Privacy Policy

Applies to the website drival.de and to the Drival app on Android and iOS.
Last updated: 2 October 2026 · Deutsche Fassung

This is a translation of the German privacy policy. If the two versions differ, the German version prevails.

This policy describes what data is generated when you use the app and this website, what happens to it and what rights you have. It is deliberately written so that it can be read without any prior knowledge.

1. Controller

Silas Gehring: Unterer Sägerweg 104
75305 Neuenbürg
Germany
Email: info@drival.de

No data protection officer has been appointed; the legal requirements for one are not met.

2. The principle: the device first, everything else second

Drival is built to work fully without an account and without an internet connection. Recorded drives, routes you create, the times you set on them, vehicles, photos and dashcam videos are initially stored only on your device, in the app's storage. I have no access to this data.

Without an account, the app contacts other services only for ads (section 5), for map tiles and for looking up the place names of a finished drive (both section 3) and, from 0.60.0, for viewing public routes and videos (section 7f). Your tracks, routes and times are not sent to them; only the start and end point of a drive go to the place-name lookup. Your own content reaches the server only once you sign in, and your garage and routes only once you also switch on cloud sync. Both are separate, explicit steps; neither is enabled by default. What you use deliberately with an account (scoreboard, comments, ratings, reports, blocks, preview links, route videos, bookmarked videos) is described in its own section. Even then, your drives and the times you set on routes stay on the device — section 4 lists what is transferred and what is not.

3. Location data

The app needs your location — that is its purpose. It reads it through your device's location services while a recording is running, while you drive a route and, from 0.60.0, while the acceleration test page is open (section 3c). While a map is open in the app, it also reads your current position to centre the map and show where you are; this position is not stored. If you have switched on drive detection, there is a further occasion; it is described just below.

Recording while the screen is off requires the "Allow all the time" location permission (on the iPhone: "Always"). Without drive detection switched on, the location is even then captured only while a recording is running — not continuously in the background.

Drive detection (optional, off by default, since 0.56.0)

If you switch on Profile → "Detect drives automatically", the app notices that a drive is starting and asks you via a notification whether to record. It never starts a recording on its own. Only your tap on the notification starts a drive — exactly like the start button. On Android, from 0.60.0 a drive can also be detected through the connection to your car via Bluetooth; the detection there needs no location. Only there, if you wish, can recording also start by itself as soon as your car connects — the one exception to this paragraph (section 3b).

Technically, this does not work through continuous location tracking. The app registers a circle of about 150 metres with the operating system around the place where you last ended a drive or last opened the "Record" screen without recording — usually where the vehicle is parked. To place it, the app reads your position once at that moment. The system wakes the app when this circle is left; only then does it measure for a few seconds to tell driving apart from walking. If the measurement does not indicate a drive, nothing happens. Apart from this, the location is not queried in the background between two drives.

The positions measured for this serve solely this decision. They are not stored and do not become part of any drive. Recording begins only at the moment you agree.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the same switch; the registered circle is then deleted immediately.

The recorded points (time, coordinates, speed, altitude, accuracy, heading) are stored locally and analysed locally. They are not transmitted to me, and to third parties only as described in the next paragraph. Apart from that, the only parts of a drive that can leave the device are the shape of a route you create from it and explicitly share, the picture of a drive if you share it as a link (section 7a), and from 0.60.0 the video of a pass if you explicitly add it to a route (section 7f).

Maps and place names in the app. The maps in the app (on the "Record" screen, for drives and routes, and on the route map) load map tiles, map style and fonts directly from OpenFreeMap (tiles.openfreemap.org, map data from OpenStreetMap). As with any request on the internet, OpenFreeMap receives your device's IP address and which map tiles are requested; because the map follows your position, the tiles show roughly which area you are in. When you end a recording, the app suggests a name for the drive, made from the places at its start and end. For this, the coordinates of the drive's start and end point are sent to your operating system's geocoding service — Apple on the iPhone, usually Google on Android — which returns the place name. Neither service receives any other points of the drive, any times or any account data. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in showing a map and a readable name for the drive.

If you share a route or export a drive, its entire shape goes with it — start and end included. If a route begins at your front door, that can be read from it. Earlier versions of the app could place circles around addresses and cut out the points inside them; this feature has not existed since version 0.41.0. Anyone who publishes a route should therefore deliberately trim it so that it does not begin outside their own door.

3a. Camera, microphone and dashcam

The camera is used for the profile picture and for vehicle pictures — a still picture is taken for these, and where it goes is described in section 4 — and for the dashcam (below): from 0.60.0 in the Android version, from 0.61.0 on the iPhone too. Both only if you choose to.

The microphone only for dashcam sound, and only if you want it. On Android, up to version 0.32.0 the app requested the permission for it without recording any sound: it came in through a software library the app uses, which brings it along for video recording. Since 0.33.0 it has been switched off, as have "physical activity" (step counter) and "display over other apps". From 0.60.0 "Microphone" is back in the Android version — this time on purpose, for the dashcam's "Record sound" switch. You are asked only when you switch it on; it is off by default. On the iPhone the same applies from 0.61.0: sound only with "Record sound", and you are asked only when you switch it on; until then the app recorded no sound there and did not ask for it. What the Android version requests is checked on every build against a list that states the reason next to each permission.

Dashcam: video while you drive (optional; Android since 0.60.0, iPhone from 0.61.0)

When you start a recording, you choose "With video" or "Without video"; the choice you made last is highlighted, "Without video" by default. The app asks for the camera only the first time you tap "With video" or when you switch on "Record video" under Profile → Camera; without that permission, no recording starts with video. After "With video" the app first shows the camera picture so you can line it up; filming begins only when the recording starts. A start from the "Drive detected" notification (sections 3 and 3b) uses the choice you made last — with video only if you last chose "With video". A drive started automatically (section 3b) never films, not even if you open the app during it. Filming happens only while a recording is running, the screen is on and Drival is in the foreground — never in the background.

The videos stay on the device. They are kept in the app's storage, not in your gallery, and go neither into cloud sync nor to me nor to the advertising component. On the iPhone, from 0.61.0, they are also excluded from the iCloud backup. The video with gauges is also created on the device: the app draws speed, g-forces, the speed graph, the map of the drive, the vehicle with its photo, and the time and name of the drive into a bar below the picture; each gauge can be switched off in the camera settings. Nothing is transmitted for this. If a storage limit is set, the oldest videos give way while recording.

The dashcam records sound only if you switch on "Record sound" in the camera settings and allow the microphone, on Android as on the iPhone. Conversations in the car can then be heard too — in the video on the device and in any you share; the app says so at the switch. Tell your passengers beforehand. Like the picture, the sound stays on the device, and a video you add to a route never has sound (section 7f).

When a video leaves the app: only if you tap "Share" or "Save to gallery" (on the iPhone "Save to Photos") on a drive, or add a pass to a route (section 7f). "Share" hands it through your phone's share sheet directly to the recipient you choose, like "Share image" in section 7a; nothing is stored on a server. "Save to gallery" puts a copy into the "Drival" album of your gallery on Android. On the iPhone the button is called "Save to Photos" from 0.61.0 and puts the copy into the Photos app; for this the app asks only for permission to add items there — it does not see any photos or videos in it and creates no album of its own. The copy is then yours, and the app does not delete it along with anything. Both show what the bar shows — with the map, that includes the start and end of the drive. An ad appears before either (section 5).

Deleting: if you delete a drive, its video goes with it. The camera settings offer "Delete all videos", and "Delete all data" in your profile removes them as well (section 8). Except for a video you add to a route, I do not receive these recordings and do not process them. You are responsible for what you film and pass on — other road users and passengers may be seen and heard in it.

3b. Drive detection via Bluetooth (Android, optional, since 0.60.0)

Under Profile → "Detect via Bluetooth" you choose one or more of the devices paired with your phone, such as your car's hands-free system, and what happens when the phone connects to one of them. From 0.61.0 there are two modes:

"Record automatically" (the default): The app starts a recording by itself, without video. Everything in section 3 applies to it, and it can be recognised the whole time by the notification "Recording your drive automatically". If the device disconnects and does not reconnect within five minutes, the drive ends by itself and is saved; whatever was recorded after the disconnection — such as the walk from the car park — is discarded. If the car keeps driving after the disconnection, the app waits until it stops. Nothing shorter than 300 metres is saved. A drive starts by itself only if location is set to "Allow all the time"; otherwise the notification of the second mode appears instead.
"Only ask": The app shows the notification "Drive detected — tap to record". As with drive detection in section 3, it then never starts a recording on its own; only your tap starts a drive.

If you had already chosen devices before 0.61.0, you are asked once which mode should apply; until you answer, the app keeps asking. No notification comes during a recording, and for the same device at most every ten minutes. The app does not read your location for the detection itself; it is read only for the recording (section 3).

For this the app needs the "Nearby devices" permission (up to Android 11 "Bluetooth", granted at installation), and permission to show notifications for the prompt. You are asked only on the detection page, when you tap. The app does not search for other devices; it reads only the name and address of paired ones in order to show them to you for selection. The address and name of the devices you choose, the chosen mode and, for each device, when the app last asked are stored, and only on the device. The app needs that time for the ten-minute pause. During a drive that started automatically, it also keeps track of which device started it, whether it is still connected and when it disconnected — likewise only on the device, and deleted at the latest when the drive ends. None of it goes into cloud sync, to me or to the advertising component.

Deselecting a device ends detection for it and deletes its time; "Delete all data" forgets all chosen devices along with their times. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by choosing a device — for the automatic start together with the "Record automatically" mode — and withdraw by deselecting it; for the automatic start also with "Only ask".

3c. On the device only: consumption, tags and acceleration test (since 0.60.0)

Consumption. On a vehicle you can enter an average consumption and a price; the extended analysis of a drive uses them to estimate roughly what the drive used and cost. You give drives tags such as "Commute" and filter the list of drives by them.

Acceleration test. While its page is open, the app reads your location to measure times such as 0–100 km/h. Every run that reaches at least one of these marks is saved under "Past measurements": when it was measured, with which vehicle, in which unit, the times reached and whether the run ended early — no coordinates and no top speed. You delete individual runs in that list.

All of this stays on the device, even with cloud sync switched on. It goes neither to me nor to the advertising component, and "Delete all data" removes it too (section 8).

4. Account and cloud sync (optional)

If you create an account, your email address and an encrypted proof of your password are stored. The password itself is not stored in plain text.

If sync is switched on, the following is transferred:

display name and profile settings,
vehicles from your garage (name, car brand, model, power, year of manufacture, kerb weight, type, note and, if there is one, the first photo — see below),
routes you create, including name, description, visibility, shape, start gate and finish gate, corridor width, road type and whether they count in both directions,
friendships and ratings of routes.

That is the complete list. Your recorded drives, their tracks and the times you set on routes are not transferred. There is no switch for that either: they are measured on the device, stored there and compared there with your own best time. The same applies to dashcam videos, chosen Bluetooth devices, consumption, tags and acceleration measurements (sections 3a to 3c). A video of a pass leaves the device only if you explicitly add it to a route (section 7f).

Scoreboard since 0.53.0. Since this version there is exactly one exception to this, and it is stated here so that the paragraph above does not silently become untrue. If you explicitly switch on participation under Profile → Scoreboard, five numbers are transferred per period (day, week, month, year, all time): distance driven, driving time, number of drives, number of corners and a value for the smoothness of your driving.

Changed in August 2026. Previously there were six numbers, including the highest measured speed and the highest measured acceleration. Neither is transferred or displayed any longer. They have been replaced by smoothness: a number from 0 to 100 for how fluidly forces build up and ease off. It is derived from the acceleration sensor, and only if you have switched on "Phone is firmly mounted"; without that it stays empty, and you do not appear in that one list.

This remains the case: no individual drive, no time of a drive, no coordinate. No route and no whereabouts can be reconstructed from these totals. The switch is off by default and is not tied to cloud sync — sharing your garage does not automatically enter you in the scoreboard. If you switch it off again while signed in, your row is deleted immediately. The numbers are visible only to signed-in users, and only as long as your profile is set to public.

From 0.60.0 the app no longer shows a scoreboard. "Discover" takes its place (section 7f). Nobody can join any more; only those who have switched it on still see the switch. As long as it is on, the five numbers continue to be transferred, and older versions of the app keep showing them as described above. If you switch it off, the switch disappears and your row is deleted: immediately if you are signed in, otherwise as soon as you sign in on this device again with the account whose numbers it last transferred. Another account signing in deletes nothing. If you have not opened the app signed in and with cloud sync switched on since updating to 0.60.0, the device does not know whose row it is. If you then switch it off while signed out, the app tells you so and leaves the switch on until you sign in with that account and switch it off; if you switch it off anyway, the row stays. It also stays if you choose "Delete all data" first while signed out or signed in with another account, and up to 0.58.0 it stayed if you were not signed in when you switched it off. In each of these cases "Delete cloud data", chosen while signed in, removes it. Nothing is deleted automatically.

Vehicle pictures since 0.47.0. Until then, this section said that photos of your vehicles do not leave the device. That no longer applies, and to exactly this extent: with cloud sync switched on, the first photo of each vehicle is uploaded in reduced size (longest edge 1280 pixels). Further photos of the same vehicle stay on the device. The picture is visible only to signed-in users, and only as long as your profile is set to public — the storage is private and releases pictures exclusively through short-lived, signed addresses. If you remove the photo in the app, it is also deleted from the server at the next sync; "Delete cloud data" removes all of them at once. Without cloud sync, nothing is uploaded.

Deleting your account. In the app, under Profile → Account & cloud, you will find "Delete account permanently" at the very bottom. This removes not only the content but the account itself: profile, garage, shared routes, ratings, friendships, vehicle pictures and, from 0.60.0, your route videos and bookmarked videos (section 7f). The data on the device is removed at the same time. This cannot be undone — not even by me. Anyone who no longer has access to the app can write to the address given in the legal notice.

Earlier invitations. Older Android versions (0.53.0 to 0.57.1) had an invitation feature. Since 28 September 2026 Drival no longer accepts invitations, on any platform. From the time before, who invited whom is stored — two account identifiers and the time. If you delete your account, the entry is deleted with it.

Who processes the data

For the account, database and sync I use Supabase (Supabase, Inc.). The project is located in the eu-central-1 region, i.e. in a data centre in Frankfurt am Main. The data is stored there and, in normal operation, does not leave the European Union. Supabase acts as a processor; a data processing agreement under Art. 28 GDPR is in place.

Who can see what

Private — only you. Not even the operator sees it in the app.
Friends — accounts you have confirmed as friends.
Public — every signed-in account of the app. From 0.60.0 the app also shows public routes to anyone who is not signed in: shape, route name, length and rating, comments without names, and videos, with the display name of whoever uploaded them if their profile is public (section 7f).

This classification applies to your routes. What you make public is visible to other users: the route's shape and your display name; if you additionally make your profile public, your vehicle details as well. Nobody sees the times you set on routes — they are never on the server in the first place. Versions 0.53.0 to 0.58.0 show a scoreboard across several drivers; it contains only the totals named above, and only for drivers who have switched it on. For every route, consider whether its shape reveals something about where you live.

Your friend link. Under Profile → Friends the app shows your link and a QR code for it. Anyone who opens it while signed in sees your display name — even if your profile is not public — and can send you a friend request. Nothing more: you are only friends once you accept. There is no search by name; only people who pass on their link can be found.

Comments you write on a shared route are seen by everyone allowed to see that route — with your display name, even if your profile is not public. Details in section 7d.

Legal basis

Art. 6(1)(b) GDPR — the processing is necessary to perform the user agreement you enter into by creating the account. Without an account, none of this processing takes place.

5. Advertising (Google AdMob)

The app shows ads via Google AdMob, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Ads appear in three forms: as a banner at the bottom of the "Drives", "Map", "Routes" and "Profile" pages and of the full-screen route map (up to 0.58.0 also on the "Scoreboard" page), as a video ad before the extended drive analysis, and as a full-screen ad before starting a route run and, from 0.60.0 on Android and from 0.61.0 on the iPhone, before you share a drive's video or save it to your gallery (on the iPhone: to Photos). The video ad is announced before you press the button; the analysis opens even if you close it immediately. No ads appear while a recording is running or paused — not even a banner. The "Record" screen, which is what you look at while driving, shows none at all, and neither do "Discover", your bookmarked videos or publishing a video.

To deliver ads, Google processes, among other things:

your device's advertising ID (a resettable identifier; on the iPhone only if you allow tracking — see below),
device model, operating system version and language setting,
the IP address and an approximate location derived from it,
information on whether an ad was loaded, seen or tapped.

What Google does not get: your drives, routes, times, tracks and videos. This data is not passed to the advertising component at any point.

Before the first ad, the app asks you through Google's consent dialog (User Messaging Platform) whether personalised ads may be served. The legal basis is your consent under Art. 6(1)(a) GDPR or, as applicable, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw or change it at any time in the app under Profile → Ads → "Change ad consent"; this opens the same form as on first launch. The button appears wherever Google's consent form applies, for example in the EU and the EEA. The withdrawal applies to the future.

On the iPhone, the app then additionally asks through Apple's "App Tracking Transparency" prompt whether it may track you across apps and websites owned by other companies — and it does so before the advertising component starts. If you decline, Google does not receive the device's advertising ID; ads still appear, just without this identifier. You can change your answer at any time in the iOS settings under "Privacy & Security → Tracking".

Google may also transfer data to servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023, and additionally on standard contractual clauses.

The same protection with every recipient. Anyone who processes data on my behalf or receives it for advertising is bound to the GDPR standard of protection on which this policy is based: Supabase and IONOS as processors under a contract under Art. 28 GDPR that allows processing only on my instructions; Google as an independent controller under the Google Ads Controller-Controller Data Protection Terms and, for transfers to the USA, the EU-US Data Privacy Framework and standard contractual clauses. OpenFreeMap and your operating system's geocoding service (section 3) receive nothing beyond what is described there.

More information in Google's privacy policy. On Android, the advertising ID can be reset or deleted in the settings under "Privacy → Ads".

Without ads: If an account is exempt from ads, it gets no ads. On a device that knows about this, the advertising component is not started at all, and no request goes out to Google. Another device using the same account only learns of it when, after you have signed in there, it checks with the server at a later start; until then, it may already have requested ads from Google.

6. No analysis of how you use the app

The app contains no analytics or statistics tool. It does not record which screens you open, how long you use the app or which buttons you press. Crash reports are stored locally on the device and are sent only if you do so by hand.

7. This website

Since 19 August 2026 the website has been running on its own server. It is located in a data centre of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, in Germany. When you request a page, your browser transmits technically necessary data: IP address, time, requested address, browser and system information. The web server needs this data to deliver the page and keeps no access log. Only if an error occurs with a request is it recorded, including the IP address, in the server's system log; the entry is deleted there after 14 days.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in operating the website securely and without disruption. A data processing agreement is in place with IONOS.

This website sets no cookies, loads no fonts and contains no tracking pixels. No audience measurement takes place. One script comes from another server: the AI assistant on the home page (section 7e).

The map loads nothing from other servers. It shows map material from OpenFreeMap (data from OpenStreetMap). Your browser does not request it from there, however: the map tiles are fetched by our server and passed on to you. OpenFreeMap therefore sees neither your IP address nor which part of the map you are looking at — it only sees our server. The map software itself (MapLibre GL JS, BSD-3-Clause) is also hosted on our server and is not loaded from a third-party provider.

7a. Sharing a drive with a preview image (optional, since 0.54.0)

In the app, a drive can be shared as a picture. There are two ways to do this, and they differ fundamentally:

Share image: the picture is created on the device and goes directly to the recipient through your phone's share sheet. Nothing is stored on a server.
Link with preview image: here the picture is uploaded to our server so that messaging services such as WhatsApp or Instagram can show a preview. These services do not sign in — they fetch the address that is in the page. The picture can therefore be retrieved by anyone who knows the link, including recipients of a forwarded message. What happens is stated as a note directly below the button.

What is uploaded: only the finished picture and the two lines of text on it (name of the drive, distance, duration and — unless you have switched it off in your profile — the top speed). The picture shows the line of the drive from start to end, coloured by speed and without a map underneath. The recorded track itself is not transmitted: no coordinates, no timestamps of individual measuring points, no GPX file. A link with a preview image requires an account; it is stored together with your account identifier and the time of sharing.

For how long: the picture is deleted automatically 24 hours after sharing, together with the two lines of text. After that, the link only shows a note that it has expired. The address contains a long random identifier and cannot be guessed; the page is also excluded from search engines. A link cannot be withdrawn early in the app; if you want it removed before the 24 hours are up, an email to info@drival.de is enough.

What we cannot undo: if a messaging service has already made its own copy of the preview image when the message was sent — WhatsApp and others do this —, that copy is on their servers. It is not covered by the deletion after 24 hours. The same applies to recipients who have saved the picture.

Legal basis: Art. 6(1)(a) GDPR (consent). You give it by tapping "Link with preview image" — separately for each shared picture. The note on what happens is directly below this button; the other ways ("Share image", GPX, JSON) store nothing on a server and therefore need no consent.

7b. Public routes on the map on this website

On the home page, under "Map & routes", there is a map showing the routes that drivers have explicitly set to "Public" in the app. It can be viewed without an account and without signing in. In the app an account was needed for this up to 0.58.0; from 0.60.0 the app too shows public routes without signing in, with the same details as this map (section 7f). Anyone who makes a route public thereby also makes it visible on the open web, including to search engines. The app says so at the point where the visibility is chosen.

For each such route, the following is shown:

the name the driver has given it,
the shape as a line on the map,
the length,
whether it is entered as a public road or as a closed course,
the average rating and the number of ratings,
a technical identifier of the route. The website needs it to load the comments on a route and to link to it. It is assigned on the device, and it reveals when the route was created.

Not shown and not transmitted either:

who created the route — neither display name nor user identifier. The map in the app shows the name when you are signed in; this one does not.
times driven. They are not on any server anyway, only on the device on which they were recorded.
the start and finish gates and the corridor. That is the geometry used for measuring, and the most precise information stored about a route.
a description, if one has been entered.

Technically, your browser only asks our server for this (/strecken.php); the query to the database is made by the server. The list is cached there for five minutes. Beyond that, the route table cannot be accessed without an account: the only thing released is a function that returns exactly the fields of public routes named above.

Undoing it: if you set a route in the app back to "Private" or "Friends", or delete it, it also disappears from this map with the next sync — at the latest five minutes later, when the cache has expired. The legal basis for the display is consent under Art. 6(1)(a) GDPR, given by setting the visibility to "Public".

Comments on these routes also appear in the map's pop-up, but only their text and date — without display name and without user identifier. For this, too, your browser only asks our server (/kommentare.php), which caches the response for two minutes. Comments on routes shared only with friends, and hidden comments, never appear here.

7c. Reporting and blocking

If you report a route name, a comment, a profile or, from 0.60.0, a route video, the following is stored — alongside the wording of the reported content at the time of the report, so that what is reviewed is what you reported and not a later version: which content, which reason, your explanation if you write one, the time and which account reported it. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 of the Digital Services Act (DSA) — the reporting channel is mandatory, not optional.

Your report is not anonymous towards the operator. This is also stated in the report form itself, so that you know beforehand and not afterwards. The reported person is not told who reported them. Without this link, abuse of the reporting channel could not be detected — and a reporting channel that can be used to silence others would not be one.

Blocking — from a profile or, from 0.60.0, from a comment (section 7d) or a video (section 7f) — stores who blocked whom, when and from where (profile, comment or video), plus an identifier of the block itself, through which you lift it again. From 0.60.0 your list under Profile → Blocked people shows, for each block, where it was made and the display name, but no account identifier; the name always for a block made at a comment, otherwise only if the profile is public. The blocked person is not notified. It cannot be concealed, however: while signed in, they no longer see your public routes, comments and videos, and you do not see theirs; they cannot send you a friend request and can no longer open your profile — from which they can infer that a block exists. Signed out, they see what is public without an account, like anyone else (sections 7b and 7f). If you lift the block, the row is deleted.

A brake on blocking. At most twenty blocks in an hour and fifty in a day. The reason: a block made from a video does not tell you the account behind it, but it does confirm a suspicion. Because it works both ways, that account's comments and routes then disappear from your view, and the database answers yes or no to whether there is a block between you and a particular account. Anyone who suspects an account can find out this way whether it uploaded the video. The brake does not prevent this; it only limits how often it can be done. For this, one time with your account identifier is stored per block, not whom you blocked. These times are deleted as soon as they are older than one day (at most a quarter of an hour later), and with your account.

Retention. Closed reports are deleted after twelve months. That long, because repeated abuse could not otherwise be detected, and measures against it (modelled on Art. 23 DSA) need a time frame. The legal basis for keeping them this long is my legitimate interest in protecting the reporting channel against misuse (Art. 6(1)(f) GDPR). If you delete your account, your blocks and your notices are deleted with it. Your reports remain, but without any link to you, until they have been decided and have expired: if a report has already hidden a piece of content, that content would otherwise stay hidden forever without a human ever reviewing it.

Notices. If something of yours is hidden following a report, or a decision has been made on a report of yours, Drival creates a notice for you: which content (as it was reported — the decision concerns this wording), which reasons were reported, whether the decision was automated or made by a human, and the statement of reasons. You will find it in the app under Profile → Notices and can delete it there. Who reported is never stated in it. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16(5) and Art. 17 of the Digital Services Act. Like closed reports, notices are deleted after twelve months once the case they relate to has been decided — but after two years at the latest. If a route is restricted permanently, the reason is then stated in the rules; you can ask at any time at info@drival.de.

If a report is upheld, the decision records the objectionable wording: for a route its name, for a profile the display name. This is necessary so that the same name is not uploaded again at the next sync. As long as the account exists, the record remains: it is the reason why the same name cannot come back via a second route. It is deleted once neither the route nor the account behind it exists, but no earlier than twelve months after the decision. For a profile, the time from which the garage is no longer public is also recorded — otherwise the vehicle names would remain visible, although they are self-written text just like the display name. This record belongs to the profile and is deleted together with the account.

What happens to a report, who decides and how you can object to a decision is set out in the rules.

7d. Comments on routes (optional, since 0.57.0)

With an account, you can write a comment on a shared route. What is stored is the text, the time, which account wrote it and on which route it appears.

Who sees it:

in the app, everyone who is allowed to see the route — for a public route every signed-in account, for a route shared with friends the creator's friends — and that with your display name, even if your profile is not public,
for public routes, also every visitor to this website and, from 0.60.0, anyone using the app without signing in — in both cases without a name, and on the website also visible to search engines (sections 7b and 7f).

The app says who sees the comment at the point where you write. Anyone you block does not see your comments while signed in, and you do not see theirs. From 0.60.0 you can block right at the comment, even if the author's profile is not public; all of their comments then disappear from your view (section 7c).

Check before saving. A comment containing a time or a link is rejected (see the rules). This is done by pattern matching on our database server; the text is not sent to any other service for this.

Deleting. You can delete your comment in the app at any time. "Delete cloud data" and deleting the account take all your comments with them. If the creator deletes the route, the comments on it disappear as well. On this website, a deleted comment is gone after two minutes at the latest.

A brake against flooding. For the limit of ten comments in ten minutes, one timestamp with your account identifier is stored per comment. These timestamps are deleted after one hour, independently of everything else.

The legal basis is Art. 6(1)(b) GDPR: you publish the comment yourself, and displaying it is the service you are asking for by doing so.

7e. The AI assistant on the home page (since 24 September 2026)

The home page of drival.de offers a chat with an AI assistant. It answers questions about Drival; its answers are generated automatically and can be wrong — what is binding is this policy and the rules. The assistant runs on zalu.ai, a service I operate myself. I therefore remain the controller (section 1).

What this involves:

When you open the home page, your browser loads the chat program from app.zalu.ai. As with any request, that server sees your IP address. It is located in an IONOS SE data centre in Frankfurt am Main.
The program stores a random identifier in your browser's storage (localStorage) — even if you never open the chat — and notes there whether you have already closed its hint. It keeps the course of an ongoing conversation in the tab's session storage, which is gone once you close the tab. It sets no cookies.
If you write something, your message, the identifier and a conversation number go to zalu.ai. If you fill in a form in the chat, those details go there too.

Who processes the messages: zalu.ai stores conversations with Supabase (Frankfurt am Main region, a processor under Art. 28 GDPR). To generate an answer, your message is sent to Google Gemini (Google Ireland Limited, Dublin, Ireland; possibly also to Google LLC in the USA, based on the EU-US Data Privacy Framework and standard contractual clauses). The messages are not used to train the models. So do not write anything in the chat that nobody but you should know.

Deleting: you remove the identifier by deleting the site data of drival.de in your browser. If you want a conversation deleted at zalu.ai, an email to info@drival.de is enough.

The legal basis is Art. 6(1)(f) GDPR: the legitimate interest lies in being able to answer questions about Drival straight away. For the identifier in your browser I rely on Section 25(2) no. 2 TDDDG, because without it the chat could neither link messages to a conversation nor limit misuse.

7f. Route videos, Discover and bookmarks (since 0.60.0)

From 0.60.0 the app has "Discover" where the scoreboard used to be: short videos of passes along public routes. They can be watched on Android and on the iPhone, even without an account; bookmarking needs an account. Adding a video of your own to a route is possible in the Android version and from 0.61.0 on the iPhone too, in each case with an account and from a drive recorded with the dashcam (section 3a).

What is uploaded. Something is uploaded only if, in a drive, you tap "Add to route" on a pass, confirm that you may show the video — anyone recognisable in it has agreed, or nobody is recognisable —, and choose "Publish". The app then cuts a new video on the device from the dashcam recordings: the picture of the pass with one and a half seconds before and after, a small Drival mark and, below it, a bar of its own, at most four minutes long. The bar shows the g-forces, the speed curve without values, a map of only this section (without the start and end of the drive) and the car brand and model of the drive's vehicle, if they are entered and "Trip vehicle with photo" is switched on in the camera settings; the other switches there do not apply to this video. No sound and no speed: no speed figure, not on the curve either, no vehicle photo, no vehicle name, no time and no name of the drive. How fast someone drove can be roughly estimated from the picture, the length and the speed curve, as with any video of a drive; it is not shown. The details a recording otherwise carries in the file — such as when it was filmed or which phone with which system version recorded it — are removed; only the orientation of the picture remains.

Stored with the video are: which route it is on, which account uploaded it, length, picture format, file size, for routes counted in both directions the direction, and when it was created and published. Not stored is which drive it comes from and when that drive took place; no coordinates are sent, the map is only a line drawn into the picture. For the limit of five videos per hour and twenty per day, one timestamp with your account identifier is kept per video and deleted after two days at the latest.

Where it goes. The file goes to my own server drival.de, the same one that hosts this website (section 7), and is kept only there — not at Supabase and not at any video service. The server accepts it only with your sign-in and checks with Supabase that the entry belongs to you. The entry itself, bookmarks and reports are kept at Supabase (section 4). Every request for a video is covered by what section 7 says about the server: no access log, error messages for 14 days.

Who sees it. The video is public: everyone sees it on the route and under "Discover", in the app even without an account, and the file can be retrieved at its address on drival.de by anyone who knows the address. Your display name appears with it only if your profile is public — but then for everyone, even without signing in; your account identifier does not go out, not even to someone who blocks you from a video: their list of blocked people shows the block without it, and your display name only if your profile is public. If they already suspect you, however, they can use this block to confirm that the video is yours (section 7c). Anyone you block does not see your videos while signed in, and you do not see theirs. Videos exist only on public routes: if the creator sets the route to "Friends" or "Private", the app no longer lists its videos, and within about five minutes their files can no longer be retrieved.

For how long, and how to delete it. Until you delete it — in the app, on your video — or until it may no longer be shown. The server takes a deleted video off the web within about five minutes and deletes the file. If the creator deletes the route — directly, through "Delete cloud data" or with their account —, all videos on it go with it, including other people's, and the server deletes their files in the same way. If the route is no longer public or a report is upheld, the file stays hidden on the server for another 30 days, in case the route becomes public again, and is then deleted together with its entry; the same applies to a file that was hidden when it was deleted. An upload that is started but never finished disappears after one day at the latest. There is no backup. What others have already watched, cached or recorded is not reached by the deletion.

Reporting. A video can be reported like a comment (section 7c). As a rule it is hidden after a single report until a decision is made: the app stops listing it at once, and within about five minutes the file can no longer be retrieved. It stays on the server in the meantime; only moderators can then view it, signed in, through a separate address. As long as the report is open, it is not deleted. If the report is rejected, the video can be seen again; if it is upheld, the 30-day period above applies. The notice about it (section 7c) names the video's address.

Blocking. With an account you can block the person who uploaded someone else's video right there, without opening their profile. The same block is stored as from a profile (section 7c), marked "video": who blocked whom and when. The app does not look up the account itself for this; the database does that from the video, and it does not tell you later either; the block does, however, confirm a suspicion (section 7c). Afterwards all of that person's videos disappear from your lists, and neither of you sees the other's videos, public routes and comments while signed in. They are not notified. You can lift the block under Profile → Blocked people.

Bookmarks. With an account you can bookmark a video. Supabase stores only which account bookmarked which video and when — no copy of the file. Only you see the list; whoever uploaded the video does not learn who bookmarked it. You can remove a video at any time; if it is deleted, it disappears from your list as well.

Without an account. From 0.60.0 the app shows what is public even without signing in: "Discover", the videos of a route and the public routes on the map. It shows routes and their comments with the same details as this website (section 7b), so comments without names. A video, however, shows the display name of whoever uploaded it if their profile is public, just as with an account; the map on this website shows no videos. For this the app queries Supabase and loads the videos from drival.de; as with any request, both see your device's IP address. No account is created, and nothing else about you is sent. Bookmarking, reporting, rating, commenting and driving a route need an account; the app says so at each point.

Deleted with the account. "Delete cloud data" and "Delete account permanently" (section 4) take your videos and your bookmarks with them. The server then deletes the files as described above: within about five minutes, a hidden one after 30 days.

The legal basis for publishing is your consent (Art. 6(1)(a) GDPR), which you give per video by choosing "Publish"; the app says beforehand that it becomes public. For bookmarks it is Art. 6(1)(b) GDPR, and for reports section 7c applies. For showing public content without an account I rely on Art. 6(1)(f) GDPR; the legitimate interest lies in showing what drivers have made public themselves.

8. How long data is stored

On the device: until you delete the drive or route in question, remove the app data (on Android in the settings) or uninstall the app. Dashcam videos also until a storage limit you have set pushes out the oldest (section 3a).
In the cloud: until you delete the data. Deletions are transferred with a marker so that they also reach your other devices.
Route videos on drival.de: until you delete them or the creator deletes the route; hidden ones another 30 days, with an open report until the decision and 30 days after it (section 7f).
Web server error messages: 14 days, after which they are deleted automatically. There is no access log.

On the Profile tab you will find "Delete all data". This removes all data on the device, including dashcam videos, chosen Bluetooth devices and saved acceleration measurements, and — if you are signed in — the copy in the cloud as well. The account itself remains until you delete it under Profile → Account & cloud → "Delete account permanently" (section 4).

9. Your rights

Under the GDPR you are entitled to:

access to the data stored about you (Art. 15),
rectification of inaccurate data (Art. 16),
erasure (Art. 17),
restriction of processing (Art. 18),
data portability (Art. 20),
object to processing based on legitimate interests (Art. 21),
withdrawal of consent you have given, with effect for the future (Art. 7(3)).

For access and erasure, an email to the address above is sufficient. In the app, you can also export drives yourself at any time as a GPX or JSON file.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence.

10. Children

The app is aimed at people with a driving licence and is not intended for children. Ad content is limited to the "suitable for all ages" rating, because passengers in a car can also see the screen.

11. Changes

If something about the app changes that is relevant to data protection, this policy will be updated. The version published here applies in each case.