CustoMoto! — Privacy Policy

Privacy Policy

Effective Date: July 2026

1. Introduction

CustoMoto! ("we," "our," or "us") is operated by CUSTOMOTO COMPUTER PROGRAMMING SERVICES, a sole proprietorship registered with the Department of Trade and Industry of the Philippines (DTI Business Name No. 8091235), Region IV-A (CALABARZON), Philippines.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the CustoMoto! mobile application ("App"). We are committed to protecting your privacy in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations.

By downloading, installing, or using the App, you consent to the collection and use of your personal information as described in this Policy.

2. Personal Information We Collect

2.1 Information You Provide Directly

Email address — used to create and manage your account
Password — stored in encrypted form via Firebase Authentication; we never see your plain-text password
Country and region — collected during onboarding to personalise your experience. This is information you provide or confirm — it is not precise GPS tracking. We do not continuously collect your real-time GPS location. We do not use the App to track your precise real-time GPS location for this purpose.
Motorcycle details — make, model, year, and customisation preferences you enter or save
Profile information — display name and other optional fields you choose to provide
Profile photo (optional) — if you choose to upload a photo from your device gallery, we collect and store the image file so it can be shown as your avatar. A profile photo may reveal what you look like or other personal details; providing it is voluntary. The image is processed on your device (resized and compressed before upload), uploaded to Google Firebase Storage (Google LLC, USA) in the Singapore region (asia-southeast1), and a secure HTTPS link is saved in your profile. We do not use your profile photo for automated identity verification or biometric identification. If you delete your account or request erasure, we will delete your profile image from Firebase Storage and clear the stored link within the retention period in Section 6.
Referral information — if you create your account through another user's invite link, we record which account referred you, and we maintain referral counts and reward progress for both accounts as part of the Invite a Friend program.

2.2 Information Collected Automatically

Device information — device type, operating system version, and unique device identifiers
Usage data — features used, screens visited, and interactions within the App
Log data — IP address, access times, and crash reports
Firebase Analytics data — anonymised usage patterns to improve the App
Push notifications — if you opt in, we collect and store an Expo push token in your Firebase user profile to send service and product messages related to the App. Delivery uses Expo's push notification service, which on Android uses Firebase Cloud Messaging (FCM). You may turn off notifications in the App or in your device settings at any time.

2.3 Information from Third Parties

Google Sign-In — if you use Google OAuth to log in, we receive your name and email address from Google in accordance with Google's Privacy Policy

2.4 MotoBot AI Assistant

If you use MotoBot, you may choose a display name and personality for the assistant. Your messages and related session data (such as your MotoBot settings and recent chat content) are sent to Anthropic PBC (USA) through the Claude API to generate replies. Anthropic processes this information as our service provider only, not for their own advertising. Chat content is stored in your Firebase-backed account so you can view your history in the App. When you delete your account or request erasure under the Data Privacy Act, we will delete your stored MotoBot history and personalization settings together with your other account data.

3. How We Use Your Information

To create and manage your account
To provide, operate, and improve the App and its features
To personalise your experience, including showing relevant motorcycle parts and customisation options
To process in-app purchases and manage your subscription status
To operate reward features such as daily rewards, login streaks, quests, and the Invite a Friend referral program
To send you important notices, updates, and support communications
To detect, investigate, and prevent fraudulent or abusive activity
To comply with legal obligations under Philippine law
To analyse usage trends and improve our services
Automated content checks — to keep the community respectful, we use automated word-list checks on your device and our servers to review user-entered names (such as usernames and display names). Rejected names are not stored. This does not involve human review unless we investigate a reported abuse case.

4. Legal Basis for Processing

Consent — you have given us clear consent to process your data for specific purposes
Contract — processing is necessary to perform the App services you have requested
Legitimate interests — to detect fraud, improve our services, and ensure App security
Legal obligation — to comply with applicable Philippine laws and regulations

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

5.1 Service Providers

Google Firebase (Google LLC, USA) — authentication, Cloud Firestore database, Firebase Storage (for optional profile photos), security rules, and hosting. Data is processed primarily in the asia-southeast1 (Singapore) region.
Anthropic PBC (USA) — Claude API processing when you use MotoBot. Processing is performed under our instructions to provide AI-assisted responses only.
Google Play Billing (Google LLC) — processing of in-app purchases and subscriptions on Android. Your payment details (such as your card or e-wallet information) are handled by Google, not by us; we receive only the order and entitlement information needed to deliver what you purchased.
Expo (Expo, Inc., USA) — push notification delivery, as described in Section 2.2.
Cloudinary — image hosting and processing for shared build images

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government authority in the Philippines, or to protect the rights, property, or safety of CustoMoto!, our users, or the public.

5.3 Business Transfer

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email or a prominent notice in the App before your information is transferred and becomes subject to a different privacy policy.

6. Data Retention

Account data — retained for the duration of your account and for 90 days after deletion
Build and customisation data — retained until you delete it or close your account
Transaction records — retained for 5 years as required by Philippine tax and accounting regulations
Log data — retained for 90 days for security and debugging purposes

You may request deletion of your account and personal data at any time by contacting us at wrathfulrealm@gmail.com.

7. Your Rights Under the Data Privacy Act of 2012

Right to be informed — to know what personal data we collect and how we use it
Right to access — to request a copy of your personal data that we hold
Right to rectification — to have inaccurate or incomplete data corrected
Right to erasure or blocking — to have your data deleted or blocked under certain circumstances
Right to object — to object to the processing of your personal data
Right to data portability — to receive your data in a structured, commonly used format
Right to lodge a complaint — to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph

To exercise any of these rights, contact our Data Protection Officer at wrathfulrealm@gmail.com. We will respond within 15 working days.

8. Data Security

Firebase Authentication with encrypted password storage
Firestore Security Rules that restrict each user to their own data only
Server-side validation for all sensitive operations including payments and subscriptions
HTTPS encryption for all data in transit
Rate limiting on all API endpoints to prevent abuse
Sign-in session — when you sign in, Firebase Authentication keeps an authenticated session on your device using secure local storage so you do not need to log in every time. Signing out clears the active session from the App on that device. Sign out if you share your device with others.

9. Children's Privacy

CustoMoto! is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at wrathfulrealm@gmail.com and we will delete such information promptly.

10. International Data Transfers

Your information may be transferred to and maintained on servers located outside the Philippines, including Google's asia-southeast1 (Singapore) region. By using the App, you consent to such transfers. We ensure that adequate safeguards are in place consistent with the requirements of the Data Privacy Act of 2012.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the App and updating the effective date above. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

July 2026 update: Clarified that in-app purchases and subscriptions are processed by Google Play Billing on Android (removed references to payment processors the App does not use), added the referral (Invite a Friend) data disclosure, and added reward-feature processing purposes.

May 2026 update: Added disclosures for profile photo storage (Firebase Storage), MotoBot AI processing (Anthropic Claude API), push notifications (Expo/FCM), automated content moderation, sign-in session persistence, and expanded location data clarification.

12. Contact Us

Data Protection Officer
CUSTOMOTO COMPUTER PROGRAMMING SERVICES
DTI Business Name No. 8091235
Region IV-A (CALABARZON), Philippines
Email: wrathfulrealm@gmail.com
Website: customotoapp.github.io

You may also file a complaint with the National Privacy Commission at privacy.gov.ph.