FormaVeloce Privacy Policy

1. Controller and Contact Details

The data controller for FormaVeloce is:

Henri Terna
FormaVeloce
Estonia
Privacy, legal, moderation, and data-protection requests: formaveloce@outlook.com
General support: support@formaveloce.com
Telephone: +372 5551 0655

2. Scope

This Privacy Policy applies to:

• the FormaVeloce mobile application;
• FormaVeloce accounts;
• gameplay and social functionality;
• FormaVeloce moderation and support;
• formaveloce.com.

It explains the categories of information FormaVeloce processes, why that information is processed, service providers involved, retention practices, account deletion, and user rights.

3. Minimum Age and Children

FormaVeloce is not intended for children under 13.

FormaVeloce does not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to FormaVeloce, contact formaveloce@outlook.com so appropriate action can be taken.

Users below the age at which they may independently consent to or enter into relevant agreements in their country may require authorization from a parent or guardian.

4. Categories of Information Collected

Account and Authentication Information

FormaVeloce may process:

• email address;
• Supabase user ID;
• authentication records;
• email-confirmation records;
• login and session information;
• account creation date;
• password-reset activity;
• account-deletion activity.

Supabase Auth is used for authentication and account management.

FormaVeloce does not receive your plain-text password.

The app may also record the versions and timestamp associated with your acceptance of the Terms of Service and Community Guidelines where the applicable acceptance-recording feature is enabled.

Profile and Social Information

FormaVeloce may process:

• username;
• display name;
• biography;
• avatar;
• badges;
• join date;
• profile settings;
• privacy settings;
• friends;
• followers;
• following;
• friend requests;
• race invitations;
• block relationships;
• featured or showcase selections;
• public-profile settings;
• individual visibility settings for social lists.

Car and Gameplay Information

FormaVeloce may process:

• car cards;
• car photographs;
• AI classifications;
• car make, model, trim, and generation results;
• rarity and production estimates;
• vehicle specifications and gameplay statistics;
• garage and collection data;
• condition;
• repairs;
• upgrades;
• parts;
• repair kits;
• Bolts;
• wallet entries;
• rewards;
• progression;
• capture attempts;
• capture limits and quotas;
• timestamps;
• race rooms;
• matchmaking;
• opponents;
• race results;
• events;
• achievements;
• challenges;
• reward-wheel spins;
• cooldowns;
• reward outcomes;
• anti-cheat and fraud signals.

Terms and Community Guidelines Acceptance

Where implemented, FormaVeloce may maintain a record that a user accepted an applicable version of the Terms of Service and Community Guidelines.

Such a record may include:

• user ID;
• Terms version;
• Community Guidelines version;
• acceptance timestamp.

FormaVeloce does not intentionally collect additional device-identification or IP information solely for recording policy acceptance unless that information is separately processed for security, fraud prevention, infrastructure, or legal purposes.

5. Public Information

Some information may be visible to other signed-in FormaVeloce users depending on the feature and your privacy settings.

This may include:

• username;
• display name;
• avatar;
• biography;
• badges;
• join date;
• public profile information;
• featured cars;
• showcase cars;
• car-card information;
• associated car photographs;
• social lists where those lists are set to public;
• multiplayer or leaderboard activity.

Friends, followers, and following lists have individual privacy controls where supported.

Private reports and report descriptions are not intended to be public profile content.

Users who can view content in the app may be able to screenshot, save, copy, or redistribute what they see. FormaVeloce cannot guarantee that material already copied by another person will disappear from that person's device when you later delete or change the original content.

6. Camera, Photos, Profile Images, and Permissions

FormaVeloce uses camera access to allow users to photograph cars.

The profile image picker may be used to select an avatar.

Photo-library permission may be requested where a user explicitly chooses functionality that requires such permission, such as saving an image to Photos where supported.

Denying camera, photo, or location permission should leave unrelated app functionality available where technically possible.

Permissions may be managed through your device settings.

Car Photographs

Accepted car photographs are stored in a private Supabase Storage bucket.

