Privacy Policy

Introduction

DriftPulse ("we," "us," "our," or "DriftPulse") operates the DriftPulse mobile application (iOS and Android). This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal data when you use our application and services at driftpulse.io.

We take your privacy seriously and are committed to being transparent about our data practices. Please read this policy carefully. If you do not agree with our practices, please do not use DriftPulse.

What Data We Collect

Account Information

• Email Address: Required for account creation and authentication
• Password Hash: Securely stored for authentication purposes
• Profile Data: Optional display name or profile information

Telemetry Data

When you record a drift session, we collect the following telemetry data:

• GPS Location: Latitude, longitude, and altitude coordinates
• Speed & Velocity: Current and derived velocity vectors
• Acceleration: Linear acceleration in three axes (X, Y, Z)
• Gyroscopic Data: Rotational data (yaw, pitch, roll)
• Drift Angle: Vehicle drift angle calculated from sensor fusion
• G-Forces: Gravitational force measurements
• Trajectory Data: Historical track and calculated metrics (lateral acceleration, steering input, etc.)
• Timestamps: Precise time data for all measurements

Session Recordings

• Raw sensor data files from your drift sessions
• Session metadata (duration, date, location, track name)
• Processed analytics (peak G-force, max drift angle, etc.)

Device Information

• Device Model: iPhone or Android device type
• OS Version: iOS or Android version
• App Version: DriftPulse application version
• Device Identifier: Unique device ID for session tracking
• Bluetooth Sensor Info: RaceBox Mini sensor firmware version and status

Live Sharing Data

When you enable live sharing, we collect metadata about your sharing session:

• Sharing session identifiers
• Live telemetry stream indicators
• Recipient information (if applicable)

Bluetooth Low Energy Sensor Data

DriftPulse communicates with the RaceBox Mini GPS/IMU sensor via Bluetooth Low Energy (BLE). The following data is collected from the sensor:

BLE Connection: BLE communication is local and direct between your mobile device and the RaceBox Mini sensor. No BLE data is transmitted to DriftPulse servers until you explicitly save or share a session.

How We Store Your Data

Storage Location

All DriftPulse user data is stored in AWS (Amazon Web Services) data centers located in eu-central-1 (Frankfurt, Germany), ensuring your data remains within the European Union.

Encryption

• In Transit: All data transmitted to DriftPulse servers is encrypted using TLS 1.2+ (HTTPS)
• At Rest: Session data and sensitive account information are encrypted at rest using AWS KMS (Key Management Service) with AES-256 encryption
• Database: Personally identifiable information in our database is encrypted

Data Retention

We retain your data for as long as your account is active. You can request deletion at any time (see "Your Data Rights" section). If your account is inactive for 12 months, we may contact you to confirm continued use. Session recordings are retained indefinitely unless you delete them or request account deletion.

Backup & Redundancy

Your data is backed up for disaster recovery purposes and stored across multiple AWS Availability Zones. Backups are retained for up to 30 days.

Data Sharing & Live Telemetry

Default Privacy

By default, your session data is private. We do not share your telemetry data with anyone without your explicit permission.

Live Sharing Feature

When you enable "Live Sharing" for a session, your real-time telemetry is transmitted via AWS IoT Core and MQTT protocol to designated viewers. The following occurs:

• You generate a unique share link or invite specific users
• Real-time telemetry is streamed to authorized viewers only
• Data is transmitted encrypted through AWS IoT Core
• Viewers can see live GPS position, speed, G-forces, and drift angle
• Viewers cannot download or export the raw data (sharing controls managed by you)

No Third-Party Sharing

We do not sell, trade, or share your personal data with marketing companies, analytics firms, or any third parties except as described in this policy and with your explicit consent. Your telemetry data is not shared with:

• RaceBox or sensor manufacturers
• Social media platforms (unless you explicitly integrate)
• Sponsors or partner organizations
• Data brokers or marketing companies

Live Share Session Termination

You can revoke live sharing access at any time through the DriftPulse app. Revocation is immediate; viewers will no longer receive telemetry updates.

