Privacy policy
Version 1.5 · effective 16 September 2026 · applies to the 6signals mobile app and to this website
6signals is in beta. This policy describes the app exactly as it is built today. When a feature ships that changes what is collected, this policy changes with it, and the version and date above change too.
Who is responsible
6signals is an independent project maintained by a single developer, who is the data controller for the purposes of the UK and EU General Data Protection Regulation. For anything in this document — questions, corrections, or a request to delete your data — write to robertas@fragile.digital.
The short version
- You are not asked for an email address, a phone number or a password.
- What is stored about you is a random account identifier, the display name you type, which rides you joined and when, and — only if you plan a route — that route's start, destination and line.
- Your live position is never written to a database. It is relayed to the other riders in your ride and then it is gone.
- There is no advertising, no advertising identifier, and no cross-app tracking. There is crash reporting (Google Firebase Crashlytics) and app-usage analytics (Google Firebase Analytics), both tagged with your account identifier.
- Address search goes through the project's own routing service to Geoapify, which never sees your IP address.
- Nothing is sold, and nothing is shared for anyone else's marketing.
What the app stores durably
Account, ride and membership records live in Google Cloud Firestore, in
Google's eur3 multi-region — data centres in Belgium and
the Netherlands. This is the complete list of what lives there:
| Record | Fields | Why |
|---|---|---|
| Your account | A random identifier generated on first launch, plus the times the account was created and last used. | So the app can tell riders apart, and so you are not a stranger when you ride again months later. |
| A ride | The identifier of the rider who created it, a six-character join code, and the time it was created. If the ride was created with a planned route: the start and destination as you chose them (their names and coordinates), the distance and the expected time. | So a ride exists to join, and every rider on it sees the same route. |
| Your membership | The display name you typed for that ride, and the time you joined. | So the other riders see a name on the map instead of a number. |
| A join code | The code, the ride it points at, and the time it was created. | So a code typed by a joiner resolves to a ride without letting anyone list every ride. |
| Your profile | The display name you last used and the ride you were last on. | So the app can put you back on your ride after a restart. |
The display name is free text of up to twenty-four characters and it is whatever you type. It is visible to every other rider in that ride. If you would rather not use your real name, use anything else — nothing checks it, and nothing else in the app is tied to it.
Outside Firestore, these are kept durably:
- Planned route files. When a ride is created with a route, the route's line and its turn instructions are stored as a file in Firebase Storage. Only riders on that ride can read it, and the app can neither change nor delete it: it stays with the ride. The app also keeps a copy on the phone that planned or joined the route, so guidance keeps working without signal; uninstalling the app removes that copy.
- The broker's login for your account — your account identifier and a password only your phone holds — described under "Live location". It is removed with your account.
- Crash reports and analytics events, below.
- Service logs, under "How long things are kept".
Sign-in
The app signs you in anonymously through Firebase Authentication the first time it opens. No form, no email, no password. Google records the identifier, the account timestamps, and — as the operator of that service — the IP address the request came from.
A future version will let you attach a phone number or an Apple or Google sign-in so the same account survives a new phone. That is optional by design and does not exist yet.
Crash reports
If the app crashes, a report is sent to Google Firebase Crashlytics. A report contains the stack trace of the crash, the device model and operating-system version, the device's state at the time (orientation, free memory), the app version, your account identifier, and identifiers Crashlytics and Firebase assign to the app on this phone — so a crash can be matched to a ride that went wrong, and so the same rider's repeat crash is recognised as one problem rather than many. It contains no position, no display name and no signal. Reports are not sent from development builds.
Firebase keeps crash reports for 90 days and then deletes them. Deleting your account does not delete reports already sent; they expire on their own.
App-usage analytics
The app sends usage data to Google Firebase Analytics (the product also known as Google Analytics for Firebase, or GA4): which screen you moved to and when, recorded automatically as you move around the app. Every event is tagged with your account identifier, so usage can be understood per rider — for example, whether people who create a ride also open the map. Your display name, position and signals are never part of it. Analytics is off in development builds.
Google's software also collects some things on its own: an identifier for the app on this phone, sessions (when the app is opened and for how long), device and operating-system details, and an approximate location that Google works out from a shortened form of your IP address. Collection of the phone's advertising identifier is switched off in the app, and no analytics data is linked to advertising.
Signing out or deleting your account clears the identifier analytics events are tagged with going forward; it does not withdraw events already sent. Google keeps them for two months and then deletes them; only aggregated counts that identify no one are kept longer.
What the app does not store
- Location history. Live positions are never written to a database. There is no track, no trip history, and no way — for us or for anyone else — to reconstruct where you rode last Sunday. The only places stored are a planned route's start and destination, and only when you plan one.
- A log of signals. Pressing fuel or hazard sends a message to the riders in your ride. It is not recorded.
- Contacts, photos, microphone, calendar, health data, or the other apps on your phone. The app asks for none of these and cannot read them.
- Advertising or cross-app tracking of any kind. The app does not collect your phone's advertising identifier, and no data is shared with, or bought from, advertisers or data brokers.
Live location, while you are riding
When you are on a ride with the app open, it reads your device's position about once a second and relays it to the other riders in that ride. Each report carries your account identifier, latitude and longitude, heading, speed, and the time your phone recorded it. Pressing a signal key sends your account identifier, which key, and a timestamp.
