Kolvoy Privacy Policy

Effective date: 12 November 2026 · App: Kolvoy for Android (com.kolvoy.app) and the website kolvoy.app · Controller: Elia Elhadad, an individual developer, Or Yam 52, David Hamelech St, Sderot, Israel ("we", "us") · Contact: support@kolvoy.app

Kolvoy is a group intercom for motorcycle riders. We built it so we learn as little about you as possible. You can ride without an account. There are no ads, no analytics and no tracking SDKs, and Kolvoy is free. Voice, positions and names inside a ride go only to the riders in your group, end-to-end encrypted.

This policy explains every way data leaves your phone: what stays on the phone (§2), what your group sees (§3), what our relay server sees (§4), the optional account and friends (§5), SOS texts to your emergency contacts (§6), the services we use (§7), permissions (§8), retention (§9), deletion (§10), security (§11), age (§12), your rights (§13) and international transfers (§14).

1. Summary

We do not sell personal data and we do not use it for advertising or profiling.

2. Data that stays on your phone

• Your rider name and settings (talk mode, music, announcements, location precision, safety settings).
• Your device keys. A signing key pair and an encryption key pair are generated on the phone. The private keys are protected by the Android Keystore and never leave the device.
• Your crews (saved groups). Each crew holds the group's secret key, which works like a password: anyone who has it can join that group.
• Your emergency contacts' names. You pick up to 5 contacts with the system contact picker or type them in. Kolvoy cannot read your address book; it only sees the contact you pick. Names stay on the phone. The numbers are registered with our server (§6).
• Ride history (distance, duration, track, who rode), offline map areas and diagnostic logs. They are stored only on the phone. You can export a ride as GPX or a diagnostics log yourself; nothing is uploaded automatically. "Send feedback" opens your own mail app and nothing is sent until you press send there.
• No motion or health sensors. Kolvoy does not read the accelerometer or gyroscope and has no crash detection.

Kolvoy opts out of Android cloud backup and device-to-device transfer, so none of this is copied to Google backups or to a new phone.

3. Data shared with your group

During a ride your phone sends the following to the other members of your group, directly (phone to phone over Bluetooth and Wi-Fi) and through our relay server when there is internet:

• your voice while you talk (Smart hands-free, Always open or push-to-talk, as you choose). Nothing is recorded or stored;
• your location, speed, heading and battery level while a ride is active, including with the screen off. In Settings → Location sharing you can share your exact position, an approximate one (about 500 m) or none on the map. An SOS always carries your exact location;
• your rider name and your device's public keys;
• text messages, waypoints, routes and SOS alerts you send. An SOS alert includes your location and a flag saying that our server knows your emergency contacts, so any rider in the group who has internet can ask it to text them (§6). The alert does not contain their numbers unless you turn on "Share my emergency contacts with my group for offline SOS" (§6).

All of this is end-to-end encrypted (ChaCha20-Poly1305 with keys derived from the group secret). Only phones that hold the group secret can decrypt it; our relay server and anyone listening on the radio or the network cannot. The riders in your group can see what you share with them, so share invites only with people you trust. Other riders' phones relay your encrypted packets to extend range; they cannot read them unless they are in your group.

Nearby friends. If you have an account and friends, your phone sends a short Bluetooth code that only your friends' phones can recognise (it changes every 10 minutes and means nothing to anyone else), so Kolvoy can show "friend nearby" even with no signal. You can turn this off in Settings.

4. Data our relay server sees

When phones have internet they connect to our relay server (api.kolvoy.app, relay-*.kolvoy.app), so riders who are far apart still hear each other. The server cannot decrypt voice, positions, names or messages. To route packets it necessarily sees:

• your IP address, and when you connect and disconnect;
• the group ID (a random identifier derived from the group secret) and a group authentication key that proves membership but cannot decrypt anything, plus the group admin's public key;
• random per-session sender IDs (new every session, not tied to you or your device);
• packet types, sizes and timing, which shows who in the group is talking when, and that an SOS was sent (not where, and not by whom by name).

We use this only to operate, secure and rate-limit the service. Server logs show IP addresses shortened to their network (IPv4 /24, IPv6 /48) and never contain phone numbers or message text.

5. Optional account, friends and ride parties

Riding never needs an account; choose "Continue offline". If you sign in with Google, Apple or your phone number, we use Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check) as our processor to store and process:

• your sign-in identifier: the email of your Google account, the address Apple gives us (which can be a private relay address), or your phone number, plus a random account ID. Phone sign-in codes are texted by Firebase Authentication;
• your profile: the name, username and bike you enter, a link to your Google profile photo if you choose it, and a random friend code. Your friends see your profile. Other users see your name, username and bike only when they type your exact username, scan or type your friend code, or open your friend link;
• your friend list, friend requests and blocks;
• the public keys of your phones, which your friends' phones use to recognise you nearby and to encrypt ride invites for you;
• your status: "online" while the app is open, "riding" and the ride name during a ride. Only your friends see it;
• ride invites and ride parties: each invite is encrypted on the host's phone for each friend's phone, so we cannot use it to join the ride. We see who invited whom, the ride name and when;
• a push token per phone, to deliver friend-request and invite notifications;
• an App Check / Play Integrity result showing that requests come from the genuine app (processed by Google).

Your voice, positions and SOS work the same with or without an account, and are never stored in your account.

Crash reports (off by default). If you turn on Settings → Privacy → Send crash reports (no account needed), Firebase Crashlytics receives technical crash data: stack trace, device model, Android and app version, and a random installation ID. It does not receive your location, voice, contacts or messages. You can turn it off at any time.

Finding friends from your address book is not part of this version. Kolvoy does not request access to your contacts. If we add it later, it will be opt-in, explained in the app first, and this policy will be updated before.

Payments. Kolvoy is currently free and has no in-app purchases. If paid features are ever introduced, we will update this policy before they launch.

6. Emergency contacts and SOS text messages

Registering your contacts. When your phone is online, Kolvoy registers your emergency contacts' phone numbers (up to 5, never their names) with our relay server, signed with your device key. No account is needed. The server stores them encrypted (ChaCha20-Poly1305), linked only to your device's public key. The app refreshes the record at least weekly; the server deletes it 180 days after the last refresh. Removing all your emergency contacts in the app deletes it at once.

When an SOS is escalated. SOS is manual: you hold the SOS button and a short countdown runs that you can cancel. If you do not cancel, a rider's phone that has internet (yours or another group member's) asks our server to text your contacts. It gives our server your signed SOS alert: your rider name, the kind of alert (for example "needs help"), the time and your location. Our server checks the signature and builds the text itself from a fixed template: your name, the alert, the time, a map link and a Plus Code. Nobody can make our server send any other text. The rider who asked never learns the numbers.

Our server passes each number and the text to our SMS provider, Twilio Inc., which delivers it and reports whether it was delivered. For 24 hours our server keeps, encrypted, your name, the SOS time, the numbers it texted and their delivery status, so the app can show you who was reached and, if the SOS is cancelled, text the contacts who received it that you are OK. To stop abuse (for example at most 8 texts to one number per day, plus limits per device, group, network address and overall), it keeps keyed one-way hashes of numbers, device keys and IP addresses, never the values themselves, for up to 48 hours. Twilio keeps message records under its own policy and the retention settings we choose (§7, §9).

Nothing is sent to your contacts unless an SOS happens, except a single test text when you tap "Send test SMS". Tell people before you add them as emergency contacts. They can reply STOP to opt out where the carrier supports it.

Offline fallback (your choice). "Share my emergency contacts with my group for offline SOS" puts your contacts' numbers inside your end-to-end-encrypted SOS alert, so any rider in your group can text them even if your contacts never reached our server. Everyone in the group you ride with can then see those numbers. It is on by default only while your contacts are not registered with our server (for example before your phone has been online), and you can turn it off. If no rider has internet or our server cannot text a contact, Kolvoy offers to open your own messaging app with the SOS text filled in; that message is sent by your phone and your carrier, not by us.

SOS is not an emergency service. See the Terms of Use, section 2.

7. Services we use (processors and independent providers)

We do not use advertising, analytics or attribution SDKs. If you agreed to share usage and diagnostics with Google through Android, Google Play gives us aggregate crash and ANR statistics.

The kolvoy.app website sets no cookies and loads no trackers. Only the /account page loads Firebase (sign-in, with Google reCAPTCHA for phone sign-in).

8. Permissions

Kolvoy does not request access to your contacts, SMS, call log or background location.

9. Retention

10. Deleting your data

• Delete your account in the app (Settings → Account → Delete account), on the web at https://kolvoy.app/delete-account, or by writing to support@kolvoy.app. In the app and on the web, your profile, username, friend code, friends (including your entry in their lists), requests, invites, ride parties, status, push tokens and sign-in record are erased from our servers right away. By email we delete within 30 days and confirm.
• Remove your emergency contacts in the app to delete them from our server at once. Do this before you erase the app's data or uninstall it: afterwards the app can no longer prove the record is yours, and it is deleted automatically 180 days after its last refresh.
• Forget a crew to delete that group's key from your phone. Erase all data on this phone (Settings) or uninstalling deletes your keys, crews, contacts, ride history, maps and settings from the phone.
• For server-side SOS records or Twilio message records, write to support@kolvoy.app with the approximate time of the SOS. Group IDs are random, so we need these details to find them.

What you already shared with your group (your voice as heard live, a position) exists on the other riders' phones only for as long as their app shows it. We cannot delete it from their phones.

11. Security

Group traffic is end-to-end encrypted (ChaCha20-Poly1305, X25519, Ed25519, HKDF-SHA-256). Connections to our servers use TLS, and release builds refuse unencrypted connections. Device keys are protected by the Android Keystore, in secure hardware where the phone has it. Stored emergency-contact numbers and SOS records are encrypted at rest. No system is perfectly secure; if you think an invite has leaked, the group admin can rotate the group key, or you can start a new group.

12. Age

Kolvoy is meant for riders aged 16 and over and is not directed at children. Do not create an account or use Kolvoy if you are under 16. If we learn that we hold account data of someone under 16, we delete it. If you believe a child has given us data, write to support@kolvoy.app.

13. Your rights

You have rights under the Israeli Privacy Protection Law, 5741-1981 and its regulations and, if you are in the EU, the EEA or the UK, under the GDPR / UK GDPR. They include the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time (for example by turning crash reports off) without affecting earlier processing. Write to support@kolvoy.app; we answer within 30 days. Without an account we hold very little data and none of it is linked to your name, so we may need details from you to find it.

You can also complain to a data-protection authority: in Israel the Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority), or the authority where you live or work in the EU/EEA/UK.

Legal bases (GDPR): performance of the service you ask for (relay, SOS texts, your account, friends and ride parties); consent (crash reports, sharing your emergency contacts with your group); legitimate interests (security, abuse prevention, short-lived logs, app configuration); and the vital interests of a rider in an emergency (SOS texts). Our EU representative under GDPR Article 27: [EU_REPRESENTATIVE].

14. International transfers

We are based in Israel, which the European Commission recognises as providing adequate protection for personal data. Our account database and Cloud Functions run in Google Cloud EU regions and our relay server is hosted in the EU. Some processors handle data in other countries, in particular Google (Firebase Authentication, Cloud Messaging, Crashlytics, App Check) and Twilio, which may process data in the United States. For these transfers we rely on the providers' data-processing terms, including the EU Standard Contractual Clauses and, where they participate, the EU-U.S. Data Privacy Framework, and on the conditions of the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

15. Changes

If we change this policy we update the effective date above and, for material changes, tell you in the app before the change applies.

16. Contact

Elia Elhadad · Or Yam 52, David Hamelech St, Sderot, Israel · support@kolvoy.app