Legal

Privacy Policy

Effective: April 15, 2026 · Last updated: May 8, 2026

Rekvio ("we," "us," or "our") is operated by DaBuilds. This privacy policy explains how we collect, use, store, and protect your information when you use the Rekvio mobile application (iOS and Android) and our website at rekvio.app. By using Rekvio, you agree to the practices described in this policy.

Rekvio is built on a simple principle: your data helps make your bike maintenance smarter, and nothing else. We collect only what we need, we never sell it, and you can delete it any time.

1. What We Collect

We collect information you provide directly when using Rekvio:

• Account information — email address, display name, and (where available) profile photo when you create an account. The exact data depends on your sign-in method: Sign in with Apple may provide your name and a real or private relay email address (Apple's "Hide My Email"), along with a stable Apple-issued user identifier; Google Sign-In provides your name, email address, and profile photo; email/password sign-up provides only the email address you enter. See Section 2 for full details on each option
• Bike details — make, model, year, engine type, category, displacement, and odometer reading
• Bike photo — if you choose to add a photo of your motorcycle, it is stored locally on your device only and is not uploaded to our servers
• Service logs — service type, date, odometer at time of service, cost, and notes you enter
• Riding preferences — riding pattern (chill, mixed, aggressive) and distance unit preference (km or miles)
• Notification preferences — whether you have enabled service or odometer reminders
• Device identifiers — if you enable push notifications, we receive a device push token from Apple Push Notification Service (iOS) or Firebase Cloud Messaging (Android) to deliver notifications to your device. This token is not used for tracking or advertising
• Crash diagnostics — when the app crashes or encounters an unhandled error, Firebase Crashlytics automatically sends a crash report containing the native and JavaScript stack trace, device model, OS version, app version, locale, a Crashlytics-generated Installation UUID (a pseudonymous per-install identifier — not the advertising ID — that lets us de-duplicate reports and is reset when you reinstall the app), and your IP address (collected briefly by Google to derive coarse country/region, then discarded — the full IP is not retained). When a JavaScript error is caught by the in-app error boundary, we additionally attach the React component stack (a list of component names involved in the error — no user content) so we can locate the bug. We do not attach a user ID to crash reports (we do not call setUserId), and we do not log your email, name, bike details, service logs, or any other personal content as custom keys or messages. We use this data only to identify and fix bugs. See Section 6 for details

We also store the following data locally on your device to improve the app experience. This data is never transmitted to our servers:

• App visit count and last visit date (to personalise prompts within the app)
• Notification dismissal timestamps (to avoid repeating dismissed reminders)
• Onboarding draft state (so you can resume setup if interrupted)

We do not collect:

• Your location or GPS data
• Your contacts or address book
• Any data from other apps on your device
• Browsing history or tracking data

2. Sign-In Options

Rekvio supports three sign-in options. You choose which one to use; we receive only the data described below for the option you pick.

• Sign in with Apple — When you use Sign in with Apple, Apple may share your name and email address (or a private relay address that forwards to your personal inbox via Apple's "Hide My Email" feature) with Rekvio. Apple also issues a stable, Apple-specific user identifier that we store to recognise you on future sign-ins. We use this information only to create and identify your account. We do not share Rekvio data back to Apple for advertising or profiling, and Apple does not track your activity within Rekvio
• Google Sign-In — When you use Google Sign-In, Google may share your name, email address, and profile photo with Rekvio. We use this information only for your account. We do not share Rekvio data back to Google for advertising or profiling
• Email and password — When you sign up with an email address and password, we store only the email address. Your password is never stored by Rekvio — it is hashed and managed by Firebase Authentication

You can sign out at any time. Account deletion (Settings → Profile → Delete Account, or by emailing us) removes all your data within 30 days, including your sign-in provider linkage. See Section 8 for full deletion details.

3. How We Use Your Data

Your data is used exclusively to provide and improve the Rekvio service:

• Calculate personalised service intervals for your specific bike and riding style
• Estimate your current odometer based on your riding pattern
• Send push notifications when services are due or your odometer needs updating
• Display your service history and maintenance records
• Sync your data across devices when you are signed in
• Authenticate your identity and secure your account
• Respond to your support requests or data inquiries

4. Guest Users

You can use Rekvio without creating an account. As a guest, all your data — bike details, service logs, preferences — is stored locally on your device only. This data is not transmitted to our servers.

