1. Introduction
Welcome to Trialoop ("we," "us," or the "Company"). Trialoop is a motorcycle trial race management application that enables marshals to score riders, spectators to view live leaderboards, and organizers to manage races.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Trialoop mobile application (com.trialoop.trialoop_marshal) and related services.
We are committed to complying with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy legislation. We continuously review our practices to align with these regulations.
- Company: Trialoop
- Website: https://trialoop.com
- Contact: contact@trialoop.com
2. Data Controller
Trialoop acts as the Data Controller for personal data collected through the App. For data protection inquiries: contact@trialoop.com.
3. Data We Collect
3.1 Account Data (Organizer Mode Only)
| Data Type | Details |
|---|---|
| Email address | Required for account creation and authentication |
| Sign in with Apple or Google | If you choose “Continue with Apple” or “Continue with Google”, we only receive your e-mail address (possibly Apple's relay address), your name and a provider identifier. No photo or other data is imported. |
| Password | Hashed via Supabase Auth — never stored in plain text |
Account creation is required only for Organizer mode. Marshals and spectators can use the App without an account.
3.2 Device Information
| Data Type | Details |
|---|---|
| Install identifier | A random identifier created by the app on your phone at installation. It is not linked to the hardware, your phone number or a SIM card: it is not a device fingerprint. It is used for usage statistics (3.6) and, if you sign in to an account or take part in an official race, for the security and smooth running of races (3.7). On iPhone, the system may keep it after the app is uninstalled. |
| Phone type | Model, system (iOS or Android) and version, app version: compatibility, support and statistics |
| Approximate place | Country, city and region where the phone was seen (low-precision location or IP address), see 3.4 |
We NEVER take a fingerprint of your phone: no IMEI, no serial number, no MAC address, no advertising identifier, no hardware fingerprint. The only exception, which does not concern users: the phones of Trialoop kits (owned by Trialoop or by a customer), whose IMEI is typed by the organizer for inventory.
3.3 Race Data
| Data Type | Details |
|---|---|
| Race scores | Entered by marshals, stored on our server |
| Offline score cache | Temporarily stored locally in SQLite for offline functionality |
3.4 Location Data
Only a low-precision location is requested, with your permission, never in the background. Friends Race does not share your position with your friends. When the app registers your phone or a race starts, the approximate position, country, city and region are recorded on our servers with the install identifier and the IP address of the connection. 12 months after the last use of the app, the IP address and the recorded position are erased: at most the country is kept.
3.5 Biometric Data
Face ID / fingerprint — processed entirely on your device by the operating system. We never receive, transmit, or store your biometric data.
3.6 Usage statistics (simple use, Friends Race included)
Trialoop stores neither the plan, nor the scores, nor your friends' names. At the end of a private race, the app only sends usage statistics: phone type, approximate place (position rounded to about 1 km), number of participants, zones, laps, date and duration. The app does not link them to your account: no account, e-mail or name goes with them (the install identifier is a pseudonym). The install identifier sent is the random identifier described in 3.2 (not a device fingerprint); it is only used to count private races per phone.
3.7 Taking part in an official race
If you take part in an official race (as a judge, helper, organizer or registered rider), we record more data. For each race action (scores, badge scans, starts, table passages (confirmed or forced cases), corrections, protests, validations…), we record the install identifier, the phone type and the signed-in account if there is one (otherwise the helper card or the zone activated by code), with the date and value of the action.
Why: security, the smooth running of the race and the handling of protests and disputes (legitimate interest, Art. 6(1)(f) GDPR). When you sign in to your account in the app, the install identifier is also associated with your account (one account = one active phone), with a history of sign-ins, takeovers and phone changes. Retention: see section 7. The export of your data and the account deletion cover this information (section 11).
4. Hardware Features We Access
| Feature | Purpose | Required? |
|---|---|---|
| Camera | QR code scanning for rider identification | No (marshals only) |
| NFC | NFC tag reading for rider identification | No (marshals only) |
| Bluetooth | Connection to label printer | No (printing only) |
| Location | Registration, Friends Race & usage analytics | No (on request) |
| Biometrics | Securing Organizer mode | No (organizers only) |
5. How We Use Your Data
We process your data solely to provide the race management service. We do not use your data for advertising, user profiling, or selling to third parties.
6. Data Sharing and Third Parties
We use Supabase as our data processor (database hosting). No data is shared with advertising networks, analytics providers, or data brokers.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Organizer account data | Until account deletion + up to 30 days for backup removal |
| Race scores | As required by federation regulations (typically up to 5 years) |
| Race journal (organizer log, score corrections, scans and cards, zone activations) | As long as the results exist, then anonymized 3 years after the race: account, name, e-mail, phone and IP address removed; action, value, date and the phone reduced to its type kept |
| Phone-account history and account audit trail | 12 months |
| IP address and precise positions of installations | 12 months after the last use, then the IP is erased and at most the country is kept |
| Technical log sent by phones | 90 days |
| Who entered a score, filed a protest or validated a result | Kept with the race results; detached from your account if you delete it |
| Usage statistics (Friends Race) | Kept, not linked to your account |
| Biometric data | Never stored by us (on-device only) |
8. Data Security
- Encryption in transit: TLS 1.2 or higher
- Encryption at rest on the database
- Passwords hashed via Supabase Auth
- API keys stored in device Keychain/Keystore
- Server-side role-based access control (RBAC)
9. Your Rights (GDPR)
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate data |
| Erasure | Request deletion of your account directly from your profile or by emailing contact@trialoop.com |
| Restriction | Request limitation of processing |
| Data Portability | Download a copy of your data directly from your profile (structured JSON format) |
| Object | Object to processing based on legitimate interests |
| Withdraw Consent | Withdraw consent at any time |
To exercise these rights: log in to your profile or email contact@trialoop.com. We respond within 30 days.
10. Trialoop Market
The Market lets riders and shops buy and sell equipment. We process the following data for this service:
- Listings and photos: title, description, price, city, photos (EXIF metadata, including geolocation, is removed on upload).
- Messages between buyer and seller, and listing reports.
- Orders: items, amounts, status, carrier and tracking number, and the delivery address (shared only with the seller concerned).
- Professional shops: legal identity, company and VAT numbers, address, return policy (publicly displayed on the storefront).
Online payments are processed by Stripe, an independent payment provider and data controller for banking data, which never passes through our servers. Professional sellers open a Stripe account in their own name.
| Type | Duration |
|---|---|
| Orders | Kept for accounting and legal obligations |
| Listings, photos and messages | Deleted with the account |
11. Account Deletion
You can request account deletion directly from your profile page (section Privacy & Personal Data). Your request will be processed within 15 days. We reserve the right to contact you beforehand — for example to verify your identity or handle specific cases (e.g. if you are a federation organiser). You may cancel your request at any time during that period.
You may also submit your request by email to contact@trialoop.com with subject "Account Deletion Request".
The export of your data (profile page) and the account deletion cover the information of section 3.7: the export contains the scores entered and protests filed with your phone, and the history of your phones; on deletion, race journals are kept with no link to you (anonymization) and the phone-account history is detached from your account.
12. Children's Privacy
The App is not directed at children under 16. We do not knowingly collect personal data from children.
13. Changes to This Policy
We may update this Privacy Policy. The "Last Updated" date will be modified accordingly. For material changes, we will notify you through the App.
14. Contact Us
- Email: contact@trialoop.com
- Website: https://trialoop.com