Privacy policy
Effective date: November 1, 2026
This policy explains what personal data Cornr collects when you use the Cornr app (iPhone and Android, including CarPlay and Android Auto) and the website ridecornr.com, why, who receives it, how long we keep it and what your rights are.
1. Who we are
Cornr is run by Bruno Passos, trading as Cornr, the controller of your personal data:
- Operator: Bruno Passos, trading as Cornr
- Address: Amsterdam, Netherlands
- Email: contact@ridecornr.com
- Website: ridecornr.com
For anything about your data, write to contact@ridecornr.com. That address is also our contact channel for riders in Brazil.
2. Summary
- We use your data to run Cornr: your account, your rides, your bikes, clubs and group rides, maps and weather.
- We do not sell your data and we do not show ads.
- Rides record your location only while a ride is recording.
- Other riders never see your speed in clubs, the feed or group rides, and the start and finish of your shared rides are hidden.
- The website uses Google Analytics only if you accept it in the cookie banner.
- You can switch off usage statistics and crash reports in the app, download or delete your data, and complain to a regulator.
3. What we collect and why
Account and profile
Your email address, your name, a password (stored only as a hash by our authentication provider) or your Google or Apple sign-in details, and what you add to your profile: display name, photo, and optional details such as date of birth, gender, location and riding style. We use it to create and run your account.
Your profile is public by default: other Cornr riders can find you and see your profile, the rides you share and your statistics. When you sign up, you choose whether other riders can see your new rides; you can change that at any time in Settings → Privacy & data. You can also make your profile private. Signed-out visitors cannot see profiles. Your date of birth and gender, if you give them, are visible only to you.
Bikes and gear
The motorcycles and gear you add: make, model, year, odometer readings, service, oil and tyre records, gear details, and, if you add them, your insurer and renewal date. We use this for your garage, service intervals and the reminders you switch on. We never pass insurance details to insurers or brokers. Gear and insurance details are visible only to you. Your bikes, with their photos, show on your public profile to signed-in riders.
When a motorcycle model is not yet in our service-interval catalogue, we ask an AI service (Anthropic) to look up the maker's published schedule. Only the make, model and year are sent, never anything about you.
Rides, location and motion sensors
While a ride is recording, the app collects your precise GPS position with timestamps, speed and altitude, and readings from your phone's motion sensors (accelerometer and gyroscope) from which it calculates lean angle, acceleration, braking and lateral forces. It stores these for every point of the ride and as a summary per ride, together with the weather at the time.
Location is also collected in the background (screen locked, another app open) while a ride is recording, so the whole ride is captured. It stops when you end or discard the ride. Outside a ride, the app uses your location only while it is open and you use a map, navigation or nearby features.
We use ride data to show your rides and statistics, for navigation, to match rides to routes so we can show how often a route is ridden, and for road statistics that combine many riders and identify no one.
Ride photos
Photos you add to a ride, with the time and place stored in the photo, are kept in private storage. Others can see a ride's photos only when the ride is shared; a ride you keep private keeps its photos private.
Clubs, chat and the feed
Club posts, comments, likes, photos, event RSVPs and event chat messages you write. Posts, photos and event chat in a club are visible to its members only. Public clubs, their member lists and their events can be seen by anyone, including people who are not signed in. Comments and likes on public rides are visible to anyone who can see the ride.
When a ride appears in the feed, a club or a shared ride view, the first and last kilometre of the route are removed, so the start and finish (often your home) are not shown. Rides shorter than 2 km show no map. Your speed is never shown to anyone but you. Other riders can see the distance, duration, start and end time, lean angle, acceleration, braking and the weather.
When you share a ride as an image from the app, the map in the image is drawn by Google Static Maps, which receives the route line without its first and last kilometre.
Group rides
During a group ride, your live position is sent to the other riders in the session about once per second. Live positions are not stored. Your speed is shared only as stopped, slow or riding. We keep who took part in the session (name and photo). When riders join an event at a meeting point, that join point is deleted one day after the event.
Live location link
If you switch on your live location link, anyone you give the link to can see where you are while you ride and the trail of the current ride. The trail is deleted automatically after 48 hours. While the link is on we keep your last known position; the page shows it for up to 3 hours. Switching the link off deletes the trail and the last position, and getting a new link makes the old one stop working.
Road reports
When you report police, a speed check, an accident or a traffic jam, we store the type, location, direction, country and time, linked to your account so the report can be voted on and abuse can be stopped. Other riders see the report without your name. Reports expire after 45 to 120 minutes and are deleted 7 days after they expire.
Notifications
If you allow notifications, we store your device's push token. There are three kinds:
- Service notifications: likes, comments, clubs, events and the reminders you set up.
- Riding nudges about your own riding and bikes (first ride, ride recap, milestones, weekend weather, bike checks). These are on by default and have their own switch in the notification settings.