If you uninstall the app or clear app data, your guest data will be permanently deleted. We recommend creating a free account to back up your service history.

Guest-to-account migration: If you create an account after using Rekvio as a guest, your existing bike details and service logs are migrated from your device to our cloud servers. Once migration is complete, the local-only copy is removed and your data is stored in Firestore going forward. This is a one-time, one-way transfer that enables backup and multi-device access. Your migrated data is never shared, sold, or used for advertising.

5. Data Storage and Security

For signed-in users, your data is stored securely in Google Cloud infrastructure (United States) with encryption in transit and at rest.

We implement the following security measures:

• All data is encrypted in transit using TLS/HTTPS
• Data at rest is encrypted using Google Cloud's default encryption (AES-256)
• Firestore security rules ensure users can only read and write their own data
• Passwords are never stored in Rekvio — authentication is handled securely by Google Firebase Authentication or Google Sign-In
• We conduct regular reviews of our security rules and access controls

6. Third-Party Services

Rekvio uses the following third-party services to operate. Each service only receives the minimum data required for its function:

• Google Firebase Authentication — handles account creation and sign-in across all three options (Sign in with Apple, Google Sign-In, email/password). Receives your email and (depending on the option you choose) your name, profile photo, Apple-issued user identifier, or a hashed password. Subject to Google's Privacy Policy. Data processed in the United States
• Sign in with Apple (provided by Apple Inc.) — used only when you choose this sign-in option. Apple sends your name and an email address (which may be a "Hide My Email" private relay address) plus a stable Apple-specific user identifier so we can recognise you on future sign-ins. Apple does not receive any Rekvio data in return and does not track your activity within the app. Subject to Apple's Privacy Policy
• Google Cloud Firestore — stores your bike details, service logs, and preferences for signed-in users. Subject to Google Cloud's Privacy Notice. Data processed in the United States
• Apple Push Notification Service / Firebase Cloud Messaging — delivers push notifications to your device when services are due. We send only your device push token and notification content to these services. No personal data is included in notification payloads beyond the service name
• Firebase Crashlytics (provided by Google LLC) — collects crash reports and unhandled error logs to help us identify and fix bugs and improve app stability. Data sent: native and JavaScript stack traces, device model, OS version, app version, locale, a pseudonymous Crashlytics Installation UUID (random per-install identifier, not the advertising ID, reset on reinstall), and an ephemeral IP address (used by Google to derive coarse country/region, then discarded — full IP is not retained). The in-app error boundary additionally attaches the React component stack (component names only) for caught JavaScript errors. We do not attach your Rekvio user ID, and we do not log your email, name, bike data, service logs, or any other personal content as custom keys or messages, so crash reports cannot be linked back to your Rekvio account. Data is encrypted in transit and processed by Google in the United States. Crashlytics retains crash data for approximately 90 days. Subject to Google's Privacy Policy and Firebase Privacy Information
• Expo Application Services — used to build and distribute the app. Expo does not receive or process your personal data at runtime. See Expo's Privacy Policy
• Third-party retailers — affiliate links in the Compatible Parts section (e.g. RevZilla, Amazon). Clicking these links opens their websites in your browser, subject to their own privacy policies and cookie practices. We receive a small commission on purchases at no extra cost to you. We do not share any of your Rekvio data with these retailers

Aside from Firebase Crashlytics (used solely for anonymous crash diagnostics, as described above), we do not use any product analytics SDKs, advertising SDKs, tracking pixels, or cookies in the Rekvio app. Crashlytics receives no personal data, no behavioural events, and no screen-tracking — only crash and error reports.

Our website (rekvio.app) does not use cookies, tracking pixels, analytics tools, or local storage. No personal data is collected on the website.

7. Push Notifications

Rekvio may send push notifications to remind you when services are due or when your odometer may need updating. These are entirely optional and require your explicit permission through the standard iOS or Android permission prompt. You can disable notifications at any time in:

• Your device Settings → Notifications → Rekvio
• The Rekvio app under Profile

We do not track or analyse your notification interactions. Notification scheduling is performed locally on your device. We store a device push token only to deliver notifications — this token is not used for any other purpose and is not linked to your identity for advertising or analytics.

