Privacy Policy

1. Who we are

The controller of your personal data is VALICO, Italy. For anything about this policy, write to legal@valicopassport.com.

2. In short

• We use your data to run VALICO for you: your account, your passport and visas, rides, the points riders add to the map, and challenges.
• We never keep the route you ride. Automatic check-in stays off until you turn it on.
• Other riders see only what you publish: a ride, with your first name and the initial of your last name, or a point on the map, without your name.
• No advertising, no tracking across apps and websites, no analytics tools of our own, and we never sell your data. The map software in the app sends usage data to Mapbox (see Who receives data).
• You can delete your account at any time: in the app, Settings › Delete account, or by writing to us (see Your rights).

3. Your account

You sign in to VALICO with your e-mail address and a password, with Apple or with Google, and you can connect more than one of these to the same account.

• E-mail: your address and your password. The password is stored only as a hash, which nobody at VALICO can read. We send e-mails to confirm your address and to reset your password, and a notice when your password or your address changes.
• Sign in with Apple: Apple gives us an identifier for your account and an e-mail address, which may be a private address that forwards to yours (Hide My Email).
• Sign in with Google: Google gives us an identifier, your e-mail address, your name and your profile picture. If your passport has no photo yet, VALICO makes the card portrait from that picture (see Your passport); you can replace it at any time.

To protect your account, our backend also records technical details of each sign-in: the time, the IP address and the app or browser used.

4. Your passport

Your VALICO passport holds your first and last name, date of birth, gender, place of birth and country, and, if you add them, your home city and a photo. We also keep the language you chose for the app.

• The details printed on the passport can be saved once. After that they are locked, because your visas rest on them; if something is wrong, write to us and we will correct it.
• Your date of birth tells the app whether you are 18 or older, as organising rides and adding or confirming points on the map require (see Children).
• The photo is one you choose from your photos. Our server turns it into the black-and-white portrait and the thin band printed on the card, and keeps only those two images, not the photo you chose. The portrait is not shown to other riders, and we do not use it to recognise faces.
• Other riders cannot see your passport or your visas, unless you share an image of them.

5. Visas

For every pass or road you collect, we keep the visa: which pass or road, when, and how you got it: declared by you (I RODE IT), or verified by a GPS check-in or a GPX recording, with the proof behind it (see Location and GPX files). You can remove a declared visa yourself. A verified visa rests on a proof, so only VALICO can remove it: write to us if you want one removed.

6. Location

VALICO uses your phone's location for what the app does for you, and never keeps the route you ride. The map software in the app also sends Mapbox technical data that can include your device's location (see Who receives data).

While you use the app

• Your position on the map, the passes around you and the distances are worked out on your phone.
• To show the rides near you in the calendar, and the points proposed within 50 km of you, the app sends your position with the request, rounded to about 100 metres. It is never stored.
• To confirm a point on the spot, the app reads the GPS for up to 20 seconds. We keep the result (how far you were, the accuracy, the time, the altitude, the type of phone and the app version), never your position. An accepted reading stays with the point's confirmations until you delete your account or the point is removed; a refused reading is deleted after 30 days.
• To search for a place, the words you type and your position rounded to about 1 km go to Mapbox, which suggests places. Nothing of the search is stored.

Automatic check-in

Automatic check-in is optional: it stays off until you turn it on in Settings and allow location access “Always”.

• Your phone's system watches the areas around the nearest passes you have not verified yet, and wakes VALICO when you come near one. Your phone chooses which passes to watch.
• VALICO then reads the GPS for a few minutes, 20 at most, to see whether you rode over the summit, and switches it off. The readings of those minutes are sent to our server, which checks them again.
• We keep the pass, the time, the single GPS point at the summit and the figures of the check (such as distances, speeds, accuracy, the number of readings, the type of phone, its system version and the app version). The other readings are not kept. A check-in that was not verified is kept for 30 days, without any position, and then deleted.
• With no signal, the check-in waits on your phone and is sent later; after 30 days it is dropped.
• You can turn it off at any time, in Settings or in your phone's settings. While it runs, your phone shows that an app is using your location.

7. GPX files

When you import the GPX recording of a ride, the app checks and compresses it on your phone and sends it to our server. The server checks it automatically (whether it is a real recording with times, which passes and roads it covers, and whether another account has already used the same recording) and deletes the file as soon as the result is saved, normally within seconds. A file left behind by an error is deleted automatically within the hour.

