MOKET
ENDEIT

Privacy policy

Last updated: 12 October 2026 · The German version prevails.

Controller

The controller for the Moket app and its website is:

Mirko Genovese

Ziegeleistr. 53B

86199 Augsburg, Germany

Email: mirkogenovese91@gmail.com

We are not required to appoint a data protection officer. For any privacy question, write to the address above.

In short

Account and sign-in

To sign in you enter your email and receive a one-time code; there is no password. We store your email, an internal user ID and sign-in times. The code is sent via Brevo (Sendinblue SAS, Paris, France) as our processor.

Legal basis: Art. 6(1)(b) GDPR.

Profile and bike

We store nickname, stated area, riding style, experience, bike (make, model, year, colour, category, look), your settings (e.g. ghost mode, notifications, who may follow you), your records (top speed, estimated max lean angle, with date) and medal levels.

Other riders see only nickname, bike, style, area and, unless you switch it off, your medal levels. Only you see your records, unless you share them. We do not ask for your real name, photos, date of birth or gender.

Legal basis: Art. 6(1)(b) GDPR.

Location during a ride

When: only from “Start ride” until the ride ends, with the “While using the app” permission. On Android a visible foreground service with a notification keeps recording while the screen is off. No location is collected outside a ride.

Filtered on the phone: points in your private zones and the first and last 500 m of every ride are never sent. The zones themselves stay on your device only.

On the server: the remaining points (coordinates, time, accuracy) are automatically matched against other rides (about 150 m at the same time). Nobody, not even you, can read raw points or tracks. They are deleted 72 hours after the ride ends.

Encounters: we keep only the two accounts and rides, a fuzzy area (about 5 km), the nearest town, the day and a time of day. They become visible only after both riders have ended their ride, plus a random 30–60 minute delay. During the ride the app shows at most a count, delayed and without names or places.

Ghost mode: when on, you take part in no matching.

The track of your rides stays on your phone only. On the server we keep, per ride, start, end, status, bike and the summary (km, duration, top speed, estimated maximum lean, title, group ride), so you get your history back on a new phone and medals are calculated there. Only you see the summary; others see at most your medal levels.

Legal basis: Art. 6(1)(b) GDPR. You can revoke the permission at any time in your phone settings.

Flashes, contacts and chat

After an encounter, or with a rider code/QR code, you can send a contact request (“flash”). We store sender, recipient, time and status. Unanswered requests expire after 7 days without the sender being told.

Only when both accept can you chat. Messages are kept with sender, time and read status until one of you deletes the account or ends the contact. They are encrypted in transit and on the server, but not end-to-end. We only read a chat if a participant reports it to us. To prevent abuse we limit code lookups (30 per hour).

Legal basis: Art. 6(1)(b) GDPR; abuse prevention Art. 6(1)(f) GDPR.

Rides, following and news

Group rides: others see title, description, date, meeting point (a public place), bike categories and your nickname as organiser. Only participants see the participant list. To find rides near you the app sends an approximate position that is not stored.

Following: nobody sees who follows whom. Only the count is shown, updated once a day; you can hide it and choose who may follow you.

News: your followers learn about your new public rides, new medal levels (if visible) and, only with “I’m going too”, the public rides you join. These entries are deleted after 30 days. Places, rides or encounters are never shared.

Legal basis: Art. 6(1)(b) GDPR.

Road reports

During a ride you can drop a report with one tap (road hazard, crash, check). We store type, position, time, expiry and your account. Others see the report nearby but never who made it. Reports expire after 1–4 hours. Your account is kept only to prevent abuse (max 10 reports per hour) and so you can undo a mistaken report. Expired reports are deleted no later than 24 hours after expiry.

Legal basis: Art. 6(1)(b) and (f) GDPR.

Creators and invite codes

For a creator application we store the channel, stated follower count, verification code and our review note. A creator page shows nickname, bio, channels, a “My gear” link marked as an ad, and upcoming public rides, never rides, positions or encounters.

If you sign up with a creator’s invite code we store that link; the creator only sees the total. For the banner we count views and taps per creator and day without storing who. External pages (YouTube, Instagram, shops) are the responsibility of their operators.

Legal basis: Art. 6(1)(b) GDPR; statistics Art. 6(1)(f) GDPR.

Push notifications

If you allow notifications we store your phone’s push token. Delivery runs through the Expo push service (650 Industries, Inc., USA) and Firebase Cloud Messaging (Google Ireland Ltd.) or Apple Push Notification Service. The text never contains places, times or chat content. Turn off single types in the app and all of them in your phone settings. We delete the token when you sign out.

Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

Reports and moderation

You can report riders, content or creator links. We store reporter, reported user, reason, description and status. The reported user is not told who reported. To review, we may look at the reported content, for chats the reported conversation. Reports and actions are kept up to 12 months after closing.

Legal basis: Art. 6(1)(f) GDPR; Art. 6(1)(c) GDPR with Art. 16 and 17 DSA.

Services the app calls directly

These providers see your IP address and the data listed:

The camera is used only to scan QR codes; the image is neither stored nor sent. Motion sensors only estimate lean angle on the phone.

Legal basis: Art. 6(1)(b) GDPR; updates Art. 6(1)(f) GDPR.

Hosting and processors

Database and sign-in are run for us by Supabase Inc. (USA) on servers in Frankfurt am Main. Other processors: Brevo (email, France), Expo (push and updates, USA), GitHub Inc. (USA, encrypted nightly backups). All are bound by a contract under Art. 28 GDPR. For any transfer to the USA we rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Backups are encrypted, contain no raw GPS points and are deleted after 30 days.

Website

The website moketapp.mirkogenovese.it is hosted by RackNerd LLC, 10602 North Trademark Parkway, Suite 511, Rancho Cucamonga, CA 91730, USA; the server is in a data centre in Los Angeles (USA). The USA is a third country without a general adequacy decision; RackNerd is not certified under the EU-US Data Privacy Framework and does not offer a data processing agreement or EU standard contractual clauses. A level of protection equal to the EU's is therefore not guaranteed. The website is temporary and serves only a small group of testers; it will later move to a provider in the EU. On each visit the server logs your IP address, date and time, the page requested, your browser (user agent) and the referring page. This serves the security and operation of the site; logs are deleted after 7 days.

The website sets no cookies, uses no tracking or analytics and loads no external fonts or scripts. The invite pages (/c/ and /add/) read the code only in your browser to open the app.

Legal basis: Art. 6(1)(f) GDPR.

Retention

When you delete your account (Profile > Privacy > Delete account) we delete all linked data immediately, in backups within 30 days.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and to object to processing based on legitimate interest (Art. 21 GDPR). You can withdraw consent at any time for the future.

Edit profile and bike in the app; delete your account under Profile > Privacy. You get a copy of your data by emailing mirkogenovese91@gmail.com. Without the app you can request deletion at https://moketapp.mirkogenovese.it/konto-loeschen.html.

You can complain to a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Minimum age, ads, changes

Moket is for adults (18+) only. We sell no data, use no ad or analytics SDKs and build no ad profiles. We announce material changes to this policy in the app.