Privacy policy

Last updated: November 2026

DriveLink is an app for car enthusiasts. It shows places, meets and other users on a map. That isn't possible without location data, so we explain here as precisely as we can what we do with what, what is optional and how you can switch everything off again. This policy applies to the app and to the website drivelink-app.de (for the website, see section 9).

1. Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Jakob Lischke
Kohlenstraße 46
01189 Dresden
Germany

Email: support.drivelink.app@gmail.com

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Account and profile

You need an account to use DriveLink. For this we process:

• Email address – for signing in, resetting your password and important account notices
• Password – only as a cryptographic hash; we cannot see your password
• Username and display name – your real name is not required, any name you choose is fine
• Optional profile details – profile picture, bio, vehicle details in your garage

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

3. Location data

Location data is the most sensitive type of data in DriveLink. We process it in four independent contexts.

a) Live map

While the app is open, your position can be shared with other users so you can see each other on the map. You decide who sees you: all users, only your friends or nobody. The app asks you the first time you open the map; until you decide, you are not visible to anyone. You'll find the setting in the app under Settings → Privacy → Visibility on the map, and you can change it at any time. If you choose "nobody", your position is no longer shared with others.

Ghost Zones (see below) apply regardless: inside a Ghost Zone you don't appear on the map, even with the setting "everyone".

Legal basis: Art. 6(1)(b) GDPR (core function of the app).

b) Recording routes

When you record a drive, we store the route you drove with timestamps so we can show it to you afterwards. At your request, recording continues when you lock the screen or put the app in the background. For this the app asks for a separate permission ("Always allow"). If you don't grant it, recording stops as soon as the app goes to the background – all other features remain available.

Legal basis: Art. 6(1)(b) GDPR.

c) Road heatmap

DriveLink can show on the map which roads the community drives often. If you agree, the app contributes to this automatically while you drive – even if you haven't started a recording.

How it works technically: Your positions are matched to existing road segments. All that is stored is a counter per segment and the number of different people who have driven it. No individual drives and no movement profiles are stored. A road segment only becomes visible on the map once at least three different people have driven it; an individual person's route cannot be reconstructed from this.

This feature is optional. The app asks you once, explicitly, whether you want to contribute. Data is only collected after you agree; if you decline or don't answer, you don't contribute anything. You can change your decision at any time under Settings → Privacy.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future by turning off contributing in the settings.

d) Lap times on race tracks

When you are on one of the race tracks stored in the app, DriveLink can time your laps. For this, position data within the track layout is processed. Timing only starts on closed race tracks and only when your device is verifiably on the stored track layout. No timing takes place on public roads.

We store the timed laps in your account so you can look at and compare your times later. There is currently no public leaderboard of lap times.

Legal basis: Art. 6(1)(b) GDPR.

e) Drive statistics

While DriveLink is open or a recording is running, the app detects when you are driving and counts the distance, duration and top speed of the drive. Of this, only summarised values are stored, never the route itself:

• in your profile, your total kilometres driven, your longest drive and the highest speed measured so far,
• a weekly recap with the distance driven, number of drives, top speed and spots added that week.

The driving data in your profile is visible only to you and your friends; the weekly recap only to you.

Legal basis: Art. 6(1)(b) GDPR.

Ghost Zones – areas where nothing is recorded

You can define areas in the app, for example around your home or workplace. Inside these Ghost Zones you are invisible to other users, and no position data is collected there for the road heatmap either.

Revoking permission

You can withdraw location access at any time in your device's iOS settings. The location-based features will then no longer be available; your account and your other data are not affected.

4. Content you create

DriveLink lives on content contributed by users. This includes places ("spots"), events, routes, photos, profile posts, comments, garage vehicle details and hazard reports. We store this content in order to show it in the app.

Photos: To upload, the app needs access to the camera or photo library. Access only happens when you select or take a photo yourself.

