Privacy Policy

NOXA is an automotive and moto community platform operated by Sergkei Karaketidis in Greece. For the purposes of applicable data-protection law, including the General Data Protection Regulation where it applies, Sergkei Karaketidis is the data controller for the personal data described in this policy.

Privacy, data-access and account-deletion requests can be sent to support@noxastreetapp.com.

This policy applies to the NOXA website, NOXA: Car & Moto mobile applications, authentication and storage systems, maps, events, community features, notifications, support channels and other NOXA services that link to this policy. The NOXA: Car & Moto mobile application is intended for adults aged 18 or older, in line with its App Store age rating. We do not knowingly offer mobile accounts to minors. The public website may be visited without creating a NOXA mobile account. If you believe a minor has created an account or provided personal data, contact us so we can review and remove it where appropriate.

Depending on the NOXA features you use, we may collect:

• Account and authentication data: email address, account identifier, authentication provider, session information and security events. Authentication may be provided through email/password, Apple or Google. When you use Apple or Google sign-in, NOXA may receive the account identifier and profile information that provider permits you to share, such as an email address or name. NOXA does not receive your Apple or Google account password.
• Profile data: display name, username, avatar, biography, city and other profile details you choose to add.
• Garage and vehicle data: vehicle brand, model, year, specifications, tuning details, description, photos and visibility settings.
• Content and social activity: posts, photos, captions, comments, likes, saves, follows, crew memberships, invitations, join requests, event attendance, messages and other interactions you choose to create.
• Crews, events and drives: crew roles, event details, attendance responses, group-drive or convoy participation, route points and content submitted as a host, organiser or member.
• Location data: precise device coordinates when you grant location permission and use map positioning, nearby features, route calculation, Live Drive or an active Group Drive. During an explicitly enabled sharing session, we may also process heading, speed, accuracy, timestamps, visibility audience and session-expiry information.
• Photos and media: images you deliberately select from your device or otherwise choose to upload to profiles, vehicles, crews, posts or events.
• Notification data: notification preferences, Expo push tokens, delivery status and identifiers needed to route a notification to the correct NOXA screen.
• Website and submission data: waitlist email, optional city, selected language, event or community submissions, organiser or community application details, campaign/referrer information and consent records when those features are used.
• Technical and security data: IP address, user-agent, device/app information, request timestamps, network and security signals, and similar service logs that may be processed by NOXA or its infrastructure providers.

Location access is permission-based. NOXA may use precise foreground location to place you on the map, show relevant nearby activity, or calculate a route when you request those features.

Personal Live Drive location sharing is optional and starts only when you explicitly select an audience and activate a session. During that active session, NOXA may continue updating your precise location while the app is open, minimized in the background, or the screen is locked. A personal session expires after no more than four hours. NOXA does not automatically start a new sharing session merely because you open the app.

Background location is used only for an explicitly enabled personal Live Drive or active Group Drive location-sharing session. It may continue while the app is in the background or the screen is locked so accepted participants can keep the shared drive position current. NOXA does not need continuous background location for ordinary browsing of events, profiles or the map.

Personal location sharing is optional and time-limited. You can stop personal sharing by selecting Ghost, signing out, or revoking location permission in device settings. Backgrounding alone does not revoke an active personal Live Drive session. The audience that can see active personal location depends on the visibility option you choose and the applicable NOXA access rules.

We use personal data to:

• create, authenticate and secure NOXA accounts;
• provide profiles, garages, posts, crews, events, maps, group-drive features and the interactions you request;
• operate optional location sharing and enforce the audience you select;
• store and deliver photos and content you upload;
• send service notifications and reminders for events you explicitly save or organise, plus other communications you have enabled;
• process waitlist, organiser, community and event submissions;
• maintain, troubleshoot, protect and improve NOXA and prevent spam, abuse, fraud and unauthorised access;
• respond to support, privacy, safety and legal requests.

NOXA does not currently sell personal data, use third-party advertising SDKs, or use personal data for cross-app behavioural advertising. We do not make automated decisions that produce legal or similarly significant effects about users.

Where EEA data-protection law applies, we rely on:

• Contract: processing needed to create your account and provide the NOXA features you request.
• Consent: precise/background location, photo access, optional marketing communications and other permission-based features. You can withdraw consent at any time through NOXA or your device settings where applicable.
• Legitimate interests: service security, abuse prevention, debugging, moderation, reliability and understanding how the service performs, balanced against your rights and expectations.
• Legal obligation: processing or retention required by applicable law or a valid legal request.

Some information is shared because NOXA is a social and event-discovery service. Profile, vehicle, crew, event, post and location information is shown to other users only according to the relevant visibility, membership and sharing settings. Public content may be visible broadly within NOXA or on NOXA public pages.

We also use service providers, including:

• Supabase for authentication, database, storage, realtime and serverless backend services;
• Mapbox for native mobile map functionality and map-related network requests;
• OpenRouteService for route calculations; route origin and destination coordinates are sent when a route is requested;
• Apple and Google when you choose their sign-in services;
• Expo for mobile build/platform services and push-notification delivery; Expo push tokens and notification payload data may be processed to deliver notifications;
• Vercel for website hosting, performance monitoring, Vercel Analytics and Speed Insights;
• Resend where used for transactional or operational email delivery.

Providers receive only the information reasonably necessary for the service they provide. They may process data in countries outside Greece or the EEA. Where required, international transfers are protected by an adequacy decision, contractual safeguards or another lawful transfer mechanism.

We may also disclose information when required by law, court order or a competent authority, or where reasonably necessary to protect users, investigate abuse or protect NOXA and others.

The NOXA website uses Vercel Analytics and Vercel Speed Insights to understand website usage and technical performance. These services may process technical request, page-view and performance information needed to provide those measurements.

NOXA does not currently use third-party advertising cookies. Essential storage, security mechanisms and local preferences may be used where needed to operate the website, remember choices and protect the service.

Account, profile and user-content data is generally retained while your NOXA account is active or for as long as needed to provide the service you requested. Data that you delete is removed from active product views, subject to normal technical backup cycles and lawful retention requirements.

Personal map sharing is time-limited and is designed to expire after no more than four hours. Active personal location is also designed to be removed when you select Ghost, sign out, an existing session expires, or account deletion completes. If network access is unavailable, server cleanup may be delayed; server access rules limit the lifetime of stale personal location. Group Drive location follows the participant-scoped drive lifecycle and its cleanup rules.

Waitlist information is retained until you withdraw consent, the relevant early-access purpose ends or the project no longer needs the record. Website application or submission data is retained for as long as reasonably needed to review the submission, operate the resulting relationship, resolve disputes or meet legal requirements.

Limited security, fraud-prevention, legal or backup records may be retained after other data is deleted where there is a valid reason to do so. Protected backup copies are removed through normal backup-expiry cycles and are not used as active profile data.

You can start permanent account deletion from the NOXA mobile app under Settings → Privacy & Safety → Delete Account. The app requires an identity check before deletion is completed.

If you no longer have access to the app, you can request account and associated-data deletion through our account deletion page.

A completed account deletion request is designed to remove the authentication account and associated personal data from active NOXA systems, including profile data, garage data, posts, comments, follows, crew/event ownership data and uploaded media, subject only to limited lawful security, fraud-prevention, dispute or legal retention described above.

Depending on your location and the circumstances, you may have rights to access, correct, delete, restrict or receive a copy of your personal data, object to certain processing, and withdraw consent. Withdrawal does not affect processing that was lawful before the withdrawal.

You can manage many choices directly in NOXA, including profile information, content, visibility, notifications and device permissions. Location and photo permissions can also be changed in your operating-system settings.

Send privacy requests to support@noxastreetapp.com. We may request limited information to verify that the request belongs to you.

If GDPR applies, you also have the right to lodge a complaint with the Hellenic Data Protection Authority at dpa.gr, or another competent supervisory authority.

We use technical and organisational measures designed to protect personal data, including encrypted network connections, authentication controls, restricted database access, row-level access rules, server-side validation, rate limits and provider security controls. No internet service can guarantee absolute security, so keep your credentials private and contact us if you suspect unauthorised access.

We may update this policy as NOXA, its mobile applications, website, service providers or legal requirements change. The date at the top identifies the latest version. Material changes will be communicated through the app, website or another appropriate channel.

Questions about this policy can be sent to support@noxastreetapp.com.