Rider App Privacy

1. Who is responsible

2 SHOCKS LTD is the controller for the processing described here. We are registered in England and Wales, company number 17067783, at 2 Spring Corner, High Street, TW13 4PA, Feltham, United Kingdom. Contact info@2shocks.com or write to our registered office for privacy questions and requests.

2. Accounts and device storage

Clerk provides authentication. We use your email address, Clerk identity and account identifiers to authenticate you and associate your records with your account. Clerk handles email verification, sign-in sessions and related device, network and security information. If you choose Google sign-in where available, Google and Clerk handle the profile information used for authentication. Production Google sign-in setup is still pending verification.

The native app uses secure device storage for session persistence and stores settings, privacy choices and bounded pending activity locally. Signing out or uninstalling the app does not erase server-held records. Please do not send passwords or sign-in codes to support.

3. Motorcycle records and documents

We process registrations you look up, rider-confirmed model, variant and year, nickname, optional VIN, mileage, lookup results, saved parts, service plans, private service history, notes and reminders. VIN entry does not verify ownership or connect another rider’s private history. DVSA MOT results, catalogue guidance and rider-entered records are labelled as different sources.

Garage sheets and account exports may contain your motorcycle details, work and notes. Garage PDFs are generated on your device and can be saved or shared through apps you choose. Those apps and recipients handle their copies separately. There is no verified receipt-upload or document-vault service in the current rider offering. Support attachments are processed if you send them to us.

4. Vehicle lookups and garage discovery

Registration lookups use the DVSA MOT History service and stored lookup results. Confirmed motorcycle details are used for catalogue parts and oil guidance. Results and lookup snapshots may be cached; a cached reading is not a fresh inspection. Tax or SORN data is not currently provided.

When you request nearby garages, foreground location permission lets the app obtain your location. Search coordinates and radius pass through our backend to Google Places. A location you choose for a manual search is also processed for that search. The app does not require continuous background location tracking. Map and external-navigation providers process information when you use their services; Android can show a list when a map is unavailable.

We store favourite garage identifiers and account-linked garage activity: listings accessed or saved, recipient email addresses you enter, and email-composer activity. Where the composer reports a sent result, the app can record it. This is operational activity logging, separate from optional experience measurement. A composer result does not verify delivery, acceptance or a reply. You review and send enquiries in your email app; 2Shocks does not send them automatically or read the garage’s replies.

5. Reminders, notifications and support

We store reminder schedules, notification records and your preferences. Device registration, when used, includes a device identifier, platform and push token. Expo’s push service and Apple APNs or Google FCM support configured notification delivery. Automatic MOT reminders, mileage check-ins and saved-parts updates are included in Free; custom reminders require Plus. Delivery is subject to notification settings, device permissions and service availability; storing a reminder does not guarantee a notification arrives.

Support email contains your address, message, attachments and subsequent correspondence. We also process account-linked request, lookup, usage, error and security information needed to operate the service. These operational records are separate from optional advertising-experience measurement.

6. Advertising and your choices

Advertising is enabled in the current production build configuration, subject to eligibility, Google UMP privacy signals and server controls. Actual ad availability and production serving remain subject to provider readiness. Private staging builds use demo ads. Eligible adult Free riders may see Google AdMob banners on Home, Garage, Parts and Service. Plus users, under-18 riders and riders whose age is unknown receive no ads; unresolved entitlement or pending-purchase states also suppress ads.

Use Profile → Privacy to choose an age band and review advertising privacy options. A full date of birth is not required. Refusing consent does not remove app access, but it does not necessarily remove all advertising: Google may serve limited ads where its privacy signals permit. Non-personalized and limited ads are different serving modes; neither should be assumed to involve no data processing. See Google’s explanation of limited ads.

The app requests non-personalized ads and does not deliberately attach your registration, VIN, motorcycle records, service history or precise location to ad requests. Google’s SDK may separately process IP addresses, available device/app identifiers, diagnostics and ad interactions for permitted delivery, measurement and fraud prevention. IP addresses can reveal approximate location. See Google’s Privacy Policy. We do not request Apple cross-app tracking permission in the current build.

Current banner controls delay the first opportunity until at least 24 hours after first reaching Home with a confirmed bike, and cap new impressions at three per session and six in a rolling 24 hours, at least three minutes apart. Server policy may be more restrictive and not every eligible account receives ads. These controls do not promise an ad-free session after consent refusal.

7. Optional experience measurement

“Help improve the app” in Profile → Privacy is a separate opt-in choice, off by default. If enabled, account-linked events can record experiment assignment, ad requests/results and impressions, estimated ad revenue with currency/precision, useful task events and return sessions. Events include identifiers and timestamps; they are not anonymous. The event interface excludes registrations, VINs, precise location, free text and arbitrary extra properties.