These messages travel, encrypted, over the project's own message
broker at mqtt.fragile.digital. On that broker:
- Your most recent position is held so that a rider joining mid-ride sees the group immediately. It expires about thirty seconds after it is sent.
- Your riding status — whether you are on the ride or have dropped out — is held for about an hour for the same reason. If your phone vanishes without leaving the ride, the broker marks you as dropped on your behalf, so the others know.
- Signals expire after about five minutes and are never held for later subscribers.
- The broker also keeps a login for your account — the identifier and a password — so that only your phone can send as you. It is removed when you delete your account.
- Access is scoped to the ride: only riders on it can see its positions and signals. Leaving the ride clears your last position and status. The broker is transport, not storage: nothing here is archived, and its connection logs are the project's own, on the project's server, covered by this policy like everything else here.
Location permission is requested as while using the app. The app does not track you in the background, and closing it stops the reporting. If you refuse the permission the app still works; it just shares no position.
Address search and routes
When you search for an address or plan a route, what you type and the start and destination you pick are sent to the project's own routing service, which runs on Google Cloud Run in Belgium. That service asks Geoapify for the answer on the app's behalf, so Geoapify receives the search text or the coordinates but never your IP address or your account identifier.
The routing service keeps answers in memory for a short time — up to ten minutes for a route, up to an hour for a search — so repeated requests are fast, and it logs each request, including the search text or coordinates, as described under "How long things are kept".
Map tiles
Map imagery is fetched from Protomaps, a third-party tile service, and the fonts for map labels from Protomaps' public files on GitHub Pages. Like any request to any server, fetching a tile reveals your IP address and, by which tiles you ask for, roughly which area you are looking at. Tiles are requested only while you have the map open.
Who else is involved
| Service | What it handles |
|---|---|
| Google Firebase and Google Cloud | Anonymous sign-in, the Firestore database, Firebase Storage for planned route files, the functions that issue broker logins and delete accounts, the routing service on Cloud Run, the hosting that serves this website, Crashlytics for crash reports, Firebase Analytics for app-usage statistics, and App Check — which verifies that requests come from a genuine copy of the app on a genuine device: Google Play Integrity on Android, and Apple App Attest on iOS, which sends Apple a device attestation. App Check sends Google a device attestation, not anything about you. |
| MQTT broker | Relays live positions, riding status and signals between the riders in a ride. Nothing is stored beyond the expiry times above. |
| Geoapify | Answers address searches and calculates routes, asked by the routing service, never directly by your phone. |
| Protomaps and GitHub Pages | Serve map tiles and map label fonts to the app. |
These services process data on the project's behalf. Nothing is sold to anyone, and no data is shared with advertisers, data brokers, or anyone else's marketing. Data would be disclosed only where the law requires it.
This website
This site is static. It sets no cookies, runs no analytics, embeds no third-party scripts, and loads its fonts from its own domain rather than from a font CDN — so visiting it tells nobody but the host that you were here. It is served by Firebase Hosting, and Google logs ordinary request information such as IP address, user agent and the page requested in order to serve and protect the site, and keeps it for a few months.
How long things are kept
- Live positions, riding status and signals expire on the broker in seconds, minutes and about an hour, as described above.
- Crash reports: 90 days.
- Analytics events: two months.
- Service logs: the routing service's request logs (which include search text and route coordinates) and the logs of the functions that issue broker logins (which include your account identifier and the ride's) are kept for 30 days.
- Sign-in records: Google keeps the IP addresses it logs for a few weeks.
- Accounts, rides, memberships and planned route files are kept until you ask for them to be deleted. Automatic clean-up of unused anonymous accounts is deliberately turned off: a rider who installed the app in April and rode again in July would otherwise come back a stranger, with their identifier and their history silently gone. Keeping the account is the whole point of the account.
- After an account is deleted, Google removes it from Firebase's backup systems within 180 days.
Your rights
Under the GDPR you may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to how it is used, or complain to your national data protection authority.
Anonymity cuts both ways here. There is no email address attached to your account, so the practical way to find your records is your account identifier or a join code from a ride you were on. Write anyway if you have neither — say what you can about the ride and we will work out together what can honestly be identified as yours, and say so plainly if nothing can.
Write to robertas@fragile.digital. Expect a reply within thirty days.
Deleting the app does not delete the records above, because they are not held on your phone. Ask, and they go — or delete your account yourself, in the app, and see what that removes and what it leaves.
Legal basis
- Performance of a contract. The account, the ride, the membership, planned routes, address search and the live position relay: without these the app does nothing you opened it for.
- Consent. Location access, which your phone asks for separately and which you can withdraw at any time in your device settings. Withdrawing it stops position sharing; the rest of the app still works.
- Legitimate interests. Crash reports, app-usage analytics and service logs: keeping the app working, finding what breaks, understanding which parts are used, and protecting the service from abuse. None of it is used for advertising, and you can object by writing to the address above.
Children
The app is intended for licensed motorcyclists and is not directed at children under 16. No age is collected, and none is inferred.
Changes
Material changes will move the version and date at the top of this page.