ThrottleIQ is a motorcycle ride-tracking app. It is built and run by one independent developer, and it is currently in beta. This policy describes, in plain terms, exactly what the app collects, where that data goes, and how you get rid of it. It reflects what the shipped code actually does — nothing is described here that the app does not do.
Questions, requests, or complaints: hello@blankframe.tech. That address reaches the developer directly; there is no support desk behind it.
1. What the app collects, and why
| Data | Why | Where it goes |
|---|---|---|
| Precise GPS location — latitude, longitude, speed, altitude, accuracy, timestamp, sampled continuously while a ride is recording | To draw your route and calculate distance, speed, moving vs. stopped time, and to detect a possible crash | Saved on your phone first, then backed up to your own private cloud area (see §2) |
| GPS location in the background — the same data, continuing while your screen is off or another app is in front | See §3 below | Same as above |
| Accelerometer and gyroscope readings (roughly 50 samples per second while recording) | Crash detection (being tested, see §7), hard-braking / rapid-acceleration alerts, cornering and heading estimation | Processed on your phone as it arrives. The raw sensor stream is not stored, with one exception: a 12-second recording around each hard knock the app notices, kept with that ride's impact record (§7). Otherwise only a per-point acceleration figure is kept alongside the route |
| Phone battery percentage | Shown to people watching your live-ride link, so they can tell whether your phone is about to die mid-ride | Written into the live-session record while a ride is being shared live |
| Email address, and — if you sign in with Google — the name and profile picture on your Google account | To create and sign you into your account, and to let other riders find you by exact email or @username | Firebase Authentication and your public profile record |
| Profile details you type — display name, @username, nickname, bio | To identify you to other riders | Your public profile record |
| Bikes, odometer readings, maintenance logs, saved routes | The garage and maintenance features | Stored on your phone and backed up to your private cloud area |
| Emergency contact names, phone numbers, and email addresses you type in | So the app knows who to reach if you're in a crash | Your private cloud area. The app does not read your phone's contact list — you type these in by hand |
| SafeQR medical card — blood group, allergies, conditions and medications, only if you fill them in | To build the QR code a first responder can scan, and to restore it after a reinstall or on a new phone | Your private cloud area, readable only by you. Anyone who scans your printed or shared QR code sees what is on it. Deleted with your account |
| Photos you choose to attach — profile picture, photos on shared rides | To display them in the app | Uploaded to Cloudinary (see §4). Bike photos stay on your phone only |
| Voice clips — short push-to-talk recordings (under 60 seconds each), only while you hold the talk button inside a group ride | So riders on the same group ride can talk to each other hands-free | Uploaded to Cloudinary (see §4) and playable by the other members of that group ride. The microphone is never used at any other time |
| Crash diagnostics — if the app itself crashes or hits an unhandled error, a stack trace, the device model/OS version, and app version | So bugs that crash the app get fixed, instead of going unnoticed | Firebase Crashlytics. This is separate from the ride-crash detection in §7 — it's about the app crashing, not you. Off while testing in debug builds; only real installs report |
| Things you post — forum posts and replies, ride captions, comments, votes, place entries, place reviews, follows | The community features | Publicly readable to other signed-in riders. If a rider reports a forum post, the report keeps a copy of it (title, text, image links, author, time), readable only by the reviewer; see §8 for how long |
| Direct messages — the text you send another rider, one-to-one | The chat feature | Only readable by the two people in that conversation — never public. Nobody at ThrottleIQ reads them unless one of you reports a message; then a reviewer reads the reported message and the messages around it (see the community rules). The report keeps a copy of the reported message (its text, sender and time), readable only by the reviewer, so it can still be reviewed if the message or the sender's account is deleted; see §8 for how long. Kept as long as your account exists; there's no in-app way to delete a single message or a whole conversation yet. When you delete your account, the text of your messages is deleted and you appear in the other rider's copy of the conversation as “Deleted rider”; they keep their own messages |
What the app does not collect
- No advertising, and no data sold or shared with advertisers or data brokers. Ever.
