PRIVACY POLICY AND TERMS OF USE - TRAZAVIA

Last updated: July 20, 2026

Welcome to Trazavia (hereinafter, "the Application" or "we"). We take the security and privacy of your data very seriously. This Privacy Policy explains transparently how we collect, use, store, and protect user information (hereinafter, "the User" or "you") when interacting with our mobile platform, mapping tools, and off-road community services.

By registering and using the Application, you accept the processing of your data under the terms described in this document.

1. Data Controller

• Platform: Trazavia Off-Road Community
• Support & Privacy Email: [email protected]
• Legal Framework: All personal data processing is carried out in strict compliance with the General Data Protection Regulation (GDPR - Regulation UE 2016/679) and applicable European data protection laws.

2. Data We Collect and Its Purpose

To provide you with the essential tools for 4x4 navigation, mapping features, and off-road social community functionalities, Trazavia needs to collect and process the following information:

• Account Registration Data: Email address, username, and password (the latter is securely and irreversibly encrypted in our systems using cryptographic hash functions). Purpose: Account creation and management, secure user authentication during login, and access recovery.

• Profile Data (Optional): Profile picture or image selected by the User. Purpose: To personalize your visual identity within the community ecosystem. Provided images are optimized, compressed, and stored in isolated storage systems.

• Location and Geolocational Data (GPS): Exact geographic position coordinates provided by your device's hardware. Purpose: This is a core and indispensable feature of the service. It is used to position you in real-time over the map layers (trail networks, cadastral plots, protected natural areas, cattle trails, etc.), enable navigation on off-road routes, calculate trip distances, and save your exploration logs.

• Background Location: If you explicitly grant permission in your operating system, the Application may collect your location data in the background only while a route recording or tracking session is actively enabled by you, even if the device screen is off or the application is minimized. We do not passively track your location if you are not running an explicit navigation activity.

• User-Generated Content: Recorded routes (GPS tracks), saved points of interest (POIs), comments, or updates regarding terrain and trail conditions. Purpose: To provide historical storage for your routes and, if you voluntarily choose to publish them, share them with the platform's community map.

3. Legal Basis for Processing

We process your data under the following legal grounds regulated by the GDPR:

1. Performance of a Contract / Service Provision: Processing your credentials and GPS signals is absolutely vital to execute the navigation and map tools you actively request when using the platform.
2. Explicit Consent: To access the device's GPS location (both in the foreground and background) and local storage for the profile image, the Application will request your express authorization through the operating system's native permission system. You can revoke these permissions at any time from your phone settings.
3. Consent for Optional Technologies: For analytics, behavioral measurement, and advertising (described in sections 7 to 10), we only activate the corresponding tools after you grant consent through our privacy banner, in-app settings, or—where applicable—the Google consent platform. You may withdraw this consent at any time with the same effect as if you had not granted it initially.

4. Data Retention

Your personal data will be kept as long as you maintain your account active in Trazavia.

If you choose to delete your account, all your registration, profile, geolocation, and private route data will be permanently, immediately, and irreversibly removedfrom our production servers, except for anonymized trail condition reports voluntarily shared with the public community.

5. Recipients and Data Transfers (Third-Party Services)

Trazavia enforces a strict ethical monetization policy:we do not sell or rent your personal data or GPS location to third parties

To sustain the technical infrastructure, web traffic, mapping rendering speeds, diagnostics, analytics, and—only with your consent—advertising, we delegate technical processing to specialized providers that comply with European security standards and the GDPR:

• Hosting and Infrastructure: The platform's backend and the database engine supporting massive cartographic data run in an isolated environment on dedicated servers physically located within the European Union.
• Multimedia Cloud Storage: Profile pictures and image optimization files are stored encrypted in distributed object storage services in the cloud (Cloudflare R2), ensuring optimal network transfers.
• Perimeter Security & CDN: All data flow between the Application and our servers is routed through proxies and mitigation infrastructures that block external attacks and ensure your traffic cannot be intercepted.
• Google (Firebase Analytics and Firebase Crashlytics): Google Ireland Limited processes aggregated usage events and crash reports to help us measure platform performance and fix stability issues. Analytics is activated only with your consent; Crashlytics is necessary to maintain service reliability. Privacy policy: https://policies.google.com/privacy
• Mixpanel (Mixpanel, Inc.): Processes behavioral analytics events (such as feature usage and navigation flows) when you grant consent. On the web version, events are sent to Mixpanel's EU API endpoint (api-eu.mixpanel.com). Privacy policy: https://mixpanel.com/legal/privacy-policy/
• Google Advertising (AdSense on the web and AdMob on Android): When you grant advertising consent, Google may process advertising identifiers, device information, and interaction signals to display ads within the Application. If you deny advertising consent, ads are not shown. Privacy policy: https://policies.google.com/technologies/ads

6. Information Security

We apply advanced technical and organizational security measures to safeguard your information against loss, manipulation, or unauthorized access:

• Strict encryption of all communications in transit using secure HTTPS / TLS protocols.
• Perimeter isolation of databases via strict firewalls that block external access.
• Secure password storage using robust encryption algorithms.

