Skip to main content
zerologs
Sign InSign Up
Back to Home

Privacy Policy

Last updated: 26 October 2026

1. Who we are and what this covers

zerologs reads the diagnostic logs of Zero electric motorcycles and turns them into rides, charges and battery health. This policy covers the website zerologs.bike and the Android app ZeroLogs (bike.zerologs.app), which opens the same account. They are run by one independent developer (“we”), who decides how your data is used and is the data controller.

We do not sell personal data, we show no advertising, and the app does not use the Android advertising ID.

2. What we collect, and when

2.1 Your account

  • Email address (required) and password, stored only as a bcrypt hash.
  • If you fill them in: full name, display name, public handle, bio, riding-since year, a profile picture, country, currency and electricity tariffs (for charging costs), unit system, and your body weight (it improves the range estimate).

2.2 Your motorcycle

  • The log files you upload (MBB and BMS .bin files, console captures) and everything read from them: VIN, model, firmware, serial numbers, rides, charges, battery and cell readings, temperatures, odometer, errors and warnings.
  • What you add yourself: bikes, batteries, components, service records, photos of the bike.

2.3 Rides, trips and photos

  • Phone recordings you upload (GPX files, Sensor Logger exports) and the routes built from them; trip names and notes.
  • Photos you add to a trip. We read a photo’s position once, to suggest where it belongs on the map, and then store and publish an image re-encoded without any metadata: no GPS, no camera, no time.

2.4 In the Android app

  • Location (GPS): only while a ride is being recorded (after you tap Start, or, if you turn on automatic rides, while the app waits for and records a ride). Android shows a notification for as long as it runs. The app asks for location “while using the app” only; it does not ask for background location. The positions are uploaded to your account to draw the ride.
  • Bluetooth: the app connects only to the motorcycle you pair through Android’s own pairing dialog, and only reads from it (battery, cells, temperatures, speed, odometer, firmware, and the motorcycle’s log when you download it). If you pair tyre pressure sensors, the app listens to their broadcasts (pressure, temperature and the sensor’s battery); this scan is never used to work out where you are. These readings are uploaded to your account with your rides, and which sensor is on which wheel is kept on your account so that another phone, or the app reinstalled, finds the pairing.
  • The phone: an installation identifier created by the app, the phone’s make and model and the app version, so that you can see the phone in your account and remove it. The app’s credential is kept in the Android Keystore. If push notifications are switched on, a Firebase Cloud Messaging token (Google) is stored to deliver them.
  • Problem reports: when you send one from the app (Report a problem), your words become a ticket in your account, like one written on the Feedback page. If you leave its box ticked, the app also sends its technical log (what it exchanged with the motorcycle, connections and downloads) and the phone’s make, model, Android version and language, the app version, and your motorcycle’s model and VIN. If the app crashes, the error is kept on the phone and offered as a report the next time it opens: it is sent only if you press Send.
  • Files you share to the app wait on the phone until they are uploaded, then the queued copy is removed. Rides recorded with the app are also kept on the phone, so you can see them offline; they go when you uninstall the app.

2.5 Sign-in and security

  • For every sign-in: the IP address, the browser or app it came from, and the time. The IP address is looked up with ip-api.com to show the approximate city and country next to each session in your account, so you can recognise and sign out a device you do not know.
  • Server logs (IP address, request, user agent), kept for a limited time for security, then deleted.

2.6 Messages

  • What you write to us: the contact form (name, email, message), feedback tickets and their replies, survey answers, data correction requests.

2.7 Only if you choose to

  • Analytics cookies: Google Analytics loads only after you accept analytics cookies in the cookie banner, on the website and in the app alike. See the cookie policy.
  • Help decode: if you contribute a Bluetooth capture, we keep only the frames exchanged with the motorcycle and discard the rest of the file.
  • Testing the Android app: if you join the closed test, your Google account’s email is in our Google Group of testers, where only its managers and Google Play can see it. Leaving the group takes you out of the test.

3. Why we use it

  • To provide the service you signed up for (contract): decode logs, build rides, charges and trips, estimate battery health, record rides with the app, show weather and maps, send account email.
  • AI features: the verdicts and summaries on rides, trips, reports and the fleet page, and the assistant, send the figures they need to an AI provider (section 5), not your name or email address.
  • Security and abuse prevention (legitimate interest): sessions, sign-in locations, rate limits, reCAPTCHA on public forms.
  • News by email about the service: every newsletter carries a one-click unsubscribe link.
  • With your consent: analytics cookies, a Gravatar on your public page, Help decode contributions. You can withdraw consent at any time in the cookie preferences or in your profile.

4. What becomes public: only what you publish

Nothing in your account is public by default. You decide what to publish, and you can revoke it at any time:

  • Share links to a report, a trip or a bike: they show only what you ticked, a published link can only be narrowed, never widened, and revoking it stops it at once.
  • Your rider page (/u/your-handle): only if you make it public.
  • Live ride links: your position while the link is open, to whoever holds it, with the area around the start hidden; it ends when you stop it or it expires, and viewers get no archive of it. While a link is open the app also sends its position for that link alone; it is kept in our cache server, not in the database, and expires when the link ends.

5. Who processes data for us

These providers process data only to deliver the parts of the service named here:

  • OVHcloud (European Union): the server that runs the service (database and files).
  • Scaleway (European Union): encrypted off-site backups.
  • DeepSeek (China): the AI features (readings, errors and ride, charge and trip figures, including the places and weather of a trip when a trip is summarised).
  • Langfuse (European Union): records the AI requests and answers, labelled with your account’s email address, to check their quality and cost.
  • Resend: sends our email (your address and the message).
  • Open-Meteo: weather and place search. Our server sends it coordinates rounded to about 1 km, never who you are.
  • ip-api.com: the approximate city and country of a sign-in’s IP address.
  • Google: reCAPTCHA on the contact, feedback and report forms; Google Analytics, only after you accept analytics cookies; Firebase Cloud Messaging in the app, only if push notifications are on; Google Groups and Google Play for the testers of the Android app’s closed test.
  • CARTO and OpenStreetMap: map tiles. Your browser or the app requests them directly, so they see your IP address and the area of the map you look at.
  • Gravatar (Automattic): unless you upload a picture, your avatar inside your account is requested from Gravatar with a hash of your email address. On your public page it appears only if you switch it on.

Some of these providers process data outside the European Economic Area (DeepSeek in China; Google and others may process data in the United States).

6. How long we keep it

  • Everything in your account is kept while the account exists. You can delete a log file, a recording, a photo, a bike or a link at any time.
  • The readings the app records during a ride (about one a second) are kept in full for 12 months. After that only a 10-second summary of them is kept, for as long as the account exists: the lowest and highest value of each reading and the last position in those 10 seconds. The route drawn on each ride stays with the ride. Readings that arrive more than 11 months after they were taken are not accepted.
  • For each upload from the app or another device, the server’s reply is deleted after 48 hours and the upload’s own record after 90 days, leaving a daily count of what was received.
  • Deleting your account removes it and everything it owns at once (from Profile on the website or in the app). How, and what is deleted.
  • Encrypted backups made before a deletion keep a copy until they expire: 14 days on the server; off-site, daily copies for 30 days, weekly for 12 weeks and monthly for 24 months; and a monthly archive kept 10 years that cannot be altered. Backups are used only to recover from a disaster, and accounts deleted since a backup was made are deleted again before the service reopens.
  • Newsletters already sent keep their open and click counts, without your address. Messages to the contact form are kept as long as needed to answer them.

7. Security

Everything travels over HTTPS, both from the website and from the app. Passwords are stored as bcrypt hashes. Every signed-in device is listed in your account and can be signed out from there. Backups are encrypted.

8. Your rights

Under the GDPR you can ask to access your data, correct it, delete it, receive it in a portable format, restrict or object to its use, and withdraw any consent. Most of it you can do yourself: edit your profile, download a report as CSV or PDF and a trip as GPX, delete anything, or delete the whole account. For the rest, write to us through the contact form from the email address of the account.

You can also complain to a data protection authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

9. Children

zerologs is for motorcycle riders and is not meant for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, tell us and we will delete it.

10. Changes

When this policy changes, this page shows the new date at the top.

11. Contact

Questions about this policy or your data: use the contact form. It reaches the developer directly and needs no account. We publish no email address: the site is run by one person, and an address on a public page is an address in every spam list within a week.