- No advertising-style tracking. ThrottleIQ uses Firebase Analytics only to count which screens are opened and a short, fixed list of steps — signing up, signing in, starting or ending a ride, sharing a ride or a Year in Review page (which page, not what is on it), adding a bike, saving a route — so the app can be improved. It never sends your name, email, account ID, location, ride details, messages or anything you type. It does not use the advertising ID (the permission is removed from the app), does not personalise ads, and does not build an advertising profile. Events are tied to an anonymous installation identifier, not to your account. You can turn this off any time in Settings → Privacy & Safety, and it is off in developer builds. Separately, Firebase Crashlytics catches app crashes — see the crash-diagnostics row in the table above — and only fires when the app itself breaks.
- No push notifications. Notifications you see are generated on your own phone or read from your own account records. Google's messaging library is bundled with the app and, like every Firebase app, the Firebase SDKs give your installation an anonymous identifier — but ThrottleIQ never reads, stores, or sends anything to a push token, and nobody can push a message to your phone through it.
- No contact list, no SMS, no camera roll scanning. Photos are chosen one at a time through your phone's own picker. The microphone is used only for the group-ride voice clips described above, and only while you hold the talk button.
2. What actually leaves your phone
ThrottleIQ records offline first. Rides are written to a database on your own device before anything is uploaded, and the app works with no connection at all. When you are back online it syncs to the cloud so that your history survives losing or reinstalling your phone.
What is backed up, and who can reach it
Two things are uploaded for each ride: the summary (date, distance, duration, max speed, event counts, bike) and the point-by-point GPS trail — the full route, with a timestamp, speed and acceleration figure at each point. Your bikes, maintenance logs, saved routes and the impact records described in §7 are backed up too.
All of it lands in a private area of the database keyed to your account. Database security rules restrict every one of those records — the GPS trail especially — to your account alone. No other rider can read them, and none of it appears anywhere in the app for anyone but you.
Your route only becomes visible to anyone else if you deliberately make it so: sharing a ride to the feed (§5), publishing a saved route, or starting a live-share link (§6).
Uninstalling the app deletes the local database on the device. The cloud backup survives an uninstall by design — that is what it is for — so uninstalling is not the same as deleting your data. To remove the backup as well, see §9. You can export any ride to a JSON or GPX file from the app if you want your own copy.
Anonymous road-speed data
After each ride, the app also contributes a small, anonymous record for each rough stretch of road you rode: a speed, the day of the week, the hour, and (when available) the weather at the time. This goes into a shared pool that every rider's app draws from — not your account's private area.
These records carry no name, no account ID, no ride ID, and no exact coordinates — only a coarse ~150m map cell, which is not enough to pinpoint an address or identify who rode it. They cannot be linked back to you or your account, by us or by anyone else.
The pool is used for one thing: right after a ride, the app privately compares your own speed on a stretch against the anonymous history for that same stretch, and if yours was a real outlier, shows you a note about it on your own ride summary. Nobody else ever sees this comparison, and it is never reported, published, or used to identify you to anyone — including other riders, insurers, or authorities.
This is on by default for every recorded ride and does not currently have its own off switch separate from turning off ride recording entirely.
Home-screen widgets
If you add one of the app's home-screen widgets, the figures it shows — recent ride stats and upcoming maintenance — are written to your phone's own local app storage so the widget can draw them. That data stays on the device and is not sent anywhere. Bear in mind a widget is visible to anyone who can see your home screen.
3. Background location — why it is needed
Recording a ride you start yourself does not need background location. While and only while that ride is recording, the app runs an Android foreground service with a visible notification ("Ride Recording Active"), so it keeps recording with the screen off or another app in front using the ordinary "While using the app" permission. Location collection starts when you start the ride and stops when you finish it.
Only one optional feature asks for location while the app is in the background, which on Android means the "Allow all the time" setting: Detect rides automatically. It is off unless you turn it on in Settings, and the app explains it on screen before the system asks.
- With it on, the app listens to your phone's motion signal (activity recognition, run by the operating system) and turns GPS on only once you are moving in a vehicle, so a ride is logged even if you never opened the app. A notification reading "Watching for rides" is shown while it runs.
- The background position fixes are kept on your phone and summarised into detected rides; the raw fixes are deleted from the phone after 14 days.