Your Data Rights

Access Your Data

You have the right to request a complete copy of your personal data that we hold. Contact us at support@driftpulse.io to request a data export. We will provide your data in a commonly used, machine-readable format (JSON or CSV) within 30 days.

Delete Your Data

You can delete individual sessions or request complete account deletion:

• Single Session: Delete sessions directly in the DriftPulse app
• Complete Account Deletion: Request account deletion at support@driftpulse.io. We will delete all associated data within 30 days, except where legally required to retain records

Correct Your Data

You can update your account information (email, profile name) directly in the DriftPulse app settings.

Data Portability

You can export your session data in standard formats for use with other telemetry analysis tools. Request this via support@driftpulse.io.

Opt-Out of Non-Essential Processing

You can disable analytics and crash reporting in app settings. Telemetry data collection cannot be disabled as it is core to app functionality.

Analytics & Crash Reporting

Current Status

DriftPulse currently does not collect analytics or crash reporting data. All telemetry collected is session-specific and user-initiated.

Future Analytics

In the future, we may implement optional analytics to improve the app experience. If we do, we will:

• Notify you before enabling analytics collection
• Provide clear opt-in or opt-out controls in app settings
• Anonymize analytics data to prevent identification
• Store analytics data separately from personal account data

Crash Reporting

If we implement crash reporting in the future, it will include:

• App version, device model, and OS version
• Error logs and stack traces
• No personal user data or session telemetry
• Optional user-provided feedback about the crash

Third-Party Services

AWS Services

DriftPulse uses the following AWS services in eu-central-1:

• Amazon Cognito: User authentication and account management
• Amazon RDS/DynamoDB: Session and user data storage
• AWS IoT Core: Real-time data streaming for live telemetry
• AWS KMS: Data encryption
• AWS CloudWatch: Application monitoring and logging

View AWS Privacy Policy

RaceBox

DriftPulse communicates with RaceBox Mini sensors via Bluetooth. RaceBox does not receive your telemetry data unless you explicitly export or share it. No personal account data is shared with RaceBox.

No Other Third Parties

We do not use email marketing, web analytics, or CDN services that would process your personal data.

GDPR & Data Protection

Data Controller

DriftPulse acts as the Data Controller for personal data collected through the app.

Legal Basis for Processing

We process your data under the following legal bases:

• Contract (GDPR Art. 6(1)(b)): Telemetry data collection is necessary to provide the app service
• Consent (GDPR Art. 6(1)(a)): Live sharing, analytics, and crash reporting (optional)
• Legitimate Interest (GDPR Art. 6(1)(f)): App security, fraud prevention, system reliability

Data Subject Rights (GDPR)

EU residents have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure ("right to be forgotten") (Art. 17)
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to lodge a complaint with a supervisory authority

International Data Transfers

All data is processed and stored in eu-central-1 (Frankfurt). No data transfers outside the EU occur without explicit consent and appropriate safeguards.

Data Protection Impact Assessment

DriftPulse has completed a Data Protection Impact Assessment for telemetry processing. For a copy, contact support@driftpulse.io.

Security

We implement comprehensive security measures to protect your data:

• Transport Security: TLS 1.2+ encryption for all data in transit
• Data Encryption: AES-256 encryption at rest using AWS KMS
• Authentication: Secure password hashing and optional multi-factor authentication (future)
• Access Control: Role-based access control for backend systems
• Logging: Security audit logs with immutable storage
• Penetration Testing: Regular security assessments
• Incident Response: Documented incident response plan

Disclaimer: While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your data.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us:

EU Representative

For GDPR inquiries, contact: support@driftpulse.io

Supervisory Authorities

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority:

• Germany (Hessischer Datenschutzbeauftrager): datenschutz.hessen.de
• Other EU Countries: Visit EDPB Members Directory

Changes to This Policy

DriftPulse may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notification. Your continued use of the app after changes means you accept the updated policy. Please review this policy regularly.