- Offers and news (Cornr Pro, partner offers, new features). These are off until you switch them on.
For weekend-weather nudges we look up the forecast for the area you usually ride in, rounded to about 10 km.
Subscriptions and payments
If you buy Cornr Pro, we process your subscription status, the product, transaction and renewal status and the identifiers that link the purchase to your account. In the app, Apple (App Store) or Google (Google Play) takes the payment. On the website, payment goes through RevenueCat Web Billing, with Stripe as the payment processor; we pass RevenueCat your account id and email. Card details go straight to the payment provider; Cornr never sees or stores them. We keep purchase records as Dutch tax law requires.
Support requests
When you contact us through the support form or by email, we keep your email address, your message and, from the form, your app version and device, so we can answer.
AI ride poster
If you create an AI ride poster (a beta feature), the photo you pick, your bike's make and model, the approximate time of day of the ride and its weather are sent to Google's Gemini API to generate the background. No location or place names are sent. The finished poster is stored privately in your account.
Invite links and how you found Cornr
When you open an invite link (ridecornr.com/r/…), we record the invite code, time, the referring page, campaign tags in the link, browser family, operating system, device type, country and region, and a salted hash of your IP address that changes daily (to filter duplicate and automated clicks). We do not store the IP address. Two cookies (cornr_ref and cornr_click) keep the invite for 30 days so a later sign-up can be credited. On Android, the invite code can reach the app through the Google Play install referrer. When you sign up, we record how you found Cornr (invite, campaign or what you tell us) and your country. The rider who invited you may see that their invite was accepted.
Usage statistics and crash reports
The app records which features are used (for example "ride started" or "route saved"), with your account id, a random install id, a session id, your platform and app version. It never includes your location, your speed or your email. We use it, only within Cornr, to improve the app. The website counts a few steps the same way (subscription page viewed, checkout started, app-store button clicked), without cookies and without storing your IP address.
When the app crashes, Sentry receives a crash report (error details, device model, operating system, app version) without your account id or email. Sentry stores it in its EU data region (Germany). Any coordinates in a crash report are rounded to about 10 km.
You can switch off usage statistics and crash reports in the app under Settings → Privacy & data. These two choices apply to the phone you set them on.
We also record which app version each account runs (version, build, update channel), to know when old versions can be retired.
Brand programmes
If you join a brand programme (for example with a code from a dealer), we record your membership, your programme bike and your home dealer. The programme screen has two switches, both off until you turn them on:
- Service alerts: reminders from the programme about servicing your bike.
- Contact sharing: lets your home dealer receive your name and phone number to confirm service bookings, and see your bike's model and the genuine accessories you marked as fitted.
The brand itself receives nothing about you.
Website
- Cookies and browser storage: see the cookie list. Google Analytics runs only if you accept it; it receives page addresses without query strings and never runs on live location, presentation, partner or admin pages.
- Presentation pages that Cornr shares with partners count reading anonymously (a random id in your browser, time per slide, country and region, device type, browser family and the label of the link that was sent). No IP address is stored.
- Our hosting provider, Vercel, processes your IP address in short-lived server logs to deliver and protect the site.
4. Legal bases
| Purpose | Legal basis (GDPR) | Legal basis (LGPD) |
|---|---|---|
| Your account, rides, garage, clubs, group rides, live location link, road reports, navigation, maps and weather | Performance of our contract with you (Art. 6(1)(b)) | Performance of a contract (Art. 7, V) |
| Subscriptions and payments | Contract (Art. 6(1)(b)) | Contract (Art. 7, V) |
| Keeping purchase records | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 7, II) |
| Service notifications and riding nudges | Legitimate interest in a useful service (Art. 6(1)(f)); you can switch them off | Legitimate interest (Art. 7, IX) |
| Offers and news notifications | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Usage statistics and crash reports | Legitimate interest in a working, improving app (Art. 6(1)(f)); you can switch them off | Legitimate interest (Art. 7, IX) |
| Invite links and sign-up attribution | Legitimate interest in knowing which invites work (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Google Analytics on the website | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Sharing contact details with a brand programme | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| AI ride poster | Contract: you ask us to make it (Art. 6(1)(b)) | Contract (Art. 7, V) |
| Support requests | Contract and legitimate interest (Art. 6(1)(b) and (f)) | Contract and legitimate interest (Art. 7, V and IX) |
| Security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
Where we rely on legitimate interest, you may object at any time (see section 9). Where we rely on consent, you may withdraw it at any time; that does not affect what happened before.
We make no decisions about you by automated means that have legal or similarly significant effects. Scores, rankings and route suggestions are calculated automatically but have no such effect.