• We keep the visas the recording earned and the time you passed each pass or road, as for every visa.
• We keep the name of each file you imported and its result for 30 days, so the app can show them.
• For each accepted recording we keep a coded fingerprint: codes worked out from its points (one without a key, the others with a secret key), the start and end time of the ride, its distance, the passes and roads it earned visas for, and any review notes, which may point to another recording of the same ride. It holds no coordinates, so the route cannot be read from it, but a copy of the recording, or points of it, can be matched against it. It stops the same recording, or a copy of it, from earning visas for another account, so we keep it after you delete your account, no longer linked to your account.

Some recordings are set aside for a person at VALICO to look at, for example when two accounts send the same ride. Visas from recordings that are not genuine can be taken back.

8. Rides and meetups

Riders aged 18 or older with a complete passport can organise a ride, a multi-day tour or a meetup. We keep what you enter: the title, description, dates and time, meeting point, surface and pace, passes, the distance within which riders see it, and the WhatsApp, Telegram or Instagram links you add.

• Signed-in riders see your ride in their calendar when they are within the distance you chose from the meeting point, and any signed-in rider who has its link can open it. It shows you by your first name and the initial of your last name (for example “Marco R.”), never by your e-mail address.
• A ride's link opened outside the app shows nothing of the ride.
• A meeting point you propose for your ride shows on the ride and, until it is approved, to riders nearby as a proposed point. Once approved it becomes a point on the map.
• Riders can report a ride. We keep who reported it, the reason and when; the organiser is not told who. Every report reaches VALICO by e-mail (see Messages and e-mails), and three reports from riders with a complete passport hide a ride until VALICO checks it. A rider can also hide a ride's organiser: we keep that they did, and the organiser's rides no longer show to them.

9. Points you add to the map

Riders aged 18 or older with a complete passport can propose a mountain pass, a scenic road or a biker point, with 1 to 3 photos, and confirm the points others proposed.

• We keep what you send: the category, name, place (for a road its start, end and route), description, elevation and photos.
• Your phone makes a new picture from the pixels of the photo you chose, and our server does it again, so the location, camera and time recorded in the original file (its EXIF data) never reach us. A person at VALICO checks every photo before anyone else sees it. A photo that is not accepted is deleted after 7 days.
• A proposed point is shown to signed-in riders within 50 km without your name (“a rider”), and riders on the spot can confirm it (see Location). The exception is a meeting point you propose for your ride, which shows on your ride.
• Once a point is approved, by VALICO or by the confirmations of riders on the spot, it becomes part of the VALICO map. It stays there if you delete your account, with its photos credited to “VALICO community”, without your name.
• We keep the reports you make (each one reaches VALICO by e-mail), the riders you hide, and VALICO's decisions on contributions and on who may contribute.
• E-mails to VALICO about new points and reports name the riders involved by first name and initial.

10. Challenges

When you join a sponsored challenge, accepting its sponsor's terms, we keep that you joined, your progress, which we work out from your verified visas, when you completed it, the discount code given to you and when you looked at it.

• The sponsor receives only numbers, such as how many riders joined or completed the challenge and how many codes were shown, never who you are or which code you got.
• If you use a code with the sponsor, you deal with the sponsor directly, under its own privacy policy.
• If you delete your account, your code stays marked as given and the challenge's counts stay, without any link to you, so a code is never given twice.

11. Messages and e-mails

• When you write to us, we use your e-mail address and your message to answer, and keep them as long as needed to deal with your request.
• New points, every report, and the rides and points that reports hide reach VALICO by e-mail, sent through our e-mail provider, Resend. These e-mails name riders by first name and initial, never by e-mail address, and contain no rider's position.
• Account e-mails (confirming your address, resetting your password, notices of a changed password or address) are sent by our backend, Supabase, or through our e-mail provider.
• If you share the check-in log from Settings to help us find a problem, it contains passes, times and distances, never a position.

12. On your phone

The app keeps on your phone your session, so you stay signed in, a copy of the map data, check-ins and points waiting for signal, a short log of recent check-in events (passes, times and distances, never a position) and your settings. Signing out stops automatic check-in, and check-ins waiting for signal stay for your next sign-in; deleting your account removes them.

VALICO's notifications, such as a verified visa or a completed challenge, are made on your phone: we use no push notification service. Images of your passport or visas go to your photos only when you save them, and you choose where to share them.

13. This website

valicopassport.com and the ride links are delivered by Cloudflare. We set no cookies, use no analytics or trackers on them and keep no record of your visits. Cloudflare processes your IP address and the page you ask for, to deliver it and to protect the site.

