Privacy Policy

01

What this policy covers.

This policy explains how RevClub handles personal data when you create an account, post builds, upload photos or profile pictures, react to content, follow users, save spots, submit spots/events/workshops, receive notifications, submit reports, block users, use public website forms, request an export, or request deletion.

02

Data we collect.

Account data:

• Email address.
• Username.
• Display name, optional.
• Confirmation that you are at least 13 years old. RevClub does not collect or retain date of birth.
• Country, optional and country-level only.
• Onboarding preferences where provided.

Profile and content:

• Profile picture, staged profile-picture candidates, bio, links, roles, and profile details you choose to add.
• Car builds, current and previous, including build notes and build-log entries.
• Photos uploaded to builds, mod logs, spots, standalone photo posts, events, workshops, and profile pictures.
• Captions, manual car text, modifications, notes, and build-log content.
• Reviews of cars, with text and ratings.
• Swipes, likes, dislikes, ratings, saved items, follows, and notification records.
• Reports filed against content or accounts, report details, blocks of other users, moderation results, and moderator action records.

Location submission data:

• Typed address/geocoding searches for spot, event, and workshop submission forms.
• Submitted spots, events, and workshops, including title/name, description, city, area, address or location text, and coordinates.
• Photos or cover images uploaded to spots, events, and workshops.
• Access or permission confirmation recorded when you submit a spot.
• Ticket, website, booking, or external URLs where you submit them.

Uploaded image metadata:

• Where implemented, RevClub may process uploaded images to reduce metadata such as EXIF or GPS metadata before storage or display.
• You should avoid uploading images that expose personal information you do not want public, including number plates, faces, house numbers, addresses, or location clues.
• You can use reports to request review or removal of privacy-sensitive content.

Technical data:

• Push tokens if you enable notifications.
• Device, app version, and operating system version where provided by the app platform.
• Authentication and session data.
• Logs of significant errors and abuse-prevention events.
• Storage object paths corresponding to your uploaded, export, and deletion-related files.
• Public website waitlist/contact form details you submit.
• Crash diagnostics collected through Sentry, which may include crash logs, error stack traces, device, operating system and app version information, and limited technical context needed to diagnose bugs. HTTP breadcrumbs are sanitised before being sent so they do not include full URLs, query strings, request bodies, storage object paths, table or RPC names, or user identifiers. We do not use Sentry data for advertising or tracking.

03

How we use your data.

• To operate the app and authenticate users.
• To display profiles, builds, photos, spots, events, workshops, notifications, and rankings.
• To moderate content and respond to reports.
• To run a server-enforced prohibited-content safeguard for supported public text fields.
• To prevent abuse, fraud, and harm.
• To comply with legal obligations.
• To process data export and account deletion requests.

Location. If you use location-based sorting or distance display on the Spots tab, RevClub asks for foreground location permission and uses your current device location to calculate distances to spots, events, and services. For the Nearest sort, your location is used to order results by distance. Your current location is processed on your device and is not stored by RevClub, sent to our servers, shared with Supabase, or used for background tracking. You can disable location access at any time in your device settings.

Newly submitted supported images are checked for unsafe material before or as part of public display or moderation handling. This includes supported uploaded media such as build photos, spot photos, standalone photo posts, event/workshop covers, and staged profile-picture candidates. We use AWS Rekognition for automated image moderation where implemented. We may store moderation decisions, labels, timestamps, scan results, and related metadata to protect users, enforce our rules, and prevent abuse. Uploaded content may be approved, rejected, removed, or kept pending for review, and users can still report content manually. Automated tools do not detect all unsafe or illegal content.

04

Who we share data with.

RevClub does not sell personal data.

• Supabase, for authentication, database, storage, and Edge Functions.
• AWS Rekognition, where used to process supported uploaded images for unsafe-content moderation, including staged profile-picture candidates.
• LocationIQ, for typed address/geocoding lookup in spot, event, and workshop submission flows.
• Expo Push Notifications, for push token registration and notification delivery if you enable notifications.
• Formspree, for public website waitlist and contact form submissions.
• Sentry, for crash diagnostics only, with HTTP breadcrumbs sanitised before being sent and no use of Sentry data for advertising or tracking.
• Legal authorities where required by law.

05

International data transfers.

Some of our processors operate outside the UK. Data transfers are governed by appropriate safeguards including standard contractual clauses where applicable.

06

How long we keep data.

We retain account data for as long as your account is active. Signed-in users can initiate account deletion inside the app. Account deletion removes or anonymises account/profile data and user-created content/storage covered by the implemented deletion flow. Reports filed against a deleted account may be retained in anonymised form for safety and moderation purposes.

Private JSON export links expire after 1 hour, and old export files are cleaned from the private export bucket after the 48-hour retention window. Temporary profile-picture candidates are deleted after approval, rejection, or failure where possible; some storage cleanup may be queued if immediate deletion fails. We may retain moderation records, blocks, audit records, backups, and logs longer where required by law, or to maintain safety, reliability, and abuse-prevention records.

07

Your rights.

Under UK GDPR, you may have rights to access, correct, delete, restrict, object to processing, and request portability of your personal data. Make requests to support@revclubapp.com from the email address linked to your account. You may complain to the UK data protection regulator, the ICO, at ico.org.uk.

08

Children and minors.

RevClub is not designed for children under 13. Users must be at least 13 to use RevClub. RevClub may remove accounts where we believe the user is under 13.

09

Security.

We use Supabase authentication and standard secure-storage practices. No system can be guaranteed fully secure. We use reasonable technical and organisational measures.

10

Changes to this policy.

We may update this policy from time to time. The effective date at the top reflects the current version.

11

Contact.

For privacy, safety, support, legal, and Online Safety Act notices, contact support@revclubapp.com.