Our database is hosted by Supabase in Ireland.

6. How long we keep it

We keep your data while your account is open. When you delete your account we delete your profile, photos and personal data within 30 days. Comments and places may be removed or anonymised. Backups expire within 90 days. We may keep minimal records where the law requires.

7. Your rights

Under UK GDPR you can access, correct, delete, restrict or object to use of your data, move it to another service, and withdraw consent. Email team@roadcom.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

8. Deleting your account

In the app, open Profile, tap the gear button for Settings, then tap Delete account. You can also email us and we will do it for you. Full details are on the delete account page.

9. Children

RoadCom is not for anyone under 16. We do not knowingly collect data from children. If you think a child has an account, contact us.

10. Security

Data is encrypted in transit, and access is controlled by database security rules. No system is perfectly secure; we will tell you and the ICO about serious breaches as the law requires.

11. Changes

We will update this page and, for important changes, tell you in the app.