Privacy Policy

Product: Kayz — Motorcycle Ride Organizer
Effective Date: May 16, 2026
Last Updated: June 25, 2026

Introduction

Kayz ("Kayz," "we," "our," or "us") is a mobile application developed and operated by Looma LLC that enables motorcycle riders to create, discover, and join group rides. We are committed to protecting your personal information and being transparent about how we collect, use, disclose, and safeguard it.

This Privacy Policy applies to the Kayz mobile application, any associated web interfaces, and the backend services that support them (collectively, the "Service"). By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this policy.

If you do not agree with this Privacy Policy, please do not use the Service.

1. Who We Are and How to Contact Us

Kayz is a product of Looma LLC, a limited liability company organized under the laws of the State of North Carolina, with its principal place of business in Raleigh, North Carolina ("Company").

For privacy-related inquiries, requests, or complaints, you may contact us at:

• Email: hi@kayz.club
• Mailing Address: Looma LLC, 4030 Wake Forest Road, STE 349, Raleigh, NC 27609, United States

We will respond to all verifiable requests within the timeframes required by applicable law, and in no event later than 30 days of receipt.

2. Scope of This Policy

This Privacy Policy covers personal information we process in connection with:

• Creating and managing a Kayz account;
• Creating, editing, publishing, and canceling rides;
• Discovering, viewing, and RSVPing to rides;
• Receiving push notifications and in-app alerts;
• Interacting with our customer support or reporting features; and
• All other use of the Service.

This policy does not apply to third-party websites, applications, or services that you may access through links within the Service. Those third parties have their own privacy policies, and we encourage you to review them.

3. Information We Collect

3.1 Information You Provide Directly

Account Registration

When you create a Kayz account, we collect:

• Email address: used for authentication, account management, and transactional communications;
• Password: stored in hashed form by our authentication provider; we do not have access to your plaintext password;
• Display name: shown publicly on ride cards and your profile;
• Home region or city: used to seed the local ride browse feed; required at onboarding;
• Profile photo: optional; uploaded to our cloud storage; displayed on ride cards and details screens;
• Motorcycle information: optional; not displayed on public feed in current product version.

Ride Content

When you create a ride as an organizer, we collect and store:

• Ride title, date, start time, and status;
• Start location and destination coordinates (latitude/longitude) and human-readable place names;
• Intermediate waypoints (coordinates, optional labels, optional estimated dwell time);
• Road-snapped route polyline geometry and associated statistics (distance, estimated duration);
• Route description and optional notes;
• Maximum rider cap (optional);
• Ride status changes (scheduled, postponed, cancelled, completed);
• Edit history and update logs.

Reports and Moderation

If you submit a report against a ride or another user, we collect the report content, the reported content identifier, and your user identifier.

3.2 Information Collected Automatically

Location Data

When you use the browse or route-planning features, the Service requests access to your device's GPS to determine your current location. We use location data to:

• Filter and sort nearby rides within your selected radius;
• Seed the default browse feed;
• Power the map display during ride creation (Plan Route).

Location access is requested at the time you use the relevant feature. You may deny or revoke location permissions through your device settings, in which case the Service will fall back to your profile-specified home region. We do not collect background location data when the app is not in use.

Device and Usage Data

We automatically collect certain technical data when you interact with the Service, including:

• Device type, operating system, and version;
• App version;
• Unique device identifiers (for push notification delivery);
• App session logs, error reports, and crash diagnostics;
• Feature usage events (e.g., ride created, RSVP submitted, filter changed), used for product improvement and abuse detection.

Crash diagnostics and product analytics are transmitted to the third-party subprocessors listed in Section 5.2 (Sentry and PostHog). Install and ride-share link attribution data may be transmitted to AppsFlyer as described in Sections 5.2 and 5.2.1.

Push Notification Tokens

When you grant notification permissions, the Service registers your device with Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) and stores the resulting push token. This token is used exclusively to deliver ride-related notifications (confirmation, reminders, updates, cancellations, organizer alerts). Tokens are associated with your user account and device platform. Revoked or stale tokens are marked inactive rather than deleted.

3.3 Information from Third Parties

At this time, we do not receive personal information about you from third-party data brokers or social media platforms. If this changes, we will update this Privacy Policy accordingly.

4. How We Use Your Information

We use the personal information we collect for the following purposes, each of which is grounded in a lawful basis as described in Section 8 (for EEA/UK users):

Service Delivery and Core Features

• Authenticating you and maintaining your session;
• Displaying and filtering rides based on your location and preferences;
• Enabling ride creation, publication, and management;
• Processing RSVPs and maintaining accurate rider counts;
• Displaying organizer and rider information on ride cards and detail screens;
• Sending push notifications for RSVP confirmation, ride reminders (24 hours and 1 hour before departure), ride updates, and cancellations;
• Notifying organizers of new RSVPs and RSVP cancellations.

Safety and Integrity

• Detecting, investigating, and responding to violations of our Terms of Service;
• Reviewing user reports and taking moderation actions (suspension, content removal);
• Preventing fraud, abuse, and unauthorized access;
• Enforcing rider limits and waitlist integrity.