Planned routes: When you plan a route, we store its name, the stops you chose (place name and coordinates), date and time, an optional meeting point and your settings for visibility and number of participants. You decide who sees the route: all users, only your friends or only you. We don't store the exact road geometry – it is calculated on the respective device whenever the route is displayed (see section 10).

If you pause a multi-stage tour, your progress (which stops you have already reached) is stored only on your device and is not transmitted to us.

Legal basis: Art. 6(1)(b) GDPR.

5. Messages, groups and convoys

You can send direct messages to other users and team up in convoys. Messages are stored on our servers so they can be delivered.

In a convoy, your location is visible to the other participants while the convoy is running. Ghost Zones apply here too: inside one of your own Ghost Zones you are invisible to convoy participants as well. Convoys end automatically no later than twelve hours after they start.

Groups

You can create groups and invite your friends to them. Within a group we process:

• the group name and the list of members (who is a member, who manages the group),
• messages written in the group,
• routes shared in the group, as well as votes on routes and the votes cast,
• convoys started from a group.

This content is visible only to the members of the respective group. If you share a route in a group, all members can see it – even if you have otherwise saved it as private. You can only invite people to a group who are your friends in DriveLink. As with direct messages, group messages are encrypted in transit but are not end-to-end encrypted on the server.

You can leave a group at any time. The person who manages a group can remove members and delete the group; this deletes all messages, votes and ballots of the group. If the last member leaves a group, it is deleted as well.

Legal basis: Art. 6(1)(b) GDPR.

6. Push notifications

If you allow notifications, your device generates a technical identifier (push token), which we store in order to send you notices – for example about new messages (including in groups), friend requests, convoy invitations or upcoming meets. You can turn notifications off at any time in the iOS settings or in the app.

Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time.

7. Reports, blocking and moderation

You can report content and users and block other users. We store reports together with your user ID, the reported content and the reason given so that we can review them. We store blocks in order to hide the affected content from you. We usually handle reports within 24 hours.

Legal basis: Art. 6(1)(c) GDPR (legal obligations, including under the Digital Services Act) and Art. 6(1)(f) GDPR (legitimate interest in a platform free of abuse).

8. Technical usage data

We store the time you last opened the app in order to determine how many people actively use DriveLink. No usage profile is created: we don't analyse which features you use or how long you spend in the app. No third-party analytics service is used.

Online status: We also store whether you are currently online and when you were last online. Only you and your friends can see this, for example in the friends list and in chat.

Streak: If you open the app on consecutive days, DriveLink counts this as a streak. For this we only store the date of your last visit and your current and longest streak, not a list of individual days. Your current streak is visible to other users as a ring around your profile picture.

When our servers are accessed, technically necessary connection data also arises (IP address, time, function called). This serves operation and the prevention of abuse and is deleted after a short time.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation and in measuring reach without reference to individual persons); for online status and streak, Art. 6(1)(b) GDPR (features of the app).

9. This website (drivelink-app.de)

The website drivelink-app.de is purely informational. It does not set cookies, stores nothing on your device, uses no analytics or tracking services and loads no content from third-party servers. The fonts are also hosted on this website's own web space and are not loaded from Google or other providers.

Hosting via GitHub Pages

The website is hosted on GitHub Pages: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you open a page, your browser necessarily transmits data to GitHub's server, in particular your IP address, the date and time of the request, the page requested, the page you came from (referrer) and information about your browser and operating system. According to GitHub, it stores visitors' IP addresses for security purposes. We ourselves have no access to these logs and do not analyse them. How long GitHub keeps them is determined by GitHub; GitHub does not state a fixed period.

This involves a transfer of data to the USA. GitHub is certified under the EU-U.S. Data Privacy Framework; to that extent an adequacy decision of the European Commission exists for the USA (Art. 45 GDPR). In addition, GitHub relies on the EU standard contractual clauses. You can find more information in GitHub's privacy statement.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and reliably).

