Privacy policy

RideIQ ("we", "us", "our") respects your privacy. This policy describes what data we collect, how we use it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Data we collect

1.1 Account data

When you register with email we collect:

• Email address
• Password (hashed with Argon2, never stored in readable form)
• Optionally a display name

1.2 Google sign-in data

If you sign in with Google, we receive the following from Google:

• Email address — for account identification
• Name — used as display name in the app

We request only the basic scopes (email and profile). We have no access to your Google password, contacts, calendar, files, or any other Google services.

1.3 Usage data

While you use RideIQ we may process:

• Search queries and saved filters
• Favorited cars
• Location data (only if you enter it yourself for distance calculations)

2. How we use your data

We use your data exclusively to deliver and improve the RideIQ service:

• Account management — sign-in, sessions, account settings
• Functionality — storing your searches, favorites, and preferences
• Service delivery — showing relevant search results

We do not use your data for profiling, targeted advertising, or any purpose other than providing the app functionality.

3. Google user data

RideIQ's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

• Data from Google is used solely for authentication and account creation
• We store only your email and name; no OAuth tokens or other Google data
• We do not share, sell, or distribute Google user data to third parties
• We do not use Google user data for advertising or other commercial purposes
• Humans do not read your data, except where needed for security, legal compliance, or with your explicit consent

4. Sharing with third parties

We do not share your personal data with third parties, except:

• Stripe — for processing payments on a Pro subscription. Stripe receives your email and payment details under their own privacy policy.
• Plausible Analytics — privacy-friendly, cookieless website analytics. No personal data is shared.

We do not sell your data. We do not make data available to third parties for their own purposes.

5. Cookies

We use only functional cookies needed for the website to work:

• Session cookie — to keep you signed in
• CSRF token — protection against cross-site attacks

We do not use tracking cookies, advertising cookies, or third-party cookies.

6. Data security

We apply appropriate technical and organizational measures to protect your data:

• All connections use HTTPS (TLS encryption)
• Passwords are hashed with Argon2 and never stored readable
• The database is only accessible from the secured server environment
• Google OAuth tokens are not retained after authentication

7. Retention and deletion

• Account data — kept while your account is active. On account deletion, all personal data is removed within 30 days.
• Invoice data — retained for 7 years (Dutch tax law).
• Google data — on account deletion, the email and name received from Google are also deleted.

8. Your rights (GDPR)

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• Access — know what data we process about you
• Correction — have inaccurate data corrected
• Deletion — have your account and all associated data deleted
• Portability — request a copy of your data
• Objection — object to processing of your data

You can exercise your rights by contacting us at the email below. We respond within 30 days.

9. Changes

We may update this policy from time to time. For material changes we will notify you by email. The date at the top shows when the policy was last updated.

10. Contact

For questions about this privacy policy or your data, contact:

RideIQ
Email: hello@tomhoenderdos.nl

Provisional English translation mirroring the Dutch AutoSift policy. A professionally reviewed version will be published before public launch.