Car photographs may be delivered to authorized app users through access-controlled or time-limited signed URLs where permitted by FormaVeloce functionality.

A signed or access-controlled delivery mechanism reduces direct public storage exposure but cannot prevent an authorized viewer from taking a screenshot, copying displayed content, or otherwise redistributing material after receiving access.

Avatars

Accepted avatars are stored in a public Supabase Storage bucket.

Anyone who obtains an avatar URL may be able to access, copy, cache, or redistribute that avatar.

Changing or deleting an avatar does not guarantee deletion of copies previously cached or saved outside FormaVeloce's control.

Submitted Images

Car photographs and profile images may be processed through a Supabase Edge Function and may be sent to OpenAI for classification or image-safety moderation.

Accepted car photographs and accepted avatars may be stored in Supabase Storage.

Rejected images do not become accepted public profile images or accepted car cards.

Rejected or failed images may still undergo temporary technical processing, security handling, or provider-side operational processing. FormaVeloce does not represent that every rejected image is permanently retained.

Users should avoid unnecessarily capturing or uploading unrelated people, identifiable faces, readable license plates, private addresses, personal documents, sensitive locations, or other sensitive information.

FormaVeloce provides a privacy brush that may be used to obscure details before submission.

7. Location Processing

Location is optional and is used only where the user enables the spotting-country feature.

When enabled, FormaVeloce may:

1. temporarily obtain foreground device coordinates;
2. reverse-geocode those coordinates to determine the country where the car was spotted;
3. store the resulting country code.

FormaVeloce does not intentionally store exact latitude or longitude in car-card data.

Exact coordinates are discarded after the country is determined.

If location permission is denied, unavailable, disabled, or reverse geocoding fails, captures may continue without a spotting country.

8. AI Classification and Automated Moderation

FormaVeloce uses automated systems for functions including:

• car make, model, trim, and generation identification;
• vehicle specification generation;
• gameplay statistics;
• rarity and production estimates;
• car-image safety moderation;
• avatar-image safety moderation;
• determining whether an image is a legitimate car-related image;
• anti-cheat decisions;
• capture eligibility;
• reward eligibility;
• purchase verification;
• rewarded-ad verification;
• fraud prevention;
• duplicate-claim prevention.

Images submitted for car identification or profile use may be sent to OpenAI through Supabase-hosted backend infrastructure.

Automated output may be inaccurate, incomplete, estimated, or rejected.

Automated systems may reject a capture, prevent content from becoming visible, change whether a car card is created, flag possible fraud, or otherwise affect gameplay functionality.

Automated moderation can make mistakes.

Users may report incorrect vehicle information through supported in-app tools or request review by contacting support.

9. Gameplay, Racing, and Social Data

FormaVeloce processes gameplay information to provide its car collecting, garage, repair, upgrade, racing, event, achievement, challenge, progression, reward, and social systems.

Social information may include:

• friendships;
• follows;
• followers;
• invitations;
• blocks;
• privacy settings;
• public profile selections;
• showcase selections.

Racing information may include:

• race rooms;
• matchmaking data;
• participating users;
• cars used;
• results;
• race timing;
• related gameplay records.

This information may also be used to investigate cheating, fraud, abuse, reports, or technical problems.

10. Reports, Blocks, and Moderation

When you submit a report, FormaVeloce may process:

• reporter user ID;
• reported-user ID;
• usernames or display names relevant to the report;
• report source;
• report reason;
• optional written description;
• car-card identifier;
• race-room identifier;
• report context;
• creation timestamp;
• 24-hour review deadline;
• moderation status;
• moderation outcome;
• moderation notes.

Depending on the reporting context, a report may concern:

• profile images;
• usernames;
• display names;
• biographies;
• showcase content;
• car photographs;
• vehicle identity;
• vehicle statistics;
• multiplayer behavior;
• harassment or abuse;
• other policy violations.

Blocking

When one user blocks another, FormaVeloce may process:

• blocker user ID;
• blocked-user ID;
• block timestamp;
• social relationship changes;
• related moderation information.

Blocking may:

• hide the blocked user's profile and applicable content from the blocking user's experience;
• remove follows;
• remove friendships;
• remove pending friend requests;
• remove pending race invitations;
• prevent future supported social and racing interactions.

A block also creates a moderation ticket for FormaVeloce to review.

Moderation Notifications

New ordinary reports create a moderation ticket in FormaVeloce's backend and may generate a moderation email through Resend to formaveloce@outlook.com.

Moderation emails may contain information needed to review the report, such as:

• usernames or display names;
• user IDs;
• report reason;
• optional report description;
• content identifiers;
• race identifiers;
• context;
• timestamps;
• review deadline.

Moderation Actions

FormaVeloce may record moderation actions including:

• dismissal of a report;
• warnings;
• profile resets;
• avatar removal;
• content removal;
• showcase hiding;
• social restrictions;
• temporary suspension;
• permanent banning;
• correction or removal of fraudulent results;
• restoration following an incorrect action.

Reports concerning objectionable content or abusive users are reviewed and acted upon within 24 hours.

11. Advertising

FormaVeloce uses Google Mobile Ads / AdMob for optional rewarded advertisements.

AdMob and its partners may process information including:

• advertising identifiers;
• device information;
• application information;
• IP address;
• approximate region;
• advertising requests;
• ad impressions;
• ad interactions;
• completion information;
• advertising-consent status;
• fraud-prevention information;
• ad request identifiers;
• reward identifiers;
• transaction identifiers.

Where required, FormaVeloce provides advertising-consent or privacy controls.

On iOS, FormaVeloce may use App Tracking Transparency where required by Apple.

Declining tracking does not prevent basic use of FormaVeloce.

FormaVeloce does not sell personal data for direct monetary payment. However, advertising-related processing may be treated as a "sale," "sharing," targeted advertising, or similar activity under particular privacy laws depending on the applicable statutory definition and configuration. Where applicable, FormaVeloce provides disclosures and choices required by law.

12. Purchases

FormaVeloce may offer consumable Bolt packs through Apple In-App Purchase and, where available, Google Play Billing.

Purchase-related information may include:

• product ID;
• purchase platform;
• transaction identifier;
• Apple signed transaction information;
• Google purchase token;
• purchase status;
• purchase time;
• authenticated FormaVeloce user ID;
• fraud checks;
• duplicate-claim checks;
• wallet ledger entries;
• refund information;
• reversal information;
• chargeback information.

FormaVeloce does not receive complete payment-card information.

Payments are processed by Apple or Google.

Purchases are verified server-side before Bolts are credited.

Purchase information may be used to:

• deliver purchased Bolts;
• prevent duplicate claims;
• detect fraud;
• process refund or reversal information;
• resolve billing disputes;
• meet accounting or legal requirements.

13. Purposes of Processing

FormaVeloce processes information to:

• create and authenticate accounts;
• maintain account security;
• provide profile functionality;
• provide car capture and identification;
• create and maintain car cards;
• operate collections and garages;
• provide repairs and upgrades;
• operate racing;
• operate challenges, achievements, events, and rewards;
• operate social functionality;
• provide public profiles and showcases;
• process purchases;
• provide rewarded advertising;
• determine spotting country where enabled;
• filter objectionable user-generated content;
• perform image-safety moderation;
• process reports;
• operate blocking functionality;
• investigate abusive behavior;
• enforce the Terms and Community Guidelines;
• prevent fraud and cheating;
• provide support;
• process account deletion;
• maintain security and reliability;
• diagnose technical problems;
• comply with legal obligations.

14. GDPR Legal Bases

Where the General Data Protection Regulation applies, FormaVeloce relies on different legal bases depending on the processing.

Contract

Processing may be necessary to provide the service you request, including:

• accounts;
• gameplay;
• captures;
• car cards;
• profiles;
• racing;
• social functionality;
• purchases;
• rewards;
• reporting and blocking functionality.

Consent

Consent may be relied upon where required for activities such as:

• optional location use;
• certain advertising processing;
• tracking where applicable;
• other optional processing that legally requires consent.

Legitimate Interests

FormaVeloce may rely on legitimate interests to:

• secure the service;
• prevent fraud;
• prevent cheating;
• detect abuse;
• moderate user-generated content;
• investigate reports;
• protect users;
• enforce rules;
• prevent repeat abuse or ban evasion;
• maintain reliability;
• provide appropriate support.

Where legitimate interests are relied upon, FormaVeloce considers the nature of the information, the purpose of processing, and the rights and interests of affected users.

Legal Obligation

FormaVeloce may process or retain information where necessary to comply with:

• tax obligations;
• accounting obligations;
• consumer-protection requirements;
• lawful government or court requests;
• other applicable legal duties.

Consent is not treated as the legal basis for every type of processing.

15. Service Providers and Data Sharing

FormaVeloce uses service providers to operate the service.

Supabase

Used for:

• authentication;
• database services;
• public and private storage;
• Edge Functions;
• Realtime functionality;
• backend infrastructure.

OpenAI

Used for:

• analysis of submitted car photographs;
• vehicle identification;
• image-safety moderation of car photographs;
• image-safety moderation of profile images.

Google AdMob

Used for:

• rewarded advertising;
• advertising-consent functionality where applicable;
• advertising verification;
• reward-related information.

Apple

Used for:

• App Store distribution;
• StoreKit;
• In-App Purchase;
• App Store Server API;
• TestFlight;
• iOS platform functionality.

Google

Used where applicable for:

• Google Play Billing;
• Google Play platform functionality;
• Android services.

Expo / EAS / Expo Updates

Used for:

• application builds;
• delivery;
• updates;
• related application infrastructure.

Resend

Used to deliver email, including moderation-report notifications.

Moderation emails delivered through Resend may include report metadata needed for review, such as usernames, display names, user IDs, report reasons, optional descriptions, content or race identifiers, context, timestamps, and review deadlines.

FormaVeloce does not list providers that are not currently implemented merely because they are commonly used by mobile applications.

16. International Transfers

FormaVeloce is operated from Estonia, but service providers may process information in other countries, including countries outside the European Economic Area.

Where GDPR or other applicable law requires a transfer mechanism, FormaVeloce relies on lawful mechanisms made available by the relevant service provider, which may include:

• adequacy decisions;
• Standard Contractual Clauses;
• other legally recognized safeguards.

The exact processing location may depend on the provider and service configuration.

17. Data Retention

FormaVeloce does not retain every category of information for the same period.

Retention is based on the purpose for which information is processed and applicable legal, security, fraud-prevention, moderation, accounting, and technical requirements.

In general:

• Active account and profile information is retained while the account exists unless removed earlier.
• Gameplay information is generally retained while the account and relevant gameplay records exist.
• Accepted car photographs and avatars are generally retained while the related account or content exists unless removed earlier.
• Purchase and wallet records may be retained where necessary for accounting, refund processing, dispute handling, fraud prevention, or duplicate-claim prevention.
• Reports, blocks, moderation actions, and enforcement evidence may be retained after account deletion when reasonably necessary to protect users, prevent repeated abuse, consider appeals, resolve disputes, or comply with law.
• Security and technical logs may remain temporarily according to legitimate operational or security needs.
• Backups may temporarily contain deleted information during normal backup and provider retention cycles.
• Content saved or screenshotted by other users may remain on those users' devices outside FormaVeloce's control.

Information should be deleted or anonymized when it is no longer reasonably necessary for the purpose for which it is retained.

FormaVeloce does not promise that all technical backup copies disappear instantaneously.

18. Immediate Account Deletion

Users can initiate permanent account deletion directly through FormaVeloce.

The app requires the user to type DELETE and then complete a final confirmation step.

After final confirmation, deletion is immediate and irreversible.

The backend deletion process is designed to:

• delete the Supabase authentication account;
• remove avatar files;
• remove car-photo files;
• delete associated profile information;
• delete applicable gameplay information;
• delete applicable collection information;
• delete social relationships;
• delete applicable racing information;
• delete other user-owned account data;
• sign the user out.

The application also clears applicable local app data after successful deletion.

Deleting an account permanently removes access to:

• Bolts;
• purchased Bolts associated with the account;
• earned Bolts;
• cards;
• progress;
• virtual items;
• achievements;
• account-associated content;
• account access.

Deleted account assets cannot simply be transferred to another account.

Certain information may remain where genuinely necessary and permitted for:

• transaction records;
• fraud prevention;
• security;
• moderation;
• prevention of repeat abuse;
• appeals;
• legal claims;
• dispute resolution;
• legal compliance;
• temporary backup integrity.

Retained information is limited to the legitimate purpose requiring retention.

Deleting the account cannot remove screenshots, copies, or cached content previously saved by other users.

Deleting your FormaVeloce account does not request a refund from Apple or Google.

19. Security

FormaVeloce uses reasonable technical and organizational measures intended to protect personal information.

These measures may include:

• encrypted transmission;
• Supabase authentication;
• database access controls;
• row-level security where applicable;
• private storage for car photographs;
• time-limited or access-controlled image delivery;
• server-side verification for sensitive operations;
• server-side purchase verification;
• authenticated moderation actions;
• backend secret protection;
• fraud and anti-cheat controls.

No system is completely secure, and FormaVeloce cannot guarantee absolute security.

Avatars are stored in public storage and may be viewed by anyone who obtains the relevant avatar URL.

20. User Privacy Rights

Depending on applicable law, including where GDPR applies, you may have rights to:

• access personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing;
• receive portable information where applicable;
• withdraw consent where processing relies on consent;
• complain to a data-protection authority.

To exercise a privacy right, contact:

formaveloce@outlook.com

FormaVeloce may need to verify your identity before processing a request.

Requests will be handled within the period required by applicable law.

Where a request is refused or restricted, FormaVeloce will provide an explanation where legally required.

21. Advertising and Consent Choices

Where required, users may manage advertising privacy or consent choices through functionality provided in or alongside FormaVeloce.

You may also manage relevant device-level privacy settings.

On iOS, App Tracking Transparency choices may be managed through iOS settings where applicable.

Withdrawing advertising consent or declining tracking may change the type of advertising available but does not prevent basic use of FormaVeloce.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn.

22. Automated Decisions and Review Requests

Automated systems may influence:

• whether a capture is accepted;
• vehicle identification;
• car-card information;
• rarity or specification estimates;
• anti-cheat results;
• image-safety decisions;
• whether content is permitted to become visible;
• reward eligibility;
• purchase verification;
• duplicate-claim prevention;
• fraud flags.

These systems may make mistakes.

If you believe:

• a vehicle was incorrectly identified;
• a photograph was incorrectly rejected;
• your profile content was incorrectly rejected;
• an anti-cheat result was incorrect;
• a reward or purchase result was incorrect;
• a moderation decision was incorrect,

you may use available in-app reporting tools or contact support.

Moderation appeals should be sent to formaveloce@outlook.com.

23. Children

FormaVeloce is not intended for children under 13 and does not knowingly seek personal information from children under 13.

If FormaVeloce becomes aware that personal information has been collected from a child under 13 in circumstances where it should not have been collected, reasonable steps will be taken to address the issue.

Contact formaveloce@outlook.com if you believe such information has been provided.

24. Changes to This Privacy Policy

FormaVeloce may update this Privacy Policy when:

• app functionality changes;
• data processing changes;
• providers change;
• moderation or safety systems change;
• legal requirements change;
• platform requirements change.

The current version will be published on formaveloce.com and will display its last-updated date.

Where legally required, users may receive additional notice regarding material changes.

25. Contact and Supervisory Authority

Privacy, data-protection, moderation, legal, and appeals

formaveloce@outlook.com

General support

support@formaveloce.com

Controller

Henri Terna
FormaVeloce
Estonia
Telephone: +372 5551 0655

If GDPR applies to you, you also have the right to lodge a complaint with an appropriate supervisory authority.

In Estonia, the relevant supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).