Privacy Policy

1. Who We Are

Papap ("we", "our", or "us") is a motorcycle community platform available as a mobile application on iOS and Android. This Privacy Policy explains how we collect, use, store, and share information about you when you use the Papap app or visit our website at papap.co.

By creating an account or using Papap, you agree to the practices described in this policy.

2. Data We Collect

2.1 Account & Profile Information

When you register or update your profile, we collect:

• Email address
• Username
• Password (stored as a secure hash — we never store plain-text passwords)
• Profile photo
• Profile description
• Home location (address name and GPS coordinates you choose to set)
• Phone number (required to create a Roadside Assist profile; visible to other users in the app)

If you sign in with Google or Apple, we receive the name and email address associated with that account. We do not receive your Google or Apple passwords.

2.2 Location Data

Papap collects your device's precise GPS location ("foreground location") when the app is open and in use. This is used to:

• Discover group rides and events near you
• Find nearby Roadside Assist helpers
• Display location-relevant Moments

Location data is cached on your device for up to 15 minutes to reduce battery usage. We do not track your location in the background when the app is closed.

Location shared with other users: If you create a Roadside Assist profile and set it to available, your approximate current location will be visible to other Papap users who are searching for nearby assistance. You can remove this visibility at any time by setting your Roadside Assist profile to unavailable or by deleting the profile.

2.3 Content You Create

• Events — title, description, location, date/time, route waypoints, photos (up to 9), participant settings
• Moments — photos, captions (up to 300 characters), optional location tag
• Garage — motorcycle brand, model, year, nickname, photos (up to 5)
• Roadside Assist profile — service types, available resources, availability schedule, service radius, notes
• Chat messages — text messages sent in event group chats
• Comments and likes — on Moments

2.4 Device & Technical Data

• Firebase Cloud Messaging (FCM) device token — for push notifications
• App language preference
• Crash reports and error logs (via Firebase Crashlytics)
• Session tokens (JWT access and refresh tokens, stored locally on your device)

2.5 Notification Preferences

We store your in-app notification settings, including preferences for new event alerts, event reminders, chat notifications, and your notification radius.

3. How We Use Your Data

4. Third-Party Services

We use the following third-party services to operate Papap. Each has its own privacy policy.

We do not sell your personal data to advertisers or data brokers.

5. Device Permissions

Papap requests the following device permissions. You can revoke any permission at any time in your device settings.

6. Data Sharing

We share your information only in the following circumstances:

• With other Papap users — your username, profile photo, motorcycles in your garage, Moments, and public events are visible to other users of the app. Your Roadside Assist profile (including phone number, if provided) is visible to users searching for nearby help.
• With service providers — only as described in Section 4 above, and only to the extent necessary to provide the service.
• Legal requirements — if required by law, court order, or to protect the rights and safety of our users.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

We do not sell, rent, or trade your personal data.

7. User-Generated Content & Community Safety

Papap is a community platform where users create and share content including photos, event listings, Moments, and chat messages. We are committed to maintaining a safe and respectful environment for all users. Papap facilitates real-world interactions between users. Users should exercise caution when communicating with others and when meeting in person. Papap does not conduct background checks and is not responsible for user behavior.

7.1 Content Standards

The following content is not permitted on Papap:

• Nudity or sexually explicit material
• Real-world graphic violence outside of a newsworthy context
• Harassment, hate speech, or threats directed at other users
• Content that violates our Terms of Service

7.2 User Safety Tools

Papap provides the following tools to help you control your experience:

• Block users — you can block another user to prevent them from interacting with you or viewing your content.
• Report users or content — you can report users or specific content (Moments, comments, profiles) that you believe violates our community standards, using the report option available directly in-app.

7.3 Content Moderation

Reports submitted by users are reviewed by our team. We may remove content that violates our Terms of Service and take action — including suspension or permanent removal — against accounts that repeatedly breach community standards.

7.4 Event Participant Controls

When creating an event, organisers can configure participant settings to restrict who may join or view event details, allowing interactions to be limited to approved participants only.

8. Data Retention & Account Deletion

We retain your data for as long as your account is active. You have the right to delete your account and all associated data at any time.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Correction — update inaccurate or incomplete data (available directly in-app)
• Deletion — delete your account and associated data (available in app Settings → Delete Account)
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — for location or notifications, revoke permission in your device settings at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

Papap is not intended for children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Cookies & Tracking (Website)

Our website (papap.co) uses the following technologies:

• Google Tag Manager & Google Analytics — collects data about how visitors use our website (pages visited, session duration, device type, traffic sources). See Google's Privacy Policy.
• Meta Pixel — loaded only if you accept marketing cookies in our banner; tracks page views and interactions to measure ad effectiveness. See Meta's Privacy Policy.

You can accept or decline marketing cookies (Meta Pixel) using the banner shown on your first visit. Google Analytics runs regardless of that choice. You can change your marketing preference at any time by clearing your browser's local storage for this site.

Essential functionality (the cookie consent preference itself) is stored in your browser's localStorage and does not require consent.

12. Security

We take reasonable technical and organisational measures to protect your data, including:

• All data transmitted between the app and our servers is encrypted using HTTPS/TLS
• Passwords are stored as secure hashes — never in plain text
• Authentication uses short-lived JWT access tokens with refresh token rotation
• Media files are stored in Cloudflare R2, accessed only via time-limited presigned URLs
• Firebase Crashlytics is used to detect and resolve security-related crashes promptly

No system is completely secure. If you discover a security vulnerability, please report it responsibly to [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app or by email at least 14 days before the changes take effect. The "last updated" date at the top of this page always reflects the most recent revision.

Continued use of Papap after changes take effect constitutes acceptance of the revised policy.

14. Child Safety & Prevention of Sexual Exploitation

Papap has a zero-tolerance policy for child sexual abuse and exploitation (CSAE).

We strictly prohibit any content or behavior that involves, promotes, or facilitates the sexual exploitation or abuse of minors. This includes, but is not limited to:

• Sharing, uploading, or distributing any content depicting minors in a sexual context
• Grooming, solicitation, or inappropriate communication involving minors
• Any attempt to exploit or harm children through the platform

Detection and Moderation

We actively monitor reports submitted by users and take immediate action against violating content or accounts. This may include:

• Removal of content
• Temporary suspension
• Permanent account termination

Reporting and Cooperation with Authorities

Papap complies with applicable laws regarding child safety and will report confirmed cases of child sexual abuse or exploitation to the appropriate legal authorities.

User Responsibility

Users are encouraged to report any suspicious behavior or content directly within the app using the available reporting tools.

Age Restrictions

Papap is not intended for users under the age of 17, and we do not knowingly allow minors to use the platform.

15. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or how we handle your data:

• Email: [email protected]