Privacy Policy

DynoApp is operated from Queensland, Australia, and made available globally. This Policy applies to all users of the App, regardless of country. Where mandatory local data-protection laws grant you additional rights (including the EU/UK GDPR, the California Consumer Privacy Act/CPRA, the Australian Privacy Act 1988, Brazil's LGPD, Canada's PIPEDA, and other equivalent legislation), those rights are recognised and apply to you in addition to the rights described below.

Information you provide:

• Account data: email address, display name, username, password (hashed), avatar, banner, bio, country, and language preference.
• Vehicle data: make, model, year, VIN (if provided), weight, drivetrain, modifications, and photos.
• Social content: posts, comments, reels, photos, race challenges, direct and group messages (including voice messages and reactions), and reports you submit.
• Acceptance and age-assurance records: the declared age in years, resulting age group, verification status, method and timestamps. A date of birth entered into the neutral age gate is processed once and is not stored by DynoApp.
• Support tickets: any information you include when contacting us.

Information collected automatically:

• GPS / location data: latitude, longitude, speed, heading, and accuracy used for performance recording, pre-run GPS checks and calibration. Location is also requested for local weather on the dashboard and during setup, subject to device permissions. Run recordings can include location samples.
• Optional run video: when you enable Video Evidence, the camera provides a preview and records footage with a telemetry overlay during your run. Saved video is associated with the run; review the run's sharing settings before publishing it.
• Motion sensor data: accelerometer readings used to compute G-forces and assist GPS during runs.
• Device & technical data: device model, operating system, app version, browser/user agent, IP address, language, time zone, and crash diagnostics.
• Usage data: pages viewed, features used, in-app events, and rough timing of activity, used for security and product improvement.
• Push notification tokens: if you enable push notifications.

Information from third parties:

• Payment data: if you purchase Pro or credits, our payment processor (Stripe) collects and processes your payment details directly. We receive a transaction confirmation and limited metadata (e.g. last four card digits, country) but never your full card number.
• Age assurance: community access requires a confirmed 16+ outcome. A neutral date-of-birth declaration starts the process; DynoApp stores the declared age in years, age-group result and timestamp, not the entered birth date. Eligibility is then confirmed through an optional Stripe Identity document check or a non-ID manual support review. DynoApp receives the document-check outcome and session identifier, not the ID image, and does not require a government ID.

We process personal information for the following purposes:

• To create and manage your account and authenticate logins;
• To measure, calculate, store, and display performance runs and metrics;
• To operate social features (leaderboard, follows, comments, messages, races, reels);
• To process payments, subscriptions, credits, and refunds via Stripe;
• To send transactional and security communications (e.g. password resets, billing receipts);
• To send push notifications you have opted in to;
• To prevent fraud, abuse, spam, harassment, and violations of our Terms;
• To respond to support requests, reports, and legal enquiries;
• To improve, debug, and develop new features (using aggregated or pseudonymised data where reasonably possible);
• To comply with legal obligations and enforce our rights.

If you are located in the European Economic Area, United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract (Art. 6(1)(b)): to provide the App and the features you request.
• Legitimate interests (Art. 6(1)(f)): to secure the App, prevent abuse, and improve our services - balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)): for push notifications, optional analytics, and any other purpose where consent is required. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws, tax records, and lawful requests.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share information only as follows:

• Other users: profile, runs, posts, comments, and reels you choose to make public are visible to other users in line with your privacy settings.
• Service providers (sub-processors): we use trusted vendors to operate the App, including Base44 (hosting & database), Stripe (payments), and push-notification gateways. They process data only on our instructions and under written confidentiality and security obligations.
• Legal & safety: we may disclose information if required by law, court order, or to protect the rights, property, or safety of users, the public, or the Operator.
• Business transfers: in the event of a merger, acquisition, restructuring, or asset sale, your information may be transferred subject to this Policy.
• With your consent: for any other purpose disclosed to you at the time.