Turning the setting off stops new collection and clears queued unsent events on that device. Saving the preference disables further ingestion for your account; the app asks you to retry if saving fails. This does not automatically erase previously accepted events. The backend cleanup rule removes experience events older than 90 days from receipt when the scheduled cleanup executes. This rule does not apply to Google’s own SDK records or to operational garage-activity records.

8. Subscription information

Paid Plus purchasing is not currently configured and verified for public release. If enabled, Apple or Google will handle payment, and RevenueCat and our backend will handle account/customer identifiers, store transaction references, products, entitlement, renewal and expiry information. We do not receive full payment-card details from the store. This describes the intended purchase processing, not evidence of an operational checkout. See subscription information.

9. Purposes and lawful bases

• Providing requested rider services: account access, saved records, requested lookups, garage searches, plans and available entitlements support performance of our contract with you.
• Optional measurement: consent supports optional first-party experience measurement. You may withdraw it without losing app access.
• Device and advertising choices: location and notification permissions control those capabilities. Advertising storage/access follows the applicable consent choices and permitted serving mode; a device permission is not blanket consent for unrelated processing.
• Operation, security and support: legitimate interests support reliable operation, proportionate activity logging, fraud/misuse prevention, troubleshooting and answering enquiries, balanced against your rights.
• Legal obligations: information is processed where needed to handle rights requests and applicable legal requirements.

We do not use motorcycle matching or advertising eligibility to make decisions with legal or similarly significant effects about you.

10. Providers, sharing and processing locations

Relevant providers are Clerk (authentication), Railway (backend and logs), Neon (database), Google Maps/Places (garage searches), Google AdMob/UMP (advertising/privacy choices), Expo and Apple APNs/Google FCM (configured notifications), and GoDaddy/Microsoft 365 (support email). Vercel hosts the website linked from the app. RevenueCat and Apple/Google purchase processing remain subject to commercial setup. Providers’ roles depend on their service and applicable terms. Authorised team members, necessary professional advisers and authorities may also receive information for their relevant purposes. We do not sell your private motorcycle records.

Our team operates from the UK and Romania. The documented Railway backend deployment is in Amsterdam and the Neon database is in AWS London. Other provider processing can occur internationally, including in the United States. UK database hosting does not mean all processing stays in the UK. Confirmation of all applicable provider agreements and international-transfer arrangements is still pending; we do not assert that particular contractual safeguards have already been agreed. Contact us for the information available about your processing.

11. Retention and bike removal

Account and motorcycle records currently remain stored for ongoing service use. Removing a motorcycle detaches it from your garage, clears the rider-entered VIN, nickname and lookup linkage, and cancels active/paused reminders. The detached bike and original rider’s private plans/history remain stored. A new rider does not inherit private history by entering the same registration or VIN; re-adding a bike does not automatically recover it. Ending Plus, signing out and uninstalling the app are separate from account deletion.

A fixed retention schedule for active/inactive accounts, detached records, lookup snapshots, garage activity and operational logs is still pending confirmation. Do not interpret removal or inactivity as automatic erasure. Lookup-cache entries expire under a configured cache lifetime and are removed by scheduled cleanup; that does not erase saved motorcycle records or account-linked lookup snapshots.

Support correspondence is kept while an enquiry is open and for 12 months after closure, with relevant information kept longer only for an unresolved issue, legal obligation or legal claim. The documented Neon recovery-history setting is seven days; it is not the retention period for live rider records or every backup. Provider logs, recovery copies, other backups and any lawfully retained records have separate arrangements. Exact remaining provider retention and recovery details are pending confirmation. Copies you save or share outside 2Shocks are controlled separately.

12. Export and account-deletion requests

Profile → Privacy provides an authenticated account export, including original-rider plans, service history and reminders retained after bike removal, and stored privacy/experience information. Export is not deletion and is not proof that every provider-held security record is included.

The app provides an authenticated account-deletion request and status flow. Follow its verification and confirmation steps. Ordinary rider records can be processed automatically; subscription, billing or shared garage records may require individual review and provider coordination. See Request deletion of your 2Shocks account for the outside-app pathway, verification, scope and timing. Neither opening an email draft nor submitting a request means erasure is complete.

13. Your rights and younger riders

Depending on the circumstances, you can request access, correction, erasure, restriction, objection or portability and withdraw consent without affecting earlier lawful processing. Contact our email or registered office. We may need proportionate identity verification. Requests are normally free and handled without undue delay, normally within one calendar month, with any applicable extension or refusal explained. This is distinct from a guarantee that all deletion completes within a particular service target.

You can complain directly to the Information Commissioner’s Office without first complaining to us. The intended app audience is UK riders aged 16 and over; this is not a claim of verified age checks. The advertising age-band choice is separate. Under-18 and unknown-age riders receive no ads. We will update this notice and provide appropriate notice of material changes.