Product Improvement

• Analyzing aggregate usage patterns to understand how riders interact with the Service;
• Diagnosing bugs, crashes, and performance issues;
• Informing product roadmap and feature prioritization decisions.

Legal Compliance

• Complying with applicable laws, regulations, legal process, and lawful governmental requests;
• Enforcing our agreements and policies;
• Protecting the rights, property, and safety of Kayz, our users, and the public.

5. Information We Share

We do not sell your personal information. We do not share your personal information with third parties for their own direct marketing purposes. We share information only in the following circumstances:

5.1 Other Users of the Service (Public Ride Data)

Certain information you provide is publicly visible within the Service by design:

• Your display name and profile photo appear on ride cards and the ride detail screen;
• Ride content you publish (title, date, start location, destination, route summary, rider count) is visible to all users, including unauthenticated users browsing the feed;
• Your RSVP status (going/not going) is visible to the ride organizer on the rider list;
• Rider counts are displayed publicly on ride cards.

You should not include sensitive personal information in ride titles, descriptions, or notes that you do not wish to be publicly visible.

5.2 Service Providers (Processors)

We engage the following third-party service providers who process personal information on our behalf, subject to appropriate contractual protections and data processing agreements:

We do not authorize these providers to use your information for any purpose other than providing services to us.

5.2.1 Mobile attribution, analytics, and data minimization

App Tracking Transparency (iOS). When ride-share attribution is enabled, Kayz may display Apple's App Tracking Transparency prompt on iOS before initializing AppsFlyer. If you deny tracking, Kayz does not use IDFA for attribution, but you may continue using the Service; attribution may continue using probabilistic methods permitted by Apple and AppsFlyer.

Telemetry safeguards. Before crash reports and analytics events are sent to Sentry or PostHog, Kayz applies in-app safeguards that remove or coarsen sensitive fields, including email addresses, display names, @handler values, access tokens, comment bodies, and precise latitude/longitude (coordinates are rounded to approximately two decimal places). PostHog GeoIP enrichment is disabled in the mobile client.

Product analytics opt-out. PostHog product analytics are enabled by default in production builds. You may opt out by emailing hi@kayz.club with the subject line "Analytics Opt-Out." An in-app Settings toggle may be added in a future release.

Crash reporting. Sentry crash and error reporting is enabled in production and preview builds when configured. It operates separately from product analytics opt-out because it supports app stability and security, not marketing or advertising.

5.3 Legal Requirements and Protection of Rights

We may disclose your information when we have a good-faith belief that doing so is necessary to:

• Comply with a valid legal obligation, court order, subpoena, or governmental request;
• Enforce our Terms of Service or other agreements;
• Detect, prevent, or address fraud, security, or technical issues;
• Protect the rights, property, or personal safety of Kayz, our users, or the public.

We will, where legally permitted, provide notice to affected users before disclosing information in response to legal process.

5.4 Business Transfers

If Kayz is involved in a merger, acquisition, asset sale, financing, restructuring, or similar corporate transaction, your information may be transferred as part of that transaction. We will notify you (via the email address on your account or a prominent notice within the Service) before your personal information is transferred and becomes subject to a different privacy policy. You may have the right to object to or withdraw consent for such a transfer under applicable law.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

When you delete your account, we will honor your deletion request within 30 days, subject to applicable legal retention obligations. Residual copies may remain in encrypted backups for up to 90 days before being overwritten.

7. Data Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption in transit: All communications between the app and our servers use TLS/HTTPS;
• Encryption at rest: Sensitive data stored in Supabase (Postgres) is encrypted at rest;
• Authentication security: Passwords are hashed using modern cryptographic algorithms; sessions are managed via short-lived JWTs stored in the device's secure storage (Expo SecureStore);
• Access controls: Database row-level security (RLS) policies enforce that users can only access data they are authorized to view or modify;
• Least privilege: Administrative access to production systems is restricted to authorized personnel on a need-to-know basis;
• Monitoring: We monitor for anomalous access patterns and security events.

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and applicable regulators as required by law.

8. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal information on the following legal bases under the General Data Protection Regulation (GDPR) or applicable equivalent law:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your fundamental rights and freedoms given the nature of the processing and the safeguards we apply.

9. Your Rights and Choices

Depending on your location, you may have the following rights with respect to your personal information:

9.1 Universal Choices (All Users)

• Push Notifications: You may disable push notifications at any time through your device's notification settings or the in-app notification toggle. This will not affect your ability to use the Service but will prevent you from receiving ride reminders and alerts.
• Location Access: You may revoke location permissions through your device's settings at any time.
• Profile Information: You may update your display name, profile photo, home region, and motorcycle information within the app at any time.
• Account Deletion: Open Settings → Delete Account in the Kayz app. Confirm your @handle and sign in again with Apple, Google, or Facebook. Without the app, request deletion at https://kayz.club/delete-account or email hi@kayz.club. We process requests within 30 days, subject to legal retention obligations.
• Product Analytics Opt-Out: Email hi@kayz.club with the subject line "Analytics Opt-Out" to request that we stop sending product analytics events associated with your account.
• iOS App Tracking: On iOS, you may revoke or grant App Tracking Transparency permission at any time through Settings → Privacy & Security → Tracking.