- Turn it off at any time in Settings, or revoke "Allow all the time" in your phone's system settings; the feature then switches itself off. Recording rides by hand keeps working.
- The one other use of location is one-off: when you open the Places tab or ask to import nearby places, the app takes a single position fix to find what's around you.
If you would rather the app not use your location at all, turn off Ride tracking in Settings → Your ThrottleIQ. Ride recording, automatic trip detection, ride analytics and crash detection are then switched off, and the app keeps only the odometer readings and maintenance records you enter yourself. Turning off Places & routes in the same place also stops the one-off position fix that Places uses. Rides you already recorded are kept until you delete them or your account.
4. Third parties, and exactly what each one receives
| Service | What it receives |
|---|---|
| Firebase Authentication (Google) | Your email address and password credential, or your Google sign-in token. This is what proves who you are. |
| Cloud Firestore (Google) | Your profile, ride summaries and ride GPS trails, impact records and, if you opt in, crash research records (§7), bikes, maintenance logs, saved routes, emergency contacts, SafeQR medical card, earned badges, in-app notifications, forum posts, shared rides, direct messages, places, reviews, follows, and live-session records. This is the app's database. |
| Firebase Analytics (Google) | Anonymous usage counts: screen names (never with an ID in them) and a fixed list of steps such as ride started or bike added, plus a coarse label like email or google for how you signed in. Tied to an anonymous installation identifier, not your account. No advertising ID, no ad personalisation. You can switch it off in Settings → Privacy & Safety. |
| Firebase App Check (Google) | An attestation from your phone's own integrity service (Google Play Integrity on Android, Apple App Attest on iPhone) that proves a request comes from the genuine ThrottleIQ app rather than a script. It contains no personal data and is not linked to your account. |
Cloudinary — cloud name vjvcigkt |
Only the files you choose to upload: your profile picture, any photo you attach to a shared ride, and group-ride voice clips. Uploads are unsigned and each one gets a public, unguessable URL that is then stored in the database. Cloudinary does not receive your rides, your location, or your account details. |
OpenStreetMap tile servers — tile.openstreetmap.org |
Map tiles are fetched directly from OpenStreetMap whenever a map is drawn — while riding, on ride summaries, and on the live-share page. Each request necessarily reveals your device's IP address and which map squares you are looking at, which approximates where you are. Your account is never identified to them. |
Overpass API — overpass-api.de |
Only when you explicitly tap "Import nearby" in the Places tab: your current coordinates and a search radius, in order to look up fuel stops, motorcycle garages, parts shops, cafés, and viewpoints around you. This never happens automatically in the background. |
Open-Meteo — api.open-meteo.com |
After each ride, the coordinates of where it started and the ride's date/time, to look up the weather then and there for the anonymous road-speed feature described in §2. No API key, login, or account is used — like the OpenStreetMap row above, the request necessarily reveals your device's IP address to Open-Meteo, but never your ThrottleIQ account or identity. |
| Google Sign-In | Only if you choose that sign-in method. Google handles the login and returns your email, name, and profile photo. |
| Firebase Hosting (Google) | Serves this page and the live-ride viewer page. Standard web server request logs apply. |
These services process data so the app can function. Their own handling of it is governed by their policies — Firebase, Cloudinary, OpenStreetMap Foundation.
5. What other riders can see
- Your profile — display name, @username, nickname, bio and profile photo — is readable by other signed-in riders by default. You can restrict your profile's visibility to mutual follows, or make it private, in profile settings.
- Your email address is not shown to other riders. Someone who already knows your exact email can find your account with it, but only once you have verified that address.
- Rides are private until you share them. When you share one, you pick the audience: public, your followers, or mutual follows only. A shared ride carries its route line, stats (including a riding score worked out from counts of hard braking and rapid acceleration on that ride), your name and photo, the bike, and any caption or photo you attached.
- Group-ride voice clips can be heard by the other members of that group ride.
- Route trimming. When a ride is shared, roughly the first and last 200 metres of the route are cut off before it is uploaded, so the shared trace does not begin or end at your front door. If a ride is short enough that trimming consumes the whole track, the ride is shared with no route line at all rather than an untrimmed one.
- Forum posts, comments, votes, places you add, and reviews you write are visible to other signed-in riders and carry your name.
