Privacy Policy
Gravel ("we", "us", "our") is a car meet and social app. This policy explains what data we collect, why we collect it, and how you can control it. We keep things simple: we only collect what we need to run the app.
1. What we collect
Here is every category of data Gravel collects and why.
| Data | Why we collect it |
|---|---|
| Email address | Account creation, login, and password recovery. |
| Password | Authentication. Passwords are hashed by Supabase and never stored in plaintext. We never see your password. |
| Username & display name | Identifies you on your profile, posts, and meets. |
| Bio & profile photo | Optional. Shown on your public profile. |
| Vehicle info (year, make, model, photo) | Optional. Shown on your profile so others know what you drive. |
| Location (latitude & longitude) | Used to show meets near you, power the local chat channel, and the live convoy map. Location is only used while you are actively using features that require it. |
| Posts, photos, and replies | Content you choose to share on the feed or at a meet. |
| Meet details (title, location, time, cover photo) | Events you create or RSVP to. Location coordinates are stored so other users can discover nearby meets. |
| Chat messages | Global and local channel messages, and direct messages between users. Local channel messages include your location at the time of sending. |
| Social activity (likes, follows, shares, RSVPs) | Powers feed ranking, notifications, and your activity stats. |
| Notification preferences | Controls which push notifications you receive per follow and app-wide. |
2. How we use your data
- Operate the app — authentication, showing your profile, displaying meets and posts.
- Location features — nearby meets discovery uses your location on demand (within ~30 miles). Local chat attaches your location to messages in that channel. The convoy map shows your position to other participants while you are in that view.
- Notifications — we send push notifications for likes, follows, replies, meet updates, and cancellations based on your preferences.
- Safety — we may use data to detect spam, abuse, or violations of our terms.
We do not sell your data. We do not use your data for advertising.
3. How long we keep it
- Account data — retained while your account is active.
- Posts, meets, vehicles — retained until you delete them.
- Local channel messages — the app only fetches messages from the last 48 hours. Older messages remain in the database but are not shown.
- Direct messages — retained until you or the other participant deletes them.
- Uploaded photos — deleted from storage when you delete the associated post, meet, vehicle, or avatar.
4. Who we share data with
We use Supabase as our database and file storage provider. Your data is stored on Supabase's infrastructure. Supabase's privacy policy is available at supabase.com/privacy.
We do not share your data with any other third parties, advertisers, or data brokers.
Content you post publicly (posts, meets, profile) is visible to other Gravel users.
5. Location data
Location is only accessed when you use a feature that needs it:
- Nearby meets — your coordinates are sent to our server to find meets within ~30 miles. Not stored persistently after the query.
- Local chat — your location is stored alongside the message so it can be shown to other users in the same area.
- Convoy map — your location is used while the map is open. Not stored after you leave the view.
You can revoke location permission at any time in your device's system settings. Features that require location will not work without it.
6. Your rights and controls
- Edit your profile — update your username, bio, photo, and vehicles at any time.
- Delete content — delete any post, reply, meet, or vehicle you created.
- Notification preferences — manage push notification settings per follow and globally in the app.
- Revoke permissions — turn off location or push notifications in your device settings at any time.
- Delete your account — to request full account and data deletion, email us at hello@trygravel.app.
7. Children's privacy
Gravel is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.
8. Changes to this policy
We may update this policy as the app evolves. If we make material changes, we will notify you in the app or by email. The date at the top of this page reflects when the policy was last updated.
9. Contact
Questions about this policy or your data? Email us at hello@trygravel.app.