Who is responsible
Jesús G Paterna, Spain, is the controller for Credit Coaster. For privacy, rights and support, contact creditcoasterapp@gmail.com. You do not need to send an identity document when you first contact us. We will ask for further information only when needed to verify a request and only to the extent necessary.
What data we use
- Account
- Email address, user ID and authentication data. Your password is encrypted in transit to Supabase Auth, which verifies it. It is not stored in plain text in the catalogue.
- Passport
- Coaster credits, ratings, notes, approximate or exact ride dates if you enter them, display name, Home Park, park preferences, friendships and invitations. Ride dates and notes are optional.
- On your device
- Interface, units and motion preferences, cached catalogue and images, guest Passport and your selected avatar. On iOS and Android, session tokens use secure system storage. When you choose a new photo after consent, a reduced copy is sent via Supabase to OpenAI for automated checks of explicit sexual content. The accepted avatar stays on your device and is not published or shared with friends. No photo is stored in our database or public storage by this check. Usage counters linked to your account prevent abuse and are reset each UTC day; older entries are removed on subsequent checks. Removing the photo also resets permission for future checks. Provider processing is subject to OpenAI data controls; this is not a promise of local-only processing or zero retention by the provider.
- Optional location
- The app requests permission to use your location while in use. It checks your position once when opened if you have already granted permission, or when you grant it, to centre the map and estimate how close parks are. It does not track you continuously or in the background. Your position stays in app memory and is not added to the Passport or saved in our database. Your operating system and map provider may handle technical data under their own terms.
- Technical data
- Infrastructure providers receive information needed to serve and protect the service, including IP address, request time, user agent, authentication and error logs. The app logs we design do not contain passwords or the contents of your notes.
- Contact
- If you email us, we receive your address, subject, message and any information you choose to attach. Avoid sending passwords, access codes, documents or sensitive data.
Purposes and legal bases
We provide account registration, Passport sync, credit management and friendship features to deliver the service you request (GDPR Article 6(1)(b)). Optional location and sharing of notes or Passport rely on consent, which you may withdraw in the corresponding settings while keeping catalogue access (Article 6(1)(a)). Security, abuse prevention and troubleshooting rely on our legitimate interest in keeping the service safe, with data minimisation (Article 6(1)(f)). Where applicable we handle rights requests and legal obligations under Article 6(1)(c).
We use support messages to address what you request, either to provide the requested service or based on our legitimate interest in resolving the issue. We do not add you to marketing lists.
What other people can see
Accepted friends can see your display name and the profile information used by social features. They can see your credits, ratings and stats only when you share your Passport. Your ride dates remain private. Friends can read your notes as reviews only when you enable that option as well. You can turn off sharing in Settings. Your ratings contribute to the overall ride average without showing your identity alongside it.
Passport sharing includes recently added rides and credits you have in common. The MVP does not have friend push notifications enabled. Enabling them in future would require service configuration and device permission.
Recommendations
Home compares your ratings and catalogue attributes to suggest similar models or coasters. It also uses community averages and, with your permission, approximate distance. We do not send your notes to an AI service to generate recommendations. We do not make automated decisions about you with legal or similarly significant effects.
Providers and international transfers
Supabase provides authentication and the database. Cloudflare hosts this site and serves images. Google/Gmail provides the support mailbox and may send sign-in emails if SMTP is configured. Apple Maps provides the map on iOS. On Android, OpenFreeMap serves vector tiles based on OpenStreetMap. The web Map implementation uses Leaflet and OpenStreetMap tiles with resources from unpkg. POV links open YouTube or another external service only when selected.
Providers may process data outside the European Economic Area. Processing is subject to their terms and applicable safeguards, such as standard contractual clauses or adequacy decisions where relevant. We cannot guarantee that every request, copy or support operation stays in Spain or the EU. Contact us for details about the safeguards.
Read the policies of Supabase, Cloudflare, Google, Apple and the OpenStreetMap Foundation. External resources and videos have their own policies. This support site embeds no videos, maps, advertising pixels or third-party analytics.
How long data is kept
Account and Passport data are kept while your account exists, until you update the data or request deletion, subject to legal obligations or the need to retain information for claims. You can delete your account in Passport → Settings → Delete account. This revokes sessions and removes your account, credits, notes, profile and related connections from the live database. Your ratings no longer count towards community totals. The public catalogue remains available.
Deletion does not remove copies or screenshots others lawfully made earlier. Provider backups and technical logs may retain information for their retention cycles. We do not promise instant deletion of every historical copy. Any restoration must honour deletion requests.
We keep emails while we address the request and only as long afterwards as needed for follow-up, security or potential claims. We review whether they are still necessary and delete those we no longer need. Log and backup retention depend on the provider’s plan and configuration. You may ask for details. You can remove local settings and caches on your device. Uninstalling the app does not delete your remote account.
How to exercise your rights
Where applicable you can ask for access, rectification, erasure, portability, restriction or objection, and withdraw consent without affecting prior lawful processing. Email creditcoasterapp@gmail.com with the right you wish to exercise and your account email. We will verify ownership proportionately and respond within one month. If a legally permitted extension is needed due to complexity, we will notify you within that period. You can complain to the Spanish Data Protection Agency.
Children, security and changes
The service is not directed at children under 14. If you find data about a child shared without required authorisation, contact us to review it and remove it where appropriate. Do not send other people’s data in notes or messages without a lawful basis.
We use HTTPS, authentication and per-user access controls. No service can guarantee the absence of incidents. You can report one using the contact address above. We will update this policy when features, providers or purposes change and give notice before implementing significant changes requiring new information or consent.
Cookies and web form
This support site does not set its own advertising or analytics cookies or store form text on a server. The form prepares a draft in your email client. Nothing reaches the support mailbox until you send it. Cloudflare may use necessary technical security mechanisms. If used separately, the web app keeps its session, preferences and cache in browser storage.
The authentication callback temporarily holds the tokens returned by Supabase in memory after you confirm an email link. It removes them from the address bar and does not send them to analytics or the contact form. Never share a complete sign-in email URL.