In Settings → Your ThrottleIQ you can set the community to Forums only or Off. This changes what you see in the app: the ride feed, people, chat, follows and group rides (and, when Off, the forums) are hidden, and follow links are ignored. It does not hide your profile from other riders or remove anything you have already shared or posted. To do that, change your profile visibility, delete the shared rides or posts, or delete your account (section 9).
6. Live-ride sharing links
If you start live sharing during a ride, the app creates a session identified by a random
32-character token and gives you a link like
https://throttleiqfb.web.app/live/<token>. While the ride is running, that
session record holds your current latitude and longitude, your current speed, your
phone's battery percentage, your ride status (riding, paused, crash, completed), the
time it was last updated, your account ID, and the ride ID. It updates continuously as you
ride, and it plots a live trail on a map.
Please understand what the link does
- Anyone holding the link can watch — no account, no sign-in, no approval from you. The link is the permission. Whoever you send it to can forward it to anyone else, and it will work for them too.
- Session records are stamped to expire 24 hours after the ride starts, and the viewer page refuses to display a session past that point. The record itself is not automatically deleted at expiry today — expiry stops the page from showing it, it does not erase it. Adding automatic deletion is a known outstanding item.
- Only send a live link to people you actually want to know where you are, and treat it as public once it leaves your hands.
7. Crash detection
Crash detection is still being tested and does not alert anyone: no alarm, no countdown, no message to you or your emergency contacts. While a ride records, the app looks for a hard knock followed by the bike stopping. When it notices one it shows nothing during the ride and saves an impact record on your phone: the time and position, your speed before and after, figures measured from the motion sensors (peak force, free fall, rotation), a 12-second recording of the motion sensors around the moment, whether the app was on screen and the phone charging, and where you said the phone was (for example a pocket or a mount).
After the ride, the summary may ask whether you fell, and you can report a fall the app missed. Your answer, and the road surface and severity if you pick them, are saved with the record. Impact records are backed up to your private cloud area like the ride (§2), and only your account can read them. Deleting the ride removes them from your phone; their cloud copies are removed when your account is deleted (§9).
Optional: help improve crash detection
Off unless you turn on Help improve crash detection in Settings → Privacy & Safety. With it on, every impact record you have answered, including answers given before you turned it on, is also copied to a research set used to tune the detector: your answer, the surface and severity you picked, the measured figures, your speed before, where the phone was, your bike's engine size and type, the phone platform, when the record was made (date and time, plus the local hour and weekday), and a map cell of roughly 1.2 × 0.6 km.
The copy carries no name, no exact position, no sensor recording and nothing you typed. It does carry your account ID, so it can be deleted with your account; no app user can read the research set. That makes it de-identified, not anonymous. Turn the setting off and your copies are removed from the research set the next time the app syncs.
ThrottleIQ is not an emergency service, and does not call one. It does not contact anybody on your behalf after a crash. Do not rely on ThrottleIQ as a safety net. The one thing that genuinely works today is the live-share link you send out yourself before or during a ride.
8. How long data is kept
- On your phone: rides, GPS trails, bikes and maintenance logs stay until you delete them in the app or uninstall it.
- In the cloud: your profile, ride summaries, ride GPS trails, bikes, maintenance logs, routes, emergency contacts, impact records, posts, reviews and shared rides are kept for as long as your account exists. There is no automatic expiry on any of it. Crash research records (§7) are kept until you turn that setting off or delete your account.
- Live-share sessions: stop being viewable 24 hours after they start; the underlying record persists until deleted (see §6).
- Deleted content: when you delete a ride, post, review, or emergency contact in the app, the record is removed. Photos already uploaded to Cloudinary are not automatically removed when the post referencing them is deleted — email the address below if you need an image taken down.
- Reported messages and posts: when a rider reports a direct message or a forum post, a copy of it (the text, a post's title and image links, the author and the time) is kept with the report as evidence, so the report can still be reviewed if the content or the author's account is deleted. Only the reviewer can read it. It is deleted 90 days after the report is reviewed. If the author deletes their account before the review, the copy is kept until the review; after the review their account ID is removed from the report.
