Kolo
Privacy policy
This policy explains how Kolo processes information for its authenticated nearby-rider network for people aged 16 and over. Kolo is a prototype and is not an emergency service.
Information processed
- Account and security information such as email address, display name, identifiers, authentication provider, sessions, recovery and policy-acceptance events.
- Rider profile information such as ride type and characteristics, birth year used to enforce the 16+ rule, optional sex, interests, visibility, and messaging preferences.
- Fresh foreground location and accuracy. Ordinary discovery publishes a coarsened cell and banded distance, not an exact rider coordinate. Sparse cells are suppressed.
- Messages, broadcasts, events, blocks, reports, notification records, and optional push-notification installation information.
- If you explicitly confirm an SOS, one fresh exact incident location, accuracy, consent time, and limited-duration emergency event are shared with eligible nearby riders. This is not continuous or background tracking and does not contact emergency services.
- Technical and security records needed to operate, diagnose, and protect the service.
How information is used
Information is used for authentication, profile and visibility controls, privacy-bounded nearby discovery, rider communication, events and SOS display, blocking and reporting, notifications, abuse prevention, support, and service security.
Visibility and location choices
Profiles start hidden. Foreground publishing stops when you hide your profile, sign out, or leave the foreground. Sex is not published unless you opt in and cannot be used as a discovery filter. Ordinary rider results use approximately one-kilometre cells, rounded distance bands, freshness limits, and minimum cell occupancy.
Sharing and service providers
Public-safe profile and coarsened location fields are shared only with authenticated, eligible nearby riders under the visibility, freshness, occupancy, block, and messaging rules. An SOS exact location is shared only after the separate confirmation described above. Hosting, authentication, push notification, email, map and secure-storage providers — including Railway, Google Sign-In and Firebase Messaging — process this information only on instructions, as processors under data processing agreements, and are not recipients the information is shared with. Pictures you export to another app with the system share sheet are sent to whichever app you choose, which is outside those agreements and outside Kolo’s control.
Kolo’s servers and database are hosted in the United States, so your information is stored and processed there. That transfer relies on the EU–U.S. Data Privacy Framework: Railway Corporation, which hosts the service, and Google, which provides sign-in and push notifications, are each certified under it by the U.S. Department of Commerce. You can check their current status on the Data Privacy Framework list.
Retention and security
The service keeps the latest location rather than a general location history. Most other records are deleted on a schedule rather than kept for as long as they might be useful:
- Messages are deleted 24 months after they are sent.
- Inbox notifications are deleted 6 months after you read them, or 12 months after they arrive if you never do.
- Photographs and videos attached to an event are deleted 30 days after the event ends.
- Places curated by Kolo administrators are removed from the map immediately when withdrawn, and the stored record and its change history are deleted 12 months after that.
- Expired sign-in sessions and email confirmation links are deleted a week after they stop working.
- Records of administrator access to rider information are kept for 24 months, because they are how a misuse of that access would be investigated.
Safety reports are treated differently on purpose. A report that has been resolved or dismissed is deleted 24 months afterwards, together with its handling history. A report that is still open is never deleted on a schedule, because a case somebody is still looking at should not disappear merely because time has passed. If you delete your account, reports you filed are kept but the link to you is removed, so a pattern of reports about the same rider is not lost when the people who reported them leave.
Your account and profile are kept while your account exists and are removed when you delete it, as described on the Kolo account-deletion page. Deleting something does not remove it from backups straight away: backups are taken daily and kept for 6 days, and monthly and kept for 89 days, so a deleted record can remain in a backup for up to 89 days before it ages out.
Production traffic uses HTTPS and native sessions use platform secure storage. No system can guarantee absolute security.
Photos, videos and reviews you add
Event photos, videos and reviews you add remain yours. By adding them you allow Kolo to store them and show them to the riders who are eligible to see them, for the retention periods above, and to remove them. Kolo does not use them for advertising or promotion. Apart from those riders, they are accessible only to the service providers described above and, if they are reported, to the person reviewing the report.
Reports, moderation and appeals
Reports are reviewed by one person, the operator named below, not by a staffed team and not around the clock, so no response time is promised. Reports marked urgent and child-safety reports alert the reviewer directly. If anyone is in immediate danger, call 112: neither a report nor an SOS contacts emergency services.
If content of yours was removed or a report about you was acted on, and you think that was a mistake, email support@rolutec.com with the subject “Kolo appeal”, from the address on your account, and say what happened. The same person reviews the appeal by hand and records the outcome with the case. Removed content is not restored automatically, and evidence that has already expired or been deleted may no longer be available.
Your choices
You can remain hidden, control profile disclosures and message audience, deny location or notification permission, opt out of push, resolve or cancel an SOS, block and report users, sign out, and request account deletion.
Who is responsible, and how to make contact
Kolo is provided by Robert Lucencic, an individual acting as the data controller, at Ozaljska ulica 96, 10110 Zagreb, Croatia. Email support@rolutec.com. See the Kolo account-deletion page.