We operate globally and may store and process your information in Australia, the United States, the European Union, and other countries where our service providers operate. Where personal information is transferred out of the EEA, UK, or another jurisdiction with data-export restrictions, we rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or your explicit consent. You may request a copy of the safeguards in place by contacting us.

We retain personal information only for as long as necessary to provide the App and fulfil the purposes described in this Policy, unless a longer retention period is required by law (for example, tax, accounting, or fraud-prevention obligations). When you delete your account, your personal profile, runs, posts, and messages are permanently removed from active systems within 30 days, and from encrypted backups within 90 days. Aggregated or fully anonymised data that can no longer identify you may be retained indefinitely.

Depending on where you live, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion / erasure: request deletion of your account and personal information.
• Portability: receive your information in a structured, machine-readable format.
• Restriction & objection: restrict or object to certain processing.
• Withdraw consent: at any time, where processing is based on consent.
• Non-discrimination (California): you will not receive discriminatory treatment for exercising your CCPA/CPRA rights.
• Lodge a complaint: with your local data-protection authority (e.g. the OAIC in Australia, the ICO in the UK, your national DPA in the EEA).

You can manage your profile and delete your account directly in the App via Settings → Account & Security. For access, portability, correction, restriction, or other requests, contact us via Settings → Help & Legal → Contact Support. We respond within the timeframes required by applicable law (generally 30 days).

We implement appropriate technical and organisational measures to protect personal information, including encryption in transit (TLS) and at rest, hashed passwords, access controls, audit logging, rate limiting, and regular security reviews. Direct and group messages are encrypted in transit and at rest. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and notifying us promptly of any suspected unauthorised access.

DynoApp provides in-app reporting tools that allow any user to flag content they believe is illegal or harmful, including illegal content (e.g. terrorism, CSAM, non-consensual intimate imagery), hate speech, harassment, impersonation, violence, and self-harm content. Reports are reviewed by our moderation team and, where required by law (including the EU Digital Services Act and Australia's Online Safety Act), may be escalated to the relevant authority. To submit a report, use the report button on any post, comment, profile, or message, or contact us via Settings → Help & Legal → Contact Support.

DynoApp does not permit accounts for children under 13. Users aged 13 to 15 may access only private core vehicle-performance features with parent or legal guardian approval; community features require a 16+ age-assurance outcome. We minimise age-assurance data, restrict community services server-side, and provide a review path for an incorrect result. If we learn that an under-13 child created an account, or that required guardian approval was not provided, we will restrict and delete the account as required. Parents, guardians and users may contact us through in-app Support.

The App uses local storage and similar technologies to keep you signed in, remember your preferences (language, units, theme), cache offline data, and operate core features. We do not use third-party advertising cookies. We may use privacy-respecting product analytics to measure aggregate usage and crashes; this data is pseudonymised and used only to improve the App. Where required by law, we will ask for your consent before placing non-essential cookies.

We do not use your personal information for solely automated decision-making that produces legal or similarly significant effects on you. Some App features (e.g. spam filters, banned-word detection, rate limits, fraud heuristics) use automated rules to protect users and the platform; you may contact us to request human review of any automated action that materially affects your account.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and in accordance with applicable law (including the Notifiable Data Breaches scheme under the Australian Privacy Act, Articles 33-34 of the GDPR/UK GDPR, and equivalent obligations elsewhere).

The App may contain links to third-party websites or services (for example, when sharing a run on social media or visiting a payment provider). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with any personal information.

We may update this Policy from time to time. The "Effective" date at the top of this page indicates when the latest changes took effect. Material changes will be communicated through in-app notice or email and, where required by law, with advance notice. Your continued use of the App after the effective date constitutes acceptance of the updated Policy.

For privacy questions, requests, or complaints, please contact us via Settings → Help & Legal → Contact Support. We will respond to your enquiry within the timeframes required by applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority.