Privacy policy

Last updated: 15 September 2026

This policy explains what personal data AdvTour collects about you, why, and what you can do about it. It is written to meet Law no. 195/2024 of the Republic of Moldova on personal data protection.

Who is responsible

Andrew MAGIK, Republic of Moldova, operates advtour.md and is the controller of your data.

For anything to do with your data, write to gdpr@advtour.md.

We have not appointed a data protection officer: we are not a public authority, we do not monitor people on a large scale, and we do not process health, biometric or similar special data.

What we collect and why

If you only browse

We do not need an account from you to show you the map. Our web server records technical data — your IP address, browser and the pages requested — which is needed to serve the site and to spot attacks. Map tiles and terrain images are loaded from OpenStreetMap, EOX and the AWS public terrain dataset, so those services see your IP address, the same as for any image on the web.

Legal basis: our legitimate interest in delivering and protecting the site (art. 6(1)(f)).

If you create an account

We store your username, e-mail address and password (hashed — we never see it). You may add an avatar, your off-road experience level and years, your motorcycle model and contact details. Everything after the password is optional and you can remove it at any time.

We use this to run your account, to sign you in, to show who published a place or a track, and to approve new accounts so the map does not fill with spam.

Legal basis: performance of our agreement with you (art. 6(1)(b)); for account approval and anti-spam, our legitimate interest (art. 6(1)(f)).

If you sign in with Google, Google tells us your account identifier and e-mail address. We do not receive your Google password.

What you publish

Places, tracks, events, groups, route marks, photos, videos and GPX routes you upload are stored with a link to your account. Whether they are visible to everyone, to a group, or only to you is your choice, per item.

Bear in mind that a GPX trace is a record of where you rode, and that photos may show people. Publish accordingly.

Legal basis: performance of our agreement with you (art. 6(1)(b)).

Coffee money (MIA)

You may add a MIA payment link to your profile so other riders can thank you for what you publish. This is optional. If you add one, the link is shown to everyone who can see your places, tracks and events — treat it as public. Clearing the field removes it everywhere. If you administer the site, your link is also the one offered by the cup in the header.

We do not process payments. Opening the link takes you to your bank's own page, and the transfer happens between you, your bank and the recipient's bank through MIA. We never see the amount, who paid, or whether a payment took place, and we take no commission.

Legal basis: your consent (art. 6(1)(a)). Withdraw it by clearing the field on your profile.

Live location during events

If you switch on location sharing during an event, we process your position, accuracy, heading and speed so the other participants of that event can see where you are.

• Sharing is off until you turn it on, for each event.
• Only participants of that event see your position.
• We keep only your latest position — we do not build a trace of your ride.
• Stopping deletes it. Anything left behind is purged automatically after 48 hours.

Legal basis: your consent (art. 6(1)(a)). Withdraw it by tapping "Stop sharing".

Messages between event participants

If you join an event, you can send the other participants a short message, or ask them to switch live location sharing on — which is what you do when somebody in the group is lost and everyone needs to find each other quickly.

• Only the participants and the organizer of that event receive it.
• Your message is delivered as a notification as well, so it passes through your browser vendor's push service like any other notification.
• Asking someone to share their location does not switch anything on for them; they decide, and sharing stays entirely up to them.
• You can delete a message you sent. The organizer and our moderators can also remove one.
• Joining an event subscribes you to its messages; leaving it unsubscribes you. To stop receiving notifications altogether, switch them off in the notification settings in the site header.
• Messages exist only while the event runs — for a one-day ride, that day; for a longer event, the days it spans. Once it is over they are deleted.

Legal basis: our legitimate interest in the coordination and safety of a ride you chose to join (art. 6(1)(f)).

Push notifications

If you allow notifications, we store the push endpoint your browser gives us and which kinds of notification you asked for. Your browser vendor's push service (Google, Mozilla or Apple, depending on your browser) necessarily handles the delivery.

Legal basis: your consent (art. 6(1)(a)). Withdraw it in the app or in your browser settings.

Analytics

If — and only if — you accept analytics cookies, we use Google Analytics to see which features people use. It receives an anonymous identifier, your device and approximate location, and the pages and actions you view; if you are signed in it also receives your internal account identifier and role. It never receives your name, username or e-mail address.

Nothing is loaded before you accept, and you can withdraw at any time through "Cookie settings" in the footer. See our cookie policy.

Legal basis: your consent (art. 6(1)(a)).

Quotas

We count how often you use expensive features (route calculation, translation) to enforce fair-use limits and to detect abuse.

Legal basis: our legitimate interest in keeping the service available and affordable (art. 6(1)(f)).

Who else sees your data

• Our hosting provider (host.md), which stores everything on our behalf.
• Google, for analytics (only with your consent) and for Google sign-in (only if you use it).
• OpenRouteService (Germany), which calculates routes. It receives coordinates from our server, never your IP address or identity.
• Telegram, if an event organiser reposts a public event announcement.
• Your browser's push service, if you enable notifications.
• Our e-mail provider, for confirmation and password-reset messages.
• Your bank and the recipient's bank, if you send or receive coffee money through MIA. That transfer happens in their systems, never ours.
• Other riders — but only as much as your own visibility settings allow.

We do not sell your data and we do not use it for advertising.

Google and Telegram operate outside Moldova, so using those features involves a transfer abroad, under their standard data protection terms.

How long we keep it

Your rights

Under Law 195/2024 you can ask us to:

• give you access to your data, and a copy of it;
• correct anything inaccurate;
• delete your data ("right to be forgotten");
• restrict how we use it;
• hand it over in a portable, machine-readable format;
• stop processing based on legitimate interest, by objecting to it;
• withdraw consent you gave, at any time, without affecting what was lawful before you withdrew it.

You are not subject to any automated decision-making on AdvTour.

Two of these you can exercise yourself, right now. On your profile page:

• Download my data gives you the full JSON export.
• Delete my account erases your account and personal data immediately.

When you delete your account we remove your login details, profile, avatar, favourites, live positions, push subscriptions, votes and usage counters. The places, tracks and events you published stay on the map, credited to a deleted rider, because other riders rely on them — they no longer identify you. If you want those gone as well, delete them before deleting your account, or ask us at gdpr@advtour.md.

For anything else, write to gdpr@advtour.md. We answer within one month.

Complaints

If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain to the supervisory authority:

Centrul Național pentru Protecția Datelor cu Caracter Personal datepersonale.md

Changes

If we change this policy we will update the date above, and for anything material we will say so in the app.