8. Data Retention and Account Deletion

Your data is retained as long as your account is active. We do not retain data beyond what is necessary to provide the service.

Account deletion: You can delete your account at any time from Settings → Profile → Delete Account inside the Rekvio app, or via the web at rekvio.app/delete-account, or by emailing dabuilds@rekvio.app. When you delete your account:

• Your account authentication record is immediately deleted from Firebase Authentication
• All your data — including bike details, service logs, preferences, and any waitlist entries — is permanently deleted from our servers within 30 days
• Your device push notification token is invalidated
• This action is irreversible — deleted data cannot be recovered

Guest users: If you use Rekvio as a guest, all your data is stored only on your device. Uninstalling the app or clearing app data permanently deletes it.

If you have not used Rekvio for 24 months and have no active account, we may delete your data after providing 30 days' email notice to your registered email address.

Crash diagnostic data: Anonymous crash reports collected by Firebase Crashlytics are retained for 90 days by default and then automatically deleted, in line with Google's standard Crashlytics retention. Because these reports do not contain identifiers, they cannot be linked back to your account or device after deletion.

9. Your Rights

You have the right to:

• Access — request a copy of all data we hold about you
• Correction — update or correct any inaccurate data
• Deletion — delete your account and all associated data
• Portability — request a machine-readable copy of your data
• Objection — object to any processing of your data

To exercise any of these rights, contact us at dabuilds@rekvio.app, use Settings → Profile → Delete Account in the app, or visit rekvio.app/delete-account.

10. Children's Privacy

Rekvio is designed for motorcycle owners and riders and is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 in the European Economic Area). If you believe we have inadvertently collected information from a child, please contact us immediately at dabuilds@rekvio.app and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by sending a push notification through the app, by email to your registered email address, or by prominently posting a notice within the app at least 7 days before the changes take effect. The effective date at the top of this policy indicates when the current version became active.

Continued use of Rekvio after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account as described in Section 8.

12. Applicable Law and Regional Rights

This privacy policy is governed by the laws of the United States.

European Union (GDPR)

If you are in the EU/EEA, our legal basis for processing your data is:

• Contract performance — processing your bike details, service logs, and preferences is necessary to provide the Rekvio service you signed up for
• Legitimate interest — sending service reminders based on your maintenance schedule, and processing pseudonymous crash diagnostics (Firebase Crashlytics) to keep the app stable and secure. Our legitimate interest in fixing crashes is balanced against your privacy by collecting only diagnostic data (no account identifiers, no content) and discarding IP addresses after coarse geolocation
• Consent — push notifications and marketing emails, which you can withdraw at any time

You have the right to access, rectify, erase, restrict processing, data portability, and to lodge a complaint with your local data protection authority. For any GDPR inquiries, contact our data protection contact at dabuilds@rekvio.app.

California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Categories of personal information collected: Identifiers (email, name), vehicle information (bike make/model/year/odometer/engine type), service activity data (service logs, riding preferences, cost records), and internet/device information (anonymous crash reports — device model, OS version, app version, stack traces — collected via Firebase Crashlytics solely for bug fixing; no identifiers attached)
• Purpose of collection: To provide the Rekvio motorcycle maintenance service as described in Section 3
• We do not sell your personal information. We have never sold personal information and have no plans to do so
• We do not share your personal information for cross-context behavioral advertising
• Right to know: You can request what data we collect about you and how it is used
• Right to delete: You can request deletion of your personal information
• Right to correct: You can request correction of inaccurate personal information
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• To exercise your CCPA/CPRA rights, email dabuilds@rekvio.app. We will verify your identity and respond within 45 days

Canada (PIPEDA)

If you are a Canadian resident, you have the right to access and correct your personal information. Your data is processed in the United States. By using Rekvio, you consent to the transfer of your data outside Canada. To submit a PIPEDA request, email dabuilds@rekvio.app.

13. In-App Access

This privacy policy is accessible at any time from within the Rekvio app under Profile, and on our website at rekvio.app/privacy.

14. Contact Us

Rekvio is operated by DaBuilds. For all privacy-related inquiries, data protection requests, GDPR, CCPA/CPRA, or PIPEDA questions, contact: