Privacy Policy

DRIVE&JOY mobile application (iOS and Android) and the driveandjoy.cz website

Effective from: 2 November 2026 · Version 1.75

This policy explains what personal data we process in the DRIVE&JOY mobile application and on the driveandjoy.cz website, for what purpose, on what legal basis, how long we retain it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing.

1. Data Controller

The controller is a limited liability company (s.r.o.) registered in the Czech Commercial Register maintained by the Municipal Court in Prague, file no. C 451500.

For any questions regarding the protection of personal data and to exercise your rights, please contact us at the e-mail address above.

2. What data we process in the mobile application and for what purpose

We process only data that is necessary to provide the app's services, or that you voluntarily provide.

Without an e-mail address (or Sign in with Apple or Google) we cannot create an account. Everything else — your profile (including your date of birth and phone number), garage, location, chat messages or questions to the artificial intelligence features — you provide voluntarily; if you do not, only the feature concerned will be unavailable to you. The technical data (sections 2.9, 2.23 and 2.25) is recorded by the app itself as you use it. No law requires you to provide your data.

2.1 Registration and sign-in (account)

• E-mail address, password (the password is stored exclusively as a secure cryptographic hash).
• Sign in with Apple (iPhone only) or with Google. The sign-in window is opened by your device itself, which communicates with Apple or Google directly; we never see the password to that account. From the provider we receive your e-mail address (with Apple possibly a private relay address, if you choose one), the identifier of your account with that provider and your name, if the provider passes it on. Google also adds the address of your Google profile picture; it is stored in the sign-in record, but we do not use it in the app. We use the name as your display name if you have not filled one in.
• Deleting an account you sign in to with Apple. If you delete, on iPhone, an account you sign in to with Apple, the app first asks you to confirm with Apple once more. The app sends the one-time code that Apple issues to our server, which exchanges it with Apple and immediately revokes the app's access to your Apple ID, so that Apple ends the link between your Apple ID and our app. We store neither the code nor any tokens or identifiers Apple returns to us in the process; if Apple refuses the revocation, we record only the technical code of its error. If you confirm with Apple using a different Apple ID from the one linked to your account, only the sign-in of that other Apple ID is revoked. If the revocation fails, if you confirm a different Apple ID, if you close the Apple confirmation, or if you delete the account elsewhere (in the Android app or through us), you can still delete the account without it, and you can then end the link yourself in your Apple ID settings.
• Age confirmation. An account is for people aged 18 or over (Terms of Use). When you register, in the first step of the introductory guide, you confirm that you are 18 or older; you cannot finish the guide without it. We store only that you confirmed your age and when. We do not ask for your date of birth or any document for this and we do not verify age in any other way.
• Access for a team member to the app administration. Our administrator can invite a member of our team (a moderator, marketing, an administrator) to the app administration: they enter the person's e-mail address and role, and if the person does not have an account with us yet, they create one (possibly with a name the administrator enters). The team member sets the password themselves using the link in the e-mail invitation (valid for 24 hours and usable once), or the administrator creates a password and hands it over in person; the administrator does not change a password you already have, and you can change a password created for you at any time. For an invitation we store only a cryptographic hash of the link, who created it and when, until when it is valid and when it was used; the record is deleted when the account is deleted. We also store which role you have in the administration.
• Purpose: creating and securing your user account, sign-in, password reset, e-mail verification being able to show that you confirmed your age when you registered, and access for team members to the app administration.

2.2 Profile

• Display name, bio, profile picture (avatar).
• Where you are from (optional): country, and for Czechia also the region (kraj). We show other members only the country; they do not see the region. Based on the region we recommend events and routes to you (for example the "Tip na víkend" (Weekend tip) in JOY Roads and tips in your region, section 2.13), and Wingman works with it (section 2.17).
• Location (free text that could be filled in in earlier versions of the app). We no longer collect it and we do not show it to other members; if you filled it in earlier, we keep it and delete it on request (section 1) or when you delete your account.
• Preferences: preferred vehicle view, clothing size, riding style, preferred activity types, notification settings, profile visibility level, membership tier (Free / JOY+ / JOY+ PRO). We do not show your clothing size to other members; in the future we want to pre-fill it into event registrations and shop orders (section 2.15).
• Welcome guide: we store which step of the welcome guide you reached, so that you can continue after an interruption, and when you completed it. Based on the completion time, for the first seven days we show you the "Tvoje první kolo" (Your first lap) card on Home with first steps (adding a car if your garage is still empty, a route from your region, an event matching your interests, a club). We do not show this to other members.
• Date of birth and phone number (optional). You fill them in only when editing your profile (the group "Pro přihlášky na akce" (For event registrations)). We need the date of birth for events with an age limit and the phone number for organising events and contacting you. The app does not use them anywhere else yet; in the future we want to pre-fill them into event registrations and shop orders. We do not show them to other members, we do not pass them to partners or to the artificial intelligence features (section 2.17), and they are not stored in the copy of your profile on your phone (section 9). Apart from you, only the app administrators have access to them. To delete them, clear the field when editing your profile and save the profile; when you delete your account they are deleted together with the profile.
• Followers and private profiles. You always see the people who follow you in your own list of followers (display name and profile picture), even if their profile is private. A member with a private profile who follows someone therefore becomes visible to the person they follow. In someone else's list of followers and followed members, others see a member with a private profile only if they follow that member themselves; otherwise they see only how many such members there are.
• Follow requests. If you have a private profile, only a member whose follow request you approve follows you. We store who requested to follow you and when; you receive a notification about the request (section 2.13) and approve or decline it in the app. We notify the requester of an approval, not of a decline. Until you deal with the request, the requester sees only what anyone who does not follow you sees of a private profile: display name, profile picture, badges, the month and year since when you have been a member, and the numbers of followers and followed members. A request ends when it is dealt with, withdrawn by the requester, by a block between you, or when either of you deletes their account; if you switch your profile to public, pending requests are accepted (without a notification). You can remove a follower at any time; with a private profile they can then follow you again only after approval. Follows created before we introduced requests remain.
• Showcase, profile cover and title. On your profile you can choose up to three of your badges or albums for the showcase (vitrína) and, from the status level Hliník (aluminium), a profile cover; the team may award a member a title. Other members see the showcase, title and cover only with your consent; what exactly we store and who sees what is described in section 2.6 (Showcase, profile cover, title and garage plate).
• Purpose: personalisation, displaying your profile to other users (to the extent set by your visibility settings), recommending relevant events and routes and suggesting members to follow (section 2.6).

2.3 Garage (vehicles)

• Vehicle data: make, model, year, kind (car or motorcycle), purpose of use, power, torque, engine type, displacement, fuel, weight, drivetrain, transmission, modifications, vehicle nickname, notes, mileage (for a motorcycle also engine hours), last service and service interval, roadworthiness-test (STK) due date, vignette validity, the estimated value of the vehicle and the VIN (among members, visible only to you).
• Vehicle photos.
• Service records: the date, type and name of the job, a note, mileage, a photo, the service interval, the "Nastavit jako poslední servis" (Set as last service) option (if you choose it, we record the mileage from the record as the vehicle's last service and, if it is higher, also as its mileage), the "Aktualizovat nájezd auta" (Update the vehicle's mileage) option, for a roadworthiness test the "Uložit jako termín technické u auta" (Save as the vehicle's test due date) option (we record the next test due date with the vehicle) and whether other members can see the record on a vehicle that is visible to them.
• Build log: the type, name, description, date and photo of a modification or service; other members can see it on a vehicle that is visible to them.
• Loading by VIN: when you enter a VIN (for a new vehicle, or in Technika for a saved one), our server queries the public Vehicle Register of the Czech Ministry of Transport and the app pre-fills the make, model, year of first registration, power, displacement, fuel, engine type (electric, hybrid), weight and roadworthiness-test (STK) due date; you can overwrite everything. The Ministry receives only the VIN and our server's address, not your IP address or account. From the register we take only the vehicle's technical data — we do not store document numbers, the number of owners or anything about the owner. We save the VIN with the vehicle: other members, Wingman, listings and the public garage never receive it; apart from you, only the app administrators have access to it. You can delete it in Technika ("Smazat VIN" — Delete VIN); removing the vehicle from your garage deletes it.
• Vehicle illustration: based on the make, model, year and the colour you choose for the vehicle, we show an illustration (a side view of the vehicle). Our server requests it using only the model and colour details — without your name, account, VIN, number plate or vehicle photos — and stores the finished image with us; the image is shared by all members with the same model and colour. We store the chosen colour with the vehicle and others see it on a vehicle that is visible to them (see below, including the public garage). Because of limits, for each newly created illustration we remember whose request it came from, and for each check of whether we can illustrate your model, who started it, when, and which make, model and year it asked about (section 5).
• Who can see a vehicle: a vehicle with the visibility "Pro komunitu" (For the community) can be seen by signed-in members in the community Garages, in the Community Overview (for a week after you add it, in the New cars in garages rail, including how long ago you added the vehicle), in the community feed and on your profile (if your profile is private, only by those who follow you); a private vehicle is visible only to you; if you choose it when joining a ride, those who can see the ride also see its make, model, year and nickname (section 2.6). If you are selling the vehicle in the For sale section, it shows a label with the price (for a reserved listing "Rezervováno" (Reserved)) and a link to the listing (section 2.18).
• Consents for a vehicle: Auto z komunity and Stopy vozu. For your vehicle you can give two separate consents: that the team may use the vehicle in the Joy dne question "Auto z komunity" (Car from the community), and that others see the vehicle's Stopy vozu (Vehicle tracks: regions, circuits and flagship events where you have been with it). For each we store whether it applies, when you last gave or withdrew it and which version of the consent text it relates to (auto-komunity-v1 and stopy-vozu-v1 respectively); both end when the vehicle is handed over to another owner. What follows from them is described in section 2.6 (Car from the community in Joy dne, Vehicle tracks).
• Purpose: maintaining your personal garage, reminders of the roadworthiness test, vignette and service, optionally sharing a vehicle within the community (according to visibility settings), suggesting a club based on the vehicle's make (section 2.6), the vehicle illustration in the chosen colour, with consent Car from the community and Vehicle tracks (section 2.6), Wingman's answers when you ask it about a vehicle (section 2.17), and alerts about Forum questions on a model you have in your garage and questions about the same model in the vehicle detail (section 2.6; we use the make and model even of a private vehicle and show them to no one).

2.4 Event attendance ("I'm going") and bookings

• "I'm going". When you tap "Jedu na akci" ("I'm going") on an event in the app, we store an attendance record with your account: the event, the status (you are going, or you have cancelled) and the time of confirmation or cancellation. Nothing is paid and we send no confirmation e-mail.
• Who sees your attendance. Signed-in members who open the event see you in the list "Kdo z komunity jede" ("Who from the community is going"): your display name, profile picture, badge (verified member, JOY+ or JOY+ PRO) and the vehicle you are going with, if it is visible to the community in your garage. Other members do not see in the list a vehicle you entered manually when booking. Other members also see a confirmed attendance in the community activity (feed). If your profile is private, only members who follow you see you in the list and in the feed. When you cancel your attendance, you disappear from the list and from the feed. A member you have blocked, or who has blocked you, does not see you there (section 2.12). Attendance earns points, and after the event it unlocks the event rating (section 2.6). For DRIVE&JOY events the team can confirm on site that you arrived; for each confirmed day of the event we award additional points (section 2.6, Attendance confirmed by the team).
• Bookings with attendee details and payment are not offered by the app today. If you created such a booking earlier, we keep with it the number of attendees, the total amount, the currency, vehicle data for the event, the waiver acceptance timestamp, the contact phone and notes, and for each attendee the name, e-mail and date of birth. The details of the other attendees were provided to us by the person who made the booking.
• For DRIVE&JOY events that you register for through the website, no booking is created in the app. If you open from the app the registration for an event whose registration on the website is linked to the app (usually an event with priority registration), we link it to your account and the app may show you its status (section 3.2).
• Changes to and cancellation of an event. If the date or place changes of a catalogue event that has not yet ended and that you have confirmed "Jedu na akci" ("I'm going") for (or have a booking for) or have saved (section 2.7), or if such an event is cancelled (including withdrawal by moderation) or, after being cancelled, goes ahead after all, you receive a notification (section 2.13). If the date and place return to what you know, we tell you that the event remains unchanged. A further edit of the same event within 3 hours, while you have not yet read the previous notification about a change, is only written into its text without a new notification; if the event starts within 24 hours, we notify you of every change.
• Purpose: recording your attendance at an event and showing it to other members, processing your event booking, preparing the attendee list, performance of the participation contract, and Wingman's answers when you use it (section 2.17).
• Retention: we keep the attendance record and the booking (including attendee details and the payment data stored with the booking, section 2.5) until you delete your account, when they are deleted. Cancelling your attendance does not delete the record; it is only marked as cancelled. Stripe also keeps a record of any payment for its own legal obligations as an independent controller (section 6).

2.5 Payments

• Payment details (card number, etc.) are processed solely by the Stripe payment gateway. DRIVE&JOY never sees or stores the full payment card number (PAN). We store only the payment identifier (stripe_payment_intent_id), the payment status and the amount.
• Cancellation of a booking by an administrator. If an administrator cancels your booking, you receive a notification (section 2.13); if we refund the payment, it also says whether we refund all of it or half of it.
• Purpose: processing payment for a booking and any refunds.

2.6 Community (follows, clubs, Forum, rides, ratings, points and seasons)

• Follows: "who follows whom" relationships and requests to follow a private profile (who requested to follow whom and when; section 2.2).
• Clubs: the club's name, description, category, type and cover photo, announcements and posts in the club (the club wall, see below), members and their roles (for example administrator), requests to join and invitations and their status (time of the invitation, acceptance or refusal). For a public club, the club, its description and its member list (display name and profile picture) can be seen by all signed-in members, including those who are not in the club. Requests to join and invitations sent can be seen by the club's founder and moderators. When an administrator of a public club switches on accepting without approval, this accepts the pending requests and we notify those accepted; it does not accept a request from someone the founder is in a block with, whom an administrator removed from the club, or whose account is restricted by moderation. If a club administrator invites you, you receive a notification with their display name and the name of the club. When a club announcement is deleted (by its author, the founder or moderation, or because the club or the author's account ceases to exist), we replace its text in the members' in-app notification history with the sentence "Oznámení bylo smazáno." (The announcement has been deleted.); a notification that a phone has already displayed cannot be withdrawn this way. A member you are in a block with (section 2.12) appears to you in the member list (including as the founder) only as "Hidden member", without name and photo; the club's founder and moderators see all members by name. When a club administrator removes a member, we store who removed them and when, so that they cannot rejoin the club on their own; we delete the record as soon as the administrator lifts the ban, invites the member again, or the club ends. When the founder dissolves a club, its members receive a notification in the app and the club is deleted together with its chat, announcements and the whole club wall. To protect against spam (at most 3 clubs becoming public within 24 hours) we store with your account the times at which a club you are founding became public during the last 24 hours; older times are overwritten and the record ends when you delete your account. You can invite at most 50 people to clubs within 24 hours; for this we store for each invitation you send only who sent it and when (not who was invited), and we delete records older than one day.
• Club wall. On a club's wall, accepted members and the founder write four kinds of posts: an ordinary post (text or photos), a question, a sale (a car via a link to your listing in For sale, section 2.18, or a part with a description and a price) and a poll (a question with two to four options, for at most 7 days); the club's founder and moderators (administrators) also write announcements, which reach members as before. A club ride is added to the wall automatically as a meet-up card with its name, time, number of people going and status, without the meeting point; only those allowed to see the ride can see it. We store who wrote what and when, the kind of post, the text, up to four photos (one for a comment), for a sale the price and the "Prodáno" (Sold) mark, for a question the comment its author marked as the solution ("Pomohlo to" (That helped)) or the "Vyřešeno" (Solved) mark, for a post with photos from a meet-up the club ride you took part in (others see its name with the post), pinning and the time of the last edit (an edited post shows “edited” and we show only the latest version; an earlier one remains only in the copy kept with a report). Only members of the club can see the wall, even in a public club. With a post or a comment, other members see your display name, profile picture, when you wrote it, and the vehicle you added to your garage most recently, if they are allowed to see it under its visibility (make, model, year and nickname). People outside the club (including those waiting for acceptance or invited) see, in a public club, only announcements an administrator wrote after the wall was launched (the editor tells them so), without reactions and comments, and the number of posts in the last 30 days; in a private club they see nothing. If a public club becomes private, people outside the club stop seeing its announcements. We do not show the wall on the club's web page (section 3.6). Only members can comment, react and vote. For reactions (six emoji) we store who gave which; others see only their counts. For a vote in a poll we store who voted for what, so that nobody votes twice; nobody sees the names of voters, neither the poll's author nor the club's administrators. The results (counts and shares) are seen by those who voted and by the poll's author, and by all members once the poll ends. You do not see on the wall the posts and comments of a member with whom you are in a block (section 2.12) or whom you muted; the club's administrators see everything on their club's wall so that they can manage it. An administrator can set that only administrators write on the wall, pin one post, end a poll and delete anything on their club's wall. You can edit or delete your post or comment at any time; a deleted post takes its comments, reactions and votes with it. A part for sale is seen only by club members and does not get into For sale or onto the website; the "Napsat prodejci" (Message the seller) button opens a private conversation (section 2.12) with a pre-filled first sentence naming the part and the club, which you send yourself. Wall photos are uploaded right after you pick them to private storage, downsized and without location and device data; they can be seen only by those allowed to read the post or comment, and for reported content by moderators and DRIVE&JOY administrators. The app opens a photo via a temporary link valid for 15 minutes; a displayed photo may remain in the cache of the device of whoever saw it. Photos of announcements added outside the wall (the earlier way) remain in public storage as before. What is new on the wall: so that the app can show you the number of new posts (on the wall, on the Home screen and in Community), we store when you last opened the club's wall; nobody else sees this and the record ends when you leave the club. On the Home screen we also show, with the club, the beginning of the latest post with its author's name (first name and the initial of the surname). On the wall the app also shows members the names of members accepted in the last 7 days with an offer to welcome them, questions older than 24 hours without a reply and, to participants of a club ride, for 48 hours after it ends an offer to add photos from the meet-up. After you leave the club (also when an administrator removes you), your posts and comments remain on the wall without your name, photo and vehicle, as "Bývalý člen" (Former member). When leaving you can delete them together with your reactions (the "Opustit a smazat moje příspěvky" (Leave and delete my posts) option); meet-up cards do not disappear (they belong to the ride) and votes in polls remain so that the results do not change retroactively. We will also delete your content on the wall of a club you have already left at your request (section 8). How much you can write (in one club at most 10 posts and 100 comments per 24 hours and 30 edits per hour, at most 300 reactions and votes per hour across all clubs together) is enforced even after deletion: we store only who wrote, when and to which club, without the content, and delete the record within two days. Wingman does not receive wall content (section 2.17).
• Alerts from the club wall. We send nobody a notification about a member's new post. The author of a post receives an alert about a new comment with the club's name, the commenter's name (first name and the initial of the surname) and the beginning of the comment; if another comment on the same post arrives within 15 minutes, the alert is only rewritten, without a new notification on the lock screen. For reactions there is one alert per post (for example "Tomáš K. a 3 další reagovali na tvůj příspěvek" (Tomáš K. and 3 others reacted to your post)), with a lock-screen notification at most once an hour. No alert comes from a member you muted or with whom you are in a block (their reactions are not counted), nor once you are no longer in the club, and in a muted club it is not created at all, not even in the in-app overview. They are controlled by the People switch in Notification settings (section 2.13). If a post or a comment is deleted, we replace the alert's text with the sentence "Příspěvek byl smazán." (The post has been deleted.) or "Komentář byl smazán." (The comment has been deleted.); a notification the phone has already shown cannot be taken back.
• Sharing a club via a link. A public club can be sent via a link by anyone who can see it; a private club only by the club's founder or a moderator, and their link is an invitation valid for 7 days: whoever opens it in the app receives an invitation to the club and accepts or declines it. A link from the founder or a moderator of a public club that approves join requests works the same way, only without an expiry: whoever opens it does not wait for approval and accepts or declines the invitation. If the link's author stops being a club administrator, the link no longer invites anyone. A member removed from the club by an administrator cannot get back in through a link. With a link we store a random code, who created it, when and, for an invitation, until when it is valid. What the link's page on the website shows and when the link stops working is described in section 3.6. You send the message with the link yourself through your own app (for example SMS or WhatsApp); we do not see it.
• Club suggestion based on your vehicle: when you add a new vehicle to your garage (including in the introductory guide) and when you open the detail of your vehicle, the app sends its make to our server and the server uses it to select an official DRIVE&JOY club for that make (for example "BMW klub" for a BMW) — only a public club with open entry that you are not in, that its administrator has not removed you from and whose founder is not in a block with you (section 2.12). For a motorcycle the app does not send the make: it loads the overview of public clubs (the same one you see in Community › Clubs › Discover) and suggests the official club for motorcycles, "Moto parta", if you are not in it and its founder is not in a block with you. If its administrator has removed you from it, the suggestion may still appear, but you will not be able to join. In the introductory guide we also suggest Moto parta when your profile lists Motorcycles ("Motorky") among your interests (even if you are adding a car). Only you see the suggestion; it is calculated when you save the vehicle or open its detail, and nothing else is stored on the server because of it. After you add a vehicle the suggestion appears in a pop-up; that you declined it ("Teď ne" – Not now) is remembered for 90 days only by your device. In the vehicle detail you see it until you are in the club. You join the club only if you choose "Vstoupit" (Join).
• Rides. Whoever posts a ride (the organiser) gives its name, description, type and pace, start time and expected end, meeting point including its coordinates, destination area, where relevant the JOY Roads route or the event the ride leads to, and also its visibility, how people can join and the car limit. For participants we store who joined, with which vehicle from their garage, whether they are confirmed or waiting for the organiser's approval, and when they joined. A public ride is visible to all signed-in members, a club ride to the club's members and invitees, a private ride to the organiser, the participants and invitees. Whoever can see a ride can also see its confirmed participants: display name, profile picture and vehicle (make, model, year and nickname). A participant you are in a block with (section 2.12) appears to you only as "Hidden member", without name, photo and vehicle; the organiser sees all participants by name. A ride leading to an event can be posted only by a JOY+ or JOY+ PRO member who has confirmed attending the event ("I'm going", section 2.4); in the event detail it is shown to whoever may see the ride itself. Until the organiser approves you, only the organiser can see your request. When the organiser declines your request or removes you from the ride, we keep a note of it so that you cannot join the same ride again; we show the note to no one and it ends with the ride or when you delete your account. When you join a ride, we store which version of the safety code you agreed to and when (evidence in case of a dispute); the record ends when you leave the ride, with the ride or when you delete your account. A ride has its own chat (section 2.12).
• Ride invitations and sharing via a link. The organiser (for a public ride also a confirmed participant) can invite other members before the meeting time; the invitee receives a notification with the name of the person inviting. A public ride can be sent via a link by anyone who can see it, a club or private ride only by the organiser; the organiser's link is an invitation: whoever opens it in the app sees the ride as an invitee. For an invitation we store who invited whom and when, and whether it came in the app or via a link; for a link, a random code, who created it and when. The organiser sees invitees who have not joined yet. An invitation can be declined; for a private ride, and for a club ride if you are not a member of the club, this also removes your access to the ride. We remember the decline (when you declined, and who invited you and when) so that nobody invites you to the same ride again for 30 days. The link's page on the website shows the basic details of the ride and the organiser's first name, even when someone else sent the link (what the page shows and when the link stops working is described in section 3.6). You send the message with the link yourself through your own app (for example SMS or WhatsApp); we do not see it. When an organiser blocks someone, we remove the blocked person from the organiser's rides that have not ended yet (including a pending request) and from the chats of all the organiser's rides; participation in a ride that has already taken place remains.
• Rating a ride organiser: you can give an organiser 1 to 5 stars (you cannot rate yourself). A rating is tied to a specific past ride on which you were a confirmed participant. Others see only the organiser's average and number of ratings, not who rated how.
• Reporting content: you can report a profile, a comment, a message (section 2.12), a listing (section 2.18), a ride, a vehicle, a club and its announcements, a post and a comment on a club wall, a group, a community event and a Forum topic or reply as well as an experience with a vehicle, and only content you are allowed to see. Together with the report our server stores a copy of the reported content as you saw it (text, name, description, links to photos and who the author is), so that a moderator can assess it even after the original has been changed or deleted. If reported content with a photo disappears (a deleted club announcement or event photo, a removed group photo, a replaced or deleted club cover photo), we move the photo the copy refers to from public storage to private moderation storage (right after a moderator's action, otherwise during the nightly clean-up): it stops being available at its original address and only DRIVE&JOY administrators and moderators can open it, via a link valid for 5 minutes. For a ride we copy its name, description (up to 2,000 characters), meeting place without coordinates, destination area, date, organiser, visibility, club and status; for a vehicle its make, model, year, nickname, modifications, type, owner, visibility and links to up to 10 photos. We do not copy private vehicle notes or meeting-point coordinates. Photos of a post or a comment on a club wall are in private storage from upload; moderators and DRIVE&JOY administrators open them via a link valid for 5 minutes and we keep them there until the report is resolved, even if the author deletes the post in the meantime.
• Moderation actions: we record every action (deletion, hiding and lifting it, cancelling a ride, also without a report, withdrawing a listing or an event, handing over the administration of a club to another member, resolving or dismissing a report, blocking an account and lifting the block): who decided, whom it concerns, what the action concerned, which report it belongs to, the mandatory reason and the time. We tell the author of the content we acted on in the app what we did, with the reason and how to object; we do not tell them the name of the person who reported the content. When we cancel a ride before it starts, we notify confirmed participants and pending applicants and cancel pending requests; a ride that has already started or taken place is only marked as cancelled, disappears from listings, participants receive nothing and the points awarded for it are withdrawn. When we hand over the administration of a club to another accepted member, the previous founder stays in the club as a member. The person who reported the content receives a notification of the outcome without the reason for the action and without names; after sending it, they no longer see the report itself. Reports (including reported answers of the artificial intelligence features, section 2.17), copies of content and action records are seen only by DRIVE&JOY administrators and the moderators we have appointed for this (they may also be community members), in the app and in the web administration; the record of Joy points taken away by an administrator (see below) is seen only by DRIVE&JOY administrators. The record of decisions on the review of JOY Roads routes (see below) is also seen only by DRIVE&JOY administrators. The owner cannot bring a vehicle hidden by a moderator back to the community on their own. Purpose: handling reports and objections, a safe community. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a safe community; the action record with its reason and the notices to the author and the reporter also Art. 6(1)(c) — obligations of a provider of hosting services under Regulation (EU) 2022/2065 on digital services (Articles 16 and 17).
• Blocking an account: we hide a blocked account in the community — others no longer see its profile, vehicles, rides, clubs and listings. We cancel its upcoming rides, tell the confirmed participants and pending applicants, and cancel the pending requests; we hand the clubs it founded over to another member (a club moderator has priority), and we hide a club with no other member. We send the blocked member an e-mail with the reason, the duration of the block and how to object (section 2.8). When they try to sign in, the app tells them the account is blocked and where to send an objection; the app does not show the reason.
• Rating an event: after an event for which you confirmed "I'm going" before it ended (section 2.4) has ended, you can give it 1 to 5 stars, marks for organisation, programme and atmosphere, and tags from a fixed list; a rating has no free text. You cannot rate an event you added yourself or one you organise (as a member of the organising organisation). Others see only a summary: the number of ratings and — only once at least three members have rated the event — the average and the most frequent tags.
• Forum. In the Forum (Community → Forum) you can start a topic: a title, text, a category, a type (question or discussion) and, optionally, the car or model you are writing about. You can also reply, give someone else's reply a "Pomohlo" ("Helpful"), mark a reply to your own question as the solution and follow topics. We store who wrote what and when. A topic for the whole community can be seen by signed-in members, a club topic only by accepted members of the club, even if moderation has hidden the club from listings (after you leave the club you will no longer see it). Others see your display name, profile photo and when you wrote a topic or reply. On your profile, other members can see how many topics, replies and solutions you have in the Forum and up to three of your latest topics. Only what that member may read in the Forum is counted, and for a private profile only your followers can see it. Others cannot see who gave "Helpful", only the count; nobody else can see that you follow a topic. You and a member you are in a block with cannot see each other in the Forum. If you mute someone, you do not see their topics, replies and vehicle experiences in the Forum and their "Helpful" is not counted for you; the muted member cannot tell (see Muting and blocking). You can delete your topic or reply at any time; deleting a topic also removes other members' replies in it. A text you are writing (a draft) stays only on your device and is deleted when you sign out. You can add up to four photos to a topic or a reply (not to an experience with a vehicle). They are uploaded to non-public storage as soon as you choose them, downscaled and without location and device data; only someone who may read the topic or reply can see them, and, for a reported post or one hidden by moderation, the moderators and DRIVE&JOY administrators. The app opens a photo with a temporary link valid for 15 minutes; a displayed photo may remain in the cache of the viewer's device. You can edit your topic or reply (an experience with a vehicle in the garage); the post then shows “edited”, we show only the latest version (an earlier one remains only in the copy kept with a report) and in alerts in the app the old text is replaced with the new one, or the alert disappears (a notification already delivered to a phone cannot be changed). We check how much you may write in the Forum per hour (at most 20 topics and experiences, 100 replies and 30 edits) even after a post is deleted: we store only who wrote and when, without the content, and delete the record within two days. You can start a topic as a question about an event in the app, a JOY Roads route or a circuit; others then see the questions about it that they may read. You can send a topic as a link: the web page of the link does not show its content, it only opens the app, and the topic is then visible only to someone who is allowed to read it. When another member asks Wingman about the Forum, Wingman may receive the title and the beginning of your topic for the whole community, without your name, photo or account (section 2.17); club topics, vehicle experiences and replies are never included.
• Experiences with a vehicle. For your vehicle visible "For the community" you can write an experience (a title, text and a category). Only those who may see your vehicle can see it (section 2.3), and the same experience is also a Forum topic that others can reply to. If you archive the vehicle or change its visibility, others will no longer see the experience; deleting the vehicle, or handing it over to another member, deletes it together with the replies. If moderation hides an experience, others no longer see it; you see it on your vehicle marked as hidden by a moderator and can delete it, but not edit it. A private question to the vehicle's owner is sent as a message (section 2.12); nothing is ever transferred from messages to the Forum.
• Forum alerts. Whoever follows a topic (the author of a topic or an experience from the moment it is created) receives an alert about a new reply with the reply author's name, the topic title and the beginning of the reply; further replies are merged into one unread alert, and if another reply comes within 10 minutes of the last alert about the same topic, the alert is only rewritten, without a new notification on the lock screen. The author of a reply that the author of the question marked as the solution also receives an alert. Only someone who may still read the topic receives an alert, and never from a member they have muted or are in a block with. If a reply or a topic is deleted or hidden by moderation, or if you hide the alert yourself, the alert disappears and we overwrite its title and text with neutral wording. If moderation lifts the hiding, only the alerts the hiding removed come back, and only to someone who may still read the topic and has not muted the reply's author or is not in a block with them; we rebuild their text from the restored post. They are controlled by the People switch in Notification settings (section 2.13). If someone asks a question for the whole community about a car model you have in your garage (by make and model, including a private vehicle, not archived cars), you may receive an alert with the asker's name, the model and the title of the question, at most three per 24 hours (deleted and hidden ones count too); one question alerts at most 200 randomly chosen owners. The person asking does not learn who received the alert. These alerts are controlled by a separate switch, Otázky k tvému autu (Questions about your car), which is on unless you had the People switch off. With the switch off you do not receive these alerts at all, not even in the in-app overview.
• Reactions and following vehicles: a "To se mi líbí" ("I like this") reaction on a vehicle, a build log or a ride can be seen by anyone who can see that content. You can follow vehicles that are visible to the community; as the owner, you can see who follows your vehicle.
• Suggestions of whom to follow: the app suggests members with a public profile based on what you have in common: a vehicle of the same make, the same region, the same riding style, shared confirmed events and whether members you follow follow them; it suggests new members during the first 90 days after registration even without anything in common. With a suggestion it shows the display name, profile picture, region, riding style and the reason for the suggestion (for example "Máte auto stejné značky" (You have a car of the same make), "Byli jste na stejné akci" (You were at the same event) or "Nově v komunitě" (New in the community)); the reason is seen by the person to whom we show the suggestion. With a public profile you may therefore appear in other members' suggestions. Suggestions are calculated when they are shown, and nothing else is stored for them.
• New members: on Home (the Community chapter) the app shows the newest members with a public profile who have completed the introductory guide: display name, profile photo and when they joined the community (the same as the "Člen od" (Member since) badge on the profile). You do not see yourself or members you are in a block with. With a public profile you will therefore appear in this list for others after you register.
• Points, milestones, badges and seasons. We award you points for actions in the app: completing your profile and garage, your first event and first steps in the community, saving an event, "I'm going", attending an event that has taken place, attendance at a DRIVE&JOY event confirmed by the team (per day of the event, see Attendance confirmed by the team), rating an event, rating a ride organiser (once for each organiser, at most four times per calendar month and only after a past ride on which you were a confirmed participant), a recorded ride (at least 5 km at an average speed of at least 15 km/h), a circuit session with measured laps, completing a JOY Roads route (including your first route in a new region; only for a ride you send to the team for review and the team confirms, see Review of JOY Roads routes by the team; until we launch route reviews, we do not award points for routes), taking part in and organising a community ride, a Joy dne stamp and a counted week (see Joy dne and Stamps below), a thank-you given to you by a fellow participant of an event or a ride (see Díky below) and a Forum reply or a club wall comment that the author of the question marked as the solution (only the first solution of a topic or question, from the same asker at most twice per season and only if the asker's account is at least 30 days old; at most 100 points per season for the Forum and the wall together; five such replies, in the Forum and on the wall, earn the Pomocník (Helper) badge). So that points for the same solution are not awarded twice, for each rewarded solution we store the topic or question, you, the asker, the season and the time; the record remains even after the topic, question, reply or comment is deleted, we show it to no one, and it ends when your account or the asker's account is deleted. Points for a ride are awarded after it ends, only if it was posted at least one hour before the meeting time and had a planned duration of at least 30 minutes: to a participant for confirmed participation joined before the meeting time, to the organiser only if at least one other member took part, and to each person for at most three rides a week. From 27 October 2026, rides with only two people who are the same pair (regardless of which of you organised the ride) count at most four times within 30 days (the pair cap): for any further such ride neither of you receives points, we note the ride as excluded from points and the app shows you the reason "strop dvojice" (pair cap) for it. From 1 December 2026 we store points for completing your profile and garage without a season (they do not count towards the season leaderboard and season badges, but they do count towards status), and from then on we no longer award points for your first event and first steps in the community. For each award we store the kind of action, the number of points, what it relates to (for example an event, a route, a recorded ride or a community ride, for rating an organiser the organiser's account), the season and the time, and also the milestones and badges you have reached and when. For a recorded ride and a community ride the app shows you whether and how many points it brought, or why not (for example a short trip, a cap already reached or a ride posted too late); only you can see this. We can also take points away: if we cancel a ride that has already started or taken place (for example after a report), we take the points for it away from the participants and the organiser; we tell the organiser in the cancellation notice, and participants see the removal in their points overview. An administrator can also take points away in case of misuse; you will see the removal in your points overview and you will usually also receive a notification with the reason and the number of points (section 2.13). A removal is stored in the same way as an award, with a negative number of points and a link to the ride or the administrator's intervention. We also enter points taken away by an administrator in the record of moderation actions: who took the points away, from whom, the reason, the number of points, the season and whether you were notified. Only DRIVE&JOY administrators can see this record, not appointed moderators, and we keep it for 3 years (section 5). If, after points are taken away, your season total is no longer enough for a badge you already hold or that is awaiting review, we send DRIVE&JOY administrators an alert with your account identifier, your points total and the badges concerned (the alert is kept for 180 days like other notifications); we do not take a badge away automatically, an administrator decides. Only you can see the individual point awards and milestones, and badges for points too, unless you put them in the showcase on your profile yourself (see Showcase below); your total points for the season are shown in the season leaderboard (see below). Other signed-in members can, however, see the JOY Roads Passport on your profile (routes completed, kilometres, elevation gain, regions and badges for routes) if your profile is not private or if they follow you — but only from completions older than 7 days, and for each route only the month instead of the date of the last completion; in your own Passport you see all completions with their dates. While the review of JOY Roads routes by the team is running (see below), others see in your Passport only routes whose ride the team has confirmed, and the summaries (kilometres, elevation gain, regions and badges for routes) are calculated only from them. In the season leaderboard, signed-in members see, for members with a public profile, the display name, profile picture, membership tier, season points and rank. For 14 days after a season ends, the app still shows its results: to you your points, rank and the milestones you reached, and to all signed-in members the top three places (display name, profile picture, membership tier and points). In the community leaderboards (including the events leaderboard on the Home screen), signed-in members see, for members with a public profile, the display name, profile picture, badge and a single number: the number of events attended that have already taken place, the number of past public rides the member organised, or the number of people following the member's vehicles shared with the community. The circuit leaderboards and the League include only JOY+ PRO members with a public profile and only their sessions on circuits the app knows (a recognised circuit from its list, not Circuit mode switched on elsewhere) that are shared with the community or via a link (sections 2.10 and 3.6): in a circuit leaderboard signed-in members see the display name, profile picture, membership tier, best lap time, the vehicle's make and model, when the session started and whether the time was measured by a RaceBox; the League can be seen only by JOY+ PRO members, and it shows the display name, profile picture, the best score of a circuit session in the current month and the number of such sessions. You can hide yourself from all leaderboards (the season, the community leaderboards and the events leaderboard on the Home screen, the circuit leaderboards and the League) in Settings → Soukromí (Privacy) by switching off the option "Zobrazovat mě v žebříčcích" (Show me in leaderboards). You may receive a notification when you reach a milestone or a reward is ready (section 2.13).
• Review of rewards with value: before a season reward with value (for example unlocking a JOY Roads route for free) is issued, an administrator reviews it, so that it can be earned only through genuine activity. We record when you reached the milestone, how many points you had in the season, who approved or withheld the reward and when, and for what reason. The app shows you that a reward is awaiting review (you also receive a notification that we are preparing it; section 2.13) or that we have not issued it. A credit for a free JOY Roads route from such a reward that you have not yet redeemed can be given once to another member (see Route for a mate below). Legal basis: Art. 6(1)(b) GDPR — season rewards; the review record Art. 6(1)(f) — legitimate interest in protection against abuse.
• Review of JOY Roads routes by the team. We award points for the first completion of a JOY Roads route (including your first route in a new region) only for a ride you send us for review yourself in its detail ("Poslat týmu ke kontrole" — Send to the team for review); without your request no ride ever enters the review, and we add nothing retroactively. You can send only your own ride on a route that is accessible to you in the app, at most 7 days old, with the route completion recorded in your Passport, with a plausible recording and the ride's data uploaded, and only if the ride covered at least 60% of the route's length (we calculate how much of the route lies within 150 m of the recording); each route only once (while the request is pending or confirmed) and at most two routes from one day of driving; with the "Skrýt body a sezónu" (Hide points and season) option switched on you cannot send a ride. Our server checks these conditions automatically, but they do not decide on points: a person always decides. With the request we store the ride, the route, the day and start of the ride, the route coverage, a fingerprint of the file with the ride's data (name, size, checksum and upload time; from it we can tell that the file changed after it was sent), the status (pending, confirmed, not confirmed, withdrawn), when you sent the request and, after the decision, who decided, when, and the reason. What the team sees: only DRIVE&JOY administrators see the requests and decide on them, not appointed moderators. In the queue in the web administration they see the route, the region, the day of the ride, the route coverage in per cent and how long the request has been waiting, with your account identifier and without your name. The ride preview shows only the track within a 150 m corridor around the route, without the first and last kilometre of the recording, without times and speed, with points every 25 metres, drawn without a third-party map background; the preview is not stored anywhere. We record every opening of the preview (who and when). Decision: an administrator confirms, or does not confirm, each ride separately. After confirmation we award the points and you see them in your points overview. If the administrator does not confirm the ride, they must give a reason; you receive a notification with the reason, the fact that an administrator decided, and how to object; another administrator decides on the objection within 30 days (you can also take a dispute to the Czech Trade Inspection Authority or to court). As a moderation notice it reaches you even if you have switched DRIVE&JOY announcements off, only in the notification overview in the app (section 2.13). We enter both a confirmation and a refusal in the record of moderation actions (who decided, whom it concerns, the route, the day of the ride and the reason); only DRIVE&JOY administrators can see this record, not appointed moderators, and we keep it for 3 years (section 5). You see the status of your requests in the ride detail and in your points overview (pending points in grey and outside the total); you do not see in the app who decided. Withdrawal: until the team decides, you can withdraw the request in the ride detail; this ends the review, nobody opens the ride preview any more and no points come for it (you can send the same ride again while it meets the conditions above). We keep the request, the decision and the record of preview openings until you delete your account, even if you delete the ride (once the ride is deleted the team can no longer confirm it, only refuse it); if a route is deleted from the JOY Roads catalogue, the requests for it are deleted too. Purpose: protecting the season and status against made-up rides. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting the season and status against abuse. You may object to this (section 8); you can also withdraw the request (see above).
• Rating JOY Roads routes. You can rate a JOY Roads route whose completion is recorded in your Passport. The app offers this with the "Jak se jelo?" (How was the drive?) sheet after the completion (never while you are driving) and in the route detail; rating is voluntary. We store the number of stars (1 to 5), what you think the surface was like (excellent, passable, broken), optionally up to five places with a bad road, which account and which route the rating belongs to, and when you saved it and last edited it. We store a place with a bad road only as the distance from the start of the route in kilometres: the app snaps the point you tap on the route map onto the route line directly on your phone and sends our server only the kilometre, not your location. Your device loads the route map from Mapbox in the same way as the other maps in the app (section 2.16); we send Mapbox nothing from the rating. You rate each route once: a new rating overwrites the previous one, and in the route detail you can edit it at any time (while the route is in your Passport) or delete it. When you edit a rating, we also remember the previous stars and surface, because the summary for others is calculated from the state at midnight; after the end of the day we no longer use them and delete them the next time any member saves a rating. A blocked account cannot rate (but can delete its rating) and its ratings are not counted in the summaries. Who sees what: other members see only a summary for the route — the average number of stars, the number of ratings and how many times the surface was rated as excellent, passable and broken — and only from three ratings (until then not even their number), without names and without individual ratings. The summary changes once a day: we calculate it from the state at the previous midnight (Prague time) and only from ratings by accounts created at least 7 days before, so that a change in it does not reveal a particular member's rating. You see your own rating in the route detail straight away, only you, and you can edit or delete it. In the web administration, DRIVE&JOY's main administrators see for each route the number of ratings, the average, the share of "broken" ratings, the most frequently marked kilometres and how many ratings are backed by a ride on the route recorded in the app, without names and without account identifiers. For this, our server checks for each rating whether you have a plausible ride saved for the route covering at least 60% of its length (based on the ride's distance, start, end and duration); administrators see only the number, not the rides themselves; the administration marks a route with a worse rating (at least three ratings and an average below 3.5, or "broken" in at least 30% of the ratings) for review. Purpose: the quality of the route catalogue, alerting the team to bad sections and a summary for other members when choosing a route. Legal basis: Article 6(1)(f) GDPR — legitimate interest in the quality and safety of the routes in the catalogue and in a useful summary for members. You may object to this (section 8). Retention: until you delete the rating or your account; if a route is deleted from the JOY Roads catalogue, the ratings for it are deleted too (section 5).
• Joy points watch: once a week, on Monday, our server compares points for community rides, circuit sessions and thank-yous received (Díky) with the usual pattern and alerts DRIVE&JOY administrators to unusual cases: the same group of members with points for an unusually high number of shared rides within 30 days, an organiser with an unusually high number of rides that earned points within 30 days, and an unusually large increase in points for rides, circuit sessions and thank-yous received within 7 days; while the review of JOY Roads routes by the team is running, it also alerts them to route review requests that have been waiting longer than the set period (only the number of such requests and when the oldest one arrived, without any link to members). Once we switch these signals on, it also alerts them to a pair of members who have thanked each other (Díky, see below) in both directions more often than the set threshold within the last 30 days, to a member who within the last 30 days received at least the set number of thank-yous (Díky) from accounts that were less than 30 days old at the time of the thank-you (for this the watch reads when the givers' accounts were created), and to a ride with points but no ride recording: a ride that ended within the last 7 days, on which at least two people took part (the organiser and confirmed participants), and none of them had a ride recording in the app overlapping in time with the ride (from 30 minutes before the meeting time to 30 minutes after it ended). For ride recordings the watch only checks whether such a recording exists, by its start and end; it does not read the location, route or speed. For a finding we store the week, the kind of signal, the member concerned (for a group only the rides, from which its members are looked up only when the finding is displayed; for a ride without a recording its organiser; for a pair with thank-yous the identifiers of both members; for thank-yous from new accounts their recipient), the counts (for a ride without a recording the ride, how many people took part and how many points it brought, no locations or times of rides; for a pair the number of their mutual thank-yous; for thank-yous from new accounts only their number, without the givers) and the threshold used. Only DRIVE&JOY administrators can see the findings, in the web administration, and for a pair with thank-yous also their mutual thank-yous (who thanked whom, the kind, the event or ride, the time and whether points came for them), so that they can decide on a possible cancellation (see Díky); the alert they receive about findings contains no names. Nothing is decided automatically: the watch does not take away points, thank-yous, badges or rewards; only an administrator can do that after a review, with a reason and a way to object (see above). We keep findings for 90 days (they are deleted at the first Monday run after that), and findings recorded under you also when you delete your account; in a finding about a pair with thank-yous, only the technical identifier of your account (a random string of characters, not a name or an e-mail) remains after you delete your account, until the finding is deleted. Comparing rides with ride recordings is a new purpose for ride recordings (section 2.10). Purpose: protecting the season and rewards against abuse, for example against sham rides and arranged thank-yous. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protection against abuse; for this, it is enough to know whether and when a recording took place. You may object to this (section 8).
• Joy dne (Joy of the day). When Joy dne is running for you, the app shows you on the Home screen one question a day with three options (for example about cars, circuits, JOY Roads routes or weekend events). The day is always determined by our server in Prague time, and you can answer once a day. With your account we store the day, the option you chose, whether it was correct and, for a question about a circuit, also the circuit. We delete the option you chose after the Prague day ends (by a night job, at the latest the next morning); answers from past months are deleted on the first day of the following month, except correctly answered questions about circuits, which we keep for the Circuits album ("Znám" — I know it) until you delete your account. You see the correct answer, the explanation and the source only after you answer; the share of correct answers ("Vědělo X % členů" — X % of members knew) also only after your answer, and only if at least five members answered that day. For the question of the day we count only the total number of answers and of correct answers, without any link to accounts. Only you see your answers, including how many questions you answered this month and how many of them correctly; the app's administration sees only the aggregate counts.
• Stamps, weeks and streaks. For answering Joy dne, for rating an event or a ride organiser and for thanking a fellow participant (Díky, see below) you receive a stamp for that Prague day, at most one a day and regardless of whether your answer was correct; no stamp is given for a ride, "I'm going", a reaction or a message. We store the day of the stamp, what it was for and when. We award points for stamps on at most five days a week (Monday to Sunday, Prague time); three stamps in a week make a counted week, for which we award additional points to the season of that day. We calculate your streak (counted weeks in a row) from the stamps when it is displayed; the streak forgives you two weeks per season that did not count. Only you see your stamps, weeks and streak, and we keep them until you delete your account.
• Status. Status (Ocel, Hliník, Karbon, Titan, Karbon-keramika — steel, aluminium, carbon, titanium, carbon-ceramic) grows from what you do with people. We calculate status points from the points awarded for: first steps (profile and garage), attendance at a DRIVE&JOY event confirmed by the team, rating an event at which the team confirmed your attendance, taking part in and organising a public or club ride in which at least two other confirmed participants with an account older than 30 days took part (the same group at most twice within 30 days and in total only up to a cap within 30 days), a session on a circuit recognised by the app, thank-yous received (Díky, up to a cap per season; see below), solutions in the Forum (up to a cap per season) and counted Joy dne weeks (up to a cap per season). Points for the first completion of a JOY Roads route count towards status only for a ride the team has confirmed (see Review of JOY Roads routes by the team). For a ride we also read who took part and how old the participants' accounts are; we store nothing else about them for this purpose. We do not show the number of status points to you or to anyone else: you see only your level, how far you are from the next one, an estimate in the number of events or rides and what your status mainly grows from; from Hliník (aluminium) it is also shown on your membership card in the app and, once we launch it, on the card in Apple Wallet (section 2.19). We store the level and when you reached it. Status does not go down. The Titan and Karbon-keramika levels are confirmed by an administrator: until then the level is pending, and DRIVE&JOY administrators receive a notification without your name, with your account identifier (kept for 180 days like other notifications); we store who confirmed the level and when, and you receive a notification about it. Only an administrator can lower your status, in case of misuse and always with a reason: we store the reason, who decided and when, and how many status points no longer count from then on, and you receive a notification with the reason, whether an automatic check helped, and how to object; another administrator decides on the objection within 30 days. As a moderation notice it always reaches you, even if you have switched DRIVE&JOY announcements off (section 2.13). We enter both the confirmation and the lowering of status in the record of moderation actions (see above; who decided, whom it concerns, the level, the reason and whether an automatic check helped), which is seen by DRIVE&JOY administrators and appointed moderators and kept for 3 years (section 5). When we switch status on, we calculate it for everyone retroactively from the points they already have; higher levels are then pending confirmation by an administrator. Other members see your status only with your consent (see Status shown to others); otherwise only you see it in the app. Outside the app it is seen by whoever you yourself show your card in Apple Wallet to or send a sharing image to (section 2.19, see Sharing images). We keep it until you delete your account. Legal basis: Art. 6(1)(b) GDPR — status as a feature of the app; the calculation conditions against sham rides, confirmation of higher levels, lowering of status and notices to administrators Art. 6(1)(f) — legitimate interest in protecting status against abuse. You may object to this (section 8).
• Status shown to others. You can show your status from Hliník (aluminium) upwards to other members, but only with your explicit consent and only with a public profile. The app offers this to you once in the sheet "Ukázat status na profilu?" (Show your status on your profile?) (and at the celebration of a new level, as long as you have not decided); nothing is preselected, the options "Ukázat na profilu" (Show on profile) and "Nechat pro sebe" (Keep it to myself) are equal, and closing the sheet saves nothing. You can change your choice at any time in Settings → Soukromí (Privacy) ("Ukázat status na profilu"); withdrawal takes effect immediately and your status disappears for others everywhere. We store whether you show your status, since when, when you last decided and which version of the consent text (verejny-status-v2; consent given to the earlier version 1, which did not mention thank-yous, shows others only your status, not your thank-yous); we keep the choice until you delete your account. What others see: signed-in members see a single-colour seal and the name of the level (for example "Hliník") on your profile, and the seal next to your name in the lists of participants of events and rides they are allowed to see; they do not see status points or progress. Consent to "Ukázat na profilu" (Show on profile) also covers the thank-yous you have received (numbers by kind and thank-yous with the name of a giver who allowed it; see Díky) and, from the Karbon (carbon) level, the garage plate on your profile (see Showcase). Ocel (steel) is never shown to others; Karbon (carbon) and higher levels are shown to others only once an administrator confirms them (we store who confirmed and when, and enter it in the record of moderation actions); until then others see Hliník. For this, DRIVE&JOY administrators see in the web administration whose level from Karbon upwards is awaiting confirmation, with your display name and whether you want to show your status. Your status is not shown to others if you have a private profile or a blocked account, and it is not seen by a member you are in a block with (section 2.12) or by a member who has muted you; the status of the DRIVE&JOY founders is never shown to others. Legal basis: Art. 6(1)(a) GDPR — consent; withdrawing it does not affect the lawfulness of earlier processing.
• Výběr měsíce (Pick of the month). Once a month the DRIVE&JOY team may pick one vehicle from the community and show it in Komunita (Community) as the Pick of the month, and only a vehicle whose owner has agreed to this. Only the owner gives consent, themselves in the app in the vehicle detail ("Auto smí být ve Výběru měsíce" — The car may be in the Pick of the month), and can withdraw it there at any time; we store whether consent is in place, when you last gave or withdrew it and which version of the consent text (vyber-mesice-v1). Only a vehicle with the visibility "Pro komunitu" (For the community) that is not among your Former cars and not hidden by moderation can be picked, and only if you have a public profile and your account is not blocked. DRIVE&JOY administrators see such vehicles in the web administration as candidates: the make, model, year, nickname and type of the vehicle, your display name, when you gave consent, the number of photos of the vehicle and when it was last picked. For a pick we store the vehicle, the month, a short description by the team, and who picked it and when. Signed-in members then see in Komunita the make, model, year, nickname and type of the vehicle, the team's description and your display name and profile picture; the Pick of the month does not show photos of the vehicle for now. A pick is visible for at most 35 days (from the start of the month, or from a later pick) and is not seen by a member you are in a block with or by a member who has muted you. When the team picks your vehicle, you receive a notification (we do not say who picked it; section 2.13). Withdrawing consent or handing the vehicle over to another owner hides the pick immediately and deletes the vehicle's picks scheduled for later months; switching the vehicle or your profile to private, moving the vehicle to Former cars, hiding it by moderation or blocking the account also hide it. We keep current and past picks as a record of the decision until the vehicle is deleted or you delete your account. Legal basis: Art. 6(1)(a) GDPR — consent; withdrawing it does not affect the lawfulness of earlier processing.
• Attendance confirmed by the team. For DRIVE&JOY events an administrator can confirm on site that you arrived, for each day of the event separately: only for members who confirmed "I'm going" for the event or have a confirmed registration from the website, for at most five days per event and not in advance. We store the event, the day, who confirmed the attendance and when; for each confirmed day we award points. For this, DRIVE&JOY administrators see in the web administration the members registered for the event (display name and whether it is "I'm going" or a registration) and their confirmed days. If an administrator cancels a confirmation, we delete it and take away the points for that day; we enter the removal in the record of moderation actions as points taken away by an administrator (see above). We always notify you of a cancellation, with the reason and how to object; another administrator decides on the objection within 30 days. As a moderation notice it reaches you even if you have switched DRIVE&JOY announcements off (section 2.13). For a DRIVE&JOY event at which the team confirms attendance, we calculate the event rating summary that others see only from ratings by members whose attendance was confirmed. You see your confirmed attendance in your points overview, in your albums and in Rok v DRIVE&JOY (see below). We do not show it to others as such, but they may infer it from these features: fellow participants of the same event with confirmed attendance from the Díky offer and from Route for a mate (only if you have a public profile), other members from a thank-you for an event that someone gave you with their name, and with your consent from your showcase and Vehicle tracks (see below). We keep it until you delete your account.
• Registration order and Ročník 2026. We assign each account a sequence number according to when it was created (existing accounts retroactively). Your membership card shows your membership number instead (section 2.19), which is unrelated to the registration order. Only you see your registration order; we do not show it to other members and a partner does not receive it when verifying your card (section 2.19). Accounts created by 31 December 2026 (Prague time) receive the Ročník 2026 (Class of 2026) badge, which we show to others only if you put it in the showcase on your profile yourself (see Showcase; the registration order not even there). We keep the registration order and the badge until you delete your account.
• Features launched gradually. We launch Díky (thank-yous), Síň slávy (Hall of fame), the shared season goal, Auto z komunity (Car from the community), Trasa pro parťáka (Route for a mate), albums, the showcase, Stopy vozu (Vehicle tracks), Rok v DRIVE&JOY (Year in DRIVE&JOY), status privileges and status on the card in Apple Wallet (section 2.19) gradually, each feature separately; the same applies to status shown to others, the Pick of the month and the Joy points watch signals about thank-yous and rides without a ride recording. Until we launch a feature, the app does not offer it and nothing described for it is stored or shown (the exception is the Zakladatel (Founder) title, which we entered for the DRIVE&JOY founders in advance).
• Díky (thank-yous). After a DRIVE&JOY event at which the team confirmed your attendance, and after a past ride that you organised or on which you were a confirmed participant, you can thank a fellow participant within 7 days of its end, each person once for the same event or ride. You choose whom, what for (Organizace — Organisation, Parťák na cestě — Mate on the road, Pomoc — Help, Dobrá rada — Good advice, or Skvělá společnost — Great company) and whether your name may also be shown to others (the option "Ukázat mé jméno" — Show my name, switched off in advance). You can thank the organiser or a confirmed participant of the same ride and, for an event, a member whose attendance the team confirmed and who has a public profile; not yourself, not a member you are in a block or a mute with (whichever of you set it), and not a blocked account. The "Poděkovat" (Thank) offer in the event or ride detail shows you the display name and profile picture of the people you can thank; for an event you thus learn which members with a public profile had confirmed attendance there, and, if you have a public profile, they learn the same about you. We store who thanked whom, the kind, the event or ride, the name choice, the season, whether points came for the thank-you, and the time. Who sees what: the recipient sees in Tvá cesta (Your journey) the giver's name and profile picture, the kind and the event or ride (without the name if they are in a block or a mute with the giver or the giver's account is blocked) and receives a notification with the giver's name, without numbers (section 2.13). Other signed-in members see on the recipient's profile the numbers of thank-yous by kind (for example "Organizace ×4") and, for thank-yous where the giver allowed it, the giver's name and profile picture, the kind and the name of the event (the name of a ride only for a public ride), without a date; from this they can also tell that the giver and the recipient were at the same event or ride. Others see only thank-yous older than 7 days and only if the recipient has a public profile and has given consent to "Ukázat na profilu" (Show on profile; see Status shown to others), the recipient's account is not blocked and there is no block or mute between the recipient and the viewer; the giver's name in addition only if the giver has a public profile, the giver's account is not blocked and the giver is not in a block or a mute with the recipient or with the viewer. DRIVE&JOY administrators see in the web administration only aggregate numbers by kind, without names; individual thank-yous only for a finding of the watch (see above). Points: for a thank-you received, the recipient gets Joy points and status points, from the same person at most twice per season and at most up to a cap per season (the values are shown in the points guide in the app); for the giver, a thank-you counts as a Joy dne stamp if Joy dne is running for them (see Stamps). You see the number of thank-yous received in the Komunita (Community) album and in Rok v DRIVE&JOY (see below). Cancellation by an administrator: in case of misuse (for example an arranged thank-you), an administrator can cancel a specific thank-you, always with a reason. We take away the points that came for it, the thank-you stops being counted or shown anywhere, we enter this in the record of moderation actions as points taken away by an administrator (see Moderation actions), and the recipient receives a notice with the reason and how to object, on which another administrator decides within 30 days, without the giver's name (section 2.13). We keep a cancelled thank-you so that it is not possible to thank again for the same event or ride. We keep thank-yous until the giver or the recipient deletes their account, when they are deleted. The "Ukázat mé jméno" choice cannot be changed in the app after sending; if you want to withdraw it, write to us (section 1) and we will hide your name on the thank-you. Legal basis: Art. 6(1)(b) GDPR — the Díky feature and points for it; showing to others on the recipient's profile Art. 6(1)(a) — the recipient's consent and, for the giver's name, the giver's choice, both withdrawable; cancellation of a thank-you by an administrator Art. 6(1)(f) — legitimate interest in protecting the season and status against abuse, to which you may object (section 8).
• Síň slávy (Hall of fame). At the end of a season the DRIVE&JOY team may pick one member for the Hall of fame in each category (Organizátor sezóny — Organiser of the season, Parťák sezóny — Mate of the season, Objev sezóny — Discovery of the season, Pomocná ruka — Helping hand). Only a member with a public profile and an account that is not blocked can be picked, never a founder, a DRIVE&JOY administrator or an account with an @driveandjoy.cz address. For the selection, DRIVE&JOY administrators see in the web administration, for such members who had any of the following in the season, the display name, profile picture and counts: days of events with attendance confirmed by the team, rides organised, participations in rides and thank-yous received (no points). For a pick we store the season, the category, a short text by the team (without point numbers), who picked and when, and your consent to publication (whether it applies, when you last gave or withdrew it and which version of the consent text, sin-slavy-v1). You receive a notification about the pick (we do not say who picked; section 2.13). Other signed-in members see you in the Hall of fame only with your explicit consent, which you give in Tvá cesta (Your journey; nothing is preselected): your display name, profile picture, the season, the category and the team's text, and only if you have a public profile and your account is not blocked; a member you are in a block or a mute with does not see you. You can withdraw the consent at any time in the same place and hiding takes effect immediately. We keep the pick until you delete your account; an administrator can also remove it, in which case we delete it. Legal basis: the selection and its basis Art. 6(1)(f) GDPR — legitimate interest in recognising members who carried the community (you may object to this, section 8); publication Art. 6(1)(a) — consent, the withdrawal of which does not affect the lawfulness of earlier processing.
• Shared season goal. The team may set a goal for the whole community for a season: the number of counted Joy dne weeks, or of days at events with attendance confirmed by the team. The app shows only an anonymous total of these records of all members (without cancelled ones and without blocked accounts), the goal and whether it has been met; how many people contributed is shown only from five people. It is not calculated from kilometres, speed or the number of rides. Names are not shown and nothing new about you is stored for this.
• Auto z komunity (Car from the community) in Joy dne. For your vehicle you can consent ("Auto smí být v Joy dne" — The car may be in Joy dne) to the team using it as the Joy dne question "Auto z komunity". The app offers the consent for a vehicle with the visibility "Pro komunitu" (For the community); only the owner can give it, and not for a vehicle among Former cars or hidden by moderation. We store whether the consent applies, when you last gave or withdrew it and which version of the consent text (auto-komunity-v1). The team picks only from vehicles with consent whose owner has a public profile and an account that is not blocked; DRIVE&JOY administrators see in the web administration the make, model, year, nickname and type of the vehicle, your display name, when you gave consent, the number of photos of the vehicle and when the vehicle was last in Joy dne. The team may use one photo of the vehicle for the question: before uploading, it redraws the photo in the browser into a new file without metadata (location, device, time), and a person checks that the number plate is not visible on it. The photo is stored in our storage under a random name; the file address is public, so anyone who knows it can open the photo even without signing in. On the given day the question (the text, three options, the photo and the label "Auto z komunity") is seen by all members for whom Joy dne is running; we do not attach your name or profile to the question. We notify you of the day it is scheduled (we do not say who picked it; section 2.13). Switching the vehicle to private does not end the consent, so the vehicle can be in Joy dne until you withdraw it. You can withdraw the consent at any time in the vehicle detail, even if we stop the feature in the meantime; it also ends when the vehicle is handed over to another owner, moved to Former cars or hidden by moderation. After the consent is withdrawn or ends, we immediately delete future days with your vehicle and questions that have not yet been shown, and remove the photo from the questions; we then delete the photo file automatically within two days. We do the same if you switch your profile to private or your account is blocked (the consent itself remains). Today's and past days with your vehicle remain with the text of the question only, because members' answers are linked to them; these too disappear when the vehicle is deleted or you delete your account. Legal basis: Art. 6(1)(a) GDPR — consent; withdrawing it does not affect the lawfulness of earlier processing.
• Trasa pro parťáka (Route for a mate). A credit for a free JOY Roads route from a season reward (see Review of rewards with value) that you have not yet redeemed can be given once to another member. The offer in Sezóna (Season) shows you at most 50 members (display name and profile picture) with whom, within the last 365 days, you were on a past ride (as organiser or confirmed participant) or at an event at which the team confirmed attendance for both you and them (for an event only members with a public profile), who have neither JOY+ nor JOY+ PRO, whose account is older than 30 days, whose account is not blocked and with whom you are not in a block or a mute. From the offer you thus learn which of your fellow participants do not have JOY+; if a gift to a particular member is not possible, the app does not tell you why. A gift cannot be taken back. We store to whom and when you gave the credit and, for a route the recipient unlocks with the credit, that it comes from a gift. The recipient receives a notification with the giver's name (section 2.13); in the app the recipient then sees whom the gift is from and the giver sees whom they gave it to (without the name if they are in a block or a mute with each other). We keep the data about the gift until the giver deletes their account; if the giver deletes their account before the recipient redeems the credit, the unused gift lapses (a route the recipient has already unlocked stays with them). If the recipient deletes their account, we erase the data about them from the gift and the credit remains used up. Legal basis: Art. 6(1)(b) GDPR — provision of the feature.
• Albums. From data we already have about you we compile albums: Sezóny (Seasons; season badges), Rytmus (Rhythm; a streak of counted Joy dne weeks), Kraje (Regions; regions of JOY Roads routes you have completed; while the review of routes by the team is running, only from rides the team has confirmed), Okruhy (Circuits; "Znám" — I know — from correctly answered Joy dne questions about circuits, "Projeto" — Driven — from rides on a circuit recognised by the app), Vlajkové akce (Flagship events; DRIVE&JOY flagship events with attendance confirmed by the team), Komunita (Community; the number of events with confirmed attendance, rides with other people and thank-yous received) and Ročník (Class; the Ročník 2026 badge, the registration order and the day the account was created). Albums never count kilometres, speed or the number of rides. Only you see them; others see only what you put in the showcase yourself (see below). They are calculated when displayed and nothing new is stored for them, except a record of which new album items you have already seen (see Sheets and celebrations you have already seen).
• Showcase, profile cover, title and garage plate. You can choose up to three of your badges or albums for the showcase on your profile and, from the status level Hliník (aluminium), a profile cover from the textures your status has unlocked. The team can award the title Zakladatel (Founder; only to DRIVE&JOY founders) or Čestný člen (Honorary member; by invitation, never to anyone from the DRIVE&JOY team or to a blocked account). We store the showcase selection, the cover, the title (who awarded it, when and the reason) and your consent to showing the showcase (whether it applies, since when, when you last decided and which version of the consent text, vitrina-v1). We enter both awarding and removing a title in the record of moderation actions (who decided, whom it concerns, the title and the reason), which is seen by DRIVE&JOY administrators and appointed moderators and kept for 3 years (section 5); we notify you of the removal of a title with the reason and how to object, on which another administrator decides within 30 days (section 2.13). Other signed-in members see the showcase, title and cover only with your consent "Ukázat vitrínu na profilu" (Show the showcase on my profile; nothing is preselected), only with a public profile and an account that is not blocked; a member you are in a block with, or a member who has muted you, does not see them. They see a badge with its name and the year it was earned, an album only with the number of completed items (for example "6 krajů" — 6 regions, without listing them), Rytmus only with the highest streak threshold reached and Ročník only with the year, without the registration order; counts from rides, events, community rides and thank-yous only from records older than 7 days. Others see the cover at most up to the level that may be shown to others (Karbon and higher only after confirmation by an administrator), and for the founders and senior administrators of DRIVE&JOY not at all. Others see the garage plate (from the Karbon level) only with consent to "Ukázat na profilu" (Show on profile; see Status shown to others), and with the level that may be shown to others. You can withdraw consent to the showcase at any time on your profile and it takes effect immediately. We keep the selection, the cover, the title and the consent until you delete your account. Legal basis: Art. 6(1)(b) GDPR — the showcase, cover and title as features of the app; showing to others Art. 6(1)(a) — consent; the title entry in the record of moderation actions Art. 6(1)(f) — legitimate interest in documenting the decision in case of an objection.
• Stopy vozu (Vehicle tracks). For your vehicle you can consent ("Ukázat stopy na profilu auta" — Show tracks on the car's profile) to others seeing where you have been with it with the community: regions of JOY Roads routes you have completed with it (while the review of routes by the team is running, only from rides the team has confirmed), circuits the app recognised in rides with it, and DRIVE&JOY flagship events with attendance confirmed by the team at which the vehicle was in your registration or in a ride recording (name and year). Never kilometres, speed, times, dates of rides or the number of rides, and only your rides as the current owner. We store whether the consent applies, when you last gave or withdrew it and which version of the consent text (stopy-vozu-v1). Other signed-in members see Vehicle tracks only with your consent for the specific vehicle, only for a vehicle they are allowed to see (section 2.3) and that is not hidden by moderation, only with a public profile and an account that is not blocked, and only from records older than 7 days; a member you are in a block with, or a member who has muted you, does not see them. You can withdraw the consent at any time in the vehicle detail; it ends when the vehicle is handed over to another owner. You see everything for your own vehicle. Legal basis: Art. 6(1)(a) GDPR — consent; withdrawing it does not affect the lawfulness of earlier processing.
• Rok v DRIVE&JOY (Year in DRIVE&JOY). A summary of your year: events with attendance confirmed by the team (name and month), the number of past rides with other people, regions and circuits, the number of counted Joy dne weeks, the number of thank-yous received, badges (name and month) and your status level without a number (not with the option "Skrýt body a sezónu" switched on). No kilometres, speed or rankings. Only you see it; it is calculated when displayed from data we already have, and nothing new is stored for it.
• Sharing images. You can have the status card, an album, Rok v DRIVE&JOY and the garage plate drawn as an image. The image is created on your phone and does not carry your name, membership number, registration order, places, kilometres or speed (for the plate only the year since when you have been a member, for an album only the completed part, for example "6 krajů", for the Year only counts, without status). The level on the status card and on the plate is chosen by our server: only a level that may be shown to others (Karbon and higher only after confirmation by an administrator), not with the option "Skrýt body a sezónu" switched on and not for the founders and senior administrators of DRIVE&JOY. We do not send the image anywhere; you decide whom to send it to in the system sharing menu.
• Status privileges. From the Karbon level you can request the privilege of your level in a season: from Karbon a ride with the founders, from Titan a route proposal for JOY Roads, for Karbon-keramika a vote on the flagship route. Entitlement follows the level you have (the founders and senior administrators of DRIVE&JOY do not use privileges, nor does a blocked account). For a request we store the privilege, the season, your optional message (up to 500 characters), the status (pending, handled, not handled), when you requested it and who handled it, when and with what note. DRIVE&JOY administrators receive a notification without your name (your account identifier is only in the technical data of the notification; it is kept for 180 days like other notifications) and handle the request in the web administration, where they see your display name; you receive a notification that it has been handled, including the note (section 2.13). We keep requests until you delete your account. Legal basis: Art. 6(1)(b) GDPR — provision of the feature.
• "Joy dne na Domů" and "Skrýt body a sezónu". We store two options with your profile. "Joy dne na Domů" (Joy dne on Home; on by default) shows the Joy dne card and the word "Joy dne" in the Home header; switching it off removes both. "Skrýt body a sezónu" (Hide points and season; off by default; the app will offer it in Settings once it hides the numbers everywhere) hides the numbers of points, the week, the streak and status; Joy dne stays. With points hidden, the weekly summary does not mention points, stamps or how many points remain to a badge, Wingman does not receive your status or this week's stamps (section 2.17), and we do not put your status on the card in Apple Wallet (section 2.19), on sharing images or in Rok v DRIVE&JOY. With points hidden we do not offer you to show your status to others; status you already show with consent remains visible to others until you withdraw your consent (see Status shown to others). Only you see these options, and we keep them with your profile.
• Sheets and celebrations you have already seen: so that a celebration of a new badge or an information sheet (for example "Jak fungují Joy body" — How Joy points work) is not shown to you repeatedly, even after reinstalling the app or on a new phone, we store with your account which of them you have already seen, and when; likewise which new album items you have already seen (see Albums). Only you can see this, and we keep it until you delete your account; until the record can be sent, the app keeps it on the phone (section 9).
• TV broadcast reminders: when you switch on a reminder for a broadcast in the TV programme, we store which broadcast it belongs to and the time we sent it to you. The notification arrives about 30 minutes before the broadcast starts (section 2.13).
• Purpose: the app's social features — connecting community members, the club wall, shared rides, rating events and ride organisers, points and seasons, Joy dne, status and, with consent, showing it to others, the Pick of the month, confirming attendance at DRIVE&JOY events, Díky, the Hall of fame, the shared season goal, Car from the community, Route for a mate, albums, the showcase, Vehicle tracks, Rok v DRIVE&JOY, sharing images, status privileges, rating JOY Roads routes and broadcast reminders; your clubs, rides and season points also for Wingman's answers if you have confirmed its card in version 3 or later (section 2.17), and in addition your status and Joy dne stamps.
• Legal basis: Article 6(1)(b) GDPR — providing the app features you use; keeping a ride you organised in the participants' history after you delete your account Article 6(1)(f) — the legitimate interest of the other participants in a complete history of their rides; the record of points taken away by an administrator and the alert to administrators after points are taken away Article 6(1)(f) — legitimate interest in protection against abuse and in documenting the decision in case of an objection. The pair cap for rides (excluding a ride from points) Article 6(1)(f) — legitimate interest in protecting the season against sham rides. Selection for the Hall of fame, cancellation of a thank-you by an administrator and the title record Article 6(1)(f) (see above). Rating JOY Roads routes Article 6(1)(f) — legitimate interest in the quality and safety of the routes in the catalogue (see above). You may object to this (section 8). Showing to others with consent (status shown to others including thank-yous and the garage plate, the Pick of the month, the Hall of fame, the showcase, Car from the community and Vehicle tracks) Article 6(1)(a) — consent, which you can withdraw at any time.
• Retention: club data for as long as the club exists (deleting the club also deletes its chat and wall), membership until you leave the club. Posts, comments, reactions and votes on a club wall are kept until you, a club administrator or moderation deletes them, at most for as long as the club and your account exist; after you leave the club they remain as "Bývalý člen" (Former member) (see Club wall above); for wall photos see section 5. Club cover photos and photos in club announcements that nothing refers to any more (a deleted club or announcement, a replaced photo, an unfinished upload) are deleted automatically within two days; a photo referred to by a report is moved to private moderation storage and deleted together with the report (see Reporting content above and section 5). We remember a refused club invitation for as long as both the club and your account exist, so that the same club cannot invite you again sooner than 30 days after the previous invitation. An invitation to a private club via a link is deleted no later than two days after it expires; a link to a public club ends when the club ends or when the account of the person who created it is deleted. Ride invitations, ride links and records of declined invitations are deleted 30 days after the ride ends (for a cancelled ride, after its planned date), a record of a decline also 30 days after the decline; they end earlier when the invitee's account, or the account of the person who created the link, is deleted. After the account of the person who invited is deleted, the invitation remains until then without a link to that account. Your participation in rides, ratings, reactions, vehicle follows, points, milestones, badges, stamps, status, attendance confirmed by the team, registration order, the reward review record, route review requests with their decision and the record of preview openings (even after you delete the ride), your choice on showing status to others, the Hall of fame pick, the showcase, the cover, the title, privilege requests, the record of sheets, celebrations and album items you have seen and broadcast reminders are kept for the duration of your account; thank-yous (Díky) until the giver or the recipient deletes their account, and data about a gifted credit until the giver deletes their account (see above); when you delete your account they are deleted, as are the ratings you received as an organiser. Points for rating an organiser carry the organiser's account identifier; if the organiser deletes their account, only this technical identifier (a random string of characters, not a name or an e-mail address) remains with the points of the person who rated them. Rides you organised do not cease when you delete your account: upcoming ones (including one in progress) are cancelled and their confirmed participants and applicants receive a notification, past ones remain past rides. The ride stays in the participants' history without your name (as "Smazaný účet" (Deleted account)), and the messages in its chat remain as in other conversations (section 2.12). How long we keep rides is stated in section 5.

2.7 Saved events (wishlist)

• The list of events you have saved.
• Purpose: quick access to favourite events, recommendations, a reminder before the event and notifications about changes to it or its cancellation (sections 2.4 and 2.13).

2.8 Transactional e-mails

• Sending booking confirmations (including an .ics calendar invitation) via the Amazon SES service of Amazon Web Services. As a backup we keep our previous service, Resend, to which we can temporarily switch sending if problems arise. A confirmation is sent only for a booking with payment; tapping "I'm going" (section 2.4) sends no e-mail.
• E-mail about a blocked account. If we block your account (section 2.6), our server sends you an e-mail with the reason, the duration of the block and how to object (info@driveandjoy.cz), the same way as the other e-mails, i.e. via Amazon SES, with Resend as a backup. The provider receives your e-mail address and the content of the e-mail. When you try to sign in, the app tells you that the account is blocked and gives the contact for objections; the reason is only in the e-mail. We send this e-mail even if you have unsubscribed from our e-mails (it is a notice, not a marketing message). We do not send it to an address from which our e-mails bounce as undeliverable or whose owner marked our message as spam (section 3.10).
• Sign-in e-mails (confirming your e-mail address at registration, password reset, sign-in link, change of e-mail address and an invitation to the app administration with a link to set a password, section 2.1) are sent by our server the same way, i.e. via Amazon SES, with Resend as a backup. The provider receives your e-mail address and the content of the e-mail with a one-time link.
• Together with the confirmation, the e-mail provider also receives the names of all co-participants listed in the booking and the contact phone number, because they form part of the e-mail body.
• If an e-mail bounces as undeliverable or the recipient marks it as spam, the e-mail service provider reports it to us and we record it in the e-mail log and on the suppression list (section 3.10).
• Purpose: delivering confirmations and important booking information, verifying your e-mail address and access to your account, notice of a blocked account.
• Legal basis: Article 6(1)(b) GDPR — performance of the participation contract and provision of the account; the e-mail about a blocked account Article 6(1)(c) — an obligation of a provider of hosting services under Regulation (EU) 2022/2065 on digital services (Article 17).

2.9 Technical monitoring (errors and usage events)

• The app records technical errors: the error message text, a technical trace (stack trace), the screen name, the app version and its build number, the platform, the time the error occurred and a random identifier of the app launch (it is created anew at every launch and is not derived from any information about you). If you are signed in, the record is linked to your account. An error that cannot be sent straight away is kept on the phone and sent once there is a connection.
• We also record errors on our server: the error text, the technical trace and the name of the server function. The record of such an error may be linked to your account (for example an undelivered notification or a failed account deletion); it is then treated in the same way as errors from the app.
• It also records usage events linked to your account. They include launching the app and returning to it from the background (after at least 30 seconds). We also record when a notice of Joy points awarded (with the number of points), a celebration or an information sheet (which one) is shown, when you open the overview of the points rules, when the next-step card is shown (at most once a day) and when you tap it (which step), when you finish the introductory guide (whether you left it through the first recommended step — adding a car, a route, an event or a club — or went straight into the app), when the "Tvoje první kolo" (Your first lap) card is shown on Home (at most once a day) and when you tap one of its steps (only the kind of step, without the name of the route, event or club), when you open a tip or reminder (its kind, which notification, and whether from the push notification, from the notice inside the app or from the notification overview), and that a ride recording or a road trip along a route ended unexpectedly because the app crashed or was closed by the system (only whether the ride had a route, without location). This also includes when the Joy dne card is shown (at most once a day, with whether it showed the question, the result after your answer, or was locked while driving), what you chose in the sheet after your first Joy dne answer (reminder, weekly summary, tips) and, among celebrations and sheets, the celebration of a new status and the sheet "Co je nového v Zimě" (What's new in winter). We do not store your Joy dne answer itself as a usage event (section 2.6). This also includes the display of the welcome sheet after you join a club (only whether the club has a wall, without the club's name or identifier) and what you chose in it (Introduce yourself to the club, Say hello in the chat, Wall, Rides, Members, Chat, or Look around the club). So that the sheet appears only once, the phone remembers that you have just joined a club (section 9). The "Introduce yourself to the club" option pre-fills the text of a wall post with the make, model and year of one of the cars in your garage; only what you send yourself is published. This also includes your choice whether to show your status to others (show, or keep it to yourself, and whether you chose in the sheet, at a celebration, or in Settings; section 2.6). It further includes an attempt to sign in or register (the method — e-mail, Apple or Google —, the result, for example success, cancellation or error, and a short technical error code; never your e-mail or password) and opening a sign-in link from an e-mail (the result and error code). An attempt made before signing in is not linked to any account, only to the random launch identifier. It also includes the subscription offer and purchase: showing and closing the JOY+ offer (where you opened it from and which tier it showed), a failure to load the offer, and the result of a purchase or of restoring a subscription (the tier, the period, whether it was a free trial and the result, for example completed, cancelled, pending or error). No payment details are included; the payment is handled by Apple or Google (section 2.14). It also includes notifications: the result of the system prompt asking for permission to send notifications (where the prompt appeared — in the introductory guide, on Home, in Settings or, on Android, when starting a drive recording —, whether you allowed or declined notifications, how long the answer took and whether the system actually asked) and opening the app from a push notification or from a notice inside the app (only the kind of notification, without its text). It further includes the introductory guide and the membership offer in it: a problem loading the guide (what it was waiting for, whether it was an error or slow loading, how long it took and whether the device was connected to the internet), showing the JOY+ offer in the guide (which visit to the offer it was, whether the offer loaded, whether it offered a free trial and how long it took to load) and leaving it (how — by continuing for free, by a purchase, by restoring a purchase, with the system Back button, by the app going to the background or with a confirmed membership —, which visit it was, how long you spent in the offer and, where applicable, the tier you had selected). It further includes membership codes: tapping "Mám kód" (I have a code) (where from, which store the app sent you to and what happened, for example that the store opened, or that the code cannot be redeemed alongside a running subscription) and returning from the store (whether the membership was verified after you entered the code, whether the app registered your return and how long it took). You enter the code itself in the App Store or Google Play and the app does not see it; on Android, when verifying, the app asks RevenueCat to load your purchases from Google Play (section 2.14). It further includes sharing and links: sharing content from the app (the kind of content, for example an event, a ride, a club, a route, a listing, a drive or a route plan, and the result — shared, copied, cancelled or error; never the text, the link or what exactly you shared) and opening the app with a link to our content (the kind of link, the short source label in the link if it carries one, and whether the content opened, will open only after you sign in, no longer exists or an error occurred; never the code, the address or the identifier of the content, and we do not measure sign-in links this way). Opening a link before signing in is not linked to any account, only to the random launch identifier. And finally showing the "Odkud o nás víš?" (How do you know about us?) card on Home and whether you answered or chose "Nechci říkat" (I'd rather not say); we do not store the answer itself among usage events (section 2.28). And also showing the JOY+ free trial card on Home and tapping "Vyzkoušet zdarma" (Try for free) or "Teď ne" (Not now); an offer opened from this card is marked by the existing offer events as opened from the card (section 2.14). If any of these events had to wait in the app before being sent, it also carries the time it was created on the phone. An event carries the name of the screen or action and its details (for example the selected vehicle, the circuit or your acceptance of the terms of an artificial intelligence feature), the app version, the platform and the same random launch identifier; for controls on the car display it also records connecting and disconnecting the car, which tab you opened, which vehicle you selected, starting and ending a recording or a road trip along a route (JOY Ride) from the car display, which notification was shown and which navigation app you handed a destination to (and whether the handover succeeded), and that the controls on the car display were switched off (section 2.22). When the app starts, we also record whether its interface was reloaded. A reload flag alone does not tell us why the reload happened. On a club wall we record the publishing of a post (its kind, the number of photos and whether it is a new member's introduction), of a comment (whether with a photo), a reaction (added or removed) and a vote in a poll (whether it changes a vote), without the text, the club and the post.
• Freeze diagnostics: to investigate freezes, we record longer interruptions in the interface's responsiveness and their duration, the name of the open screen or, during a ride recording, its mode and the time since recording began. On iOS we also receive system reports of app crashes or freezes: a technical trace, the system and app versions, the device type, the freeze duration and whether CarPlay was connected during the report's time window. These details help us find bugs; they do not determine why a user left the app.
• Ride diagnostics: when a ride recording starts, while it runs (roughly every two minutes) and when it ends, the app sends technical data about its progress — the recording mode and duration, the selected vehicle, whether accessories were connected (OBD adapter, RaceBox), how many samples came from each source, gaps between them and the age of the most recent sample, whether the app stopped using a source because of an interruption, the number of laps and the best time, the circuit name and any error message. It also records the pace of internal processing and whether the app's interface was in the foreground. This includes the tail of the technical communication log and a limited record of significant connection events, retries, disconnections and errors during the ride and its preparation. The log may contain the accessory's name and identifier, diagnostic commands and responses, supported measurements, individual readings from the OBD adapter and vehicle fault codes. When you open a saved ride, the app also sends details about loading it and how long loading took. This data contains neither the coordinates nor the route of the ride.
• Discarded records: if the app sends more records within one minute than the server accepts (for example when an error keeps repeating over and over), we do not store the excess records and only note how many there were per day, for which type of record (errors or events) and from which account they came (without an account if you are not signed in).
• Aggregate indicators: once a week we calculate aggregate figures for the whole community from usage events and from data on event attendance and ratings (for example what share of members used the app on a given day or in a given week, or on how many days a week they opened it on average). We store only these figures, not linked to individual accounts, and only when they are based on at least five people; they are not personal data, so we keep them without a time limit.
• PostHog analytics: for signed-in members who have not switched analytics off, the app also sends usage events (without free text) to the PostHog service (section 2.25). We do not send error records, reports of interruptions in the interface's responsiveness, or diagnostics of ride recording starts, progress, endings and loading to PostHog. The app launch event may also carry the interface reload flag; its copy in PostHog is subject to the rules and retention period in section 2.25.
• Usage summary in the web administration: DRIVE&JOY administrators (not moderators) see, in the member list and in the detail of your account in the web administration, a summary of how you use the app: when you last used it (based on your last event in the app, your last sign-in or the last check-in of a device registered for notifications), on which platform and in which version; for the last 30 days, on how many days you opened the app, how many times you launched it, an estimate of your time in the app (calculated from the gaps between usage events), which parts of the app you open and how often, your devices by platform and app version, and the number of technical errors with their source; a timeline of usage events for the last 90 days (only the events described above, without the content of messages and posts, without location and without heart rate); the numbers of your cars, drives and kilometres driven (and when you last drove), event registrations, group drives, clubs, Forum posts (count only, never the text) and Joy points in the season; whether you have a device registered for notifications (with its platform and the time of its last check-in), whether you confirmed your e-mail and when you last signed in, and membership levels granted manually by an administrator (level, until when it is valid or that it has no end date, and reason). So that the member list can be sorted and filtered (for example by last activity or number of drives), we recalculate this data roughly every 15 minutes into a summary attached to your account. The "Pomáhat zlepšovat appku" (Help improve the app) switch (section 2.25) applies only to analytics in PostHog; this summary serves member support and community management and does not change when you switch analytics off. You can object to the summary separately (section 8). We log every view of the member list and of a member detail (which administrator, when and how many rows), without recording whom they viewed. A manual membership level is granted or ended by an administrator in the administration, always with a reason and with an end date or explicitly without one. With the level we store which administrator granted or last changed it and when, and the action itself is entered in the same log (which administrator and when), again without recording whom the level was given to. We delete a manually granted level 365 days after its validity ends (section 5). Aggregate figures for the whole community not linked to individual accounts (numbers of active people, retention, most used parts of the app) are not personal data. Purpose: member support and community management. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in running the community and helping members.
• Purpose: detecting and fixing bugs, monitoring stability and improving the app.
• Retention: in our technical monitoring, we keep error records, reports of interruptions in responsiveness, ordinary events (including app launches with the reload flag and the event recording your acceptance of the terms of an artificial intelligence feature) and counts of discarded records for 90 days. Diagnostics of ride recording starts, progress, endings and loading are kept for 400 days (we need to come back to the numbers from circuit test days even after the season ends); all of them are deleted when you delete your account, and records for the account that arrive only while it is being deleted or afterwards (for example from another signed-in device) are deleted by the following day at the latest. If a step of the clean-up after account deletion cannot be completed (for example deleting files), we note the identifier of the deleted account and the unfinished steps in an error record so that we can complete the clean-up (Art. 6(1)(c) GDPR, erasure under Art. 17 GDPR); we keep that record for no longer than 90 days. The record of your acceptance of the terms of an artificial intelligence feature itself is kept separately until you delete your account (section 2.17).

2.10 Location and ride telemetry

• Location data: geographic coordinates, speed, heading, altitude and measurement accuracy. We process location on a one-off basis to show events, routes and tracks near you, and continuously, including in the background with the screen locked, for as long as you have a ride recording or JOY Ride (co-pilot) mode running.
• Ride recording (telemetry): a time series of location and derived values (speed, acceleration / g-force, lap times on a circuit), ride distance and duration, ride summary and score, and where relevant a link to a JOY Roads route or a circuit. The detailed time series is stored as a data file in Supabase storage.
• Ride conditions. For a saved ride you can mark whether the surface was dry or wet. Our server also adds the weather at the time of the ride from the nearest weather station of the Czech Hydrometeorological Institute (ČHMÚ), if there is one within 25 km: air temperature (the average during the ride), precipitation during the ride and in the two hours before it, an estimate of cloud cover, the station's name, its distance and the time of the measurement. We choose the station by the place where you drove fastest during the ride. We usually add the weather within two hours of the ride; for rides more than three days old, only after the month ends, when ČHMÚ publishes the data; and retroactively also for rides from the past year. ČHMÚ receives nothing about you or the ride from us: our server downloads public data for the whole station for a day or a month, so ČHMÚ only sees that our server downloaded the data of a certain station for a certain period. For each ride we also store a technical note of when we last tried to add the weather and whether we cannot find a station for it; for such a ride (usually outside the Czech Republic) you can enter the temperature manually. Only you see the surface and the weather, in the ride detail; we do not pass them to leaderboards, shared links or the features with artificial intelligence (section 2.17). We keep them with the ride and they are deleted together with it. Source of the weather data: ČHMÚ, licence CC BY 4.0.
• Purpose: recording and analysing your drive, statistics and leaderboards, co-pilot navigation (JOY Ride) and ride debriefs (JOY Coach).
• Legal basis: Art. 6(1)(b) GDPR — providing a feature you switch on yourself.
• Retention: for the duration of your account, or until you delete the ride yourself; account deletion removes both the records and the stored data files. The detailed time series (the data file with the ride's progression) is kept at full resolution for 90 days after the ride; after that we automatically condense it to one record per second (for each second we keep the highest speed and the highest g-force, including the place where it occurred) and retain it in that form for the period stated above. The ride summary, score, lap times and route map are not affected by the condensing. This applies equally to all membership tiers.
• Background location tracking runs only while a ride recording or a road trip along a route (JOY Ride) is active and can be stopped at any time in the app or denied in your system settings. The rest of the app remains usable without location access.
• A ride in progress on the phone. Until we have saved a ride on the server, the app keeps it in a working file in the phone's memory, so that it is not lost if the system puts the app to sleep in the background or ends it. From build 130 onwards, while the rest of the app is asleep in the background, the native part of the app also writes the track points (location, speed, altitude, heading, accuracy and time) to a file of its own; the file carries the identifier of your account, so that the ride is not assigned to another account signed in on the same phone. Once the ride is saved or discarded, the files are deleted from the phone; a native backup file that no longer belongs to any ride is deleted by the app when it finds the file older than a week after the app starts or after you sign in. A ride in progress of an account that has signed out on the phone or has been deleted is neither uploaded nor deleted by the app under another account: it stays on the phone until you sign in to that account again or uninstall the app.
• Notifications while you drive. During a ride recording and a road trip along a route (JOY Ride) the app shows you local notifications on the phone, even when you are not connected to a car: the start of a route, an approaching stop, arrival at a stop, leaving the route and returning to it, completing the route and a notice that the recording or JOY Ride is ending (for example because the car has been standing for a long time); also the warning about a high coolant temperature from 110 °C, which is derived from the engine temperature reported by a connected OBD adapter (section 2.11) — on iPhone and, from build 134, also on Android — and on iPhone also the outcome of saving the ride (section 2.22). On Android the progress of a recording is also shown in an ongoing notification without which the system does not allow recording in the background (route, vehicle, speed, distance driven and remaining, on a circuit the lap); it is also visible on the lock screen. The notifications are composed from data we already process under this section and section 2.11, are created on your device and do not pass through our server or any push service. The arrival notification carries a "Navigovat dál" (Navigate on) button that passes the coordinates of the next stop to a navigation app (section 2.16).
• A ride shared with the community. When you choose "Zapsat čas do žebříčku" (Enter my time in the leaderboard) for a ride, signed-in JOY+ and JOY+ PRO members (except those you are in a block with) can see it: your display name, profile picture and membership tier, when the ride started and ended, its duration, distance, average speed, the highest acceleration, braking and lateral g-force (for a motorcycle also the greatest lean angle), elevation gain, the number and sharpness of corners, the data source (phone, OBD, RaceBox), the ride score and the route map. For a road ride the highest speed is not shown, and the map leaves out the area around the start and the end in the same way as when sharing via a link (a circle with a radius of 750 to 950 metres, exceptionally up to 1,250 metres, including a later return into it; it shows only the longest continuous part of the route outside it, section 3.6). For a session on a recognised circuit also the highest speed reached within the circuit area (its average speed is likewise calculated only from the time within the area), lap times and the course of the ride point by point within the circuit area (location, speed, altitude, heading, g-force, for a motorcycle the lean angle, and data from an OBD adapter if one was connected, only from the time spent in the circuit area), which members can play as a "ghost" against their own ride; the map and the course of the ride leave out everything outside the circuit area, including the trip to and from the circuit (section 3.6); in the circuit leaderboard the time also shows the vehicle's make and model (section 2.6). The time counts in the circuit leaderboard if you have not switched on hiding from leaderboards and your profile is public. You can cancel the sharing with a single tap in the ride detail.
• Review of a ride on a JOY Roads route. You can send a ride on a JOY Roads route to the team for review to earn points; the team then sees in the web administration only the track of the ride within a 150 m corridor around the route, without the first and last kilometre, without times and speed, and we record every viewing (section 2.6, Review of JOY Roads routes by the team). Without your request a ride never enters the review.
• Comparison with rides that earned points. Once we switch on this signal of the Joy points watch, our server checks once a week, for community rides that earned points, whether any of their participants had a ride recording at the time of the ride (only by the start and end of the recording, without location, route or speed); a ride on which nobody had one is shown to DRIVE&JOY administrators (section 2.6, Joy points watch).
• Technical data about the progress of a recording (ride diagnostics, without coordinates) is described in section 2.9.

2.11 Data from connected devices (Bluetooth)

• At your request the app connects over Bluetooth to an OBD-II diagnostic adapter in your vehicle or to an external GPS unit (e.g. RaceBox).
• Data processed: vehicle technical data from the adapter (RPM, speed, temperatures, engine load, etc.), more precise position and acceleration from the external unit, and the identifier of the last paired device stored locally on your phone.
• Purpose: enriching the ride recording with data straight from the vehicle.
• We use Bluetooth solely to connect to this accessory — not for advertising-related location determination or for scanning nearby devices.

2.12 Chat and messages

• Data processed: message content, attachments (photos and voice messages — an audio recording made with the device microphone), sender and recipient, timestamp, reactions, read status, muting and blocking of users, your choice of who can message you, content reports, invitations to group chats (who invited you and when, acceptance or refusal). For each conversation we also store whether you have muted, hidden or pinned it (you can pin at most three), and when you last deleted it for yourself (see below). We do not show other members that a conversation is hidden or pinned, and they cannot technically read it either; a hidden conversation comes back with a new message (only older app versions can hide a conversation), and hiding it removes the pin. For now, other participants can technically read that you have muted a conversation, until we end support for older app versions. A club chat is also muted by muting the whole club in its profile (section 2.13). For a conversation you start with the "Napsat prodejci" (Message the seller) button (for a reserved listing "Zeptat se na rezervaci" (Ask about the reservation)), we remember that it started from a listing; it does not count towards the conversation limit in Free.
• A message you are writing (a draft) is stored only on your phone, separately for each account and conversation, and is deleted when you sign out or delete the conversation on that phone.
• Saving and sharing a photo from a message: you can save a photo from a message or pass it on. Your device downloads it from our storage, stores it in the app's cache on the phone and opens the system share sheet; whom you send it to is up to you.
• A Forum topic in a message. You can send a topic in Messages: the app pre-fills a message with a link, without the topic title, and you send it yourself. Below the message the recipient's app shows the title, the author's name, the number of replies and whether it is solved only if the recipient may read the topic (section 2.6).
• The app uses the microphone solely to record a voice message that you make and send yourself; recording runs only while you hold the microphone button. A finished voice message is stored and delivered like any other chat attachment.
• Purpose: delivering messages between community members, communication with the DRIVE&JOY team (support and feedback on the app), moderating reported content, protection against unwanted contact and objectionable content, and operational safety.
• Messages are not end-to-end encrypted. Transmission is encrypted (TLS) and content is stored in the database; in justified cases (a content report) a moderator may access it. Deleting a message (by you or by a moderator) cannot be undone: we remove its text and attachment details from the database. If you delete a message yourself, the app also deletes the attachment file; if a moderator deletes it, only the sender can still open the attachment file. If the message was reported beforehand, its copy remains with the report.
• Reporting a message: together with the report we store a copy of the reported message (text up to 2,000 characters, a link to the attachment, the sender, the conversation and the time sent), so that a moderator can assess it even after the original has been deleted.
• Deleting a conversation for yourself (the "Smazat" (Delete) option in the conversation list) does not remove the messages from the database. The conversation stays unchanged for the other participants, including your messages, attachments and reactions, and they are not told about the deletion and cannot technically read it. The app no longer shows you the messages from before the deletion, or their attachments, reactions and quotes, on any of your devices; an app that is currently running on another device may keep showing them until it is restarted. We delete the notifications about those messages from your in-app notification history; a notification that your phone has already displayed cannot be withdrawn this way. You remain a participant of the conversation, and a member of the group or club or a participant of the ride. A new message brings the conversation back without the earlier history, and that history does not return even if you leave and come back. After that you can no longer delete your own messages from before the deletion for the others; if you want to delete or report a message, do so before deleting the conversation. A report you have already made does not end when you delete the conversation.
• Blocking applies to every conversation. You and a blocked member cannot see each other's messages, whether in a private conversation or in a shared group, club, ride or event chat, and you cannot message each other or invite each other to groups and clubs.
• Who can message you. In Settings → Who can message me ("Kdo mi může psát") you choose who may start a new private conversation with you: all members (default), only people you follow, or nobody. We store the choice with your profile and do not show it to other members. Someone who may not message you sees, when they try, only a notice that you are not accepting new messages at the moment, the same for "nobody" and for "only people you follow". A member asking about your listing can always start a new conversation with you; for a ride that has not been cancelled and ended no more than 30 days ago (or has not ended yet), the organiser and a confirmed participant can message each other, and the organiser can also message a pending applicant; in a private club and in a public club whose members are approved by an administrator (not in an official DRIVE&JOY club), its accepted members and founder can message each other. Existing conversations stay open, blocking still applies, and the choice does not restrict group invitations (see below).
• Spam protection in messages. An account younger than 7 days can start at most 20 new private conversations within 24 hours; for this the server compares the account's creation date with the number of conversations you started in the last 24 hours and stores nothing else for this purpose. We send notifications about new messages from one member in one conversation at most once a minute; you still receive every message in the conversation.
• The DRIVE&JOY team in Messages. A conversation with the DRIVE&JOY team — our operator account — is always at the top of your Messages list, so you can write to us at any time. After you sign up and confirm your e-mail address, the team sends you one welcome message, regardless of your “Who can message me” setting. Any further messages from the team arrive only in that conversation. What you write to the team is read by people on the DRIVE&JOY team and used to reply, to help you with the app and to improve it. The conversation with the team is stored and deleted like any other messages. You can block the team like any other member: the team row at the top of your list then disappears and the conversation is shown as a conversation with a blocked member. If you block the team before the welcome message is sent, it will not be sent. We keep a record of who received the welcome message and when, so it is never sent twice; the record is deleted together with your account.
• A message from the team the next day. About a day after the welcome message (20 to 33 hours after it), the team sends one more message to the same conversation, asking how you are getting on with the app so far; the text is the same for everyone. We send it only between 9:00 and 20:00 Prague time; if no moment between the 20th and the 33rd hour after the welcome falls within these hours, it is not sent at all. It is also not sent if you have written to the team in the meantime or the team has written to you manually in the meantime, if there is a block between you and the team, if you have muted the team or muted, hidden or deleted the conversation with it on your side, if you are no longer a participant in it or if your account is blocked. Like the welcome message, it arrives regardless of your “Who can message me” setting, and you get a notification about it as about any other message (section 2.13). Each person gets it at most once: we keep a record of whom we sent it to and when (or that sending failed, in which case we try again, at most three times); the record is deleted together with your account.
• Group invitations. Nobody can add you to a group chat without your consent. The member who creates the group sends you an invitation (a notification with their name and the group name), and you join the group only by accepting it. We remember a refusal for 30 days so that the same member cannot invite you again straight away. A member who blocks you, or whom you have blocked, cannot send you an invitation. A person you have muted can send you an invitation, but you receive no alert about it.
• Group administration. The administrator of a group is the member who created it. If they leave the group or delete their account, the member who has been in the group the longest becomes its administrator.
• Automatic filter for objectionable expressions. Before saving, our server checks the text of a message (including the name of an attached file), the name and description of a group, a comment, the name, description and announcements of a club, ride details, the bio and location of a profile, the nickname and modifications of a vehicle, build log entries, service records, a Forum topic (title, text and car or model), a Forum reply, an experience with a vehicle (title and text) and a post, a comment and poll options on a club wall against a list of expressions we do not allow in the community (for example racial and homophobic slurs). Text containing such an expression is not saved and the app asks you to edit it. We do not store rejected text anywhere and do not pass it to anyone.
• Retention: for the duration of the conversation. Messages you sent to a conversation with other people remain in it even after you delete your account, including attachments (photos, voice messages), without your name (they are shown as coming from a "Deleted account"), so that the conversation history does not fall apart for the others; you can delete individual messages yourself beforehand (in a conversation you have deleted for yourself, only those from after the deletion). The file address of an attachment still contains the technical identifier of your deleted account (a random string of characters, not your name or e-mail) under which the attachment was stored. A conversation with no participants left (the last of them has left or deleted their account) and the chat of a club that no longer exists are deleted together with all their messages and attachment files no later than the following day. After you delete your account, we also delete, no later than the following day, the files of your attachments that no message refers to any more (for example from messages a moderator deleted); the attachment file of a reported message stays with the report (section 5) unless you deleted the message together with its attachment yourself beforehand. If you edit a message, we rewrite its excerpt in the others' in-app notification history to the new wording; a notification that the recipient's phone has already displayed cannot be changed this way. If you delete a message (or a moderator deletes it), we replace its excerpt in the others' in-app notification history with the text "Message deleted"; a notification that the recipient's phone has already displayed cannot be withdrawn this way. The excerpt of a message that disappears because the whole conversation is deleted (for example the chat of a club that no longer exists) stays in the others' notification history for up to 180 days (section 2.13). If a group is renamed (or a moderator removes its name), we also replace the old name in the invitations to it and in the titles of notifications about its messages. Pinning a conversation lasts until you unpin or hide it, delete it for yourself, or until your participation in it ends (you leave or are removed, the conversation ceases to exist, or you delete your account). We keep the record of when you deleted a conversation for yourself for as long as the conversation exists, at most until you delete your account, even if you leave the conversation. For content reports see section 5.
• Legal basis: Art. 6(1)(b) GDPR — delivering messages, your choice of who can message you, and muting, hiding, pinning and deleting conversations for yourself are part of the service; moderation, blocking and the expression filter Art. 6(1)(f) — legitimate interest in the safe operation of the community; keeping your messages in other people's conversations after you delete your account Art. 6(1)(f) — the legitimate interest of the other participants in a complete conversation history. You may object to this retention (section 8).

2.13 Push notifications

• Data processed: the device token used for delivery (on iPhone the Apple Push Notification service, on Android Google's Firebase Cloud Messaging), platform and registration time; plus the content of the notifications sent and their read status.
• Purpose: delivering alerts (messages, events, reminders, social interactions) to the extent you configure in Notification settings.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating the service; notifications can be turned off at any time in Notification settings in the app; in the phone's settings they can only be hidden, which does not stop them being sent (see below).
• Allowing notifications. The app asks for permission with the system prompt only after explaining what notifications are for: in the introductory guide, on the "Zapni si notifikace" (Turn on notifications) card on the Home screen after you tap "Povolit" (Allow), in Notification settings, or after you tap "Zapnout" (Turn on) on a card the app shows right after you confirm attendance at an event ("Jedu na akci"), join a club (or ask to join) or start following a member with a public profile. The app shows this card only if the system has not yet asked on this phone, at most once every 3 days and at most three times; for this the phone remembers when it showed the card (section 9). Only the phone remembers that the app has already asked on it (or that you declined the card on Home) (section 9). If you choose "Pokračovat bez upozornění" (Continue without notifications) in the introductory guide before the system has asked, we only postpone the offer: the app shows you the card on Home no earlier than at the next launch and not sooner than 20 hours later. For this the phone remembers when you skipped notifications and the random identifier of that app launch (section 9).
• What you set. We send alerts to your lock screen to the extent you set in Notification settings: messages, rides, clubs and groups, new followers and follow requests together with thank-yous (Díky), JOY Roads routes from a mate, Forum replies and your reply being marked as the solution, comments and reactions on your posts on a club wall, questions about your car in the Forum, events, listings, garage (roadworthiness test, vignette, service) and DRIVE&JOY announcements; tips only with your consent, and the Joy dne reminder and the weekly summary only if you switch them on (see below). The JOY Coach analysis after a circuit session (JOY+ PRO) is always sent. A type you have switched off does not reach your lock screen and does not raise the unread count on the bell or on the app icon; you can still see it in the in-app notification overview until you hide it. You no longer see a hidden notification; we delete it together with the others after 180 days. Notices of a moderation action concerning your content, of the outcome of your report (section 2.6) and of points taken away by an administrator (section 2.6) reach you even if you have switched DRIVE&JOY announcements off. The same applies to notices that your status has been lowered, that your attendance confirmed by the team has been cancelled, that an administrator has cancelled a thank-you (Díky) or that a title has been removed (section 2.6). A notice that the team has not confirmed your ride on a JOY Roads route (section 2.6) also always reaches you, but only in the notification overview in the app, without a notification on the lock screen.
• What DRIVE&JOY announcements are. Only operational information you need to know: outages and security notices, changes to the service and the terms that affect you, moderation notices (see above), changes of your status and milestones and rewards in the season, including a notice that a reward with value is awaiting review (section 2.6). Promotion and news (for example a new event, route, feature or offer) do not belong there: without your consent to tips and reminders (see below) we do not send them to you, not even as a bulk message from the app's administration. They also include a notice that the team has picked your vehicle as the Pick of the month (section 2.6); we send it like notices about milestones (see Delivery time). We send in the same way notices about being picked for the Hall of fame and about the day your vehicle will be in Joy dne as Car from the community (section 2.6). Notices about a thank-you you have received (Díky, with the giver's name and without numbers) and about a JOY Roads route a mate has given you (with the giver's name; section 2.6) are also sent like notices about milestones, but they are not DRIVE&JOY announcements: you switch them on and off together with new followers and follow requests (the "Lidé" (People) option). They also include a notice that your request for a status privilege has been handled, with the administrator's note (section 2.6).
• Rides. We notify you of a request, approval, decline, removal, a change of the date, place or end, cancellation of a ride and a participant leaving, of an invitation to a ride, of a new club ride in your club and a new public ride by someone you follow, and we invite you to rate the organiser.
• Events and listings. For an event you have confirmed "Jedu na akci" ("I'm going") for (or have a booking for) or that you have saved, we send you a reminder the day before and notifications of a change of its date or place, of its cancellation (including withdrawal by moderation) and of the event going ahead after all following a cancellation (section 2.4); after an event you went to, an invitation to rate it. We also notify you when an administrator cancels your booking, including whether we refund the payment (section 2.5). For a listing we notify you of its approval or rejection, of its upcoming expiry and of its expiry, with the date until which it can be renewed (section 2.18).
• Muting and blocking. Muting hides a person's activity in the Overview, rides, comments and the Forum (their topics, replies, vehicle experiences and their "Helpful" in counts), the club wall (their posts and comments) and stops notifications from them; you still see them in lists, search and the community Garages (but not their vehicle experiences), and you receive their invitation to a group or club (without a notification). They do not learn that you muted them. From a person you mute or block (or who has blocked you) you receive no alerts about their activity (follows, club announcements, comments and reactions on a club wall, new rides, Forum replies and questions, requests and invitations) — neither on the lock screen nor in the in-app overview. Alerts concerning your own participation, for example the cancellation or a change of a ride you are going on, still arrive. Muting a person does not stop chat messages (section 2.12).
• Muting a club. You can mute a club in the club's profile. Club announcements and new club rides then do not reach your lock screen and do not raise the unread count, but you will see them in the notification overview in the app; the club chat is muted and its messages do not count as unread. Alerts about comments and reactions on your posts on the wall of a muted club are not created at all, not even in the in-app notification overview. Invitations, requests to join and alerts concerning your own participation still arrive. We do not show the muting of a club to other members in the app (for now, however, other participants of the club chat can technically read that the club chat is muted, until we end support for older app versions), and it ends when you leave the club.
• Delivery time. Event reminders that we send ourselves on a schedule (before an event, for a saved event and after an event with an invitation to rate it) are not sent between 9 pm and 8 am Prague time; they go out in the morning. Notifications about a milestone or a reward in the season that you did not trigger yourself (for example when an administrator approves a reward) are not sent to your lock screen between 9 pm and 8 am Prague time; they go out in the morning after 8 am. Notifications that are not urgent — tips and reminders, milestones and rewards in the season, the JOY Coach analysis, invitations to rate an event or a ride organiser and questions about your car in the Forum — are sent without sound and reach your lock screen only within quiet windows in Prague time: on weekdays from 9:30 am to 3:30 pm and from 7:30 pm to 9 pm, at weekends from 7:30 pm to 9 pm. A notification about a badge or reward earned by attending an event or a ride goes out at the earliest at 9:30 am on the next weekday. For an event that ended on a Saturday we send the invitation to rate it on Sunday at 7:30 pm, for other events at 9:30 am on the next weekday; we send the invitation to rate a ride organiser on weekdays at 9:30 am (on Monday for rides from Friday to Sunday). While you are driving we do not send these notifications to your lock screen (see Quiet while driving). Our server does not defer other notifications (messages, events and bookings, rides, moderation and the operation of the service). Every notification is in the notification overview in the app straight away. A deferred notification waits in our queue, and before sending it we check again that it is still valid (you have not read or hidden it, you have not switched its type off and you have a device to deliver it to) and that you have not started driving in the meantime. A notification deferred only because of the night-time quiet period is discarded if it has not gone out within 24 hours of being created, any other one 24 hours after it was due to go out — so a notification about a badge from a Friday event may wait in our queue until Tuesday morning.
• Quiet while driving. When you start a ride recording or a road trip along a route (JOY Ride), your device sends our server the time until which not to disturb you: 4 hours ahead at the start; during a long ride it extends it at most once an hour, and when the ride ends it shortens it (to at most 10 minutes, and to the end immediately when the recording stops because the car has been standing for a long time). Based on it, our server defers notifications that are not urgent (see Delivery time); the others still arrive. Only this time is sent — no location, route or other information about the ride. We keep only the latest value and delete it once it has passed, usually within 10 minutes, during the night-time quiet period (9 pm to 8 am) in the morning; when you delete your account, immediately. Purpose: not disturbing you at the wheel with notifications that can wait. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the safe use of the app while driving. You may object to this (section 8).
• Delivery status of notifications. For each notification we record how sending it to your lock screen turned out, and when: sent, no device (you have no phone to deliver it to), switched off (you have switched the type off, the notification belongs only in the in-app overview, you read or hid it before it went out, or the account is blocked), deferred, or failed. Together with the event of opening a tip (section 2.9) this tells us how many notifications arrive and how many of them you open, so that we send fewer and better ones. Nobody sees it in the app. We delete it together with the notification after 180 days and when you delete your account. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating the service. You may object to this (section 8).
• The notification content is passed to the push service provider. In order for a notification to be delivered, the Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android) receives its shortened title and text, the type and identifier of the alert, the link into the app and, on iPhone, also the unread count for the number on the app icon (on Android the push does not carry it) — for a chat message this means the sender's name and an excerpt of the message, plus the name and identifier of the conversation and, for a private message, the sender's identifier, so that it opens straight away when tapped. If you would rather this did not happen, turn message notifications off in Notification settings in the app. Turning notifications or their previews off in the phone's settings does not stop them being sent: notifications still travel through Apple's or Google's service, and the phone merely does not show them, or shows them without a preview.
• Who sends the notification: always our server, never your device. Apple and Google therefore do not see your phone's IP address when we send it; their service only learns it from the separate connection your device uses to collect notifications (on Android through Google Play services, which run on the phone independently of our app).
• Alongside notifications delivered through Apple and Google, the app also shows local notifications that are composed on your device itself (notifications during a ride recording and a road trip along a route with JOY Ride, on the phone and on the car display, sections 2.10 and 2.22). These do not pass through our server or any push service, so their content is not shared with Apple or Google.
• On Android the Firebase Cloud Messaging library registers with Google: it creates an identifier of the app installation and requests a delivery token; Google sees your device's IP address in the process. From app build 130 onwards it first does so only once you are signed in to the app and the app is allowed to show notifications (on Android 13 and later therefore only after you agree in the system prompt; older Android versions allow notifications in advance). Older builds register with Google as soon as the app starts, even before you allow notifications. Once the library has registered, the registration stays on the phone even after you turn notifications off, and the library renews it with Google from time to time when the app starts (Google again sees your device's IP address in the process). After you sign out of the app it stays if our server confirms that it has deleted this device's token, or if the app is not allowed to show notifications; otherwise the app cancels it when you sign out, so that the signed-out phone does not keep receiving the account's notifications. After you delete your account this usually happens, because the token has already been deleted by then and no confirmation comes. App versions before update 1.0.589 do not cancel the registration when you sign out yourself. The registration also ends when you uninstall the app or clear its data in the phone's settings, or when the app signs you out itself because your sign-in is no longer valid. As a rule we store the token against your account only if the app is allowed to show notifications; however, if Google creates a new token for a registration that has stayed on the phone, the app stores it against the signed-in account even with notifications turned off.
• Tips and reminders (for example events in your region and elsewhere, upcoming community rides with free places, JOY Roads route tips, a weekly summary (only until the app offers its own "Souhrn týdne" (Weekly summary) switch, see below), the anniversary of your DRIVE&JOY membership and reminders of what you are still missing in the app; with consent to the version 3 or 4 wording (a shorter wording with the same scope) also offers of the JOY+ and JOY+ PRO memberships (membership benefits and promotions; without prices in the notification, with a link into the app), news and promotions from the DRIVE&JOY shop and new features of the app; at most three times a week, including tips sent in bulk from the app's administration, as a notification and in the notification history) are sent only with your explicit consent. We do not send partners' discounts and promotions as tips. The app asks you for consent in the introductory guide after registration (the "Upozornění" (Notifications) step) or with a card on the home screen, never with a notification, and only once: if you declined the tips or withdrew your consent, we do not ask you again (not even in the sheet after your first Joy dne answer, see below); you can give or withdraw consent at any time in Notification settings (the "Tipy a připomínky" (Tips and reminders) option), where you also see since when and to which version of the text your consent applies. We store whether you have given consent, when you gave it and to which version of the consent text, and that and about which version of the text we have already asked you; for each tip we store which scope it belongs to. In addition, we record every grant, extension and withdrawal of consent and every refusal of the tips in a record that is no longer changed: when it happened, to which version of the text, and whether you answered in the introductory guide, on the card on the home screen or in Notification settings (for older versions of the app we do not know). The record serves to demonstrate what you consented to and when (Art. 7(1) GDPR); nobody else sees it in the app and you can request an extract of it (section 8). Without consent we neither create nor send these tips. Consent given to an earlier wording (version 1 or 2) remains valid, but only for the earlier scope: we do not send you offers of JOY+ and JOY+ PRO, shop news or new app features on its basis. The app asks you once for consent to the new wording with the "Co nově posíláme" (What we now send) card; if you do not give it (the "Teď ne" (Not now) option), you keep receiving tips in the earlier scope. Legal basis: Art. 6(1)(a) GDPR — consent; withdrawing it does not affect the lawfulness of earlier processing. We keep the record of consent under Art. 6(1)(c) GDPR — the obligation to demonstrate consent (Art. 7(1) GDPR).
• Joy dne reminder and weekly summary. After your first Joy dne answer, the app shows you once the sheet "Joy dne je každý den nový. Co ti máme posílat?" (Joy dne is new every day. What should we send you?) with three switches, all off: the Joy dne reminder, the weekly summary and tips. You see the tips switch only if you have not yet expressed a view on tips, that is, you do not have consent, have not declined the tips and have not withdrawn your consent; if you switch it on, we record the consent in the same way as on the card on the home screen (see above). We store only what you switch on yourself; closing the sheet stores nothing and switches nothing off. You can also switch the reminder and the summary on or off in Settings (Joy dne) and in Notification settings. The Joy dne reminder arrives at most once a day, at the time (8:00 am to 8:59 pm) and on the days you choose, and only if you have not yet answered that day and have no stamp. It does not arrive during the night-time quiet period (9 pm to 8 am) or while you are driving (see Quiet while driving); after you finish driving it arrives if this is within two hours of the chosen time and before 9 pm. The notification carries the text of the question of the day, goes out via Apple or Google (see above), without sound (on Android in the "Připomínka" (Reminder) channel), and is valid only until midnight. If five reminders in a row remain without an answer and without a stamp, we mute the reminder and tell you so only in the notification overview; you can switch it back on in Settings. We store whether you want the reminder, the time, the days and when we muted it. On a day when you are due to receive a reminder we do not send you a tip. The weekly summary (what you achieved in DRIVE&JOY during the week, on Sunday evening) is sent only with the "Souhrn týdne" (Weekly summary) switch on, even without consent to tips, and like the other notifications that are not urgent (see Delivery time); until the app offers this switch, the summary is sent as a tip only with consent to tips. We store whether you want the summary. Purpose: a reminder and a summary that you ask for yourself. Legal basis: Art. 6(1)(b) GDPR — provision of a feature you switch on yourself.
• The in-app notification history (the notification text and read status) is kept for 180 days. If you delete a conversation for yourself, we immediately delete from the history the notifications about its messages up to that moment (section 2.12).
• After you delete your account, your name may remain in the text of notifications other members have already received (for example "X now follows you") for up to 180 days, until we delete them.
• The token is tied to a specific device. We always delete it when the account is deleted, and usually also when the device signs out; if notifications are turned off in the phone's settings, however, the token may stay with the account until it stops being valid (for example after the app is uninstalled), until you sign in again on the phone with notifications allowed, or until the account is deleted. If it cannot be verified on sign-out that the token has been deleted on our side, the app cancels the device's registration with Apple or Google (see above), so that the signed-out phone does not keep receiving the account's notifications. A token that the app has not renewed for 120 days (it renews it when it starts with notifications allowed) is deleted automatically.

2.14 JOY+ and JOY+ PRO subscriptions

• The subscription is purchased and billed in the app store: on iPhone through the App Store (Apple), in the Android app through Google Play (Google) once the app offers it there (from 21 October 2026 at the earliest). The purchase takes place directly between your device and the store, which processes your account with it, your payment details and your device's IP address as an independent controller under its own policy. The RevenueCat library (next bullet) also attaches the identifier of your account with us to the purchase: on iPhone directly (the appAccountToken value), in the Android app as its SHA-256 hash (the obfuscatedAccountId value). The store keeps it with the purchase as an independent controller, Google also uses it to detect fraudulent purchases, and deleting your account with us does not delete it from the store. We never see your payment details (such as your card number).
• We use RevenueCat to manage subscriptions. Its library runs directly on your device; it starts only once you sign in to your account, and in the Android app only when the app offers subscriptions there. RevenueCat therefore processes not only the user identifier and purchase status (including the purchase details from the App Store or Google Play) but also your device IP address and device identifiers. The user identifier is the identifier of your account with us; we do not pass your name or e-mail to RevenueCat.
• On Android, once the app offers subscriptions there, RevenueCat verifies Google Play purchases directly with Google, using access we have granted it in Google Play, and Google sends it notifications about subscription changes through the Google Cloud Pub/Sub service in our Google Cloud project. A notification carries neither your name nor your e-mail, only the purchase token and details of the subscription change.
• RevenueCat sends our server messages about events in your subscription (purchase, renewal, change, transfer to another account, cancellation, expiry, refund). A message carries the identifier of your account with us, the product, the type and time of the event, and further purchase details that RevenueCat attaches to it (for example the validity period, store and country, price and currency, and transaction identifiers). We use the messages to set your membership tier and store them in full, together with the outcome of processing them, as a record of why the account has that tier.
• From the subscription event messages (type of period — trial or paid — and its end) our server recognises whether you are in a free trial before the first payment. It uses this to decide whether you may claim partner discounts (section 2.19). Nothing else is stored for this.
• Our server also asks RevenueCat about the status of your subscription itself: when you complete or restore a purchase in the app, when the app learns from RevenueCat about a subscription our server does not know about yet, when RevenueCat reports a transfer, a change or the expiry of the subscription or a refund, and once a night for accounts whose subscription RevenueCat has told us about. It sends RevenueCat only the identifier of your account with us. We store with the account the latest membership tier RevenueCat reported to us, the time of that information and where it came from (a message from RevenueCat, or a query by our server).
• Restoring a purchase on another account. The subscription is tied to your Apple ID or to the Google account with which you bought it. If you restore the purchase in the app while signed in to another DRIVE&JOY account, RevenueCat transfers the subscription to that account and the original account loses its membership.
• Deleting your account does not cancel the subscription with Apple or in Google Play. You have to cancel it in your Apple account settings or in the Subscriptions section of Google Play, otherwise it keeps renewing and the store keeps charging for it (Terms of Use, section 14).
• For DRIVE&JOY events with priority registration, JOY+ and JOY+ PRO members get priority (Terms of Use, section 5). What is processed in that case is described in section 3.2.
• Offers of the JOY+ and JOY+ PRO memberships (membership benefits and promotions) are sent to you as a notification only with your consent to tips and reminders in the version 3 or 4 wording (section 2.13), without prices in the notification. Your consent to them and its withdrawal are entered in the record of consent events (sections 2.13 and 5).
• The free trial card. If you have no membership and the app store (through RevenueCat) confirms that you are eligible for a trial period, the app shows you once on Home the card "14 dní zdarma, pak se rozhodneš." (14 days free, then you decide) with the buttons "Vyzkoušet zdarma" (Try for free) and "Teď ne" (Not now), at the earliest on the third day of the account (the day it was created counts as the first), never while driving and only when no other prompt is waiting on Home. The JOY+ card for members without a membership then shows the button "Vyzkoušet 14 dní zdarma" (Try 14 days for free) with the price you will pay after the trial ends. The app checks eligibility the same way as every time the offer is shown; nothing new is sent to anyone. After "Teď ne" (Not now) the card is not shown again on this phone.
• Purpose: unlocking and renewing JOY+ premium features.
• Legal basis: Art. 6(1)(b) GDPR — performance of the subscription contract; attaching the identifier of your account to the purchase in the store Art. 6(1)(f) — legitimate interest in reliably matching the purchase to your account and in protection against fraudulent purchases; keeping the subscription event messages and leaving the record at RevenueCat after the deletion of an account with an active subscription Art. 6(1)(f) — legitimate interest in tracing and documenting purchases and the membership tier in a complaint or dispute, and for the messages also in subscription statistics, and disconnecting the app from RevenueCat after account deletion (with the record under a random identifier created in the process) also Art. 6(1)(f) — legitimate interest in the record under your identifier not being created again. You may object to this (section 8). We keep the list of deleted accounts under Art. 6(1)(c) GDPR so that we can erase the record at RevenueCat (Art. 17 GDPR).
• Retention: the latest subscription status reported by RevenueCat until you delete your account; subscription event messages for 3 years from their receipt. When you delete your account, we anonymise the messages concerning it within 30 days: we remove from them the identifier of your account and all other identifiers (we replace the identifier of the message at RevenueCat with a random one and drop the account aliases), the country, price and currency, transaction numbers and other payment details, and the exact times. Only the type of the event (for example a purchase or a renewal), the product, the month in which the event occurred and in which the message arrived, the membership tier we set based on the message (for a test purchase also the tier before it), the outcome of processing the message and a marker that we have modified the message in this way remain; for the rest of the 3 years we use them only for subscription statistics. A message that arrives only after account deletion (the subscription with Apple or in Google Play keeps running until you cancel it) is anonymised within 30 days of its receipt, even if it no longer carries the identifier of your account (RevenueCat leaves it out if it has meanwhile deleted its record about you). If a message also concerns another, existing account (a subscription transfer), we delete only the identifier of your account from it. For an account with an active subscription, whose record at RevenueCat we keep (next bullet), the messages can be matched to that record until it is deleted; until then we treat them as personal data.
• The customer record at RevenueCat (the identifier of your account with us, data about your device and, if you had a subscription, the purchase history) is deleted when you delete your account if you have no active subscription at that time. At the same time, the app on the device on which you delete your account disconnects from RevenueCat so that it does not create the record under the identifier of your account again, and within 30 days of account deletion we repeat the deletion, because the record may meanwhile be created again, for example by an older version of the app on another device on which you were signed in. Deleting your account does not end an active subscription (Apple or Google Play keeps renewing and charging it until you cancel it); we therefore keep such a record so that we can trace and document a purchase if you contact us about it after deleting your account (for example with a complaint) or if a dispute about it arises, and we delete it after the subscription ends, even if it keeps running for years after account deletion. RevenueCat holds it as our processor on our instructions. For the repeated deletion, we keep the identifier of your account and the time of account deletion in a list of deleted accounts until the record is deleted in the process; if the record cannot be deleted because of an error at RevenueCat even 1095 days after account deletion, we remove it from the list and then delete the record at your request (section 8). At your request we delete the record earlier (section 8), unless we need it for the establishment, exercise or defence of legal claims. This does not cancel the subscription with Apple or in Google Play, and the purchase can still be restored afterwards.
• After the disconnection the RevenueCat library keeps running in the app, until you close it or sign in again, under a new random identifier unrelated to your account, and RevenueCat creates a record for it with device data only. We do not link it to your account; RevenueCat holds it as our processor for as long as we use its service.

2.15 DRIVE&JOY merchandise shop

• We are preparing the DRIVE&JOY merchandise shop and will open it soon. The app says there that we are preparing it and will open it soon; we do not accept orders there yet, and the app does not load the offer or product photos from the online store. The member discount on merchandise is listed in the JOY+ offer with a note that the online store has not opened yet. Before we open the shop, we will add to this policy what data an order involves, whom we pass it to and how long we keep it.
• News and promotions from the shop are sent to you as a notification only with your consent to tips and reminders in the version 3 or 4 wording (section 2.13).
• Earlier orders. If you ordered merchandise in the app before, we keep the order (items, delivery details, e-mail address, amount and payment status) as an accounting record for the period required by accounting and tax legislation (up to 10 years, section 5); when you delete your account, we remove the e-mail address and the delivery details from it. The payment was processed by Stripe. A copy of the order that we may have created in the Shopify online store for shipping (name, delivery address, phone, e-mail, items) is not deleted by account deletion itself; we delete it at your request (section 8), at the latest together with the accounting record.
• Purpose: fulfilling earlier orders, handling complaints and meeting accounting and tax obligations. Legal basis: Art. 6(1)(b) GDPR — performance of the purchase contract; Art. 6(1)(c) for accounting records.
• The Stripe payment library that the shop in the app uses does, however, remain in the Android app and sends its own technical telemetry every time the app starts (section 2.21).

2.16 Map data, place search, route calculation and navigation

• When a map is displayed in the app (events, JOY Roads routes, route plans from the planner, meeting points of community rides, co-pilot, ride recording, the onboarding guide when you choose your region) your device requests map tiles from Mapbox, which in doing so processes your device's IP address and the coordinates of the displayed viewport — so when the map follows your position (co-pilot, ride recording), also the area where you currently are. The map of ride meeting points does not follow your position. The Distance filter in Rides asks once for your device's location to calculate the distance to meeting points; the location stays only in the memory of the running app and we do not send it anywhere.
• In addition, the Mapbox map library in the app sends Mapbox technical messages. When a map loads, and once a day, a billing message goes out with a random identifier that the library stores in the app's storage on the phone and replaces with a new one after 24 hours. Performance messages follow: loading times, the size of the map, the screen and the window, connection type, graphics chip, zoom and the browser identifier (it reveals the operating system version and the app build number, and on Android usually also the phone model). They contain neither the device's location nor the route of the ride. Mapbox uses them for billing and to monitor the performance of its library (for its role see section 6); we do not receive them.
• On public pages of the website (for example a shared ride record or a shared route plan) the map background is an image that the browser downloads from Mapbox; Mapbox sees your device's IP address and the centre and scale of the displayed area. No identifier is stored on your device there.
• Place search (the start and destination in the ride planner, the place of an event or the meeting point of a ride): the text you type into the search is passed by our server to Mapy.com (Seznam.cz), which therefore does not see your IP address. If Mapy.com finds nothing (typically for places abroad) or is unavailable, your device sends the same text directly to Mapbox Search, which then also sees your device's IP address. The search does not send your location. To protect the shared search credits (at most 150 searches per account in 24 hours) we briefly store a cryptographic fingerprint of your account identifier (SHA-256 with a secret server key); we delete it within 3 days of the last search at the latest (section 5).
• For route calculation (ride planner, route navigation) our server passes the actual coordinates of the start, destination and waypoints to Mapbox; the start may also be your current location if you choose "Moje poloha" (My location) in the planner. In this case your device does not contact the provider directly.
• To convert coordinates into a place name (and back) our server passes the coordinates to Mapy.com (Seznam.cz) — in the planner also the coordinates of the start, which may be your current location ("Moje poloha", My location). The elevation profile of routes also comes from Mapy.com — we calculated the elevations in advance from the route geometry, so no data about you is passed on when the profile is shown. Next to places found via Mapy.com, the ride plan and the route elevation profile we do, however, show the Mapy.com logo, which your device downloads directly from their server; Seznam.cz therefore sees your device's IP address, nothing else.
• The map with stops on the car display (CarPlay) is drawn by iOS from Apple's maps; Apple sees your device's IP address and the displayed area in the process.
• If you choose navigation in an external app — on the phone or on the car display via CarPlay — your device (not our server) opens Apple Maps, Google Maps, Waze or Mapy.cz and passes it the destination coordinates (for an event without coordinates, the name of the place), and for a road trip along a route (JOY Ride) also the coordinates of the waypoints along the route. (Apple Maps and Waze do not support waypoints, so they receive only the start of the route, its end, or the next stop.) For a ride you are going on, the "Navigovat na sraz" (Navigate to the meeting point) button opens Google Maps or Apple Maps with the coordinates of the meeting point and, if the ride has none, with the text of the meeting place. The provider of the chosen app therefore sees your device's IP address and where you are heading; from that point its own policy applies and it acts as an independent controller of that data. The app remembers your choice on the phone, so it does not ask again; you can change it in Settings → CarPlay. Until you choose one, the car display asks every time — only the "Navigate on" button on a stop notification falls back to Apple Maps without asking (as it also does when the chosen app is not on the phone, or when you chose Mapy.cz and your location is not known). On Android, from build 134, the "Navigate on" button on a stop notification (section 2.10) opens the navigation app chosen in the app — Google Maps, Waze or Mapy.cz (Google Maps if none is chosen; if the chosen app is not on the phone, its website) — and passes it the coordinates of the next stop. In builds 134 to 144, Mapy.cz receive the location from when the notification was created as the starting point. From build 145, when you tap the notification, the device reads the last known location; it adds it to the link only if it is no more than two minutes old and its reported accuracy is no more than 35 metres. Without such a location, it opens Google Maps with only the destination coordinates. Builds before 134 always open Google Maps and do not pass your location.
• Mapy.cz additionally receive your current location as the starting point, because the Mapy.cz app will not start navigation without it. The device adds it to the link only if it knows it and it is no more than two minutes old; otherwise the link starts at the beginning of the route and Mapy.cz show only an overview of the route (for a single destination on the car display no link is created at all and the app offers another navigation app). If the Mapy.cz app is not on the phone, the same address opens on the mapy.com website, so Seznam.cz sees your location and your device's IP address all the same; on the car display Mapy.cz are not offered unless the app is installed. Apple Maps, Google Maps and Waze do not receive your location in the link — where they need a starting point, they determine it themselves in their own app. On the car display and for the "Navigate on" button, the location is added to the link only from app build 130 onwards; older builds do not add it there. Where the app points this out: on the phone, right at the Mapy.cz option after you tap Navigovat (Navigate) in JOY Ride (when it knows your location and adds it to the link), and in Settings → CarPlay below the choice of navigation app. There is no such notice in the list of navigation apps on the car display or at the "Navigate on" button: if you chose Mapy.cz there or in Settings → CarPlay, they receive your location with every further handover from the car display and from the "Navigate on" button, without the app asking again.
• Purpose: rendering the map, searching for places, calculating and displaying a route, determining the start and destination places.
• Legal basis: Art. 6(1)(b) GDPR — the map, place search and route calculation are part of the app features you use; the technical messages of the map library and the map background on public pages of the website Art. 6(1)(f) — legitimate interest in a working map service that can be billed.

2.17 Artificial intelligence features (Wingman, JOY Coach, ride planner, ride summary)

Four features of the app send data relating to you or your ride to a language model operated by an external provider. The app never contacts the provider directly — the request is always sent by our server, so your IP address does not reach the provider. We do not pass on your name, e-mail address, account identifier or geographic coordinates.

Provider: OpenAI (GPT model). It is the only language-model provider we use; no other provider receives data from us for these features, not even when the model is not responding at the moment: in that case you get a substitute calculated without artificial intelligence, or a prompt to try again later.

OpenAI: the contracting party and our processor is OpenAI Ireland Ltd. (Ireland); the model is operated by the OpenAI group (OpenAI OpCo, LLC) on the infrastructure of its suppliers. We do not use processing in the EU (data residency), so we do not restrict where a request is processed: OpenAI processes it in the USA or in another country where OpenAI or its suppliers operate servers, including outside the European Economic Area (see section 7). Under OpenAI's terms, data sent through its API is not used to train or improve its models; we have sharing of data with OpenAI for these purposes switched off. We send requests with the option that OpenAI does not store the response for continuing the conversation. OpenAI keeps prompts and responses in its logs for detecting abuse of the service for at most 30 days, longer only where the law requires it or where it is reasonably necessary to protect the service or third parties from harm; content that its automated checks flag as a possible violation of its policies may be reviewed by OpenAI, also with the help of contracted moderation suppliers. To speed things up, OpenAI may briefly keep parts of a request in an encrypted cache, for at most 24 hours. Until 28 October 2026, the data for all four features was processed by Google's Gemini model in the USA; it received the same data by the same route. An acceptance of the terms that you gave for these features in a version naming Google does not extend to OpenAI: before you use the feature again, the app will ask you for a new one.

We also use the GPT (OpenAI) model to translate headlines and introductions of news articles from the English motoring website autosport.com into Czech. The translation is done by our server and involves no data about you. The same model also writes short descriptions of events from organisers' public calendars for us; for that it receives the public text about the event, including the organiser's name (section 2.24). What is stated above about training and retention at OpenAI also applies to this data.

What each feature sends:

Wingman (in-app advisor) receives your question (free text, up to 300 characters), the last two questions and answers from the conversation in progress, the questions from your last four conversations (up to three from each; for the most recent one also the last answer, shortened to 260 characters) so that it knows what has already been discussed, and, with every question, a brief summary of what you have in the app:

• about you: your membership tier, region, riding style, interests selected in the app, the month and year since when you have been a member, and whether you are asking from an iPhone (iPad) or from Android;
• vehicles in your garage: make, model, year, kind (car or motorcycle), mileage, roadworthiness-test and vignette dates and how many kilometres remain until the next service;
• rides: their number and total kilometres, the last five rides (date, circuit and number of laps with the best lap, or the distance of a road ride, ride duration, vehicle and JOY Roads route; top speed only for a circuit ride, ride score only for JOY+ PRO) and your best laps on individual circuits with dates; if you ask about a specific ride, also the lap times, best sectors, consistency, the JOY Coach analysis and the result of your previous visit to the same circuit;
• events: your attendance at upcoming (and ongoing) events ("Jedu na akci") and bookings (name, date, venue, whether payment is pending, which car);
• saved route plans: name, length, duration, style;
• JOY Roads Passport: number of routes completed, kilometres, the last route with its date;
• what you are currently looking at: an event, a route, your route plan including the names of the places it passes through, a vehicle, a ride, a circuit or a guide;
• Forum topics (only when you ask about the Forum yourself, for example "what do people say about this in the Forum"): at most three topics for the whole community that you could read in the app yourself and that relate to your question — the title (up to 120 characters), the beginning of the text (up to 240 characters), the number of replies and whether the topic has a solution. We do not pass on the author's name, profile photo or account; we replace the author's name in the text with the word "member" and remove e-mail addresses, phone numbers, links and "@" mentions from it. Wingman does not receive club topics, vehicle experiences, topics about a specific vehicle or the replies in threads. We do not store the topics with your question; only Wingman's answer is stored, as part of the conversation.

The Wingman card has listed them since version 3; version 4, which names OpenAI, applies today. With the card confirmed, the summary also includes:

• community: the clubs you belong to (name and your role: founder, moderator, member, or a pending request to join) and the upcoming or ongoing community rides you organise or have joined (name, day and start time, destination area and whether you organise, are going or are waiting for the organiser's approval); for both clubs and rides also how many there are;
• your listings in For sale: the vehicle (make, model, year), price, listing status (draft, awaiting approval, published, reserved, not approved, sold, expired), whether changes are awaiting approval, the number of views and the number of listings;
• season: points in the current season, the number of milestones reached, the name of the next milestone, how many points are missing to reach it, and when the season ends;
• Joy points (when you ask about points, badges, the season, status or Joy dne): what points are awarded for (the kind of action, the number of points and the cap; also attendance confirmed by the team, when the team confirms it), how many points you can still earn before the season ends without driving (by rating past events and ride organisers and with Joy dne stamps) and, for your rides from the last 30 days (at most five), the day of the ride, whether it earned points and how many, or why not (for example a short trip or a cap already reached), and points for a completed JOY Roads route; it does not receive the route or location of the ride, the name of the JOY Roads route, the status of a request for the team to review the route or the reason why the team did not confirm the ride (section 2.6);
• status and Joy dne (for the same questions): your status without a number (the level, the next level and whether a level is awaiting confirmation by an administrator) and how many Joy dne stamps you have this week and whether the week counts; the status only if the app shows it to you, the stamps only if Joy dne is running for you, and neither with points hidden (section 2.6);
• past events: how many events with confirmed attendance you took part in over the last 12 months, and the name and date of the most recent one;
• vehicle service: the nearest date from your service records if it has already passed or falls within 30 days; if you ask about a specific vehicle, also its technical details (purpose, power, torque, engine type, displacement, fuel, weight, drivetrain, transmission, rev limiter, engine hours), the last five service records (date, type of work, for the type "Jiné" (Other) also its name, mileage) with their number, and the next dates according to the records.

Without confirming the card in version 4, Wingman does not answer and we do not even load these data for it; the rest of the app works unchanged. Before the change of provider (see above), the version 2 card was enough for answers and Wingman received the data above only with the version 3 card, which anyone who had confirmed an earlier card saw once as "Co Wingman nově zná" (What Wingman now knows).

Otherwise, Wingman receives nothing about other members: not the names, profile photos or vehicles of ride participants and club members, nor a ride's organiser, meeting point (or its coordinates), ride description, invitations, notifications, posts and comments on a club wall or messages. From clubs and rides it receives only their name and destination area as entered by the club founder or ride organiser (another member), and is explicitly instructed to treat them only as names, never as instructions. It does not receive rides you merely see or are only invited to, nor clubs you have only been invited to; a ride the app does not show you (for example because of a block, section 2.12) it does not receive even if you joined it earlier. We do not send Wingman your vehicle's nickname, notes, modifications or estimated value, the notes and photos of service records, a listing's title, description, town or photos, your membership card number, or your saved (favourite) events and listings. The exception is the Forum topics described above: from them it receives text written by another member, but without that member's name, photo or account.

Other features:

• JOY Coach (circuit ride analysis, JOY+ PRO only) — the circuit name and numbers from the telemetry: lap times, best lap, achievable time, points along the track where time is lost and the speeds there, and the data source (phone / RaceBox). No identifier, date or coordinates.
• Ride planner — the name of the town of the start and destination (we do not send coordinates to the model; a geocoding service converts them to a name first — see 2.16), the chosen route type and time frame, the kind and timing of breaks, your free-text wish (up to 200 characters) and supporting data prepared by our server: in which direction and how far from the start the nearest hilly areas lie and which JOY Roads routes are within reach. If you ask for another variant, the model also receives the names of the places from the previous suggestion so that it does not repeat them. The "Nejrychlejší" (Fastest) route type does not use the model and nothing is sent to it; the route is calculated by the map service alone (section 2.16).
• Shareable ride summary (JOY+ and JOY+ PRO) — figures from a completed road ride along a plan: distance, riding time, the hour you set off, the number of corners, how twisty the route was, elevation gain, top speed and how closely you followed the plan. We do not send the model the ride score, your stops or the name of the plan. The model composes a few sentences from the figures, and we store the finished summary with the ride.

Purpose: providing a feature you invoke yourself — an advisor answer that takes into account what you have in the app, a ride analysis, a route suggestion, summary text.

Legal basis: Article 6(1)(b) GDPR — providing a feature you request yourself. You do not have to use any of these features; the rest of the app works unchanged. For the text of Forum topics written by other members, the legal basis towards their authors is Article 6(1)(f) GDPR — our legitimate interest in answering a member who explicitly asks about the Forum from what the community has written in the Forum for all signed-in members; the author may object to this (section 8).

Age: The artificial intelligence features are only for users aged 18 or over, as is the whole account (section 2.1). You confirm that you are 18 or older when you register (section 2.1) and again in the consent before using them for the first time; we do not verify age in any other way.

Retention: Wingman conversations (questions and answers) 90 days; the technical record of a model call (without content — only the feature, model, token count, cost and response time) 90 days, with the model's answer itself deleted from it after 24 hours; the number of trial requests you have used in Free (Wingman, ride planner) until you delete your account, so that the trial does not renew; a JOY Coach ride analysis and a ride summary are stored with the ride and are deleted together with it; a generated route plan is kept for 30 days unless you save it — even if you share it by link, rate it or drive a ride based on it (deleting the plan ends the shared link, a ride based on the plan stays); a saved plan until you remove it from My plans, at most until you delete your account, and you can delete any plan at any time (Delete plan on the plan screen, or by swiping it in My plans); the copy of saved plans kept on your phone for opening without a signal is deleted when you sign out, unsave or delete the plan (section 9); the record of your acceptance of the terms of Wingman, JOY Coach, the ride planner and the ride summary (which feature, which version of the terms, when you accepted them and, where applicable, when you withdrew the acceptance; by confirming the ride planner introduction you also accept the ride summary) until you delete your account — it serves to prove that you were informed about the data being passed to the provider (Art. 6(1)(f) GDPR); we do not run these features without a valid acceptance, and you can withdraw it by e-mail at info@driveandjoy.cz. So that we can tune our automatic checks, we additionally store as a usage event (section 2.9), for 90 days, model output that the check rejected, so that you never saw it (up to 400 characters), and for Wingman the question for which the model suggested adding a new guide to the app (up to 300 characters). Everything is also deleted when your account is deleted.

Decision-making: none of these features makes automated decisions about you within the meaning of Article 22 GDPR — they have no effect on your membership, pricing or access to services.

Reporting an answer. Every answer these features show you carries a "Report answer" button in the app. When you use it, we store against your account: the text of the answer (up to 2,000 characters, exactly as you saw it on screen), the question it answered (for Wingman, up to 500 characters — without it there is no way to judge whether the answer makes sense), the name of the feature and of the model, the reason you selected plus your optional note, and the time of the report. Nothing else from the conversation or from your profile is attached to the report, and the report is not sent to the model provider — it stays with us. A reported answer is seen and reviewed only by DRIVE&JOY administrators and the moderators we have appointed for this (section 2.6, Moderation actions). Conversations with Wingman that you do not report are not shown by the app or by our administration to anyone but you. Purpose: assessing a harmful output and putting it right (adjusting the model's instructions or switching the feature off). Legal basis: Article 6(1)(f) — legitimate interest in the safety of the service; reporting is voluntary. Retention: the same as for other content reports (section 5).

Thumbs up or down. For a Wingman answer, a route plan, a JOY Coach debrief and a ride summary you can give a thumbs up or down (Helpful, Not helpful) and, after a thumbs down, pick a reason from a list (for example "Too general"). We record this as a usage event linked to your account (section 2.9): which feature you rated, thumbs up or down, the reason you selected and the identifier of the model call the rating belongs to; for Wingman also what the answer was based on (the app guide, your data or general knowledge) and where in the app you asked from (for example the club or a car's detail). Neither the question nor the answer text is stored with the rating, and the rating is not sent to the model provider. Using the identifier we match the rating to the technical record of the model call for as long as that record exists (the model's answer itself stays in it for only 24 hours, see Retention above). Your phone also remembers that you rated a result, so the thumbs do not show for it again. Purpose: improving the AI features (which answers and plans help and which do not). Legal basis: Article 6(1)(f) — legitimate interest in improving the service; rating is voluntary. Retention: as for other usage events (section 2.9); the copy in PostHog under section 2.25.

2.18 Vehicle listings ("For sale")

• Data processed: details of the listed vehicle (make, model, year, mileage, technical details, roadworthiness-test (STK) due date, first registration, number of owners, origin, service book, damage — Yes, No or Not stated, modifications), the price and VAT mode, whether you sell as a private person or as a business, region and town, title, description and photographs; also the time you accepted the Listing Rules and the outcome of the listing check (who approved or rejected it, when, and for what reason). Other members see your display name, profile picture and "member since" with the listing.
• Contact details do not belong in a listing. Our server does not accept a phone number, e-mail address or link in the listing text; it checks this when you submit the listing for approval and, for a published listing, on every edit (only you can see a draft listing). Interested buyers write to you through a message in the app (section 2.12).
• Editing a published listing: until a moderator reviews the changes, we keep the last approved version of the listing (details and photos) so that we can restore it if the changes are rejected; we delete it after the decision or when the listing is deleted. Photos you remove from the listing while editing stay in storage until the decision, and after the changes are approved we delete them within two days at the latest.
• Saved listings and views: we remember which listings you have saved and, so that a view is counted at most once a day, also which listing you opened on which day. The seller sees only the total number of views and saves, not who they were.
• Purpose: publishing the listing to other members and enabling contact between seller and buyer; your listings also for Wingman's answers if you have confirmed its card in version 3 or later (section 2.17).
• Legal basis: Article 6(1)(b) GDPR — providing a feature you invoke yourself; counting views Article 6(1)(f) — legitimate interest in giving the seller an overview.
• Who can see a listing: an active or reserved listing can be seen by signed-in members in the For sale section, an active one also in the Community Overview (the New for sale rail). Web publication is preselected (switched on) when you submit the listing for review, and you can switch it off before submitting. If you have a private profile, we preselect it as switched off for a new listing and for a draft listing started from your garage. Only for a draft listing you return to that was created before 9 October 2026 may it be switched on — so check it before submitting. If you leave it switched on, the listing also has a public page on driveandjoy.cz that anyone with the link can open, even without an account (section 3.6); what the page shows is described in the Listing Rules, article 10. Later you can remove it in the app only by deleting the listing; if you write to us at info@driveandjoy.cz, we will switch it off without deleting the listing. Listing photos are in public storage — anyone who knows a photo's address can open it.
• Offering a vehicle from your garage: when you choose "Nabídnout k prodeji" (Offer for sale) on a vehicle in your garage, the app immediately starts a draft listing and copies the vehicle's photos from your garage into it, i.e. into the public listing storage, before you submit the listing. If a listing was created from a vehicle in your garage and the vehicle is visible to the community, a "Na prodej" (For sale) label with the price (for a reserved listing "Rezervováno" (Reserved)) and a link to the active listing appear on it in the community Garages, in the vehicle detail and on your profile.
• Archive of sold vehicles and the public page of a sold listing: a sold listing stays among the offers for 14 days with a "Sold" label and no price, and then moves to the archive of sold vehicles. There, signed-in members can see it with no time limit, together with your name and profile picture, the last listed price, the month of sale and how long it was offered. If the listing has a public page on the website, that page remains too, only without the price. A listing sold under version 1.0 of the Listing Rules, i.e. marked as sold before version 1.2 took effect on 9 October 2026 (version 1.1 never took effect), does not move to the archive of sold vehicles and has no public page on the website: we switch the page off at the moment of sale, and for earlier sales we switched it off afterwards. Like other sold listings, it stays among the offers for 14 days with a "Sold" label and no price (Listing Rules, article 9). We put it into the archive only if you ask us to. You can also hide a sold listing from the archive of sold vehicles yourself (in the listing detail, with Hide from archive ("Skrýt z archivu")); it cannot be returned to the archive from the app, and hiding does not switch off the listing's public page on the website, if it has one. Purpose: a history of the offers in the community — what was sold here, for how much and how quickly. Legal basis: Article 6(1)(f) GDPR — legitimate interest in a For sale section with a history. You can object to this (section 8); we comply by hiding the sale from the archive and from the website, or by deleting the listing. A sold listing can no longer be edited, but you can delete it yourself at any time.
• Retention: we keep a listing, photos included, until you delete it, at the latest until you delete your account, when it is deleted together with its photos. You can delete it at any time and in any state: it disappears from the offers, the archive and the website immediately, and we delete the photo files from storage without undue delay. A listing is never deleted automatically: an expired one disappears from the offers and from its public page and only you (and a moderator) can still see it, it can be renewed within 14 days of expiring (you receive a notification both before it expires and when it expires, section 2.13) and we keep it, photos included; a sold one stays in the archive of sold vehicles (see above); a draft stays, photos included, until you submit it. In every case only until you delete it.
• The record of a saved or viewed listing is deleted together with the listing, or when you delete your account.

2.19 Membership card and verification at a partner

• Membership number. Every account has a permanent membership number in the form DJ-1234-5678. The number is random: it reveals neither your registration order nor the date your account was created nor anything else about you. Accounts that did not have one were assigned a number on 26 October 2026; new accounts receive it when they are created. It is shown on your membership card in the app and in Apple Wallet, and we keep it until you delete your account.
• The membership card in Apple Wallet is generated on our server and contains your display name, membership tier, the date since when you have been a member, and a QR code with the identifier of your account (with your membership number below it); Apple stores it in the wallet on your device.
• Status on the card in Apple Wallet. Once we launch this feature, a card in Apple Wallet that you add from then on also shows your status level (from Hliník (aluminium), without points). The card is issued by our server, which puts on it the level others would also see: Karbon (carbon) and higher levels only once an administrator confirms them, until then Hliník (aluminium) (section 2.6, Status shown to others); anyone you show the card to sees the level. With the option "Skrýt body a sezónu" switched on and for a blocked account we do not put the level on the card. The card does not update itself: the level stays on it (even if you later switch on "Skrýt body a sezónu") until you add the card again or remove it from Apple Wallet. On Android and on a device without Apple Wallet, status is shown only on the membership card in the app.
• When redeeming a partner discount, the partner verifies that the card is valid by scanning the QR code or entering the membership number. Our service returns only the display name, profile picture (if you have one), membership number, membership tier (JOY+ or JOY+ PRO) and confirmation that the membership is valid. The picture lets the partner recognise that the card is being shown by its owner. The partner receives no other data (no e-mail, phone, garage or rides). If you do not have a valid JOY+ membership, the partner only learns that the card is not valid. If you are in the free trial of a subscription before the first payment, the partner only learns that the discount cannot be redeemed yet because a trial is running (no name or other data; Terms of Use, section 5). Only a partner for whom we have switched verification on can verify a card. The partner may also type the membership number in by hand; we limit the number of hand-entered numbers per partner per day.
• When a partner redeems a discount, we keep a record of which partner it was and when, together with your name and membership tier at that moment (at most one record per day for each partner). For every verification attempt we record which code the partner entered, with what result and from which IP address (the partner's device) — to protect against people trying out other members' numbers.
• Partner codes and vouchers. At some partners the app issues you a discount code or a voucher on request (a voucher only with an annual membership). We keep the partner's codes in a pool that only our server and DRIVE&JOY administrators can see. We issue you one code per period applicable at that partner (calendar month, year, or once), one voucher per year, and we record which code we issued to you and when, so that it is not issued twice and you can see it again in the app. We do not tell the partner whom a code belongs to; the partner sees it only when you use it there. During a free trial before the first payment we do not issue codes. 24 months after issue we remove the link between the code and your account (the code stays marked as issued).
• Enquiry to a partner. For partners with an individual offer (for example insurance or legal protection) you can send an enquiry from the app. You fill in your name, e-mail and, if you wish, phone and a message, and you expressly consent to their transfer to the partner named in the consent. Our server sends the enquiry by e-mail (via the e-mail provider in section 6) with your e-mail as the reply-to address; the partner replies to you directly and does not see your IP address. We hold the content of the enquiry only in the outgoing mail queue until it is sent; a message that cannot be delivered is deleted after 30 days at the latest. We keep only a record that it was sent (to which partner, when, for which version of the consent text and the technical message identifier) to document your consent and to limit the number of enquiries (at most 2 to one partner and 6 in total per 24 hours). During a free trial before the first payment we do not send enquiries. The partner processes the data it receives from the enquiry as an independent controller under its own policy; you can withdraw your consent, but this does not recall an enquiry already sent — please contact the partner.
• Purpose: proving membership and claiming member benefits (card verification, issuing a code or voucher, an enquiry to a partner), on the card in Apple Wallet also showing your status level; the log of attempts and the enquiry record serve to protect against abuse and to document consent.
• Legal basis: Article 6(1)(b) GDPR — performance of the membership contract (card, number, codes and vouchers, distinguishing the trial); transfer of enquiry data to the partner Article 6(1)(a) — your consent; for the log of attempts and the enquiry record Article 6(1)(f) — legitimate interest in protection against abuse and in documenting consent.
• Retention: membership number until you delete your account; redemption records for the duration of your account; records of verification attempts 90 days; the link between an issued code or voucher and your account 24 months from issue; the record of a sent enquiry 12 months.

2.20 Weather forecast

• In the app and on the website we show a weather forecast for events and circuits from the Norwegian Meteorological Institute (MET Norway). The request is sent by our server, not by your device: MET Norway receives only the coordinates of the event or circuit rounded to roughly 1 km (not your location) and does not learn your IP address or any other data about you. Our server briefly stores the forecast for a given place so that it does not ask MET Norway about the same place again.
• To protect against overload (rate limiting of requests per address per hour) we briefly store a cryptographic fingerprint of your IP address (SHA-256 with a secret server key — the readable address is not stored); we delete it within 3 days of the last request at the latest (section 5).
• The precipitation radar (for events, routes and in the co-pilot) is likewise fetched by our server, from public data of the Czech Hydrometeorological Institute; nothing about you is passed to that provider. For the radar, too, we limit the number of requests per address per hour and briefly store a fingerprint of the IP address for this, in the same way as for the forecast (see above).
• Weather for a ride recording is added by our server from ČHMÚ public data, in the same way as for the radar: ČHMÚ learns nothing about you or the ride (section 2.10).
• Purpose: displaying the weather for an event, circuit or route and at the time of a recorded ride.
• Legal basis: Article 6(1)(f) GDPR — legitimate interest in the usefulness of the service.

2.21 What we do NOT use in the app, and what is worth knowing

• We use no cookies and no advertising tracking, no advertising SDKs, and we do not share data with advertising networks or data brokers. That is why the app never asks for tracking permission (App Tracking Transparency). PostHog analytics (section 2.25) does not track you across other companies' apps and websites either. Members without a subscription see an advertising strip of our partners on the Home screen. The strip is part of the app: it is chosen from the partner catalogue by day, not by you, and we pass nothing about you to the partner.
• We use no third-party crash reporting. Technical errors (section 2.9) are stored solely in our own database. We do not send them to anyone else.
• We do use third-party usage analytics: we store usage events (section 2.9) in our own database, and for signed-in members who have not switched analytics off, the app also sends them, without free text, together with taps and usage recordings to the PostHog service (section 2.25).
• Some third-party libraries in the app send their own technical data: the Stripe payment library (see below), the Mapbox map library (section 2.16) and, on Android, the Firebase notification library (section 2.13).
• Stripe — payment library telemetry on Android: the Stripe payment library sends its own technical telemetry. In the Android app this means one request leaves your device for q.stripe.com every time you open the app — even when you are not paying, and before the app contacts our own server. It contains the app name and version, the Stripe library version and your phone model and manufacturer; Stripe sees your device IP address in the process. Stripe offers no opt-out for this telemetry. The library is in the app for payments in the merchandise shop, which we have not opened yet (section 2.15), and the telemetry will keep running until we remove the library from the Android app; event entries are not paid in the app. On iPhone the Stripe library does not start up with the app at all, so none of this happens there.
• The device fingerprint for fraud protection (Stripe Radar) is taken only when you actually pay, not when the app starts. Until 20 September 2026 the Android app also took it at every launch and stored a long-lived identifier on the phone; we have removed that.
• A link opened before signing in. A link to content (for example a ride or a club) that you open before you sign in or finish the initial setup is kept by the app on the phone for at most 7 days so that it can open it for you after you sign in; it forgets it when you sign out or sign in to a different account. The short source label from a link is a different item: the app keeps it separately and uses it for at most 30 days after the link was opened (section 2.28).
• Request for a rating on Google Play (Android app from build 149). After a recorded drive has been saved, or once you have used the app on at least three different days, the app may ask Google Play for its rating window, at most once every 90 days and never while you are signing in, in the introductory guide or while driving. Google decides whether the window is shown. Whatever you rate or write in the window goes directly to Google, which processes it as an independent controller and publishes it on Google Play under its own rules (section 6); we do not learn whether the window appeared, nor whether or how you rated the app. For this the phone only remembers the time of the last request and at most the last ten days on which you used the app (section 9).
• We do not use your data to train artificial intelligence models, and the contractual terms do not allow the model provider to do so either (section 2.17).
• The app does, however, contain third-party components loaded from their servers, which therefore receive your device's IP address: Google Fonts, the YouTube (Google) player and video thumbnails (the player loads through our page on driveandjoy.cz, so our website hosting provider Vercel also sees the IP address), the RevenueCat subscription library (in the Android app only when it offers subscriptions there), Mapbox map data, the Mapy.com logo (section 2.16) and event photos stored on other websites (section 2.24).
• Thumbnail images in the news feed are loaded directly from the servers of the individual publishers (Czech and international motoring media), which therefore receive your device's IP address and the address of the page requesting the image. The article texts themselves pass through our server — so publishers do not learn what you read in the app, but they do record that their image was requested.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a working app (fonts, the video player, news thumbnails, the Mapy.com logo, event photos and the technical messages of libraries in the app); for the subscription library also Art. 6(1)(b) — performance of a contract; for the request for a rating on Google Play Art. 6(1)(f) — legitimate interest in feedback on the app in the store.

2.22 CarPlay (controls on the car display)

• So that the app can be controlled from the car display even when it is not running on your phone at all, the app stores in your device's memory a short summary: the fact that you are signed in, your account identifier and membership tier, the vehicle you last drove and the vehicles in your garage, the catalogue of circuits, your nearest destinations (name, place, date, coordinates and the address of the photo) and the route you last selected including its stops. This data never leaves the device and access tokens are never stored in it. The personal part of the summary is deleted when you sign out; only the catalogue of circuits remains on the device, and that is a public list, not your data.
• Destination photos (events and routes) are downloaded by your device from the address stored with that event or route — usually from our own storage — and saved into the app's storage on the phone so that they appear in the car immediately. They are deleted on sign-out together with the rest of the summary.
• A ride recording started from the car display processes location data in the same way and for the same purpose as a recording started on the phone (section 2.10). It is, however, written by the native part of the app: the track points are saved to a file in the phone's memory even if you never open the app, and they are uploaded the next time you launch it. It is a working file: once the ride is complete (uploaded, or discarded), it is deleted from the phone. Section 2.10 applies otherwise.
• The car display can also start a road trip along a selected route (JOY Ride). A route you prepare for CarPlay in advance starts guidance directly in the car: for that the phone stores the prepared route (the route with its course and stops, your account identifier and membership tier), which is valid for at most 24 hours and is deleted on sign-out. For other routes the phone cannot be woken from the car: the app notes which route you chose (valid for at most 10 minutes, then it expires, and it is deleted on sign-out as well), shows a "Jízda je připravená" (Your ride is ready) notification with the route name on the phone, and starts the trip once you open the app.
• Events from the car display that occur while the app is not running on the phone wait on the device until the app sends them; on sign-out we send them under the account that is signing out, or discard them.
• While you drive, the app shows you notifications (section 2.10): the start of a route, an approaching stop, arrival at a stop, leaving the route and returning to it, completing the route, a notice that the recording or JOY Ride is ending (for example because the car has been standing for a long time), the outcome of saving the ride ("Ride saved" / "Saving failed") and a warning about a high coolant temperature (from 110 °C; the title gives the measured temperature, for example "Voda 112 °C" (Coolant 112 °C)). That last one is not derived from location but from the engine temperature reported by a connected OBD adapter (section 2.11); the others are composed from the location data we already process under section 2.10. All of these notifications are local — they are composed on your device and do not pass through our server or any push service (unlike the notifications described in section 2.13). Besides the car display they also appear on the phone whenever you do not have the app open. The arrival notification carries a button that passes the coordinates of the next stop to your chosen navigation app (see section 2.16). We record a usage event under section 2.9 when a notification is shown and when that button is used; nothing extra is passed to the navigation app because of it.
• Live figures from the ride in progress — speed, engine revolutions, lap number and the gap to your fastest lap, distance covered, coolant and oil temperature, the next stop and the distance remaining — are shown by the app in a Live Activity (each surface shows only as many of them as fit): besides the phone's lock screen, now also on the car display and in the Smart Stack of a paired Apple Watch. This is not new processing — the content is composed on your device, nothing is sent to our servers for it and we use no push service to update it. It is worth knowing, though, that these figures are visible to anyone who looks at the car display or at your watch.
• Voice announcements in the car are synthesised speech; in the car the app does not listen or record anything and does not use the microphone for this.
• In Settings → CarPlay you can turn off the voice (ride status, lap times) and the Warnings group — that is, the "Off route / Back on route" notifications and the coolant temperature warning (from 110 °C). That switch does not govern the stop notifications or the ride outcome — those are turned off in the system notification settings.
• Remote switch. If the controls on the car display caused problems in a particular build of the app, we can switch them off remotely for a while. The iPhone app therefore asks our server when it starts whether the controls on the car display are switched on, and from build 130 onwards also every time it connects to the car; the request only checks the switch setting, and apart from the hosting provider's server logs (section 5) we store nothing from it. When the controls are switched off, the car display shows only a message that they are temporarily off, and you record the ride on the phone; we record the fact that they were switched off as a usage event (section 2.9).
• Legal basis: Article 6(1)(b) GDPR — providing a feature you switch on yourself.
• Retention: the summary and the downloaded destination photos stay on the device while you remain signed in and are deleted when you sign out. Recorded track points are stored as a ride recording under section 2.10.

2.23 App updates

• We deliver fixes and new features in the app even without a new version in the App Store or Google Play. That is why, when it starts and every time it returns to the foreground, the app asks our server whether there is an update for it.
• In doing so it sends the platform (iOS / Android), the version of the app and of the installed update, the build number, the operating system version, the version of the update library, other technical details of the build (for example whether it is running in an emulator) and a random device identifier that the update library created by itself and stored on the phone (on iPhone in the Keychain, where it survives even deleting and reinstalling the app). The identifier is not linked to your account and our server does not store it; in the technical record of the check it writes only the platform, the versions, the result and the response time.
• The check runs entirely on our side (on Supabase servers); nothing is sent to the maker of the update library or to anyone else. The device downloads a new version from our storage via a link of limited validity.
• Signed updates. From build 130 onwards the app installs only an update signed with our key; it adds to the update request the identifier of the public key with which it verifies the signature (it is the same for all devices with that build and reveals nothing about you).
• Purpose: delivering fixes and new versions of the app, and rolling them out only to devices on which they will run.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure and functional operation of the app.

2.24 Events added to the app

• Any signed-in user can add an event to the event catalogue in the app: with a free account (Free) at most two per calendar month, as a JOY+ or JOY+ PRO member without a monthly limit. We store what you fill in on the form: the name, description, start and end, the place and its coordinates (found by place search, section 2.16), region, the type of event and of vehicles, a link to the event's website and a link to its photo. We also store with the event that your account added it and when (we use this to apply the monthly limit), and the outcome of the review (who approved or rejected it, when, and for what reason).
• An administrator reviews the event before it is published. You can see the status of your events and the reason for any rejection under Moje akce → Přidané (My events → Added); you can edit a rejected event and submit it again.
• An approved event is public: all users of the app can see it, its details are accessible without signing in, and anyone can share it via a link to its page on driveandjoy.cz. We do not display your name or profile with the event. Signed-in members can, however, find out the identifier of your account from the event, and from it your display name and profile picture.
• The event photo is downloaded, from the address you gave, by the device of everyone to whom the event is shown in the app or on its page on the website; the operator of the website hosting the photo therefore sees the IP address of their device (sections 2.21 and 9).
• Purpose: an event catalogue for the community. Legal basis: Art. 6(1)(b) GDPR — providing a feature you invoke yourself; keeping the event in the catalogue after account deletion Art. 6(1)(f) — the legitimate interest of other members in a complete event catalogue. You may object to this (section 8).
• Retention: we keep the event in the event catalogue until we delete it; a rejected or not yet approved event stays only with us. You cannot delete it yourself in the app; if you write to us at info@driveandjoy.cz, we will delete it or remove from it whatever you do not want there. When you delete your account, your events remain, only their link to your account is removed.
• Events from organisers' public calendars. Our server also proposes events for the catalogue itself: once a week it downloads the public calendars and event pages from the websites of organisers, circuits and motorsport associations and stores the event's name, date, place and type, a link to the source and the name of the organiser as the source gives it — the organiser may also be a natural person. Our server sends the public text about the event, including the organiser's name but without e-mail addresses, telephone numbers and lines naming a contact person, to the GPT language model (OpenAI, section 2.17), which writes a short description of the event from it. The event and its organiser appear in the app only after an administrator approves the event. Source: publicly accessible websites of organisers, circuits and associations. Purpose: a complete catalogue of public events for the community. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in informing the community about public events. You may object to this (section 8). Retention: we keep the event and its organiser in the catalogue until we delete them; the record of the calendar item from which the event was created (the event details as the source gave them) is kept even for a rejected or deleted event, so that the server does not create it again.

2.25 Usage analytics and recordings (PostHog)

• To learn which parts of the app members use, where they get stuck and what to improve, the app sends usage data to the PostHog service (PostHog, Inc., USA), specifically to its European part PostHog EU Cloud: the data is stored in the EU (Amazon Web Services, Germany). PostHog acts as our processor (section 6).
• This applies only to signed-in members. Without signing in, the app sends nothing to PostHog.
• What is sent: your account identifier (a random string of characters; we do not attach your e-mail, name or phone number to it in PostHog, although your name and other details shown on screen may appear in a recording or in the text of a tap), the platform (iOS / Android), the app version, a flag for accounts of the DRIVE&JOY team and whether this is live operation or testing; which screens you open; taps on controls and form submissions — the type of control, the screen, the position of the tap on the screen, the text of the element you tapped (for example a button label or the name of an event or route on a card; if the element contains a member's name, that is sent too), its label for screen readers, its title, the in-app link and other technical attributes of the element (for example its identifier) and, for some controls, their fixed label (for example the items of the bottom bar). On the messages and chat screens, for notices about a personal message, in conversations with Wingman, in the checkout and on the heart rate card, a tap sends only the type of control and its position — without text, labels or links. What you type into form fields is not sent with taps; repeated rapid taps on the same spot and taps the app did not respond to; usage events under section 2.9, of their details only numbers, yes/no values and short codes, no free text; and data on how fast the app loads and responds (Web Vitals). The PostHog library itself adds technical data about the device: the operating system and its version, the device model and type, the identifier of the browser inside the app (user-agent), the language, the time zone, the screen dimensions and a random session identifier.
• Usage recordings: the app may also make a recording of how you move around it (screens, scrolling, taps), from which a pass through the app can be replayed. In the recording the text on screen is visible — the app's labels and the content shown (for example the names of events, routes and listings, members' names and details in profiles, clubs and lists of people, posts, comments and polls on a club wall, car details including the VIN in the car form) — as is what you type into form fields. Masked are passwords, e-mail and phone fields, your e-mail address in Settings and in your Profile, notices and rows in the notification overview about personal messages (text and labels), and image addresses; photos (including background images), videos, maps and drawing surfaces (canvas) are replaced by a blank area. The sign-in and password screens, messages and chats, event moderation (it contains reported messages), the JOY Ride screen and the ride detail (with the heart rate card, section 2.27) are not recorded at all — recording stops on them, and if one of them stays open underneath another screen, it appears in the recording only as a blank area; conversations with Wingman, the checkout and the heart rate card appear in the recording only as a blank area. Never while driving: during a ride recording and during a road trip along a route (JOY Ride) nothing is sent to PostHog — neither recordings nor events. The app's console output and network requests are not recorded.
• Who sends it: the data is sent to PostHog directly by your device, not by our server. PostHog therefore sees your device's IP address during the transfer; under our project settings it discards it, does not store it and does not derive even an approximate location from it.
• The PostHog library stores no cookies and no identifier on your phone; it keeps the account identifier and the session identifier only in memory while the app is running.
• PostHog's artificial intelligence features and the use of our data for training artificial intelligence are switched off in PostHog.
• PostHog's sub-processors for PostHog EU Cloud (according to PostHog's list updated on 12 June 2026): Amazon Web Services (data storage, Germany), Wiz (security, Germany and France), PlanetScale (database monitoring, Germany), Modal Labs (computing, Germany) and Cloudflare (network data transfer, worldwide).
• Switching it off (objection): analytics runs without asking for consent, on the basis of our legitimate interest (below). You can switch it off at any time with the Nastavení › Soukromí › "Pomáhat zlepšovat appku" (Settings › Privacy › "Help improve the app") switch — by doing so you object (section 8). The switch is on by default. Switching it off applies to your account on all devices: on the device where you switch it off, PostHog stops immediately; on your other devices, the next time the app starts. Technical monitoring under section 2.9 continues. We store your choice and when you last changed it with your account.
• Purpose: learning how the app is used, where members get stuck and what to improve in it.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving the app. You may object to this at any time with the switch above or by e-mail (section 8).
• Retention: events in PostHog 1 year, recordings 30 days; your switch choice until you delete your account. When you delete your account, we delete you in PostHog together with your events and recordings (PostHog deletes them in the background, usually within a few days). If this does not succeed straight away, we record it among the unfinished clean-up steps and complete the deletion manually (section 2.9).
• Recipients: PostHog (processor) and its sub-processors listed above (sections 6 and 7).

2.26 My trips (JOY+ and JOY+ PRO)

• In My trips ("Moje cesty" in the app) you can put together collections of routes and multi-day trips. We store with your account the trip's name and note and, for each day, its name, start, destination and overnight stay (free text you write yourself, for example an address) and its stages (links to JOY Roads routes or to your saved route plans, each with its own note). We keep only the latest version of a trip, with its version number and the time of the last change.
• Only you can see a trip. We do not pass it to other members, partners or the artificial intelligence features.
• Technical receipts. Each save and deletion creates a receipt without the trip's content (the identifiers of the request and the trip, a fingerprint of the request and the version number, for a deletion only a deletion mark instead of the version number), so that a request sent again, for example after a loss of signal, is not written twice. For an existing trip we keep only the receipt of the latest save. Deleting a trip removes the trip and all its receipts; only the deletion receipt remains (the trip identifier and a fingerprint of the request, without content), so that a delayed older request cannot bring the deleted trip back.
• A trip you are drafting stays only on your phone until you save or discard it (section 9); it is deleted when you sign out.
• Purpose: planning your own trips.
• Legal basis: Art. 6(1)(b) GDPR — providing a feature you invoke yourself.
• Retention: a trip until you delete it or your account, the deletion receipt until you delete your account (section 5). A deleted trip may remain in the database backups for some time (at most 30 days, section 5, Backups).
• Recipients: Supabase (database), GitHub (database backups, section 5).

2.27 Heart rate from the Health app and from Health Connect

• What the app reads. On iPhone from the Health app and on Android from Health Connect (builds 141–146; from build 147 reading heart rate on Android is temporarily switched off), the app reads only your heart rate during your drive: the value, the time of the measurement and the name of the source (for example Apple Watch, Oura or Samsung Health) and, where available, the device model. It reads no other health data and writes nothing to Health or Health Connect. Heart rate gets there from a watch, ring or band that you connect to them yourself. Health Connect lets the app read heart rate from at most 30 days before you allowed access.
• Consent. We read and store heart rate only on the basis of your explicit consent: you give it with the button "Propojit se Zdravím" (Connect to Health; on Android "Propojit s Health Connect") in the Heart rate card in the drive detail, which describes what happens with your heart rate, and in the iOS or Health Connect system prompt in which you allow reading heart rate. If you connected the app before storing was introduced (Privacy Policy 1.56), your heart rate is not stored until you choose "Ukládat tep k jízdám" (Store heart rate with drives) in the card. We keep the record of your consent (when, in which version of the text, from which platform and, if applicable, when you withdrew it) until you delete your account, so that we can demonstrate the consent.
• What we store. With your drive we store the heart rate of the main source: the name of the source, the individual measurements as time from the start of the drive (at most 20,000) and the average, maximum and minimum. Only you see the stored heart rate, also on another device; other members and the DRIVE&JOY team do not see it in the app or in the admin.
• JOY Coach. When you let JOY Coach analyse a drive on a circuit (JOY+ PRO, section 2.17), our server passes your stored heart rate to the GPT (OpenAI) language model together with the facts about the drive: the average, maximum and minimum, heart rate per lap and the course of your heart rate (at most 1,200 measurements). The analysis may mention heart rate; it does not assess heart rate as health data, and we do not show an analysis containing a health assessment. We do not send the name of the source to the model. We store an analysis with heart rate with the drive like other analyses; we do not pass it to Wingman. Under its terms, OpenAI does not use data sent through its API to train models; it keeps them in its logs for detecting abuse for at most 30 days and may process them in the USA and in other countries, also outside the European Economic Area (sections 2.17 and 7). If you gave consent in the wording that named the Gemini model (Privacy Policy 1.58 and earlier), JOY Coach will not pass on your heart rate until you confirm the new wording in the Heart rate card.
• Sharing. Heart rate gets onto the drive image for sharing only if you switch on "Přidat tep do obrázku" (Add heart rate to the image) when sharing (average and maximum; anyone you send the image to will see them). Otherwise heart rate does not get into a shared drive, a leaderboard, a link to the drive or the website.
• Withdrawal. Choose "Neukládat tep" (Do not store heart rate) in the Heart rate card: we delete the stored heart rate from all your drives and the JOY Coach analyses that used it, and heart rate is then only read on your phone as before. You can stop reading heart rate entirely in the Health app (profile › Apps › DRIVE&JOY) or in Health Connect (App permissions › DRIVE&JOY).
• Purpose: showing your heart rate with your drive and including it in the JOY Coach analysis of the drive.
• Legal basis: heart rate is data concerning health (Art. 9 GDPR); we process it only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time without affecting earlier processing. Record of consent: Art. 6(1)(c) GDPR (demonstrating consent, Art. 7(1) GDPR).
• Retention: the stored heart rate stays with the drive — if you delete the drive, the heart rate is deleted too; otherwise until you withdraw consent or delete your account. An analysis with heart rate until you withdraw consent, delete the drive or delete your account. Deleted heart rate may remain in database backups for at most 30 days (section 5, Backups).
• Recipients: Supabase (database), OpenAI (GPT model, only for the JOY Coach analysis), GitHub (database backups, section 5).

2.28 Where you heard about us

• So that we know how people find us (flyers, events, recommendations, social media, shared links), we store a source with your account. It is always only a short code, never free text: our server stores only labels that we ourselves use in links, flyers and in the question (for example "letak", "akce", "ig" or "sdileni-akce"), and stores any other as "jine" (other). The source can come from three places, and for each of them the first entry applies; a later one does not overwrite it.
• The question on Home. The app asks you once on Home "Odkud o nás víš?" (How do you know about us?), at the earliest at the second launch after you finish the introductory guide and never while driving. You answer by tapping one of the options offered (a flyer, an event, a friend, social media, e-mail, or other); answering is voluntary and you can choose "Nechci říkat" (I'd rather not say). We store the code of the chosen option, including "Nechci říkat", so that the question does not appear again, not even on another phone. If the answer cannot be sent straight away, it waits on the phone until the next launch (section 9).
• Source from a link. If you open the app with a link to our content (for example an event, a ride, a club, a route or a listing) that carries a short source label (the "z" or "utm_source" parameter in the address, for example from a flyer or from sharing in the app), the app keeps the first such label on the phone, even before you sign in, and uses it for at most 30 days after the link was opened. If you then create an account, it stores the label with it; for an account that already existed before the link was opened, it discards it. We do not store the code, the address or the identifier of the content from the link with your account.
• Source of an installation from Google Play (Android app from build 149 only). Links to Google Play from our website, flyers and messages carry a short source label (section 3.4), and Google Play makes it available to the app after installation (Install Referrer). After you sign in, the app asks the Play Store service directly on the phone for it (once per installation); the app itself sends nothing over the network for this. From the answer it takes only the source label (utm_source; for an ordinary installation from the store this is usually the label of Google Play itself) and sends it to our server, which stores it with your account. We neither store nor send anywhere the full answer, the times of the click and of the installation, or any other campaign details.
• Shared links. A link to our website that you share from the app carries a label of the kind of content (for example "z=sdileni-akce"), without any data about you. If someone opens it in the app, it is used as a source from a link (above); on the website, Vercel Web Analytics may record it as part of the page address (section 3.4).
• Who sees the source. Other members do not see your source. The app reads only your own records, so that it knows you have already answered the question. DRIVE&JOY administrators only get aggregate counts per source from them, without member identifiers and without the DRIVE&JOY team accounts. The source is sent to our server by your device; we do not pass it on to anyone else.
• Purpose: finding out how members find us and focusing our promotion accordingly (flyers, events, sharing).
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in knowing how people find us; answering the question is voluntary. You may object to this (section 8).
• Retention: the source with your account until account deletion, when it is deleted together with the account; the source from a link is used on the phone for at most 30 days after the link was opened, and an unsent answer to the question waits on the phone until it is sent (sections 5 and 9).
• Recipients: Supabase (database), GitHub (database backups, section 5).

2.29 News by e-mail

• We send news by e-mail only to those who ask for it in the app themselves: by ticking the optional "Chci novinky e-mailem" (I want news by e-mail) box in the first step of the introductory guide, by tapping "Chci novinky" (I want news) on a one-off card on Home (the app shows it only to those who have not answered the question yet, and never while driving), or with the Nastavení › Notifikace › Novinky e-mailem (Settings › Notifications › News by e-mail) switch. The box is not pre-ticked, neither registration nor use of the app depends on it, and agreeing to the Terms does not replace it.
• What we send: invitations to events, new routes and app features, and offers of the JOY+ and JOY+ PRO memberships, to the e-mail address of your account. We choose the offer according to the membership you have: we leave out an offer of a membership you already have, and JOY+ PRO members receive no membership offer. Partner offers are not part of this consent and we do not pass your address on to partners.
• Data processed: your account e-mail address; your membership level (Free, JOY+, JOY+ PRO), which we use to choose the offer in the e-mail; whether the consent is valid, the version of the text you consented to and the time it was given; which version of the question you have already answered (yes or no), so that the app does not ask again; a log of events (consent given, withdrawn, declined) with the time, the text version and the place where you answered (introductory guide, Home card, Settings, the unsubscribe link in an e-mail). Your device sends an answer given in the app to our server. We record an unticked box in the introductory guide as a refusal only if it was on the screen for at least a second; otherwise the Home card asks you later.
• Withdrawal is as easy as giving consent: with the switch in Nastavení › Notifikace, or with the unsubscribe link carried by every news e-mail (section 3.10). Unsubscribing through the link withdraws the consent and we record it in the event log; the switch then shows off. If you turn the switch on again, you give a new consent and this also cancels the unsubscribe made through the link, which applies to the whole address: the other e-mails you unsubscribed from with that link may then reach you again (section 3.10). Turning the switch on does not re-subscribe an address from which e-mails bounce as undeliverable or whose owner marked our message as spam, and the app tells you so next to the switch; you can still withdraw the consent with the switch.
• News e-mails are sent by our server through Amazon SES (Resend as a fallback) and recorded in the log of sent e-mails (section 3.10). The provider receives your e-mail address and the content of the e-mail. We do not send news to an address on the suppression list (section 3.10), to an unconfirmed address or to the address of a deleted account.
• News by e-mail is separate: it is not connected to the consent to tips and reminders in notifications (section 2.13) or to the app updates you requested on the website (section 3.3).
• Purpose: sending DRIVE&JOY news by e-mail; the consent status and the event log as proof of when, and to which text, you gave or withdrew consent.
• Legal basis: Art. 6(1)(a) GDPR — consent (sending commercial communications under Section 7 of Act No. 480/2004 Coll.); the consent status and the event log Art. 6(1)(c) — demonstrating consent (Art. 7(1) GDPR). You may withdraw your consent at any time (see section 8); withdrawal does not affect the lawfulness of processing before the withdrawal.
• Retention: the consent status and the event log until account deletion, when they are deleted together with the account. After withdrawal we keep only the fact that the consent is not valid and the event log, so that we do not send you news by mistake and can show what you chose and when.
• Recipients: Supabase (database), Amazon Web Services (Amazon SES: sending e-mails; Resend as a fallback), GitHub (database backups, section 5).

3. What data we process on the driveandjoy.cz website and when organising events

On the public driveandjoy.cz website and when organising events we process personal data in the following situations: data you submit yourself through forms (3.1–3.3), visitor statistics (3.4), website technical error logging (3.5), content that app members choose to share (3.6), the survey completed at exhibitions and events (3.7), contact records and event payments (3.8), business contacts (3.9), sent e-mails and unsubscribing (3.10) and event photos and videos on our social networks (Instagram, Facebook, TikTok, YouTube), including the photo library from which we prepare posts (3.11). The website does not require a user account.

The details a form requires (it tells you when they are missing) are needed to handle your enquiry or registration; the rest are optional. No law requires you to provide your data.

3.1 Contact form

• Data processed: name, e-mail address, phone number (optional), Instagram username (optional), the content of your message.
• Purpose: receiving and handling your enquiry or request and any follow-up communication with you.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest (to respond to the enquiry and manage communication). If the enquiry is aimed at concluding a contract, Art. 6(1)(b) applies — steps taken prior to entering into a contract.
• Retention: we keep the message with your entry in our contact records for as long as that entry, i.e. 5 years from your last contact with us (section 3.8).
• Your message creates or updates your entry in our contact records (section 3.8).
• To protect the form against abuse (rate limiting of submissions per hour) we briefly store a cryptographic fingerprint of your IP address and e-mail address (SHA-256 with a secret server key — the readable address is not stored); we delete it within 3 days of the last submission at the latest (section 5).
• Recipients: Supabase (storing the message in the database), Amazon Web Services (Amazon SES: sending the e-mail with the message content to our address and a confirmation of receipt to yours; Resend as a backup), WEDOS (our mailbox, where the message arrives), Vercel (website hosting and delivery), GitHub (database backups, section 5).

3.2 Event registration

• Data processed: name, e-mail address, phone number, for a crew registration the name of the second person, vehicle details (make, model, year of manufacture, power, registration plate / licence plate, modifications), the selected event option, for some events a selected add-on, T-shirt or hoodie size and favourite number, number of people, information about your experience, a note, and confirmation of consent to the processing of personal data (GDPR acknowledgement).
• The name of the second crew member is provided to us by the person submitting the registration. We ask them to make that person aware of this policy.
• Events with registration linked to the app. For a DRIVE&JOY event with a limited number of places whose registration on the website is linked to the app (usually an event with priority registration, for which JOY+ and JOY+ PRO members can register earlier — Terms of Use, section 5), we also record the time and order in which the registration was accepted and its status (accepted, confirmed, waiting list, cancelled, where applicable with the reason for the change). Places are allocated in the order in which registrations reach our server, for a registration without an account in the order of confirmation (see Confirmation by e-mail below). Until the registration is sent, the browser keeps the details you have filled in in the session storage of that tab (sessionStorage), so that after a page reload or a connection failure the registration can be sent again without creating a second one; after a successful submission it deletes them, otherwise they disappear when the tab is closed.
• Confirmation by e-mail. A registration for such an event that you do not open from the app (not linked to an account) has to be confirmed with a link we send you by e-mail after it is submitted; the link is valid for 24 hours. Until it is confirmed, the registration does not take up a place, the organiser does not see it, it does not create an entry in our contact records and no copy is sent to our address: we keep the details from the form separately from accepted registrations. The place is allocated at the moment of confirmation, in the order of confirmed registrations. We do not store the link itself, only its cryptographic hash. We delete an unconfirmed registration no later than one hour after the time limit expires, i.e. within 25 hours of submission. After confirmation only a record of the confirmation remains (the hash of the link, the time of confirmation and the link to the registration, without the details from the form), which we delete 7 days after confirmation. Opening the link does not confirm anything by itself: the registration is confirmed only by tapping the button on the page the link leads to, and the confirmation is sent by your device (browser) directly to our server. The page removes the code from the link from the address right after opening and keeps it in the session storage of that tab (sessionStorage) until confirmation; it disappears when the tab is closed. You receive the e-mail with the link even if you have unsubscribed from our e-mails before (section 3.10). If you receive such an e-mail although you did not register, simply ignore it.
• Registration opened from the app. When you open the registration for such an event with the button in the app, we link it to your account: we store with it the identifier of your account, your membership tier at the moment it was accepted and the phase in which it arrived (priority for members, or registration open to everyone). For this the app issues a one-time verification link valid for 60 minutes. We do not store the link itself, only its cryptographic hash together with the account and event it was issued for, when it was issued and until when it is valid, when it was used and which registration it belongs to; we delete this record within 8 days. The browser keeps the verification link until the registration is sent, in the same way as the details filled in. The form is sent by your device (the browser opened from the app) directly to our server.
• Purpose: processing your registration for a specific event, preparing the attendee list, event-related communication and sending a registration confirmation; for an event with registration linked to the app also allocating places in order and showing the status of the registration in the app, and for priority registration verifying the entitlement to priority; for a registration without an account also verifying that it was sent by the owner of the e-mail address and protecting places against fake registrations.
• Legal basis: Art. 6(1)(b) GDPR — performance of the participation contract, or steps taken prior to entering into a contract at your request. Your confirmation serves as evidence that you were informed of the processing terms. Verifying a registration without an account with a link sent by e-mail and protecting places against fake registrations: Art. 6(1)(f) GDPR — legitimate interest in allocating places fairly (this also covers an address entered in the form by someone else).
• Retention: we keep the registration with your entry in our contact records for as long as that entry, i.e. 5 years from your last contact with us (section 3.8); data with accounting or tax relevance for the period set by statutory time limits (see Section 5).
• Your registration creates or updates your entry in our contact records (section 3.8); a registration awaiting confirmation by e-mail only after it is confirmed.
• To protect the form against abuse (rate limiting of registrations per hour) we briefly store a cryptographic fingerprint of your IP address and e-mail address (SHA-256 with a secret server key — the readable address is not stored), and for a registration opened from the app a fingerprint of your account identifier instead of the e-mail address, if the account can be verified; we delete it within 3 days of the last submission at the latest (section 5).
• Recipients: Supabase (database), Amazon Web Services (Amazon SES: e-mail with the link to confirm the registration, confirmation e-mail and a copy of the registration to our address; Resend as a backup), WEDOS (our mailbox, where the copy of the registration arrives), Vercel (website hosting), GitHub (database backups, section 5), and where relevant the organiser of the specific event (to the extent necessary for the attendee list).

3.3 Mobile app updates (beta invitation, release announcement)

• Data processed: e-mail address; the wording and time of the consent given; a cryptographic fingerprint of your IP address (SHA-256 with a secret server key — the readable IP address is not stored); a truncated browser identifier (user-agent); a single-use confirmation link and the time your e-mail address was confirmed (double opt-in).
• Purpose: sending information about the DRIVE&JOY mobile app by e-mail — beta invitation, release announcement and app news. The IP fingerprint, browser identifier and the wording and time of consent serve as evidence that consent was given (Section 7 of Czech Act No. 480/2004 Coll.) and to protect the form against abuse (rate limiting).
• Legal basis: Art. 6(1)(a) GDPR — consent given by ticking the box in the form and confirmed by tapping "Potvrdit e-mail" (Confirm e-mail) on the page the link in the e-mail opens. Opening the link alone (for example by an e-mail security filter) does not confirm consent; the confirmation is sent by your browser directly to our server. The page removes the code from the link from the address right after opening and keeps it in the session storage of that tab (sessionStorage) until confirmation; it disappears when the tab is closed. Without confirmation we send you no further e-mails. You may withdraw consent at any time (see Section 8); withdrawal does not affect the lawfulness of processing before withdrawal.
• Retention: until you withdraw consent or until we stop sending app updates. We send no further e-mails to unconfirmed addresses (not confirmed on the page). The confirmation link is valid for 7 days. We do not yet delete an unconfirmed request (the address with the wording and time of consent, the IP address hash and the browser identifier) automatically: it remains until we stop sending app updates, and at your request we delete it sooner (section 8). We deleted the requests submitted through the form on 1 November 2026; they may remain in the database backups for at most 30 days (section 5, Backups).
• Since the app's release in the App Store and Google Play, the form is no longer offered on the website. You can switch on news by e-mail in the app (section 2.29). We no longer send app updates to addresses from earlier requests.
• Recipients: Supabase (database), Amazon Web Services (Amazon SES: sending e-mails; Resend as a backup), Vercel (website hosting), GitHub (database backups, section 5).

3.4 Visitor statistics (cookieless analytics)

• To measure traffic we use our own tool that uses no cookies or other identifiers stored on your device and performs no cross-site tracking.
• Data processed: the page visited (URL), device type, the source of the visit (referrer) and the time of the visit. Your IP address and browser identifier (user-agent) are not stored in a readable form — a cryptographic fingerprint is derived from them (SHA-256). The fingerprint is computed with a daily salt and a secret server key; without the secret key the fingerprint cannot be linked back to the visitor. This visit fingerprint is used only to roughly distinguish visits within a single day. To protect against flooding (rate limiting of page views from one address per hour) we additionally store a separate, short-lived fingerprint of your IP address (SHA-256 with a secret server key, without the daily salt); we delete it within 3 days of the last page view at the latest (section 5). An automatic filter excludes access by bots and search engines.
• Purpose: visitor statistics and improving the website's content and performance.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring the website's performance and security. Because no cookies or personal identifiers are stored on your device, this tool does not need consent from the consent banner.
• Retention: individual visit records (including the fingerprint) for 180 days from the visit, after which we delete them. Summary figures (for example the number of visits per day) from which an individual visit cannot be identified may be kept longer.
• Alongside our own tool, the website runs Vercel Web Analytics and Vercel Speed Insights provided by our hosting provider. Neither uses cookies and neither stores anything on your device. Web Analytics records the page address (including selected address parameters), the source of the visit, the country, region and city derived from your IP address, the device type, the operating system and the browser. On the app download page and for links to the app stores, it also records two custom events: a view of the download page with a short label of where the link came from (for example, a flyer or the website header), and a click on a link to the App Store or Google Play with the platform and the same label. Links to the App Store and Google Play, as well as the “Get” banner that Safari on iPhone shows above the page, carry the same label; Apple and Google show us only aggregate numbers of visits and downloads by that label. For an installation from Google Play, the Android app additionally reads it after you sign in and stores it with your account (section 2.28). It tells individual visitors apart by a fingerprint that Vercel creates from the incoming request (which carries, among other things, your IP address and browser identifier) and that ceases to exist after 24 hours; the stored records are then no longer linked to any particular visitor. Speed Insights measures how quickly pages load and respond to input, and attaches the page address, connection speed, device type, operating system, browser and country to the measurement. For links to a ride, a club, a route plan and a shared ride recording, we send both tools an address in which the code is replaced with placeholder characters, and we omit address parameters that carry secrets. We send them nothing from the pages of the web administration (/admin).
• Recipients: Supabase (storing the visit records), Vercel (website hosting, Vercel Web Analytics and Vercel Speed Insights), GitHub (database backups, section 5).
• Only with your consent from the consent banner do we additionally measure with Microsoft Clarity, which does use cookies (section 3.12).

3.5 Website technical error logging

• If a technical error occurs while the website is displayed or while a form is being submitted, we record the error message text, a technical trace (stack trace), the page address and the website version. For a form we only record that the submission failed and the technical error code (for an event registration also the event identifier) — never the content of the form.
• So that we can tell how many errors affected a single visit, we attach a random visit identifier. It is generated at random when the page loads, is not derived from any information about you, is not stored on your device and ceases to exist when you close or reload the page.
• We also attach a flag indicating whether the access was most likely automated (a search engine robot or an automated browser). Your browser determines it from its own identifier (user-agent); the browser identifier itself is not sent.
• The record contains no name, e-mail address or other direct identifier of the visitor.
• Purpose: detecting and fixing technical defects and ensuring the website works properly.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the functionality and security of the website.
• Retention: 90 days.
• Recipients: Supabase (storing the records), GitHub (database backups, section 5).

3.6 App members' content published on the website

• App members can choose to share certain content via a link; an event a member added to the app is always public once approved (section 2.24). Such a link is then publicly accessible without signing in, and the content is displayed on driveandjoy.cz. For a listing, web publication is preselected when it is submitted and the member can switch it off before submitting; for a private profile we preselect it as switched off for a new listing and for a draft listing started from the garage (section 2.18).
• What can be shared: a ride record (summary and route map), a vehicle listing (including the details the member entered), a route plan, a community ride and a community club — always to the extent the member configures in the app, for a ride and a club to the extent below. An approved event that a member added to the app can be shared via a link by anyone (section 2.24).
• The data displayed may include the member's name or nickname, photographs and vehicle details, and for a listing also the profile picture and since when the person has been a member. For a road ride (the link on the website and the share card in the app) and for a route plan, the map leaves out a circle with a radius of 750 to 950 metres around the start and around the destination (exceptionally up to 1,250 metres), including a later return into it, and shows only the longest continuous part of the route outside it. The centre of the circle is shifted from the start in a direction known only to our server (usually by 150 to 250 metres, always by at least 60 metres), and the start and the destination always lie at least 400 metres inside it. We store the circle with your account when a shared ride or plan is first displayed, or when you create a ride share card in the app — even for a private ride you end up not sending to anyone; later shared rides and plans from around the same place (including a trip that ends there) then usually get the same circle. A stored circle never changes and is deleted when you delete your account. The app draws the ride share card only from the route our server sends it after trimming; if the server does not send it, the card has no map. For a plan, places within 2 km of the start and the end are not shown either, nor, for a trip to a destination, the name of the destination; where a plan follows a JOY Roads route for members (even if the planner did not choose it on purpose), the map leaves out that route's section and neither its name nor places on it are shown. A link to a JOY Roads route is not shown either if the route starts or ends within 5 km of the plan's start or destination. The trimming thus hides the exact location of the start and the destination; the approximate area (on the order of hundreds of metres, more precisely from many shares from the same place) can, however, be estimated from the map and knowledge of the roads, and we cannot rule that out completely. For a session on a recognised circuit (the link on the website and the share card in the app), the map shows only the circuit area — a circle around the circuit within which the app recognises it (depending on the circuit, a radius of 600 metres to 3.6 km from its centre) — and leaves out the trip to and from the circuit. The circuit is a public place, so at most the map shows which way you entered and left the area. The ride summary (when it started and ended, duration and distance) is calculated from the whole ride, including the trip to the circuit. The highest speed is not shown at all for a road ride, and for a session on a circuit (the link on the website and the share card in the app) only from the part of the ride within the circuit area; if no point of the ride is within the area, it is not shown there either. The average speed of a session on a circuit is likewise calculated only from the part of the ride within the circuit area; for a road ride, from the whole ride. The point-by-point course of the ride (for the "ghost" in the leaderboard, section 2.10) is available only to signed-in members in the app, never to a visitor of the link who is not signed in.
• The ride page (driveandjoy.cz/v/…) shows the name, the day and time of the start and end, the type and pace, the region (chosen as the destination area, or the region of a linked JOY Roads route), the car limit and the number of free places, whether the organiser approves participants, and the organiser's first name (the first word of their display name; it does not show the rest of the name or a photo); it does not show the meeting point, the description, the route or the participants. The link stops working when the ride ends or is cancelled, when we block or someone deletes the account of the organiser or of the person who created the link, and a participant's link also when the organiser switches a public ride to a club or private ride.
• The club page (driveandjoy.cz/k/…) shows the name, focus, number of members and the club's cover photo, for a public club also its type; it does not show the description, the founder, the members, announcements or the chat. The link stops working when the club ends or is hidden by the administration, when a public club is switched to private, when we block or someone deletes the account of the founder or of the person who created the link, and for an invitation to a private club after 7 days or when the person who created it stops being an administrator of the club.
• To protect shared content against overload (rate limiting of requests per address per hour) we briefly store a cryptographic fingerprint of your IP address (SHA-256 with a secret server key — the readable address is not stored) in the public server functions from which the website and the app load shared content (a community ride, a club, a ride record including the course of the ride for the "ghost", a route plan, a listing, an event and a JOY Roads route); we delete it within 3 days of the last request at the latest (section 5). A link preview of a community ride or club fetched by a messaging app (for example in an SMS) is loaded by our website; so that the limit is counted for each visitor separately, the website passes the visitor's IP address to the server function with a signature made with our secret key, valid for 2 minutes.
• Purpose: allowing members to share app content outside the app and to invite people outside the app to rides and clubs.
• Legal basis: Article 6(1)(b) GDPR — providing a feature the member invokes; for the page of a sold listing Article 6(1)(f) (section 2.18). Ride and club details on the page of a link sent by a member other than the organiser or founder (including the organiser's first name): Article 6(1)(f) — legitimate interest of members in inviting people outside the app to rides and clubs and of the invitee in knowing who is organising the ride; you may object to this (section 8). The IP address fingerprint for rate limiting: Article 6(1)(f) — legitimate interest in protecting the pages against overload and abuse. Sharing can be revoked in the app at any time, which disables the link. For a route plan the link also stops working when, after confirming, you choose another variant of the route — one link must not show two different routes. A ride or club link cannot be revoked; it stops working in the cases described above. Listings are the exception: once submitted, the member can remove a listing's public page in the app only by deleting the listing, we switch it off without deletion on request by e-mail, the page of an expired listing stops working by itself, and for a listing sold under version 1.0 of the Listing Rules we switch it off at the moment of sale (section 2.18). Sharing an event added to the app cannot be revoked: its page ends only when the event is deleted, which you can ask us to do by e-mail (section 2.24).
• Once sharing is revoked or the content deleted (for a listing also once its public page is switched off), the linked page stops showing the content straight away; an expired listing stops being shown by the following day at the latest, because we process expiry once a day. The link preview card for a listing, a route plan, an event, a ride or a club (title, description and first image, as shown for example by messaging apps) may, however, still be served from our website's cache for up to 5 minutes.
• Recipients: Vercel (website hosting and delivery), Supabase (database), Mapbox (map background for a shared ride record and route plan), operators of websites hosting event photos (for an event added to the app, section 2.24), GitHub (database backups, section 5).

3.7 Survey at exhibitions and events

• At exhibitions and events you could fill in our survey about what you expect from a motoring community and from the DRIVE&JOY app.
• Data processed: your answers to the survey questions (for example which cars you own, how often you drive, what interests you, how you look for events today, which partner benefits you would value, how much you spend on your motoring hobby per year, and what price and payment method you would choose for a membership), an optional comment, region and age band; also your contact details if you provided them (name, e-mail address, phone number), whether you gave consent, the event at which you completed the survey, and the time of completion.
• Purpose: contact details — sending an invitation to the app and news, to which you consented; answers — understanding what you expect from the community and the app, and deciding what we build. We evaluate the answers mainly in aggregate.
• Legal basis: contact details — Art. 6(1)(a) GDPR, consent to the processing of your contact details for sending an invitation to the app and news, given by ticking a box in the survey. You may withdraw consent at any time (see Section 8); withdrawal does not affect the lawfulness of processing before withdrawal. Answers — Art. 6(1)(f) GDPR, legitimate interest in understanding the community's needs and improving our services.
• Retention: answers for 5 years from completion; contact details until you withdraw consent, for no longer than 5 years from completion.
• The contact details from the survey created an entry in our contact records (section 3.8). When you withdraw your consent, we delete the contact details from the survey and this entry; if an event registration, a contact form message or a payment also belongs to the entry, the entry remains for them and we remove the survey data from it.
• Recipients: Supabase (database), GitHub (database backups, section 5).

3.8 Contact records and event payments

• We keep records of people who have contacted us through the website or at events (a CRM). An entry is created automatically from an event registration and from the contact form (sections 3.1 and 3.2), some entries were created from the survey (section 3.7), and an administrator may also create or update an entry manually.
• Data processed: e-mail address, name, phone number, Instagram username, the source of the entry (registration, contact form, survey, manual entry), the administrator's tags and notes (for an entry from the survey also an automatic summary of some of your answers: region, whether you would try the app, price expectation and comment) and the time of your last activity; your event registrations and contact form messages are linked to the entry.
• Event payments: against the entry we record payments received for taking part in an event — the event, the amount and currency (including the conversion to Czech crowns), the date and method of payment, and a note.
• Purpose: an overview of who is in contact with us and which events they register for, follow-up communication, organising events and recording payments for them.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in keeping an overview of contacts and customers and of event payments; for payments also Art. 6(1)(c) — compliance with accounting and tax obligations.
• Retention: the entry, including the registrations and messages that belong to it, for 5 years from your last contact with us; an entry from the survey is deleted earlier if you withdraw your consent (section 3.7); payment data for the period required by accounting and tax legislation (see Section 5).
• Notifications to administrators: administrators receive a notification about a new message from the contact form, an event registration, a new business contact, a payment, a change of status of a contact or business contact in our records and an undelivered e-mail. It carries the name (for a registration also the name of the event, for a payment the amount and the event, for a change of status the old and the new status); not the e-mail address or the content of the message. We keep the history of these notifications for 90 days. Notifications reach an administrator's browser through the web push service run by the maker of that browser (for example Apple, Google or Mozilla); the content of the notification is encrypted for the administrator's device, so the operator of the service sees only encrypted data and the subscription address, not the name.
• The records are accessible only to signed-in administrators. The only thing linked to an account in the mobile app is a registration that you opened from the app (section 3.2); when the account is deleted, this link is removed and the registration stays in the records under this section. To have an entry corrected or erased, please e-mail us (see Section 8).
• Recipients: Supabase (database), GitHub (database backups, section 5).

3.9 Business contacts

• We closed the separate records of contacts of company representatives on 13 October 2026 and deleted its only entry.
• We keep contact details of representatives of companies and organisations with whom we discuss partnerships or other cooperation in our contact records (section 3.8), tagged "partner"; everything stated in section 3.8 applies to them, including retention for 5 years from the last contact.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in business communication; where discussions are aimed at concluding a contract, Art. 6(1)(b).

3.10 Sent e-mails, unsubscribing and undeliverable addresses

• Log of sent e-mails: for e-mails we send from the website (confirmation of a registration or of a received message, information about the app) and for news by e-mail from the app (section 2.29) we record the recipient's address, the type of e-mail, the time, the outcome of sending and delivery (for example sent, undelivered, marked as spam) and a technical error message. We do not store the content of the e-mail in the log.
• Unsubscribe link: some e-mails carry a link that lets you unsubscribe with a single click. The link contains a random code that we store with your address so that the unsubscribe request is matched to the right address. An unsubscribe applies to the whole address; if your app account has consented to news by e-mail, it also withdraws that consent (section 2.29).
• Suppression list: an address that has unsubscribed, from which an e-mail bounced as undeliverable, or whose owner marked our message as spam is added to the list together with the reason and time. We record the bounce and complaint reports that our e-mail service provider sends us (Amazon SES through the Amazon SNS service, or Resend when it is used as a backup), in the log and on the list, for all e-mails we send through it, including e-mails from the app (for example booking confirmations, section 2.8). Addresses from which an e-mail bounced as permanently undeliverable, or whose owner marked it as spam, are also added by Amazon SES itself to our account's suppression list, and it does not send e-mails to them; they stay on that list until we remove them. In addition, Amazon SES adds an address from which an e-mail bounced as permanently undeliverable to its global suppression list, which applies to all Amazon SES customers, which it keeps as an independent controller and which cannot be switched off; the address stays on it for at most 14 days.
• Purpose: documenting to whom and when we sent an e-mail, resolving delivery problems and respecting unsubscribes and undeliverable addresses, i.e. not sending e-mails from the website or news by e-mail from the app (section 2.29) to them again. The exceptions are the e-mail about a blocked account (section 2.8) and the e-mail with the link to confirm an event registration you have just asked for (section 3.2): an address that has unsubscribed still receives them; we do not send them to an address that is on the list because of a bounce or a complaint.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in reliable and documentable e-mail delivery; for unsubscribing also Art. 6(1)(c) — the obligation to respect withdrawn consent and objections to receiving communications (Czech Act No. 480/2004 Coll.).
• Retention: the log for 24 months from sending; the suppression list for as long as the reason for not writing to the address persists (if we deleted it, we might write to you again by mistake); unsubscribe codes for as long as the links in e-mails already delivered can be used.
• Recipients: Supabase (database), Amazon Web Services (Amazon SES and Amazon SNS: sending e-mails, reporting bounces or complaints and our account's suppression list; Resend as a backup), GitHub (database backups, section 5).

3.11 Event photos and videos on our social networks

• We publish photos and videos from our events (Track Days, Eventy and Road Trips) on our profile instagram.com/driveandjoy and on our Facebook, TikTok and YouTube profiles once we set them up; they are uploaded by our administrators or by an external marketing contractor who prepares posts for us and receives the photos from us for this purpose only (section 6). We closed the photo gallery on the driveandjoy.cz website on 13 October 2026: it held no photos at the time it was closed, and its address now leads to our Instagram.
• Photo library and prepared posts. We store the event photos from which we prepare posts in a private library in our storage at Supabase (the photo and a reduced preview). For each photo we keep its name, tags (for example the event, place or car), dimensions, file size and who uploaded it and when. Prepared posts are stored privately in the same way: the graphics and their texts, the caption with hashtags, the planned publication date and who created the post and last edited it, and when. Only our administrators and the external marketing contractor can see the library and the posts; they are not public and do not appear in the app.
• Shoot plan. For filming days we keep a private plan in the administration: which ideas we will film, what has been filmed, photographed or packed, the time of filming, the best take, short notes from the set and who last changed an item and when. Only our administrators and the external marketing contractor can see it.
• Text suggestions with artificial intelligence. In the studio an administrator or the marketing contractor can ask an artificial intelligence assistant to suggest the texts and template of a post. Our server then sends OpenAI (the GPT language model, section 2.17) the request, the texts of the slide being prepared, the list of our templates and facts about the app, and, if the "Podle fotky" (based on the photo) option is on, the selected photo, which the studio reduces to at most 1,024 px and strips of location and camera data before sending; the photo is only sent after tapping "Navrhnout" (suggest). The photo may show identifiable people and vehicle registration plates; the model is instructed not to describe people, not to guess their names and not to transcribe registration plates. Our server does the sending, so OpenAI does not see the device's IP address or the account of the person asking; under OpenAI's terms, data sent through its API is not used to train models. We do not store the photo or the request; for each suggestion we keep a technical record of the call (who asked and when, the number of tokens and the cost), the response itself only for 24 hours and any output rejected by our checks for 90 days (section 5). A suggestion is only inserted into the post after confirmation, and a person always publishes it.
• If a photo shows an identifiable person or a vehicle's registration plate, it is that person's personal data.
• Who sees the photos and videos: published ones, anyone who opens our profile on the network in question; photos in the library, only our administrators and the marketing contractor.
• Purpose: to show what our events look like and to bring them closer to those who were not there.
• Legal basis: Article 6(1)(f) GDPR — legitimate interest in presenting our events. At our events we let participants know that photos and videos are being taken. You may object to the publication of a photo or video at any time (section 8). For text suggestions with artificial intelligence, our legitimate interest in preparing posts quickly.
• If you do not want to appear in a photo or video, write to us at info@driveandjoy.cz and we will remove it from our profiles and from the library.
• Retention: we keep published photos and videos on our profiles until we remove them ourselves. We keep photos in the library for 3 years from uploading, prepared posts for 3 years from their last edit and the shoot plan (selection, ticks and on-set notes) for 3 years from its last change; a nightly clean-up then deletes them. They disappear from backups (section 5) no later than 30 days after deletion (data in the database) or 15 days (reduced previews); we do not back up the original library photos. When manually deleted from the library or content plan, an item remains in a private trash for 30 days, during which an administrator or marketing contractor can restore it. A nightly clean-up then removes it.
• Recipients: anyone who opens our profile on the network in question; Supabase, where the photo library and the prepared posts are stored (processor); OpenAI, the GPT language model for text suggestions (processor); an external marketing contractor who prepares and publishes the posts for us as a processor under a data processing agreement and our instructions; Meta Platforms Ireland Limited, the operator of Instagram and Facebook, which processes the photos on its servers as an independent controller under its own policy; likewise TikTok Technology Limited, the operator of TikTok, and Google Ireland Limited, the operator of YouTube (sections 6 and 7).

3.12 Visitor analytics with consent (Microsoft Clarity)

• If you accept visitor analytics in the consent banner on the website, the Microsoft Clarity tool from Microsoft is loaded. Without consent it is not loaded at all.
• What it records: how you use the pages — clicks, mouse movement and scrolling, the address of the page visited, where you came from, device type, operating system and browser, and your approximate location based on your IP address. This produces click maps and session recordings. The content of form fields is not recorded; forms with personal data (event registration, the contact form, the request for information about the app) and pages with members' content (a For sale listing, an event added to the app, section 3.6) are additionally hidden from Clarity in full, so it sees no text on them, not even a member's name or photo.
• Clarity does not run on pages whose address carries a code or token (links to a ride, club, route plan and shared drive, unsubscribe pages, confirmation of an event registration, confirmation of the e-mail for app news and addresses with a token or code in their parameters), on the page for verifying a membership card at a partner, or in the website administration. If a visit starts on such a page, Clarity is not loaded at all until the page is closed or reloaded.
• Cookies: Clarity stores the cookies _clck (visitor identifier, valid for 1 year) and _clsk (links the pages of one visit, 1 day) on driveandjoy.cz. Microsoft may also set its own cookies on its domains (clarity.ms, bing.com), for example MUID, CLID, MR, SM and ANONCHK; according to Microsoft they also serve its advertising and operational purposes. In the consent signal we pass to Clarity we expressly refuse advertising storage.
• Purpose: to find out what works on the website and where people get stuck, and to improve the website accordingly.
• Legal basis: Art. 6(1)(a) GDPR — your consent; for storing cookies Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications. Consent is voluntary and the website works the same without it.
• Changing and withdrawing consent: at any time with the Cookie settings button in the website footer or on the page of this policy. After withdrawal, Clarity is instructed to stop storing data and to delete its cookies, we delete the _clck and _clsk cookies on driveandjoy.cz ourselves as well, and the page reloads so that Clarity is no longer loaded. Your browser remembers your choice (consent or refusal) together with the time of the decision in localStorage (key dj-souhlas); after 365 days we ask again.
• Retention: Microsoft keeps session recordings for 30 days, and randomly selected recordings, recordings we mark and click maps for up to 9 months (according to the Clarity documentation).
• Recipients: Microsoft (section 6). For Clarity data Microsoft is an independent controller and also processes it for its own purposes under its privacy statement. The contracting party is Microsoft Ireland Operations Limited (Ireland); the data is stored in the Microsoft Azure cloud and is also transferred to the USA (section 7). The data is sent directly by your browser, so Microsoft sees your device's IP address.

4. Legal basis for processing (Article 6 GDPR)

The detailed legal basis for each web processing activity is stated directly with it in Section 3.

5. Data retention

• Forum photos are kept with the post. Photos that are not published, removed by editing or belong to a deleted post are deleted during the nightly clean-up: a photo less than 7 days old in the first night after 7 days from upload (within 8 days of upload at the latest), an older one in the night after it is removed or the post is deleted. When you delete your account, we delete them together with the account. Photos of a reported post are deleted only in the night after the report is resolved. We delete the record of who wrote to the Forum and when (hourly limits) within two days.
• Club wall photos are kept with the post or comment. Photos that are not published, removed by editing or belong to a deleted post or comment (also after the club ends) are deleted during the nightly clean-up: a photo less than 7 days old in the first night after 7 days from upload (within 8 days of upload at the latest), an older one in the night after it is removed or deleted. When you delete your account, we delete them together with the account. Photos of a reported post or comment are deleted only in the night after the report is resolved. We delete the record of who wrote to a club wall and when (limits) within two days.
• Account, profile, garage, community, Forum and wishlist data (including participation in rides, ratings, points, badges, the reward review record and the record of sheets and celebrations you have seen) is retained for the duration of your account (for clubs and their wall see section 2.6). After account deletion it is erased (except for data we are legally required to retain, messages as described in section 2.12, notifications about your activity that other members have already received (for example that you started following them) as described in section 2.13, content reports another member made about you or your content as described in the Content reports bullet below and events you added to the app as described in section 2.24; the account identifier is kept in the list of deleted accounts as described in section 2.14 and, if the clean-up after account deletion is not completed, in an error record as described in section 2.9). Rides you organised remain after you delete your account without a link to it (section 2.6), as do moderation action records (the Record of moderation actions bullet below).
• The usage summary attached to your account (last activity, platform, app version and counts; section 2.9) is recalculated roughly every 15 minutes and retained until account deletion, when it is deleted together with the account. The timeline and the 30-day counts are calculated from the usage and error records we keep for 90 days (section 2.9); the summary contains no longer history.
• Manually granted membership levels (level, until when it is valid, reason and which administrator granted or last changed it and when; section 2.9) are retained while they are valid and for 365 days after they end, at most until account deletion.
• The source of your account (where you heard about us: your answer to the question, the source from a link and the source of an installation from Google Play; section 2.28) is retained until account deletion, when it is deleted together with the account.
• The consent to news by e-mail (consent status, text version, time and the record of giving, withdrawal and refusal; section 2.29) is retained until account deletion, when it is deleted together with the account.
• Vehicle illustration (section 2.3): the chosen colour with the vehicle until you change it or delete the vehicle; the link between a newly created illustration and the member whose request it came from until the account is closed (then we delete it, the image stays without the link); the record of a model check (who, when, which model) 30 days.
• We keep the VIN with the vehicle until you delete it in Technika or remove the vehicle from your garage (to Former cars), at the latest until your account is closed.
• Event attendance records and bookings made in the app (including attendee details and the payment data stored with the booking) are retained until you delete your account, when they are deleted (section 2.4). Event payments in the contact records (section 3.8) are retained for the period required by accounting and tax legislation (Act No. 563/1991 Coll., on accounting; Act No. 235/2004 Coll., on VAT) — up to 10 years.
• Data from website forms: contact form messages and event registrations are retained with the entry in our contact records for 5 years from your last contact with us, data with accounting or tax relevance under the statutory time limits above; a beta invitation request as described in section 3.3. Specific periods are stated with each processing activity in Section 3.
• Survey answers are retained for 5 years from completion; contact details from the survey until you withdraw consent, for no longer than the same period. When you withdraw your consent, we also delete the entry in our contact records created from them (section 3.7).
• An entry in our contact records is retained for 5 years from your last contact with us; business contacts in the same way, as part of the contact records (section 3.9). The history of notifications to administrators (section 3.8) is retained for 90 days.
• E-mails in our info@driveandjoy.cz mailbox (messages and copies of registrations from the website, your requests under section 8 and other correspondence) are not deleted automatically after a fixed period. We keep them for as long as we need them to deal with the matter and to document our communication with you; at your request we delete them unless we need them to establish, exercise or defend legal claims.
• Event photos and videos on our social networks stay on our profiles until we remove them ourselves; at your request we remove a photo or video (section 3.11).
• The photo library for preparing posts and the prepared posts are kept for 3 years (a photo from uploading, a post from its last edit), as is the shoot plan (3 years from its last change), after which a nightly clean-up deletes them; at your request we delete a photo you do not want to appear in from the library (section 3.11).
• Individual website visit records are retained for 180 days; summary figures from which an individual visit cannot be identified may be kept longer.
• Microsoft Clarity (section 3.12): session recordings 30 days, randomly selected recordings, recordings marked by us and click maps up to 9 months (kept by Microsoft); cookies _clck 1 year and _clsk 1 day; your browser keeps your choice in the consent banner for no more than 365 days.
• Fingerprints used for rate limiting (website forms and visit counting, sections 3.1–3.4, loading shared content (community rides, clubs, ride records, route plans, listings, events and JOY Roads routes), section 3.6, loading a vehicle by VIN, section 2.3, weather forecast requests and requests for the precipitation radar, section 2.20, and place search, section 2.16) are deleted within 3 days of the last attempt at the latest.
• Ride recordings (telemetry), including the stored data files, are retained for the duration of your account, or until you delete the ride yourself. The detailed time series of a ride is kept at full resolution for 90 days; after that we condense it to one record per second (section 2.10) and keep it in that form.
• Chat messages and attachments are retained for the duration of the conversation; deleting a conversation for yourself does not end them, and they remain for the others (section 2.12). Pinning a conversation lasts until you unpin or hide it, delete it for yourself, or until your participation in it ends (you leave or are removed, the conversation ceases to exist, or you delete your account). The record of deleting a conversation for yourself (when you last deleted it) is kept for as long as the conversation exists, at most until you delete your account. Messages you sent to a conversation with other people remain in it after you delete your account, attachments included, without your name (section 2.12). A conversation with no participants left and the chat of a club that no longer exists are deleted, attachment files included, no later than the following day (section 2.12). A group invitation is kept until it is accepted or refused (at most until the group or the account ceases to exist), a record of a refused invitation for 30 days. The counter of created groups and sent invitations (protection against mass sending; only the start of the 24-hour window and two counts) is kept for the duration of the account, and the limit counts only the last 24 hours.
• Content reports (including the copy of a reported message, the copy of other reported content, for example a ride, a vehicle, a profile or a club, and of a reported answer from an artificial intelligence feature) are kept even after they have been dealt with, for as long as the account of the person who made the report exists; deleting that account deletes the report. A photo of reported content that has since disappeared is kept in private moderation storage for the same period (section 2.6, Reporting content), even if the author of the content has deleted their account in the meantime; we delete it no later than the night after the last report referring to it ends. We keep photos of a Forum or club wall post only until the report is resolved (see Forum photos and Club wall photos above).
• The record of moderation actions (who decided, whom the action concerns, what, when and why; section 2.6), including the record of Joy points taken away by an administrator (the number of points, the season and whether you were notified), is kept for 3 years from the action, because of objections and disputes; a record of an account block is kept for as long as the block lasts and for 3 years after it is lifted or expires. Deleting the report or the account of the moderator or of the member concerned does not end the record; only its link to the report and to the account is removed. For a blocked account, the record keeps the technical identifier of the blocked account (a random string of characters, not a name or e-mail).
• Findings of the Joy points watch are kept for 90 days (they are deleted at the first Monday run after that), and findings recorded under you also when you delete your account; in a finding about a pair with thank-yous only the technical identifier of the account remains after the account is deleted, until the finding is deleted (section 2.6).
• Review of JOY Roads routes (section 2.6): we keep requests for the review of a ride (including withdrawn ones), the decisions on them and the record of every preview opening until you delete your account, even if you delete the ride; if a route is deleted from the JOY Roads catalogue, the requests for it and the record of their openings are deleted too. The decision is also in the record of moderation actions, which we keep for 3 years (the Record of moderation actions bullet above).
• Ratings of JOY Roads routes (section 2.6): we keep the stars, the surface and the marked places until you delete the rating in the app, at the latest until you delete your account; if a route is deleted from the JOY Roads catalogue, the ratings for it are deleted too. A new rating of the same route overwrites the previous one; we use the previous stars and surface only until the end of the day of the edit (for the daily summary) and delete them the next time any member saves a rating.
• Status shown to others and the Pick of the month (section 2.6): we keep your choice on showing status to others (whether, since when, when you last decided and which version of the consent text) until you delete your account. Consent to the Pick of the month (whether, when and which version of the text) is stored with the vehicle until you delete the vehicle, at the latest until you delete your account. We delete picks scheduled for later months immediately after consent is withdrawn or the vehicle is handed over; we keep current and past picks (the vehicle, the month, the description, who picked it and when) until the vehicle is deleted or you delete your account.
• Díky, the Hall of fame, gifts and status rewards (section 2.6): we keep thank-yous (Díky) until the giver or the recipient deletes their account, when they are deleted; a thank-you cancelled by an administrator for the same period, it just no longer counts anywhere. We keep the Hall of fame pick (including the consent and its version), the showcase, the cover, the title, consent to the showcase and privilege requests until you delete your account. Consents for a vehicle (Car from the community and Vehicle tracks: whether, when and which version of the text) are stored with the vehicle until you delete it, at the latest until you delete your account. We keep data about a gifted credit until the giver deletes their account; if the recipient deletes their account, we erase the data about them. We keep the vehicle photo for Car from the community only until the consent is withdrawn or ends, you switch your profile to private or your account is blocked (we then delete the file within two days); today's and past questions with your vehicle (text only) until the vehicle is deleted or you delete your account. We keep the record of a title and of a thank-you cancelled by an administrator in the record of moderation actions for 3 years (the Record of moderation actions bullet above). Albums, Rok v DRIVE&JOY and the shared goal are calculated when displayed and are not stored separately. We keep the record of Forum and club wall solutions that earned points until the account of the replier or the asker is deleted.
• Joy dne and status (section 2.6): we delete the option you chose in a Joy dne answer after the Prague day ends, and answers from past months on the first day of the following month, except correctly answered questions about circuits (the "Znám" album), which we keep until you delete your account. Stamps, status, attendance confirmed by the team, registration order and the Ročník 2026 badge are kept until you delete your account, when they are deleted. The record of the confirmation and lowering of status and of points taken away after a confirmed attendance is cancelled is kept in the record of moderation actions for 3 years (the Record of moderation actions bullet above). Notifications to administrators about status awaiting confirmation are deleted after 180 days like other notifications. The note that the pair cap excluded a ride from points ends with the ride. The settings of the Joy dne reminder and the weekly summary are kept with your notification preferences, and the "Joy dne na Domů" and "Skrýt body a sezónu" options with your profile.
• A decline of or removal from a ride is kept for as long as both the ride and your account exist, consent to a ride's safety code (version and time) for as long as you are a participant of the ride (including a pending request) and both the ride and your account exist, and the times public clubs were created for the limit of 3 in 24 hours only for the last 24 hours and at most until you delete your account, a ban from a club after removal by an administrator until the administrator lifts it, invites you again, the club ends, or you delete your account, a follow request until it is dealt with or withdrawn, at most until the requester's or the followed member's account is deleted, muting a club and the time you last opened the club wall until you leave the club, an invitation to a private club via a link for at most 7 days, after which we delete it within two days, a link to a public club until the club ends or the account of the person who created it is deleted, ride invitations, ride links and records of declined invitations for up to 30 days after the ride ends (a decline for at most 30 days after the decline), at most until the invitee's account, or the account of the person who created the link, is deleted (section 2.6). Your choice of who can message you is kept with your profile.
• Rides you organised are kept for the duration of your account. After you delete it, they remain in the participants' history without a link to your account (section 2.6), and we do not delete them automatically.
• Push notification tokens are deleted when the account is deleted and usually also when the device signs out (for the exception when notifications are turned off see section 2.13); a token that the app has not renewed for 120 days is deleted automatically.
• The in-app notification history (the notification text and read status) is retained for 180 days. Notifications about messages from a conversation you delete for yourself are deleted when you delete it (section 2.12). The delivery status of notifications is deleted together with the notification after 180 days. The time until which not to disturb you while driving is kept only as the latest value and deleted once it has passed, usually within 10 minutes, during the night-time quiet period in the morning (section 2.13).
• Your consent to tips and reminders (that you gave it and when) is kept until you withdraw it, together with the version of the text you gave it to, and the record that and about which version of the text we have already asked you until you delete your account (section 2.13). The information about which scope a tip belongs to is deleted with the notification history after 180 days.
• The record of events of your consent to tips and reminders (grant, extension, withdrawal and refusal: version of the text, time, card or Settings) is kept for as long as your account exists; records relating to a consent you withdrew are deleted 3 years after the withdrawal and the record of a refusal 3 years after your answer. When you delete your account, the whole record is deleted (section 2.13).
• Technical error and usage event records (app and website) and counts of discarded records are retained for 90 days, ride diagnostics from the app for 400 days (section 2.9); records linked to an account are also deleted when the account is deleted, and records for the account that arrive only while it is being deleted or afterwards by the following day at the latest. The identifier of a deleted account with the unfinished steps of the clean-up after its deletion is kept in an error record for no longer than 90 days (section 2.9). For the record of acceptance of the terms of artificial intelligence features see below.
• Usage analytics in PostHog (section 2.25): events 1 year, usage recordings 30 days (kept by PostHog); after you delete your account, the records in PostHog remain until the end of this period, and at your request we will delete them sooner. The "Pomáhat zlepšovat appku" (Help improve the app) choice (and when you last changed it) is kept until you delete your account.
• Wingman conversations (questions and answers) are retained for 90 days.
• The technical record of a language-model call (feature, model, token count, cost, response time — without content) is retained for 90 days; the model's answer itself is deleted from it after 24 hours. The number of trial requests used in Free (Wingman, ride planner) is kept until you delete your account. Rejected model output and questions for which the model suggested a new guide (section 2.17) are retained for 90 days.
• A JOY Coach ride analysis and a ride summary are stored with the ride and deleted together with it. A generated route plan is deleted after 30 days unless you save it — including a shared or rated plan and one you drove a ride on (the shared link ends with it, the ride stays); a saved plan is kept until you remove it from My plans, at most until you delete your account, and you can delete it at any time (section 2.17). The trimming circle of a shared ride and a shared plan (the centre and radius of the circle around the place of the start or the destination — the approximate place you drove or planned from or to, section 3.6) is kept with your account until you delete the account, even after you delete the ride, the plan or the link, so that later shares from the same place get the same circle and several shares do not reveal more. The circle is created when a shared link is first displayed or when you create a ride share card, including for a private ride you end up not sending.
• My trips (collections and multi-day trips) are kept until you delete the trip or your account, the receipt of a trip's latest save until the trip is deleted, and the deletion receipt (without content) until you delete your account (section 2.26).
• The record of your acceptance of the terms of artificial intelligence features (including any withdrawal) is retained until you delete your account (section 2.17).
• Subscription event messages from RevenueCat are retained for 3 years from their receipt and anonymised within 30 days of account deletion (for an account with an active subscription, however, they can be matched to its record at RevenueCat until that record is deleted; section 2.14), the latest subscription status reported by RevenueCat until you delete your account. The customer record at RevenueCat is deleted when you delete your account if you have no active subscription, and we repeat the deletion within 30 days; with an active subscription it is deleted after the subscription ends. The identifier of a deleted account and the time of deletion are kept for this purpose in a list of deleted accounts until the record is deleted (in the case of a persistent error at RevenueCat for no longer than 1095 days). The record under a random identifier created when the app disconnects is held by RevenueCat for as long as we use its service. At your request we delete the record earlier (section 2.14).
• Listings, including expired, sold and draft ones, are retained together with their photos until you delete them, at the latest until you delete your account (section 2.18). The last approved version of a listing being edited is kept until the moderator's decision, and photos removed during editing are deleted within two days of the changes being approved at the latest (section 2.18).
• Events you added to the app are kept in the event catalogue until we delete them, even after you delete your account, only no longer linked to it (section 2.24).
• The record of a one-time verification link for an event registration opened from the app (the hash of the link, the account, the event and the times) is deleted within 8 days (section 3.2).
• A registration awaiting confirmation by e-mail (the details from the form and the hash of the link) is deleted, if it is not confirmed, no later than one hour after the 24-hour time limit expires, i.e. within 25 hours of submission; the record of the confirmation (the hash of the link, the time and the link to the registration) 7 days after confirmation (section 3.2).
• Earlier merchandise orders are retained as accounting records as described in section 2.15.
• Records of partner discount redemptions are retained for the duration of your account, records of membership card verification attempts for 90 days (section 2.19).
• We remove the link between an issued partner code or voucher and your account 24 months after issue and delete the record of a sent enquiry to a partner after 12 months; the content of the enquiry is deleted once sent, an undelivered message after 30 days at the latest (section 2.19). We keep the membership number until you delete your account.
• Data stored on the device for the car display (the summary of destinations and vehicles, downloaded destination photos) is deleted when you sign out of the app; this data never leaves the device.
• The random identifier for update checks stays on the device (on iPhone even after the app is deleted) and our server does not store it (section 2.23). The identifier of the Mapbox map library is replaced on the device with a new one after 24 hours (section 2.16).
• Transactional e-mails are retained for the period necessary at the e-mail service provider (Amazon SES, with Resend as a backup); addresses that Amazon SES adds to our account's suppression list stay on it until we remove them, and an address from which an e-mail bounced permanently stays on the Amazon SES global suppression list for at most 14 days (section 3.10). The log of e-mails sent from the website is retained for 24 months from sending; the suppression list and unsubscribe codes as described in section 3.10.
• Server logs of our hosting providers: Supabase (app and website) and Vercel (website) record technical data about requests to their servers, including the IP address and browser identifier; the logs of our server functions at Supabase may exceptionally also contain an account identifier (for example when an account deletion cannot be completed). They keep it under their own terms; under our current plans it is available for 7 days (Supabase) or 1 day (Vercel).
• Backups. We back up the app database every night (from the move described below, including the data from the website) and stored files (ride recordings, photos, chat attachments, website images) once a week. The backup is created and test-restored by an automated job on GitHub's servers (USA), where the data is unencrypted while the job runs; at the end of the job the unencrypted data is deleted and the stored backups are encrypted. They are kept for 30 days (database) or 15 days (files), after which they expire. Supabase additionally keeps its own daily database backups for 7 days. Data that you or we delete (including on account deletion) may therefore remain in backups for at most that period; we use it from a backup only when restoring the service after an error or outage, and delete it again after the restore.
• Move of the website data (30 September 2026). On that date we moved the data from the website (sections 3.1–3.4 and 3.7–3.10) from a database in Ireland to the app database in Sweden; both are operated by Supabase in the EU. We kept the copy in Ireland for 5 days after the move so that we could go back if problems arose, and then deleted it; the backups Supabase keeps of it expire no later than 7 days after deletion. Backups of the original website database were taken every night from the move until the copy in Ireland was deleted, in the same way as our other backups (see above), and are kept for 30 days from when they were taken. During the move the data passed through our administrator's computer only for the duration of the transfer; no permanent copy remained on it. Forms submitted from an older version of the website that is still open, and links in older e-mails (unsubscribe, subscription confirmation), will for a transitional period pass through functions of the original website project at Supabase, which forward them to the app database and do not store them in the original website's database.

6. Recipients of data (processors and other recipients)

We share your data only with the following recipients. The Role column says whether the recipient processes the data on our behalf (processor) or for its own purposes as an independent controller, which is itself responsible for it under its own policy; some providers have both roles, each for different data. For all processors in the table except WEDOS, GitHub and PostHog, the data processing agreement under Art. 28 GDPR forms part of their terms of service, which are accepted when the account is created, and it is not signed separately; with WEDOS it is concluded by acceptance in the client administration. With PostHog, the data processing agreement is signed separately. GitHub processes our backups for us (see its row), but we do not yet have a data processing agreement with it: the repository from which the backups run is on a personal account, for which GitHub does not offer one. We are arranging it by transferring the repository to a GitHub organisation held by driveandjoy s.r.o. and accepting the GitHub Customer Agreement, of which it forms part. The accounts through which we use the processors' services are currently held as follows: for Supabase and Vercel under the GRND organisation; for Resend, Mapbox, WEDOS and GitHub as personal accounts of one of our managing directors; for RevenueCat and Shopify under a company e-mail address, without the details of driveandjoy s.r.o.; for Google for Firebase and Google Cloud Pub/Sub (the same project) under a company e-mail address, without an organisation held by driveandjoy s.r.o.; for Amazon Web Services as a personal account of one of our managing directors (we plan to transfer it to driveandjoy s.r.o.); for PostHog as a personal account of one of our managing directors (the data processing agreement is concluded by driveandjoy s.r.o.); for OpenAI under an organisation named DRIVE&JOY s.r.o., but with the billing details in the name of one of our managing directors, without the address and tax identifier of driveandjoy s.r.o.; for Stripe by driveandjoy s.r.o. Our accounts with Apple and with Google Play (both independent controllers) are held by driveandjoy s.r.o. The Microsoft Clarity project (Microsoft is an independent controller) is held under a personal account of one of our directors. We are transferring the accounts with processors to driveandjoy s.r.o. The Sent by column indicates whether the request is sent by our server (in which case the recipient does not see your IP address) or directly by your device. The Location and safeguards column states where the recipient processes the data and what protects its transfer outside the European Economic Area (section 7).

7. Transfers to third countries

Outside the European Economic Area (EEA), data may be processed by Google, Resend, Apple, Vercel, GitHub, RevenueCat, Mapbox, Stripe, Microsoft and Meta in the USA, by OpenAI in the USA and in other countries (see below), by TikTok in, among others, the USA, Singapore and Malaysia, and by Shopify in Canada and the USA (section 6). Supabase stores the data in the EU (Sweden); its server functions, however, run in the region closest to the caller — for users in Europe in the EU, while messages that providers in the USA send us (RevenueCat, Resend, Stripe) may be processed in the USA. Supabase's contracting party is Supabase Pte. Ltd. in Singapore, and its backups, operational logs and sub-processors may also be outside the EEA (according to Supabase, mainly in the USA and Singapore). Amazon Web Services processes the e-mails we send through Amazon SES in the EU (Sweden); for any access to them from a country outside the EEA, its data processing agreement contains standard contractual clauses. PostHog stores the analytics from the app in the EU (PostHog EU Cloud, Germany), and its sub-processors for EU Cloud process the data in Germany and France; the data is, however, transferred via the Cloudflare network, which operates worldwide, and PostHog, Inc. is an American company. Under the data processing agreement, PostHog may also process the data in the USA (operation and support of the service); such a transfer is protected by the EU–US Data Privacy Framework, in which PostHog, Inc. is certified, and in addition by Standard Contractual Clauses (SCC) in the data processing agreement. OpenAI (the contracting party is OpenAI Ireland Ltd., Ireland) has the data for the artificial intelligence features processed by the OpenAI group in the USA (OpenAI OpCo, LLC) and by cloud infrastructure suppliers that have servers in the USA and in other countries; we do not reserve processing in the EU. Content that OpenAI's automated checks flag as a possible policy violation may be passed by OpenAI for review to contracted moderation suppliers, among others in the Philippines. Under the data processing agreement (Data Processing Addendum), which forms part of OpenAI's terms of service, transfers outside the EEA are protected by standard contractual clauses or, where applicable, by the European Commission's adequacy decision for the country concerned; OpenAI is not certified under the EU–US Data Privacy Framework. Seznam.cz is based in the Czech Republic and WEDOS processes data in the Czech Republic; ČHMÚ (Czech Republic) and MET Norway (Norway, a member of the European Economic Area) receive no personal data from us.

Transfers to processors are protected by the Standard Contractual Clauses (SCC) approved by the European Commission, which form part of the data processing agreements (Supabase, Vercel, Resend, RevenueCat, Mapbox, Stripe, Google, OpenAI, Amazon Web Services), and, for recipients certified under the EU–US Data Privacy Framework (Vercel, Resend, Mapbox, Stripe, Google), also by the European Commission's adequacy decision; Stripe and Google rely on it primarily and keep the clauses as a fallback. Shopify transfers data within its group under approved binding corporate rules (BCR), to other suppliers under the SCC, and to Canada on the basis of an adequacy decision. GitHub, with which we do not yet have a data processing agreement (section 6), is certified under the EU–US Data Privacy Framework, and only that certification covers the transfer. Apple, Google, Microsoft and Meta transfer data that they process as independent controllers to the USA under their own safeguards (Apple under the SCC, Google under the EU–US Data Privacy Framework, Microsoft for Clarity from Microsoft Ireland Operations Limited to Microsoft Corporation under the SCC, and it is also certified under the EU–US Data Privacy Framework, Meta for Instagram and Facebook from Meta Platforms Ireland Limited to Meta Platforms, Inc. under the EU–US Data Privacy Framework). This ensures an adequate level of protection for your data. TikTok (TikTok Technology Limited, Ireland) transfers TikTok data outside the EEA under its own safeguards (according to its policy, standard contractual clauses and adequacy decisions), and staff of its group also access it remotely from China; in 2025 the Irish supervisory authority found that the transfers to China were not adequately protected, and TikTok appealed the decision. We have no influence over what TikTok does with published photos and videos; if you do not want to appear in them, write to us (section 3.11). On request we will provide you with a copy of the Standard Contractual Clauses, or tell you where they are published, at info@driveandjoy.cz.

The exceptions are the recipients to which your device passes the data directly and which act as independent controllers: the navigation app you choose yourself (section 2.16), the websites hosting event photos (section 2.24) and the motoring media publishers whose thumbnail images load in the news feed (section 2.21). They may be based outside the EEA as well; our agreements and clauses do not cover these transfers, and their own policies apply.

8. Your rights

In relation to your personal data you have the following rights:

• Right of access (Art. 15) — to obtain information about what data we process.
• Right to rectification (Art. 16) — to have inaccurate data corrected.
• Right to erasure (Art. 17) — the "right to be forgotten" (unless a legal retention obligation prevents it).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21) to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent.

You can exercise these rights by e-mailing the controller's address in Section 1 (info@driveandjoy.cz). Most in-app data can be managed directly in the app (editing your profile, removing a vehicle from your garage, deleting the VIN, cancelling your attendance at an event, editing and deleting a JOY Roads route rating, deleting your account), and you can withdraw consents to showing things to others (status shown to others, the showcase, the Hall of fame, the Pick of the month, Car from the community and Vehicle tracks) in it at any time; you can withdraw the consent to news by e-mail with the Nastavení › Notifikace (Settings › Notifications) switch or with the link in every news e-mail (section 2.29); you can object to usage analytics with the Nastavení › Soukromí › "Pomáhat zlepšovat appku" (Settings › Privacy › "Help improve the app") switch (section 2.25); for data submitted via the website or in the survey, for an entry in our contact records and for event photos and videos on our social networks, please contact us at the address above to have them corrected or erased.

9. Cookies, tracking and third-party components

The DRIVE&JOY mobile app uses no cookies, no advertising SDKs and no third-party crash reporting (the technical data that the Stripe, Mapbox and Firebase libraries send themselves is described in section 2.21), and does not track you across other companies' apps and websites. It does use third-party usage analytics: for signed-in members who have not switched it off, it sends usage data and usage recordings to the PostHog service (section 2.25); the PostHog library stores no cookies and no identifier on the device. We use local device storage to run the app — sign-in (session token), caching of displayed content, a copy of your profile, garage, JOY Roads routes and saved route plans (at most the 10 most recently opened or saved, including the route itself) for starting the app and opening a plan without a signal (it is used for at most 14 days after it was saved and is deleted when you sign out; a plan also when you unsave or delete it), the route planner form you are filling in (start, destination, wish and options; only until you close the app or sign out), a trip you are drafting in My trips (until you save or discard it; deleted when you sign out, section 2.26), your last planner options (loop or route to a destination, duration, style, detour, stops and avoiding motorways — without places or the wish), while a route is being planned a marker that planning is in progress (account identifier, time sent, route type and, for another variant, the previous plan's identifier) so that the app can find the finished plan among your plans after an unexpected shutdown (it is deleted once the plan arrives or is found, when you sign out, and at the latest when the app starts and the marker is older than 10 minutes), temporary storage of an unsent ride recording (section 2.10) and of unsent technical reports until they can be uploaded, a JOY Roads route completion waiting to be written to your JOY Roads Passport (account identifier, the route and its name, the day and time of completion, the duration and distance of the ride; it is kept until the write is settled and is not deleted when you sign out, so that the completion is recorded if you return to the account on the same day — it is not written under another account; the app deletes a completion older than 14 days the next time it is opened with a signed-in account; section 2.6), that you confirmed the JOY Coach notice and that you are 18+ on this device (separately for each account; we keep the record of the confirmation on the server, section 2.17), the summary for the car display (section 2.22), the random identifier for update checks (section 2.23), a link opened before signing in (at most 7 days, section 2.21), that you have already seen the explanation of the JOY Roads route review (section 2.6), the day the Joy dne card was last shown to you and a flag that Joy dne is running for you (sections 2.6 and 2.9), the quiet-while-driving state (whether a ride is under way, until when not to disturb you and whether you are following a route; section 2.13), the sheets and celebrations you have seen until this can be saved on the server (section 2.6), the membership tier from which the app counts the welcome to a new membership and which welcomes have already been shown to you on this phone (deleted when you sign out), the day the next-step card was last shown to you (section 2.9) and a flag that the app has already asked on this phone for permission to show notifications, and when it showed you the notification offer after an action (section 2.13). The phone also holds the state of the "Tvoje první kolo" (Your first lap) card on Home (which first steps it showed, which of them you completed and whether you hid it); once the seven-day period is over, the app deletes it the next time you open Home. The phone also remembers that you chose "Teď ne, dojet do cíle" (Not now, finish the lap) at the membership offer in the welcome guide, and when; for seven days after you complete the guide, the app uses it to name JOY Roads routes from your region in the JOY+ offer. It is deleted when you sign out. The phone also stores your choice of app sounds (on or off). If you skip notifications in the introductory guide before the system has asked, the phone remembers when that was, with the random identifier of that app launch (section 2.13). The phone also remembers the source from a link with which you opened the app (a short label and the time it was opened; used for at most 30 days), your answer to the "Odkud o nás víš?" (How do you know about us?) question until it can be sent, and the number of app launches since you finished the introductory guide, which determines when the question appears (both with the account identifier; section 2.28). The Android app remembers that it has already stored the source of the installation from Google Play (section 2.28) and the time of the last request for a rating on Google Play together with at most the last ten days on which you used the app (section 2.21). The app also remembers the state of the free trial card (shown, "Vyzkoušet zdarma" (Try for free) or "Teď ne" (Not now), with a random launch identifier and the time; with the account identifier; section 2.14). The phone also remembers which clubs you have recently joined or asked to join on this phone, so that a welcome sheet is shown once when you first open the club (with your account identifier; at most 30 days, deleted once shown; not sent to our server; section 2.9). Some third-party libraries also store their own identifiers and cache on the device: the Mapbox map library (a random identifier that it replaces with a new one after 24 hours; section 2.16), the RevenueCat subscription library (in the Android app only when it offers subscriptions there) and the Firebase notification library on Android (section 2.13).

The app does, however, load components from third-party servers (Google Fonts, the YouTube player and video thumbnails, the RevenueCat subscription library (in the Android app only when it offers subscriptions there), Mapbox map data, the Mapy.com logo, thumbnail images in the news feed and event photos stored on other websites). Those providers therefore receive your device's IP address and technical details about it; some of them may use their own cookies or similar identifiers in the process. Details are in section 2.21.

The driveandjoy.cz website itself uses no advertising cookies. Traffic and website speed are measured using our own tool without cookies and using Vercel Web Analytics and Vercel Speed Insights, which likewise use no cookies and store no personal identifiers on your device (see Section 3.4); these run without consent as well. Only with your consent is Microsoft Clarity loaded in addition; it stores the _clck and _clsk cookies, and Microsoft may also set its own cookies on its domains (section 3.12). The website asks for consent with a banner on your first visit: Accept all and Reject are equal options, Settings shows strictly necessary storage (always on) and visitor analytics (optional), and you can change your choice at any time with the Cookie settings button in the website footer. Your browser remembers your choice (localStorage, key dj-souhlas) for no more than 365 days; this is strictly necessary storage without which the banner would appear on every visit. Third-party components also load on the website (Google Fonts, the Mapbox map background image for shared content and, on event pages, event photos stored on other websites), which receive your device's IP address. For a registration for an event whose registration on the website is linked to the app, the browser keeps the details you filled in (and, for a registration opened from the app, the verification link) in the session storage of that tab until the registration is sent (sessionStorage, section 3.2); they serve only to send the registration and disappear when the tab is closed at the latest. On the pages for confirming an event registration and the e-mail for app news, the browser keeps the code from the link in the session storage of that tab (sessionStorage, sections 3.2 and 3.3), at most until the tab is closed.

10. Security

We take appropriate technical and organisational measures to protect your data: encrypted transmission (HTTPS/TLS), password hashing, database-level access control (Row Level Security), segregation of payment data at a certified provider (Stripe, PCI-DSS), encrypted backups that we automatically test-restore every night, and the signing of app updates delivered outside the app stores (from build 130 onwards the app does not install an update without our valid signature).

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes in the app or by e-mail. The current version is always available at this address.

12. Contact and complaints

For questions, contact us at info@driveandjoy.cz.

You also have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (ÚOOÚ)

Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

www.uoou.cz