Privacy Policy

Effective date: October 1, 2026  ·  Last updated: October 1, 2026

One Culture ("we," "us," or "our") operates the One Culture mobile application and website (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

1. Information We Collect

We collect information you provide directly when you create an account or use the Service:

• Account information: your name, email address, and password (stored as a one-way hash)
• Profile content: bio, profile photo, and garage (cars you add)
• Posts and media: photos you upload, captions, road names, and mod details
• Social actions: likes, comments, follows, group memberships, and messages
• Location data: GPS coordinates shared during group drives (only while you have location sharing active; not stored permanently)
• Road submissions: route waypoints you contribute to the community map

We also collect certain information automatically when you use the Service:

• Device type and operating system
• IP address and approximate location (for security and fraud prevention)
• Usage activity such as pages visited and features used

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To create and manage your account
• To enable social features such as posting, commenting, following, and messaging
• To display community-contributed driving roads on the map
• To send transactional emails (e.g., password resets)
• To detect and prevent fraud, abuse, and security incidents

We do not sell your personal information to third parties.

3. How We Share Your Information

We share your information only in the following circumstances:

• With other users: your name, profile photo, bio, posts, and public activity are visible to other users of the Service
• Service providers: we use Supabase (database and file storage) and Resend (transactional email) to operate the Service. These providers process data on our behalf and are bound by confidentiality obligations
• Sign-in providers: if you choose to sign in with Google or Apple, those providers share limited profile information (name, email, profile photo) with us per their own privacy policies
• Legal requirements: we may disclose your information if required by law or to protect the rights and safety of our users

4. Data Retention

We retain your account data for as long as your account is active. When you delete your account, we permanently delete your profile, posts, comments, and associated data from our systems within 30 days. Some anonymized aggregate data may be retained for analytical purposes.

5. Your Rights and Choices

You have the following rights regarding your personal data:

• Access and correction: you can view and update your profile information at any time from your profile settings
• Account deletion: you can permanently delete your account from the Edit Profile screen in the app. This removes your profile, posts, photos, and all associated data
• Data portability: to request a copy of your data, contact us at the address below
• Opt-out of communications: you may opt out of non-essential communications by contacting us

6. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete it promptly.

7. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS), hashed passwords, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Third-Party Services

The Service uses the following third-party services, each governed by their own privacy policies:

• Supabase — database and file storage (supabase.com/privacy)
• Google Sign-In — optional authentication (policies.google.com/privacy)
• Sign in with Apple — optional authentication (apple.com/legal/privacy)
• OpenStreetMap / OSRM — map tiles and road routing (no personal data shared)

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes your acceptance of the updated policy.