Privacy Policy

This is a courtesy translation. The binding version of this document is the Portuguese one, available at kitesession.app. In case of any divergence between the versions, the Portuguese text prevails.

Updated on 16 October 2026

In one sentence

Kite Sessions exists to bring people together in a session: a meetup at a spot, with date and time. Everything we collect serves that. We do not sell your data, we do not rent your contact list and we do not use your location for advertising.

Who is responsible for your data

The party that decides what is collected, and answers for it to you and under the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law 13.709/2018), is RIZER TECNOLOGIA DA INFORMAÇÃO LTDA, registered under CNPJ 41.352.161/0001-21, which operates Kite Sessions.

For any privacy matter, whether access, correction, deletion or complaint, write to [email protected]. We reply within 15 days.

What we collect, and why

So you can have an account

• Name, @ and email. Without them there is no account and no way to recognise you in the community.
• Password, stored only as a hash (bcrypt). Not even we can read your password.
• Phone, if you provide it. It is optional and serves only for contact inside the app.

So the app can show what is nearby

• Your approximate location, if you allow it. We use it to sort spots and sessions by distance, at the moment you open the screen.
• The city you choose manually. The app never depends on GPS alone: there is always a manual city switch, and anyone who refuses the location permission uses the whole app.
• We do not track your position in the background. The app does not ask for that permission.

So you exist in the community

• Your bio, your skill level, your disciplines, your gear and the spots you ride. All optional, all editable, and what is public you control in Profile › Privacy.
• Your profile photo and the photos you upload, if you upload any.
• Your sessions, attendances and check-ins. Whoever takes part in a session sees who else is going: that is the point of the product.
• The messages you write in session chats and in direct conversations.

So notifications reach you

• An identifier of your device provided by the notification system (push token). It is not your number or your IMEI, and it stops working when you uninstall the app.
• You choose which notifications you receive in Profile › Notifications, and turning them all off is a legitimate option.

So the service works and stays up

• Technical logs: date, time, IP address, device type and which API endpoint was called. They serve to investigate errors, abuse and intrusion. We keep them for 6 months, as required by the Brazilian Internet Civil Framework (Marco Civil da Internet).
• App usage measurement: which screens are opened and which actions happen, such as joining a session, reporting a spot's condition, sending a suggestion. Each event carries the system (iOS or Android), the app version and an identifier we create for your account, the same one that already appears in the app's public addresses.

What you write does not go with it. The text of a message, a report or a suggestion never enters the measurement; what enters is that a report happened, not what it said. Your name, your email and your phone do not go either.

It serves one purpose only: knowing what is used and what is not, to decide where to work. When you delete your account, that identifier stops being linked to you.

When you visit the website

The kitesession.app website, including the spot pages, measures audience with Google Analytics. For that your browser stores two of our cookies, named _ga and _ga_P3RZQLL87P, which last up to 2 years and carry a randomly drawn number. It is that number that makes it possible to know that two visits came from the same browser.

Alongside it we record the addresses of the pages you opened, where you came from (the link or the search), the approximate region inferred from your IP, and the browser, the system and the device type.

This is not linked to any account. The website has no login: there is no way to associate those visits with your name, your @ or your email, nor with the app measurement described above. They are two separate records, and we do not cross them.

The password reset page was left out of the measurement, on purpose: its address carries your reset token, and Analytics would store that entire address.

Our legal basis here is the legitimate interest in knowing what on the site is read and what is not. If you do not want to be measured, you can refuse or erase cookies in your browser settings, or use a blocker: the site keeps working in full, because the measurement is not necessary for it. And you can object to the processing by writing to [email protected].

What we do NOT collect

• Card or bank account data. The app does not process payments.
• Your contact list, your calendar, your microphone, your files.
• Health data, biometrics, racial origin, religion, political opinion or sex life. None of it is asked for, and there is no field for it.
• Advertising identifier (IDFA on iPhone, Advertising ID on Android). The app shows no network ads and takes part in no audience auction. The usage measurement described above was installed in the version without that identifier: it is an installation choice, not a setting someone could switch on later without publishing a new version of the app.

Who we share with

With no one for marketing purposes. The only third parties that touch your data are the ones that make the service work:

• Amazon Web Services: stores the photos uploaded in the app.
• DigitalOcean: hosts the server and the database.
• Expo (Expo Push): delivers notifications to your device. It receives the device token and the notification text.
• Google (Places API): when you open the map, we send the coordinates of the visible region to find schools and shops nearby. We send the map region, not who you are.
• Google (Analytics for Firebase): receives the usage measurement described above, that is, screens opened, actions taken, system, app version and your account identifier. It does not receive what you write, nor your name, email or phone, and it does not receive an advertising identifier.
• Google (Analytics): receives the website measurement described above, that is, pages opened, visit origin, approximate region, browser and the cookie's randomly drawn number. It receives nothing that identifies you, because the website has no login.
• Apple and Google: the stores through which the app is distributed, under their terms.
• Slack: receives an internal notice when something happens in the app (new account, spot registered, report), with your name, your @ and what was done. It is the dashboard of whoever operates the product, it is not public and it does not serve advertising. Your email, your phone and your location do not go in those notices.

We also share when the law requires it: a court order or a request from a competent authority. In that case we notify you, unless the proceeding itself forbids it.

When a school registers you

Schools and businesses use Kite Sessions to run their own operation, and in doing so they register students, including people who have never opened the app. If you take lessons at a school that uses the panel, there may be data about you here without you having created an account.

What the school may store about you: name, email, phone, level, date of birth, weight (which decides the gear size), the school's own notes, the lesson history, the waivers you signed, with the date, the IP and the signature stroke, and the amounts you owe or have paid them.

The school decides this, not us. In that part the relationship is inverted: the school is the controller of that data, because it is the one choosing what to register and why; Kite Sessions is the processor, because it stores and processes at the school's request. It is the same figure as an enrolment ledger kept by the school, except the ledger is ours.

In practice, that means three things:

• To access, correct or erase, talk to the school. It can edit and remove your record through the panel, immediately. If it does not reply, write to [email protected]: we mediate and, when the law requires, we act on our own.
• The school answers for having the right to register you. We require that in its terms; we have no way to check, case by case, whether you authorised it.
• We do not use that data for anything of ours. It does not enter measurement, it does not become a recommendation, it does not appear to other users and it is not sold. The email is used only for what the school asked for: the lesson reminder, the waiver to sign and the invitation to the app.

If you do have an account and the school registers you with the same email, the two things link up: the lesson starts appearing in your app, you confirm attendance and sign the waiver there. The link is born from the email and you undo it by leaving the school: ask it, or write to us.

What stays visible to others

• Always: your name, your @, your photo, your sessions and what you write in chats.
• If you allow it: your city and your gear (Profile › Privacy).
• Per session: who can join is defined in the "Who can join" field when the session is created.
• Your email, your phone and your exact location never appear on anyone's public profile.

How long we keep it

• While the account exists, whatever the account needs to work.
• Technical logs: 6 months.
• Website measurement cookies: up to 2 years, or until you erase them.
• Backups: up to 30 days. They are erased on a cycle and are only opened to restore the service.
• After you delete your account: the data that identifies you is removed immediately (see the next section). What remains is no longer yours.

Your photos and videos

You remove what you uploaded whenever you want, including after moderation has approved it: in the spot gallery, tap your media and use Remove. The file leaves the app and our storage immediately.

Two things take longer, for technical reasons: the image may keep appearing for a few hours on devices and distribution servers that had already downloaded it, and it may remain in the backups for the up to 30 days above. Neither of them is used to republish what you took down.

We also keep the upload date and the version of the Terms of Use in force at the time. It is a record of consent: it serves to know which text was valid on that day, and nothing else.

Your rights, and how to exercise them

The LGPD gives you the right to confirm processing, access, correct, request anonymisation or deletion, request portability, know who we share with and withdraw consent. In Kite Sessions none of that depends on an email request. It is in the app:

• Access and correct: Profile › Edit.
• Control what is public: Profile › Privacy.
• Control notifications: Profile › Notifications.
• Stop seeing someone: tap the person › Block. It is immediate.
• Delete your account: Profile › Delete account. Also immediate.

What the screen does not cover, such as portability, you request at [email protected] and we do it.

What happens when you delete your account

Your name, @, email, phone, bio, gear, photo and password are removed immediately, and login stops working.

We do not erase the whole row, and this is deliberate: erasing it would take with it the messages you sent in other people's conversations and the sessions that actually happened, rewriting other people's memory. What remains is an account with no person inside, shown as "Deleted account". There is no way to link it back to you.

Security

Encrypted transit (HTTPS/TLS) between the app and the server. Passwords in bcrypt hash, never in plain text. Database with no public access over the internet. Restricted administrative access, with a record of who did what.

None of these measures is an absolute guarantee. If there is a security incident that could cause you relevant risk, we notify you and the ANPD, as the law requires.

Minors

Kite Sessions is for ages 13 and up. Between 13 and 17, use depends on the consent of whoever is responsible for you. If we learn that an account belongs to someone under 13, we delete it.

Outside Brazil

The servers we use are in the United States. That means your data is transferred outside Brazil, with the contractual safeguards the LGPD requires of our suppliers.

Changes to this policy

When we change something relevant, the date at the top changes and we tell you in the app before it takes effect. Continuing to use it after that is accepting the new version. The history of previous versions is available on request.

Complaining

If our reply does not resolve it, you can complain to the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.