- রিপোর্ট করা মেসেজ ও পোস্ট: কেউ কোনো ডাইরেক্ট মেসেজ বা ফোরাম পোস্ট রিপোর্ট করলে সেটির একটি কপি (লেখা, পোস্টের শিরোনাম ও ছবির লিংক, লেখক, সময়) প্রমাণ হিসেবে রিপোর্টের সাথে রাখা হয়, যাতে লেখাটি বা লেখকের অ্যাকাউন্ট মুছে ফেলা হলেও রিপোর্টটি রিভিউ করা যায়। শুধু রিভিউয়ার এটি পড়তে পারেন। রিপোর্ট রিভিউ হওয়ার ৯০ দিন পর কপিটি মুছে ফেলা হয়। রিভিউয়ের আগে লেখক অ্যাকাউন্ট মুছে ফেললে রিভিউ পর্যন্ত কপিটি থাকে; রিভিউয়ের পর রিপোর্ট থেকে তাঁর অ্যাকাউন্ট আইডি সরিয়ে ফেলা হয়। (যন্ত্রে অনূদিত, পর্যালোচনা বাকি / machine-translated, pending review)
9. Deleting your account and your data
In the app: Settings → Delete account removes your sign-in credential and everything the app stored on your phone straight away. It does not remove your cloud records on its own: there is no automatic clean-up yet. Your cloud records — profile, username reservation, ride summaries and GPS trails, bikes, maintenance logs, saved routes, emergency contacts, impact and crash research records, badges, notifications, shared rides, live sessions, crash alerts, follows, messages, photos and voice clips — are deleted by hand, within 30 days of your request. In a direct-message conversation the other rider keeps their own messages; yours lose their text and show as from “Deleted rider”. A copy of a message or post of yours that someone reported stays with the report until 90 days after it is reviewed; your account ID is removed from it once it is reviewed (§8). To make the request, email as below; do it before or after deleting in the app.
By email (the way to request cloud deletion, and also the route if you can no longer sign in):
- Email hello@blankframe.tech from the address you signed up with, asking for account deletion. Using the signup address is how the request is verified as yours.
- Your sign-in credential and every cloud record tied to your account is deleted: profile, username reservation, ride summaries, ride GPS trails, bikes, maintenance logs, saved routes, emergency contacts, impact and crash research records, badges, notifications, live sessions, and crash alerts. Uploaded photos are removed from Cloudinary.
- Content you posted in public — forum posts and replies, comments, place entries and reviews — is deleted on request too. Say so in your email if you want it removed; otherwise it may be left in place, detached from your profile, so threads other riders replied to don't break.
- This is done within 30 days of your email. It is done by hand, by one person, and you get a reply when it is finished.
You can also delete most things yourself at any time without emailing anyone: individual rides, bikes, maintenance entries, emergency contacts, posts, and shared rides all have a delete action in the app. To wipe everything held locally, uninstall the app.
Want a copy of your data? Rides can be exported to JSON or GPX from the app. For anything else, email the address above and it will be sent to you.
10. Security, honestly stated
All traffic to Firebase, Cloudinary, OpenStreetMap, and Overpass goes over HTTPS. Access to the database is restricted by server-side security rules, so one rider cannot read another rider's private rides, bikes, maintenance logs, or emergency contacts. Sign-in is handled by Firebase Authentication; passwords are never stored by the app itself.
Two things you should weigh honestly: live-share links are readable by anyone who has the link, by design (§6); and this is a beta app maintained by one person, with no independent security audit and no formal breach-notification programme. If a breach affecting rider data is discovered, it will be reported by email to affected riders and noted on this page. Please make your own judgement about how much of your riding you want stored in it.
11. Children
ThrottleIQ is for licensed motorcycle riders and is not intended for children. Accounts are not knowingly created for anyone under 13, or under the minimum age of digital consent where you live if that is higher. If you believe a child has created an account, email the address below and it will be deleted.
12. Changes to this policy
If what the app collects changes, this page changes with it and the effective date at the top is updated. For a change that materially affects data already collected, notice will be given in the app before it takes effect.
13. Contact
ThrottleIQ is an independent, solo-developer project. There is no company, no privacy team, and no data protection officer — every request goes to one inbox and is handled by the developer: