PRIVACY POLICY
MotoScore
a service of Zugunruhe Labs, LLC
Last updated: 10/20/2026. Effective: 10/20/2026.
This policy explains what MotoScore collects, why, who else sees it, how long we keep it, and what you can ask us to do about it. It covers motoscore.app and the MotoScore service. It does not cover zugunruhelabs.com or any other site we operate, which carry their own notices.
Zugunruhe Labs, LLC is the controller of the information described here. Our contact details are in Section 12.
1. What We Collect
1.1 Information you give us
- Account details. When you sign in with Google we receive your email address and name. When you sign in with an emailed link we receive your email address.
- Beta application. If you apply to the beta program we collect your name, email address, the motorcycle you ride, your riding style, your GPS device, your region, how often you ride, your response to a commitment question, the route-planning tools you use today, what you currently pay for them, a description of a route you would use to test the Service, and anything else you choose to tell us in the free-text field.
- Routes you create. The waypoints of routes you draw or import, and the routes you save.
- Ratings and feedback. When you rate a route we record your rating, your written comments if you leave any, the type of device you used, and the time. We also record part of the route’s shape — see Section 2.
- Payment details. If you subscribe, our payment processor collects your payment details. We do not receive or store your card number.
- Founders Award record. If you take part in the Founders Award, we keep a record of the feedback you submit that counts toward it: what kind it was, when you submitted it, how many points it earned, when we decided, and a short note from our judge recording the reason for the decision. Section 8.2 explains what happens to this record if you delete your account.
- Acceptance of the Beta Test Agreement. If you apply to the beta program, we record the name you give on your application, your email address, your account identifier, the date and time you accepted, your IP address at that moment, and which version of the agreement you accepted. We keep a copy of every version we have published, so that the exact text you agreed to can be produced later. We email you a copy at the time.
1.2 Information collected automatically
- Page analytics. We use Cloudflare Web Analytics on most pages of the Service. It is a privacy-focused analytics service that does not use cookies and does not build a profile of you across sites.
- Server logs. Our servers record requests, including IP addresses, as part of normal operation.
- Browser storage. The Service stores data in your own browser — see Section 4.
2. Location and Route Data
This is the most sensitive information the Service handles, so we describe it in detail.
2.1 Your device’s location
If you open the planner with no route in progress, we may ask your browser for an approximate location, once, to center the map somewhere useful. We ask for coarse accuracy, we use it only to position the map, and we do not store it, send it to anyone, or write it to a log. If you decline, the Service works normally.
One consequence is worth stating plainly, because it is not obvious. The coordinate itself goes nowhere, but the map you are then shown has to be fetched, and the provider serving those map images can see which part of the world you are looking at. If the map opened on your location, the area you are viewing is the area you are in. That is true of any map on any website, and it is true whether or not you allowed the location request, because the same thing happens wherever you scroll the map to.
2.2 Routes you save
A saved route is stored with its waypoints exactly as you placed them, including its start and end points. We store them exactly because rebuilding your route requires it — an approximation would not be the route you saved.
Saved routes are yours. They are returned only to you, protected by access rules that prevent one account reading another’s, and they are removed when you delete your account.
What this means in practice
If you plan routes from home, your saved routes will contain your home address as a start or end point. We hold that information because the feature cannot work without it. We protect it with access controls and we delete it when you ask us to, but we want you to know it is there.
2.3 Routes you rate
When you rate a route, we store part of the route’s shape so that we can check the rating against the same road later if our assessment method changes. What we store is deliberately incomplete: before storing it we remove the portions nearest the start and the end, by a distance that varies randomly each time and that we do not record.
The result is that a stored rating shows the middle of a route but not where it began or ended. If what remains is too short to be useful, we store no shape at all and keep only the rating itself.
This shape is kept for 24 months and then removed automatically. It is also removed if you delete your account.
2.4 What we do not do
- We do not track your location while you ride. The Service has no background or continuous location capability.
- We do not sell route data, or any other personal information.
- We do not use your routes to advertise to you, and we do not run advertising.
3. Why We Use It, and On What Basis
| What we use it for | What it covers | Legal basis (UK/EU) |
|---|---|---|
| Providing the Service | Your account, your routes, scoring and export | Performance of a contract |
| Running the beta program | Your application, admission, and communications about it | Performance of a contract; consent where you opted in |
| Improving our assessments | Ratings and the partial route shape described in Section 2.3 | Legitimate interests — improving a service you use |
| Keeping the Service working and secure | Server logs, analytics | Legitimate interests — operating and securing the Service |
| Taking payment | Subscription and billing records | Performance of a contract; legal obligation for tax records |
| Answering you | Emails you send us | Legitimate interests — responding to you |
4. Storage in Your Own Browser
The Service keeps some information in your browser rather than on our servers:
- The route you are working on, including its shape, waypoints and assessment, for both route slots.
- The identifier and name of a saved route you have open.
- A record of which routes you have already rated, held as a code rather than as coordinates.
- A draft of the beta application form, if you start one.
- Your display preferences, and flags recording whether you have already seen our onboarding, our survey prompts and our welcome message.
- An identifier the mapping library sets for itself. Unlike the items above, this one is sent to Mapbox when you use the map.
Apart from that last item, none of this is sent to anyone. Deleting your account does not reach any of it, because we cannot; you can clear it through your browser’s own settings.
Signing out deliberately clears the route data. A session that simply expires does not, and nor does a sign-out that fails partway. If you are using a shared or public computer, sign out before you leave it, and clear your browser data if you want to be certain.
The cookies the Service sets are the ones that keep you signed in — there may be more than one — together with a short-lived cookie used during the sign-in exchange itself. We set no others.
5. Who Else Sees It
We do not sell personal information and we do not share it for advertising. We use the following providers to run the Service. Each receives only what its function requires.
| Provider | What it receives | Where it happens |
|---|---|---|
| Your email address and name, if you sign in with Google. Your IP address whenever your Google profile picture loads while you are signed in | At sign-in, and from your browser | |
| Supabase | Your account, your saved routes, your ratings and written feedback, your beta application, your acceptance of the Beta Test Agreement, your Founders Award record, and the partial route shape stored with a rating. Also your IP address, because your browser connects to it directly | Our servers and your browser |
| Mapbox | Your route’s waypoints, your IP address, anything you type into the map search, and requests for the map tiles you are looking at — which show the area you are viewing | From your browser |
| TomTom | A single point near the middle of your route, to look up traffic conditions when we assess it. If you turn the traffic layer on, also the tile coordinates of the area you are viewing | Our servers |
| Overpass | Route geometry, to look up road data. Not your IP address | Our servers |
| Open-Meteo | Route geometry, to look up elevation. Not your IP address | Our servers |
| Google Maps | Points from your route, only when you choose to open it in Google Maps | From your browser |
| Cloudflare | Hosting, request logs, and page analytics | Our servers and your browser |
| Stripe | Your payment details, your subscription record, and your account identifier and email address | At checkout, and from our servers |
| Resend | Your email address and the content of every email we send you, including your sign-in links. Also your beta application and any message you send us through the contact form, both of which we forward to ourselves | Our servers |
The traffic layer is off unless you turn it on. If you never turn it on, TomTom receives only the single point described above. Your browser never contacts TomTom directly: when the layer is on, your browser asks our service for the tiles and our service fetches them.
We may also disclose information where the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold — in which case we would tell you first.
6. Where It Goes
We are based in the United States and our providers are principally based there. If you are in the United Kingdom or the European Economic Area, your information will be transferred to the United States.
Where we transfer information out of the UK or EEA we rely on the European Commission’s standard contractual clauses, and the UK addendum where it applies, as adopted in Commission Implementing Decision (EU) 2021/914.
7. How Long We Keep It
| What | How long |
|---|---|
| Your account and saved routes | Until you ask us to delete them |
| Route shape stored with a rating | 24 months, then removed automatically |
| Your rating and any comments | Until you ask us to delete your account |
| Beta applications | Until you ask us to remove yours |
| Your Founders Award record | Until the Award and any membership it grants have ended, or until you delete your account |
| Your acceptance of the Beta Test Agreement | While you take part, and six (6) years after |
| Server request logs | 7 days |
| Page analytics | 30 days |
| Database and sign-in logs | 24 hours |
| Payment and tax records | As long as the law requires |
Nothing in the table above is exported to any other system for longer-term storage.
8. Your Choices and Rights
8.1 What you can ask us to do
- See what we hold about you.
- Correct anything that is wrong.
- Delete your account and the information associated with it.
- Receive a copy of information you gave us, in a portable form.
- Object to, or ask us to restrict, processing we base on legitimate interests.
- Withdraw consent where we relied on it, without affecting what we did beforehand.
Email us at the address in Section 12. We will respond within thirty (30) days. We do not charge for this, and we will not treat you differently for asking.
8.2 What deletion reaches, and what it does not
Deleting your account removes your account record, your saved routes, your ratings and the route shapes stored with them.
It does not reach route data held in your own browser, which you can clear yourself; records our payment processor is required to keep; or server logs, which expire on the schedule in Section 7.
Deleting your account also removes your Founders Award record, including our judge’s notes about your feedback. We do not keep it and we do not reconstruct it. Because the Award is determined from that record, deleting your account means you cannot be selected for the Award, and any Award already made to you ends. If you are taking part in the Award, this is worth knowing before you delete.
It also does not reach your acceptance of the Beta Test Agreement, if you accepted one. That record is the evidence that an agreement was made, and we keep it for the period in Section 7 even after the rest of your information is gone. It holds your name, your email address, the date and time, your IP address and the version you accepted, and nothing about your riding or your routes.
8.3 If you are in the UK or EEA
You may complain to your data protection authority. In the UK that is the Information Commissioner’s Office. We would rather you came to us first, but the right is yours either way.
8.4 If you are in California or another US state with a privacy law
We do not sell personal information and we do not share it for cross-context behavioral advertising. Route data is precise geolocation, which several states treat as sensitive; we use it only to provide the Service, as described in Section 2, and not for any purpose that would require an option to limit its use.
9. Security
Access to your saved routes and ratings is restricted at the database level so that one account cannot read another’s. Traffic to the Service is encrypted. Our providers are established services with their own security programs.
No service is perfectly secure, and we do not promise that yours cannot be breached. If a breach affects you, we will tell you as the law requires.
10. Children
The Service is not for anyone under sixteen (16). We do not knowingly collect information from anyone under that age. If you believe a child has given us information, tell us and we will delete it.
11. Changes
We may update this policy. If a change is material we will tell you by email or in the Service before it takes effect, and we will update the date at the top.