Links to other services

The website contains links to Apple (TestFlight or the App Store) and to Instagram. These are plain links, not embedded content: only when you click a link is the respective provider's page opened, and that provider's privacy policy then applies.

10. Recipients and services used

We only pass on data where this is necessary to operate the app. The following service providers are involved:

Supabase (hosting, database, sign-in, file storage)

Supabase Inc., 970 Toa Payoh North, Singapore. All account and content data is stored there. A data processing agreement under Art. 28 GDPR is in place with Supabase. The database location we use is in the European Union. Where data is nevertheless transferred to third countries, Supabase relies on the EU standard contractual clauses.

Apple Push Notification Service and Expo (notifications)

Apple Inc., One Apple Park Way, Cupertino, USA, and 650 Industries, Inc. ("Expo"), USA. Your device's push token and the content of the respective notification are transmitted. Only relevant if you have allowed notifications.

Map display, route calculation and place search (Apple Maps)

Map display, route calculation and place search use the map service of Apple (Apple Inc., One Apple Park Way, Cupertino, USA), which is built into iOS. The following is transmitted to Apple:

• for a route: the coordinates of the start, stops and destination,
• for place search: the search term you enter and, to show nearby places first, an approximate map area around your location,
• for showing place names: the coordinates of the respective point,
• for the map view: the map area displayed; with the traffic layer turned on, also the current traffic situation in that area.

We do not transmit any DriveLink user ID. According to Apple, map requests are not linked to your Apple Account but processed with randomly generated identifiers that only exist briefly (for example for the duration of a navigation); for details see Apple's information on "Apple Maps & Privacy". Data is only transmitted when you have a route calculated, search for a place or use the map. We don't permanently store results from Apple (such as the road geometry of a route).

Legal basis: Art. 6(1)(b) GDPR.

Data is only passed on beyond this if you have consented or we are legally obliged to do so, for example to law enforcement authorities.

11. Retention period

• Account and profile data: as long as your account exists
• Content you create: until you delete it or delete your account
• Messages: until deleted by one of the participants, at the latest until the account is deleted
• Groups and group messages: until the group is deleted, until you leave the group (your membership) or until your account is deleted. Deleting your account also deletes your group messages and votes.
• Reports: up to six months after the review is completed, to keep track of repeated violations
• Technical connection data: a few days

When you delete your account, your personal data is deleted. Content that concerns other users or remains relevant for the map is anonymised so that it can no longer be attributed to you. The road heatmap counters remain, as they are not attributed to any person even at the moment of collection. Statutory retention obligations remain unaffected.

You can delete your account yourself in the app at any time: Settings → Delete account.

12. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15) – which data we process about you
• Rectification (Art. 16) – correction of inaccurate data
• Erasure (Art. 17) – "right to be forgotten"
• Restriction of processing (Art. 18)
• Data portability (Art. 20) – receiving your data in a common format
• Withdrawal of consent (Art. 7(3)) – with effect for the future, without affecting the lawfulness of processing before withdrawal

To exercise your rights, a simple email to support.drivelink.app@gmail.com is enough.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Die Sächsische Datenschutz- und Transparenzbeauftragte
(Saxon Data Protection and Transparency Commissioner)
Maternistraße 17
01067 Dresden, Germany

You can also contact the supervisory authority of your habitual residence.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The only automatic rule in the app concerns content, not people: a place is hidden if several users confirm that it no longer exists.

14. Data security

All communication between the app and the server is encrypted (TLS). Passwords are stored as hashes. Access to data is restricted by rules at database level, so each account can only retrieve the data it is authorised to access.

15. Minimum age

DriveLink is intended for people aged 16 and over. Younger people may only use the app with the consent of their parents or guardians. We do not actively collect age; if we learn that an account is being used contrary to this rule, we delete it.

16. Changes to this policy

We update this privacy policy when features of the app or the legal situation change. The version published here applies. We will point out significant changes in the app.

17. Contact

If you have questions about data protection, reach us at support.drivelink.app@gmail.com.