7. Cookies and Similar Technologies

On the web version of Trazavia we use cookies and similar storage mechanisms to remember your privacy choices and, only after consent, to enable analytics and advertising services:

• Consent cookie (trazavia_consents): Stores your preferences for Firebase Analytics, Mixpanel, Firebase Crashlytics, and advertising. It is created when you interact with the privacy banner or save your settings. Without this cookie, optional services remain disabled by default.
• Authentication and session cookies: Necessary to keep your login session active and secure while you use the web platform. These are strictly functional and do not require separate marketing consent.
• Third-party cookies and local storage: When you grant consent, Google (Firebase, AdSense, and—where applicable—the Google consent platform) and Mixpanel may set their own cookies or use browser storage to measure usage, diagnose errors, or deliver ads. These technologies are not loaded until the corresponding consent category is enabled.

8. Consent Management

You control optional processing through transparent consent mechanisms that differ by platform and region:

• Web (outside regulated regions): On your first visit, a privacy banner lets you accept all, reject all, or configure each category individually. Your choice is stored in the trazavia_consents cookie and can be changed later from Application settings.
• Web (EEA, UK, and Switzerland): Where required by law, Google’s consent platform (Consent Mode) may manage advertising and analytics signals. If it is not available or not configured, the legacy Trazavia banner is shown instead so you can still express your preferences.
• Android app: On first launch you can configure Firebase Analytics, Mixpanel, and advertising. In regulated regions, Google’s User Messaging Platform (UMP) may additionally collect advertising consent before AdMob ads are requested.
• Default settings and withdrawal: Firebase Analytics, Mixpanel, and advertising are disabled until you opt in. Firebase Crashlytics is enabled by default because it is essential to detect and fix crashes that affect all users. You can withdraw or reset your consents at any time from Application settings; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

9. Analytics and Diagnostic Tools

The following tools help us understand how Trazavia is used and keep it stable. None of them receive your GPS tracks or private route content unless explicitly described elsewhere in this policy:

• Firebase Analytics (Google): Collects aggregated usage statistics (such as screens visited, session duration, and generic device information) to improve the product. Activated only if you enable “Firebase Analytics” in consent settings. Legal basis: consent.

• Firebase Crashlytics (Google): Automatically collects crash reports, stack traces, and technical context (device model, OS version, app version) to diagnose and fix errors. This processing is necessary to maintain a reliable service and cannot be disabled while using the Application. Legal basis: legitimate interest in service stability.

• Mixpanel (Behavioral Analysis): Records product interaction events in real time (such as feature usage and funnels) when you enable “Mixpanel” in consent settings. On the web, data is routed to Mixpanel’s EU infrastructure. Legal basis: consent.

10. Advertising

Trazavia may display native advertising units to help fund the free tier of the service. Advertising is always subject to your consent:

• Web: Google AdSense may show native ad placements in sections such as Discover, My Trails, and Profile. Ad scripts and ad requests are blocked until advertising consent is granted. If you reject advertising, no ads are displayed.
• Android: Google AdMob may show native ad placements in equivalent sections. In the EEA, UK, and other regulated regions, the Google UMP SDK collects consent before ads are loaded; elsewhere, the in-app advertising toggle applies.
• Personalization: When Google’s consent platform is active, ads may be personalized or non-personalized according to the advertising signals you allow. We do not manually profile users for ad targeting beyond what these Google tools process under your consent choices.
• Publisher declarations: Our domain publishes an ads.txt file listing authorized Google ad sellers, as required by the digital advertising industry. You can review Google’s ad technology policies at https://policies.google.com/technologies/ads

11. Your Rights

As the owner of your data, the GDPR grants you full control over it. You may exercise your rights of Access, Rectification, Erasure, Objection, Restriction, and Portability through the following channels:

1. Directly in the App: You can edit your personal data, manage privacy consents, or request total erasure and deletion of your account from your Profile settings menu.
2. By Writing: Sending an email to our support inbox at[email protected]from the same email address you registered with, indicating the action you wish us to take.

12. Changes to this Privacy Policy

We reserve the right to update this document to reflect technical upgrades in the Application (such as adding new map layers, utility tools, consent mechanisms, or sector legal regulations). Any substantial changes will be visibly notified to you through the Application or via an informational email before they take effect.