Privacy Policy

TBR is operated from Italy. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Italian data protection law, for all users wherever they live.

This Policy is authentic in Italian: this English text is a courtesy translation produced with automatic translation tools; the Italian version prevails.

TBR is an individually-run, non-commercial project; the controller is a natural person.

3.1 Data You Provide

• Account: email, username, name; password (stored only as a secure hash, and only if you register by email)
• Social sign-in: if you use Sign in with Apple or Google Sign-In, we receive your name and email from Apple or Google (Apple may provide a private relay email)
• Profile: country, city, stance, sports and skill levels, boards, sponsors, clubs, and optionally date of birth (required if you want to enter a Contest), gender, bio, website, profile and cover photo
• Content: posts, photos, videos (including in camp and Contest galleries), comments, Shakas, sessions and spots you create
• TBR Tricks (video effects): if you use it, the video you choose (at most 10 seconds), the moments and points you mark, the sport to write on the video; the monthly video counter and the log of requests (effect, time, expiry)
• Club page (only if you create one): name, page username, type, sports, city, country, address and map position, about text, year the business started, website, languages, season and opening hours, the contacts you choose to publish (phone, WhatsApp, email, Instagram), logo and cover, courses and rentals with their prices, camps with dates and place, staff you invite
• Camps: if you ask to join a camp we record the request, its status (pending, accepted, rejected) and the dates. Whoever manages the page can manually add a participant without an account by entering only their name
• Contests: if you enter we record the entry, its category and its status and, during the event, heats, start order, judges' marks, scores, times, outcomes and ranking. Your year of birth (taken from the date in your profile) is used to check the age group. The organizer can mark the fee as "paid": payment happens outside TBR. The organizer can also enter a rider without an account by entering their name, year of birth and, optionally, country, stance and photo
• Judges: the invitations you receive, your answer and the marks you give
• Direct messages: text messages, photo/video attachments, reactions, replies, and — only when you choose to send it — your current position
• Reports and requests: content you report and messages you send us

3.2 Data Collected Automatically

• Technical data: device and OS information, app version, language; IP address and user agent are processed during authentication and by our infrastructure providers
• Push data: your push notification token, platform and app language
• Usage data: which posts appear in your feed (impressions), interactions, and your progress through sign-in and registration: the steps (sign-in method chosen, cancelled or failed; required fields completed; what was missing when you tried to complete the registration), error codes and timings, with platform, app version and a random code created by the app on your phone. Never the text you type. Before you sign in this data is not tied to any account; once you sign in it is linked to yours
• Crash data: if the app crashes or an operation fails, technical reports are sent to our error-tracking service, including your user id, email and username
• Translation usage: a daily counter of how many translations you request (never the content)
• Acceptance records: when you accept the Terms and this Policy we record the accepted version, server date and time, platform, app version, language, IP address and user agent

3.3 Location Data

• Precise GPS location is used ONLY with your permission and only while you use the app: to show nearby spots and sessions on Spot Radar, to create a spot, and to share your position in a chat when you explicitly choose to
• Photo and video files are stripped of embedded location metadata (EXIF/GPS) when published
• We do not track your location in the background

3.4 What We Do NOT Collect

5.1 Public Visibility

A club page is public from the moment its manager publishes it (while it is a draft only the manager sees it) and it also shows the manager's username, name and profile photo. Anyone joining a page's staff appears there only after accepting the invitation and can leave at any time. The link between a rider and a club is public, like the rest of the profile.

Camps and Contests. Requests to join a camp are seen only by whoever makes them and by whoever manages the page (the owner and the Staff who accepted); other users only see numbers, never names. In Contests, accepted entries, heats, scores and rankings are public, including for people without an account; pending or rejected entries are seen only by the person concerned and by the organizers. Year of birth is seen only by the organizers and, for accepted entries, by that Contest's judges: never the full date, never other users. The "paid" status of the fee is seen only by the organizers and the person concerned. Individual judges' marks are not public. Organizers and judges can create a PDF of heats and results to print or share: what they do with it outside TBR is their responsibility.

Direct messages are private: only the two members of a conversation can read them. They are not end-to-end encrypted. Our moderation can access an individual message only if that message has been reported, to review the report. Chat photos are automatically screened for prohibited content at upload. We may disclose data where the law requires it.

5.2 Service Providers (Processors)

5.3 Legal Requirements

5.4 Business Transfers

5.5 No Sale of Data

• Your account is deactivated immediately and disappears from the app
• For 30 days you can change your mind: logging in again reactivates it
• After 30 days, deletion becomes permanent and automatic: profile, posts, media files, comments, Shakas, Buddies, chats (for both sides), push tokens, preferences and — if you had one — your club page with its content (courses, camps, Contests, Fans, staff), your camp requests and your Contest entries with scores and placings (the Contest stays, without you), the TBR Tricks counter and log are erased
• Data may be kept longer only where the law requires it or a report/legal claim is open
• The record of your acceptance of the legal documents is kept for 10 years (legal defence, GDPR art. 17(3)(e))
• Spots and clubs you created remain as shared community resources, no longer linked to you

• All traffic is encrypted in transit (HTTPS/TLS)
• Passwords are stored only as secure hashes
• Database access is protected by row-level security rules enforced server-side
• Chat attachments live in a private bucket accessible only via short-lived signed URLs
• Administrative access to reported chat content is technically restricted to reported messages only
• Automatic deletion jobs enforce the retention schedule

A page manager can also enter in a Contest a participant without an account, possibly under 16, by entering their name and year of birth: they do so under their own responsibility and with the consent of the person concerned or, if under 14, of both parents (Page Manager Conditions §10.3). The name appears in the public results, the year of birth does not.

If a manager added you to a camp or a Contest without you having an account (or you hold parental responsibility for the person added), you can ask for removal by writing to [email protected].

• Image screening: post photos and photos sent in chat are automatically checked by Google Vision SafeSearch; an image that fails is simply not published. If you think a photo was wrongly rejected, contact us — a human reviews such requests. Profile photos, cover photos and a club page's logo and cover do not go through this automated check: they remain subject to reporting and removal
• Club suggestion: when a club page is published, the name and position of the club you entered in your profile are automatically compared with the page's (similar name and/or within 2 km) in order to ask you whether it is your club. The answer is yours alone: if you do not answer, nothing changes, and the manager receives no data beyond what is already public on your profile
• Machine translation: chat messages are translated by an AI model only at the reader's request; the original always remains available
• TBR Tricks: for the effects that need it, the server starts from the points you tap and cuts out the outline of the rider and the board in the frames of the jump, only to apply the effect you chose: no identification of people, no decision about you
• No automated decision produces legal or similarly significant effects on you without human involvement: account suspensions and report decisions are made by a person

Italian Data Protection Authority:
Garante per la Protezione dei Dati Personali — www.garanteprivacy.it