5. Who receives your data
We use service providers who process data for us under a data processing agreement, and only for what we ask. Some are based outside the European Economic Area (see section 6).
| Recipient | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, live updates, server functions | EU (Ireland); Supabase Inc. is a US company |
| Vercel | Website hosting and server functions | Servers in the EU (Dublin); Vercel Inc. is a US company |
| Sentry | Crash reports, without account id | EU data region (Germany); Functional Software Inc. is a US company |
| RevenueCat | Subscription management, app and web | USA |
| Stripe (through RevenueCat Web Billing) | Card payments on the website | EU and USA |
| Apple | App Store purchases, Sign in with Apple, push notifications on iPhone | EU (Ireland) and USA |
| Google Play purchases, Google sign-in, push notifications on Android, Google Maps and Places (map display, place search, share images), Gemini (AI ride poster), Google Analytics (website, only with consent) | EU (Ireland) and USA | |
| Expo | Delivering push notifications and app updates | USA |
| Mapbox | Maps, navigation, directions, search and address lookup: receives the coordinates and searches needed for each request | USA |
| Open-Meteo | Weather forecasts: receives the coordinates of the place or route asked about | EU |
| OpenStreetMap (Overpass), VersaTiles, OpenStreetMap tile servers | Points of interest along a route (receives sampled route coordinates), and map tiles on the website (receives your IP address and the map area shown) | EU and UK |
| Resend | Sending emails (account emails, support) | USA |
| Anthropic | Looking up service intervals: receives only make, model and year, no personal data | USA |
We also share data when the law requires it, for example with a court or the police under a valid legal order, and with a buyer if Cornr is ever sold, under this policy.
App versions 2.3.3 and older
App versions 2.3.3 and older also sent usage events and your account id to Google Firebase Analytics and to Airbridge (an install-attribution service), asked iPhone users for permission to use the advertising identifier, and passed device identifiers to RevenueCat. Newer versions do none of this. Please update the app.
6. International transfers
Your data is stored in the EU. When a provider outside the EEA processes it, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses. For data that leaves Brazil, we rely on the ANPD's standard contractual clauses. You can ask us for a copy of the safeguards at contact@ridecornr.com.
7. How long we keep data
| Data | How long |
|---|---|
| Account, profile, bikes, gear, rides, photos, posts and comments | Until you delete them or your account |
| Live location trail | 48 hours; your last position while the link is on |
| Group ride live positions | Not stored |
| Event join points | Deleted one day after the event |
| Road reports | Deleted 7 days after they expire |
| Usage statistics (app and website) | Kept; after 14 months anything that identifies you is removed |
| Invite clicks and sign-up attribution | Kept; after 13 months anything that identifies you is removed |
| Presentation reading statistics | Kept; after 24 months anything that identifies you is removed |
| Support requests | Kept; after 24 months your email is removed and the message stays |
| Record of your privacy choices | As long as your account exists |
| Crash reports (Sentry) | 90 days |
| Purchase records | 7 years (Dutch tax law) |
| Cookies | See the cookie list |
When you delete your account, we delete your account and the data linked to it, including your photos and other files. Purchase records are kept, as the law requires, without anything that links them to you. Backups are overwritten within a few weeks.
8. Security
Data travels encrypted (HTTPS). Database access rules make sure riders reach only what they may see, and only the people who run Cornr can reach the systems behind it. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the regulator as the law requires.
9. Your rights
You can:
- see the data we hold about you (access);
- correct it (most of it directly in the app or on the website);
- delete it, or your whole account (in the app under Profile → Account settings → Delete account, or on the website under Account);
- restrict how we use it while a question is open;
- object to use based on legitimate interest, such as usage statistics, crash reports and riding nudges (switches in the app, or by email);
- get your data in a machine-readable format (portability);
- withdraw consent at any time (cookie settings on the website, notification settings in the app).
To get a copy of your data, use "Download my data" in the app's privacy settings or email contact@ridecornr.com. You can export single rides as GPX from the app.
We answer within one month (we may extend this by two months for complex requests and will tell you why). We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, please tell us first. You can also complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens, in Brazil the ANPD, or the authority where you live or work.
10. Riders in Brazil (LGPD)
The Lei Geral de Proteção de Dados applies to riders in Brazil. Bruno Passos, trading as Cornr is the controller. The legal bases are in section 4. Under Article 18 of the LGPD you can ask us to confirm that we process your data, to access, correct, anonymise, block or delete it, to port it, to know who we share it with, to know the consequences of not consenting, and to withdraw consent. We answer a request for a complete copy of your data within 15 days. Write to contact@ridecornr.com; you can also petition the ANPD.
11. Age
Cornr is for people aged 16 and over. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 16, we delete it.
12. Changes to this policy
When we change this policy, we update the effective date at the top. We announce important changes in the app or by email before they take effect.