14. Why we may use your data

• To provide VALICO under our terms of use (contract, Article 6(1)(b) GDPR): your account, passport, visas, check-ins, GPX imports, rides, map contributions, challenges and support.
• For our legitimate interests in keeping visas and challenges fair, the community safe and the service secure (Article 6(1)(f) GDPR): the automatic checks of check-ins and recordings, fingerprints, reviews, reports, hidden riders and bans, technical logs, and what we keep after an account is deleted. You can object to these uses (see Your rights).
• To meet legal obligations (Article 6(1)(c) GDPR), for example to answer a request from an authority.

The phone's permissions (location, photos, camera, notifications) are your choice: you can turn them off in your phone's settings at any time, and only the features that need them stop.

15. Who receives data

We do not sell your data and do not share it for advertising. Data reaches:

• other riders: only what you publish (see Rides and meetups and Points you add to the map);
• sponsors: only counts (see Challenges);
• the providers that process data for us, under contract:
  • Supabase, Inc. (privacy policy): our database, sign-in, file storage and server functions, on servers in Frankfurt, Germany;
  • Resend, run by Plus Five Five, Inc. (privacy policy): the e-mails about reports and new points;
  • Cloudflare, Inc. (privacy policy): this website and the ride links;
  • Cloudflare (e-mail forwarding) and the e-mail provider of the VALICO team: VALICO's mailbox, where your e-mails to us arrive;
  • the developers who build and maintain VALICO for us, when their work needs it, bound to confidentiality;
• Mapbox, Inc. (privacy policy): the maps and the place search. Your phone loads the maps from Mapbox, which so receives your IP address and the areas you look at, and the map software in the app sends Mapbox technical and usage data, which can include your device's location; Mapbox's privacy policy explains this and how to opt out of its telemetry;
• Apple and Google, if you sign in with them, and as the app stores you download VALICO from, under their own privacy policies (Apple, Google);
• the Wikimedia Foundation (privacy policy): pass descriptions and many photos come from Wikipedia and Wikimedia Commons, and your phone loads them straight from Wikimedia's servers, which receive your IP address and what is asked for;
• authorities, when the law requires it.

16. Transfers outside the EU

Our database and files are stored in the European Union, in Frankfurt. Some providers are based in the United States or may reach data from outside the European Economic Area, for example for support or through a worldwide network. Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework, for providers certified under it, or on the European Commission's standard contractual clauses. You can ask us for details.

17. How long we keep data

• Your account, passport, visas and their proofs, rides, reports, hidden riders, contributions and challenges: until you delete your account, or earlier when you remove an item where the app lets you.
• Your card photo: until you choose another one or delete your account.
• GPX files: deleted as soon as they are checked, at the latest within the hour.
• The names and results of your GPX imports: 30 days.
• Check-ins that were not verified, and point confirmations that were refused: 30 days.
• Photos that were not accepted: 7 days. A proposed point whose photos never arrived: 24 hours.
• E-mails to and from VALICO: as long as needed to deal with them.
• Technical logs of sign-ins and requests: a short time, then our providers delete them.
• After you delete your account we keep, no longer linked to your account: the fingerprints of your accepted recordings, with the times, distance, passes and roads of each ride (see GPX files); the discount codes given to you and the challenges' counts; and the points you added that are on the VALICO map.
• Longer only where the law requires it, or to establish or defend a legal claim.

18. Your rights

Under the GDPR you can ask us for access to your data and a copy of it, and for its correction, deletion, restriction or portability (a copy in a machine-readable format), and you can object to the uses based on our legitimate interests. Automatic checks decide whether a check-in or a recording verifies a visa; if you think one got it wrong, write to us and a person will look at it.

• Delete your account at any time in the app: Settings › Delete account. This deletes your account and the data linked to it, except what this policy says we keep no longer linked to your account.
• Without the app, write to reports@valicopassport.com from the e-mail address of your account (or tell us that you sign in with Apple) and ask us to delete it: we delete your account and the same data within one month, and tell you when it is done.
• For everything else, write to legal@valicopassport.com. We answer within one month and may ask you to confirm that the account is yours.
• You can complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the country where you live or work.

19. Children

VALICO is not meant for children under 16, who must not create an account. Organising rides and proposing or confirming points are for riders aged 18 or older: the app checks the date of birth on the passport. If you think a child has given us personal data, write to us and we will delete it.

20. Security

Data travels encrypted (HTTPS). In our database a rider can read only their own data and what other riders have published; photos for the map and GPX files are kept in private storage until they are checked; passwords are stored only as a hash; and only the people who need it for their work can reach our systems. If a breach puts your data at risk, we will tell you and the authority as the law requires.

21. Changes to this policy

We will update this policy when VALICO changes, together with the date at the top. If a change matters for how we use your data, we will tell you in the app before it applies.

22. Contact

VALICO, Italy. E-mail: legal@valicopassport.com; for reports and support: reports@valicopassport.com.