9.2 EEA, UK, and Switzerland (GDPR Rights)

If you are in the EEA, UK, or Switzerland, you have the following additional rights:

• Right of Access: Request a copy of the personal information we hold about you (Art. 15);
• Right to Rectification: Request correction of inaccurate or incomplete personal information (Art. 16);
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information where there is no compelling reason for continued processing (Art. 17);
• Right to Restriction of Processing: Request that we restrict how we use your personal information in certain circumstances (Art. 18);
• Right to Data Portability: Request that we provide your personal information in a structured, commonly used, machine-readable format (Art. 20);
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes (Art. 21);
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing;
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority (e.g., the ICO in the UK, or the relevant EEA DPA).

To exercise any of these rights, contact us at hi@kayz.club with the subject line "Privacy Rights Request." We will verify your identity before processing your request and respond within the timeframe required by applicable law (typically 30 days, with an extension of up to an additional 60 days for complex requests).

9.3 California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights:

• Right to Know: The right to request disclosure of the categories and specific pieces of personal information we have collected about you, and the categories of sources, business purposes, and third parties with whom we share it;
• Right to Delete: The right to request deletion of personal information we have collected about you, subject to certain exceptions;
• Right to Correct: The right to request correction of inaccurate personal information;
• Right to Opt-Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising. You may nonetheless submit an opt-out request by contacting us at hi@kayz.club;
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of personal information collected: Identifiers (name, email, device ID); commercial information (ride RSVPs); geolocation data; internet/electronic activity (app usage); inferences drawn about preferences.

Categories of recipients: Service providers as listed in Section 5.2 (including Supabase, Mapbox, push delivery providers, Vercel, AppsFlyer, Sentry, and PostHog); no third-party sale.

Sensitive Personal Information (CPRA): The CPRA designates precise geolocation data as "sensitive personal information" (SPI). Kayz collects GPS-based location data solely to power the core features of the Service (ride discovery and route planning). We do not use your precise geolocation for any purpose beyond what is necessary to provide the Service. You have the right to direct us to limit the use of your SPI to these service-delivery purposes only, which is already our practice. To exercise this right, contact us at hi@kayz.club.

To submit a verifiable CCPA/CPRA request, contact us at hi@kayz.club with subject "CCPA Privacy Request."

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If you are under 18, you are not permitted to create an account or use the Service.

If we become aware that we have inadvertently collected personal information from a person under 18 without appropriate parental consent, we will take prompt steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at hi@kayz.club.

11. International Data Transfers

Kayz operates primarily in the United States. If you use the Service from outside the United States, your information may be transferred to, stored, and processed in the United States, whose data protection laws may differ from those in your home country.

For users in the EEA, UK, or Switzerland, when we transfer personal information outside your jurisdiction, we rely on appropriate safeguards, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• UK International Data Transfer Agreements (IDTAs);
• Transfers to countries with an adequacy decision by the European Commission or UK ICO.

By using the Service, you acknowledge that your information may be transferred internationally in accordance with this policy.

12. Cookies and Tracking Technologies

The Kayz mobile application does not use browser cookies. We use functionally equivalent technologies within the mobile app, including:

• Secure local storage (Expo SecureStore): To persist your authenticated session token on your device. This is essential for the Service to function and cannot be disabled while using the app;
• In-memory session state: Application-level state maintained during your active session;
• Analytics event logging: Anonymous usage events (see Section 3.2).

If we introduce web-based interfaces in the future that use cookies or tracking pixels, we will update this policy and provide appropriate disclosures and controls.

Do Not Track: The Kayz mobile application does not respond to browser "Do Not Track" (DNT) signals, as DNT is a browser-based standard that does not apply to mobile applications. We do not track users across third-party websites or services for advertising purposes.

13. Third-Party Links and Services

The Service may display links to third-party websites or contain references to external services (e.g., mapping platforms). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party service you access through the Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy;
• Notify you via push notification or in-app alert; and/or
• For significant changes affecting how we use your personal information, request your renewed consent where legally required.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you must discontinue using the Service and may request account deletion.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact:

Privacy Team — Kayz / Looma LLC
Email: hi@kayz.club
Address: Looma LLC, 4030 Wake Forest Road, STE 349, Raleigh, NC 27609, United States

Kayz does not currently maintain a designated EU or UK representative, as the Service is not actively marketed to users in the European Economic Area or United Kingdom at this time. If this changes, we will appoint representatives and update this policy accordingly.

This Privacy Policy was drafted to reflect the product as described in the Kayz Product Requirements Document, Version 2.29, dated March 31, 2026. Kayz is a product of Looma LLC, a North Carolina limited liability company. This policy should be reviewed by qualified legal counsel admitted in North Carolina and any other operating jurisdiction before publication, and should be updated whenever material product changes affect how personal data is processed.