Xtreme 4x4 — Privacy Policy

Last updated 31 October 2026

This policy covers the Xtreme 4x4 app on iOS, Android and the web. It describes how the app currently works.

What we collect

• Your verified email address. This is how the club identifies you and sends one-time sign-in codes.
• Your mobile number, if you add one. It is optional club-contact information and is not used to sign in.
• Your name and country, as you enter them.
• Your optional profile photo. If you choose one, it is uploaded to the club's image store and can appear with your member identity in the app.
• Your vehicle — make, model, year and a nickname. An optional vehicle photo stays on your device and is not uploaded to the club.
• Your readiness checklist and service history, including service dates and notes you enter.
• Drives you join, the number of guests you bring, waitlist requests and organiser check-in records.
• What you share — community posts, chat messages, replies, reactions, and photos or voice messages you choose to send. Chat attachments are uploaded to the club's image store; voice recording uses microphone permission.
• Your app interactions — RSVPs, cancellations, saved posts, likes, room-read status, blocks and moderation reports needed to provide those features.
• Sign-in security information — the IP address of an email-verification request, its time and attempt count, used to limit abuse.
• Optional phone alerts — if you enable alerts in a supported iOS or Android version, we store a device notification token linked to your signed-in account and session. Expo and the relevant platform delivery provider (Apple or Google) process that token and notification metadata to deliver alerts. Private chat message text is not included in lock-screen alerts. Offers and promotional alerts require a separate opt-in in Notification preferences, which is off by default and can be switched off at any time. You can disable phone alerts in the app or your phone's notification settings; in-app notifications remain available.

We do not collect your location, your contacts, your number plate, or any identity or vehicle documents. The app has no advertising and no third-party tracking. It records technical app errors so the club can diagnose crashes; these reports may include the screen, app version, device-generated stack trace, time, and your internal member id.

Operational monitoring records request counts, failures and elapsed time by fixed route category. These counters exclude request bodies, query strings and member identifiers. The app also keeps local preferences, cached content and recovery drafts so it can recover from interruptions.

How we know who you are

We send a six-digit code to your email address. The code expires after ten minutes and can be tried at most five times. A successful check creates a revocable session on your device; the server stores only a cryptographic hash of the session token. The current app uses verified email, not a phone number, to establish your identity.

Who can see what

• Your posts are visible to other Xteam members. Chat messages and their photos or voice attachments are available to members permitted to access that room; attachment requests require a signed-in session.
• Your name and vehicle appear beside what you write. When you book a drive, your name and passenger count appear in its convoy list for other verified Xteam members. Email addresses and phone numbers are not included in that list.
• Your email address and mobile number are never shown to other members anywhere in the app.
• Club administrators can see member records in order to run the club, approve membership and moderate content.

Blocking and reporting

You can block another member from any post or message. Blocking hides everything they write from you, everywhere in the app, at once. It is one-way and silent — they are not told, and they still see your posts. You can undo it under Profile → Privacy and safety.

Reporting is separate: it asks club administrators to look at something.

Deleting your account

Under Profile → Delete account. It takes effect immediately, and it cannot be undone.

If you cannot use the app, request account deletion by email. The club verifies ownership before acting on an emailed request.

• Deleted: your verified email, optional phone, sessions, sign-in challenges, technical error reports, name, country, vehicle, readiness checklist, service history, every drive you joined, waitlist entries, blocks, and everything you liked or saved. Your profile photo and chat attachments are scheduled for removal from the image store; failed object deletions are retried.
• Kept, with your account attribution removed: posts and chat message text you wrote. They stay in the club shown as “Former member”, so conversations other people are still reading do not break. Personal information you put in the text itself may remain; contact the club if you need help with that content.
• Drives and organiser media remain available, with the deleted member's organiser attribution removed.

Where your data is held

Data the club holds is stored on Cloudflare's network, in a database and an image store operated by Cloudflare on the club's behalf. Uploaded profile photos and chat attachments use that image store. Your optional vehicle photo stays in the app's storage on your device. Data is not sold, rented, or shared with advertisers. Service providers process data on the club's behalf to operate hosting and email delivery; other sharing occurs only where the law requires it.

How long we keep it

Your member record is kept until you delete your account. Content you write is kept as described above. Images uploaded by organisers are kept for as long as the event they belong to is published.

Age requirement

The app is intended for adults aged 18 and over. If you believe someone under 18 has created an account, contact us so we can review and remove the account. The app does not currently verify a member's age.

Your choices

• Edit or remove your name, optional phone, vehicle and country at any time in the app.
• Block any member, and unblock them later.
• Delete your account, in the app, without contacting anyone.
• Ask us for a copy of what the club holds about you, using the contact below.

Changes

If this policy changes in a way that affects what we collect or who can see it, we will say so in the app. The date at the top always reflects the current version.

Contact

Xtreme 4x4, United Arab Emirates — eliek@xtreme-4x4.com. You can also visit the club contact page.