Off Road Xperience, LLC
6330 Oak Valley Drive, Cumming, Georgia, United States
[email protected] · headzupoffroad.com

Version 2.0 · Effective August 29, 2026 · Supersedes the policy effective August 23, 2026

---

Table of contents

1. Who this policy covers
2. The short version
3. Our role, and the park's role
4. What we collect, and from where
5. Data that never reaches us: the radio mesh
6. What we do not collect
7. Why we use it, and our legal basis
8. Sensitive information: precise location
9. Who we disclose it to
10. Artificial intelligence features
11. Event paperwork and demo days
12. How long we keep it
13. How we protect it
14. International transfers
15. Your rights and choices
16. United States state privacy rights
17. European Economic Area, United Kingdom and Switzerland
18. Canada
19. Children and minors
20. Storage on your device, cookies and similar technologies
21. Automated decision-making
22. Features that are planned but not yet live
23. Changes to this policy
24. How to contact us

• Appendix A — Data map by surface
• Appendix B — Subprocessors and service providers
• Appendix C — Retention schedule

---

1. Who this policy covers

Off Road Xperience, LLC, a Georgia limited liability company ("ORX", "HeadzUp", "we", "us", "our"), builds HeadzUp — a rider-awareness system for off-road motor parks. This policy explains what personal information the HeadzUp system handles, why, who else sees it, how long it is kept, and what you can do about it.

It applies to every part of the HeadzUp system, whether that part is live today or is described in section 22 as planned:

If a park you ride at gives you its own privacy notice, that notice governs what the park does with what it sees. This policy governs what we do.

---

2. The short version

• While a ride is active, the app sends your position, heading, speed, a rider identifier, your Rider Unit's identifier and a few health numbers to the park you selected, so park staff can see riders on their dashboard.
• Your Rider Unit also broadcasts your position over the radio directly to other riders' units. That traffic is how the awareness alerts work. It is peer-to-peer and does not pass through us.
• Messages you send to the park office, park-wide broadcasts, SOS and incident reports, and meetup pins go where you send them.
• Private rider-to-rider messages are deliberately not shown to park staff.
• We do not run advertising, we do not sell or share your personal information for advertising, we do not use analytics or crash-reporting SDKs, and we do not track you across other apps or sites.
• Everything between the app and our servers is encrypted in transit. Radio traffic is encrypted with the park's mesh key.
• HeadzUp is an awareness product. This policy is about data. For what the product does and does not do, read the End User License Agreement — in particular, HeadzUp does not prevent collisions and is not a substitute for riding carefully.

---

3. Our role, and the park's role

Two separate businesses handle your information, for two different reasons.

ORX is the controller (the business that decides why and how information is used) for: your rider account, your subscription, the operation of the app and the broker, our own diagnostics and liability records, and our support correspondence with you.

Each park operator is an independent controller for what it sees on its own dashboard: where its riders are, what they message the office, what incidents they report, and — where the park has enabled it — the position history it retains for trail and heat mapping. A park decides its own retention, its own staff access, and its own use of that information within the limits of its agreement with us and the law. We are that park's service provider / processor for the dashboard software — we host it, we do not use its data for our own purposes.

Where a park operates the dashboard itself, on its own infrastructure, we may not hold the data at all. Ask the park.

Practical consequence: a request to delete data the park holds may need to go to the park. Send it to us anyway — we will route it and tell you where it went.

---

4. What we collect, and from where

"Collect" here means the information leaves your phone or your Rider Unit and reaches a HeadzUp server or a park dashboard. Radio-only traffic is section 5.

4.1 Account and subscription

Rider accounts in a pilot program may instead be provisioned by us or by park staff, in which case the email address or phone number they entered is stored the same way and returned to the app so it can show you who is signed in.

4.2 Location

Precise location is treated as sensitive personal information — see section 8.

4.3 Identifiers

• Rider id — a per-account identifier we generate. It is not derived from your name.
• Node id / Rider Unit id — the identifier of the LoRa radio paired to your phone. It appears on every frame you publish and on the park's dashboard, and it is stable for the life of that radio. Because a unit is usually used by the same person, we treat it as a persistent identifier relating to you.
• Short id and display name — a short form of the node id, and the name shown to other riders.
• App version, platform and build — sent with status frames.

4.4 Messages and rider-generated content

4.5 Device, radio and diagnostic data

• Status and health, sent with your position: battery level, radio link quality, GPS quality, online/offline state, app version. This is what tells park staff whether your unit is working.
• Sensor frames, where a unit reports additional numeric sensor values.
• Pilot telemetry — an opt-out diagnostic stream used during pilot programs: phone model and operating system, Rider Unit hardware and firmware version, radio performance counters, app-side event records including alert decisions and the thresholds behind them. Switch it off in Settings → Pilot telemetry. Pilot telemetry never includes message text, rider names, usernames or email addresses.
• Incident record ("black box") — an internal record of what the app knew and when, around an alert. It exists so that, after a real-world incident, we can reconstruct the app's behaviour. It is never displayed in the app, never shown to a park or to any park dashboard, and is not part of Export Diagnostics. It is written to a channel only one HeadzUp-held credential can read, and unsent entries are purged from your phone after a retention period.
• Export Diagnostics — a file you generate deliberately and send to us. It contains app logs and settings. Do not send us one if you would not want us to read it.

4.6 Park operator and staff data

For park staff, club organisers and our own administrators: name or label on the account, email address, role (superadmin, admin, user), which parks the account is scoped to, invite state, password hash, session records, and any API keys issued. Actions taken in the dashboard — messages sent, incidents resolved, parks created — are attributable to the account that took them.

4.7 Position history, heat maps and trails

Where a park enables history, the backend retains rider position rows so it can draw heat maps and trail overlays. This is per-deployment configuration, not a global default. Trail surveys recorded with Trail Mapper are GPS traces driven by staff, with trail names and waypoints — they are about the park's terrain, but they are recorded by an identifiable staff member and are treated as personal information for that person.

4.8 Fleet and provisioning records

Our provisioning tools keep a registry of Rider Units: unit serial (derived from the radio's own node id), park assignment, firmware version, configuration snapshots, flashing history, and encrypted backups of the unit's keys. This is equipment data. It becomes personal information only where a unit is tied to a named rider — for example a rider who owns their unit outright.

4.9 Website

The public website serves the marketing pages, the sign-up form and (when it launches) checkout. It runs no analytics, sets no advertising cookies, and loads no third-party script by default. If bot protection is enabled for a deployment, a Cloudflare Turnstile challenge is loaded on the sign-up form only, and Cloudflare receives the data described in Appendix B. Park-entrance QR codes produce aggregate scan counts — how many scans, which park, which platform — with no identifier tying a scan to a person.

4.10 Support

If you email support, open a ticket, or talk to park staff who escalate to us, we keep the correspondence and whatever you chose to put in it.

---

5. Data that never reaches us: the radio mesh

Your Rider Unit broadcasts your position, heading and speed over LoRa radio so that other HeadzUp Rider Units in range can compute proximity and raise an alert. Those broadcasts:

• are addressed to the park's mesh and encrypted with the park's pre-shared mesh key;
• are not sent to HeadzUp servers by the radio itself;
• are receivable by any device in radio range that holds that park's mesh key — which, in normal use, means every other HeadzUp rider at that park;
• carry your node id and, depending on your settings, your display name.

There is no way to be visible to other riders' alerts and invisible to their radios at the same time. That is what the product is. If you do not want to be seen on the mesh, do not start a ride.

Two things reach our servers from the radio path only because the phone puts them there: the position your own phone publishes to the broker, and — if you have the bridge enabled — mesh traffic your phone heard and relayed. A rider with no cell signal publishes nothing.

---

6. What we do not collect

Verified against the shipped code, and mirrored in our app-store data-safety declarations:

• No advertising identifiers, ad networks, or advertising of any kind.
• No analytics or crash-reporting SDKs. No Firebase, no Sentry, no Crashlytics, no Google Analytics, no third-party attribution.
• No cross-app or cross-site tracking, and no sale or sharing of personal information for behavioural advertising, as those terms are defined under US state privacy law.
• No contacts, photos, videos, camera, calendar, files or SMS. The "From my contacts" option in Friends is not active and requests no permission.
• No audio. Alerts are spoken by your phone's own text-to-speech. Dictation converts speech to text on the device (on some phones and languages, via the platform's own speech service under Apple's or Google's terms) — HeadzUp transmits only the resulting text, never a recording.
• No payment card data in the app. The app contains no payment code at all. When checkout launches it will run on the website through a PCI-compliant payment processor; we will receive a confirmation and the last four digits, never the full card number.
• No health, financial, biometric, browsing-history, or installed-app data.
• No government identifier, except at an on-site event where you present ID at check-in — see section 11, where the whole point is that we do not keep it.

---

7. Why we use it, and our legal basis

Where the GDPR or UK GDPR applies, the legal basis is in the right-hand column. Where it does not, read the column as a plain statement of purpose.

Where we rely on legitimate interests, we have weighed those interests against your rights. You can object — see section 15.

---

8. Sensitive information: precise location

Under the California Consumer Privacy Act as amended (CCPA/CPRA) and several other state laws, precise geolocation is sensitive personal information.

We collect it, and we use and disclose it only for the purposes permitted without a further right to limit: providing the service you asked for (proximity awareness, the park's live map, incident location), securing and debugging the service, and short-term operational use. We do not use precise location to infer characteristics about you, we do not use it for advertising or profiling, and we do not sell or share it.

Because of that, no "Limit the Use of My Sensitive Personal Information" right is triggered. You can still switch it off outright: revoke the location permission, or stop riding. The app will tell you that a ride cannot run without it, because it cannot.

---

9. Who we disclose it to

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by California and other US state privacy laws. We have not done so in the preceding twelve months.

We do not disclose private rider-to-rider messages or friends-only meetups to park staff.

---

10. Artificial intelligence features

The park dashboard includes an optional Park Assistant that lets park staff ask questions about their own park in natural language. When a park has it enabled and a staff member uses it:

• The staff member's question, and the park data needed to answer it — which can include rider positions, identifiers, status and message history within that park's scope — are sent to a third-party AI provider (Anthropic, OpenAI or Google, depending on the deployment's configuration) to generate the answer.
• We select providers that contractually commit not to train models on data submitted through their business APIs, and we do not enable any provider setting that would allow it.
• The assistant is scoped to the parks the staff account is already authorised for. It cannot reach a park the account cannot already see.
• A park can run its dashboard with the assistant disabled. Ask your park whether it is on.
• The assistant is an operator tool. It is not available to riders, and no rider-to-rider private message reaches it, because those are dropped before the dashboard ever holds them.

We do not use your personal information to train any model of our own.

---

11. Event paperwork and demo days

At a controlled demonstration or validation event, check-in may ask you to complete paperwork on your own phone: your name, email, phone, a short survey, photographs of your photo ID (front and back), a photograph of your face, and your signature on the event's liability waiver, media release and confidentiality agreement.

None of it is stored. Specifically, by design and enforced in code:

• No database row, no file on disk, no log line containing any of it.
• The packet exists in server memory for the duration of one request, is emailed to the two named humans running the event, and is then discarded.
• If the email fails to send, the submission is refused and you are asked to redo it — because the alternative is a copy of your driver's licence sitting on a server.
• The whole flow is off by default and expires by itself on the event's end date, after which every one of its addresses returns "gone" without anyone needing to intervene.

The resulting email, and the signed agreements inside it, are then held by ORX as event records under ordinary business retention. The agreements you sign at an event are separate contracts and say so on their face.

---

12. How long we keep it

Summarised here; the full table with the configured values is Appendix C.

• Live rider state is short-lived working memory — minutes to a few hours — and is evicted when you go quiet.
• Position history, where a park enables it, is kept for that park's operational and trail-mapping needs.
• Messages, incidents and meetups are kept while the park needs them for its records; incident reports self-expire from riders' views after three days.
• Account records are kept while your account exists, and then deleted or anonymised, except where we must keep something to comply with law, resolve disputes or enforce our agreements.
• Pilot telemetry is kept for the duration of the pilot and then deleted or anonymised.
• Black-box records are kept as long as needed to investigate and defend claims arising from an incident, and no longer.
• Event paperwork is not retained at all in the capture path (section 11).
• Backups roll off on their own schedule; a deletion propagates to backups as they cycle.

---

13. How we protect it

• In transit: HTTPS and secure WebSockets between the app, the website and our servers. The broker connection uses TLS. The app ships with cleartext traffic disabled at the platform level.
• On the radio: LoRa traffic is encrypted with the park's pre-shared mesh key. Rider Units ship provisioned with a per-park key, verified by reading the whole configuration back off the device after it is written, not by trusting the tool's own success message.
• Passwords: salted scrypt hashes, per-user salt, constant-time comparison. We cannot recover your password, only reset it.
• Sessions: opaque random tokens with bounded lifetimes; operator sessions expire faster than rider sessions.
• Access control: dashboard accounts are scoped to specific parks and roles. API keys inherit that scoping and cannot reach outside it, whatever parameters are passed.
• Broker access control lists separate the credentials that may publish from those that may read. Exactly one credential can read the internal black-box channel, and the app's own credential cannot.
• On your phone: sign-in tokens are held in the platform's secure storage, and the Android app opts out of system cloud backup so ride data and tokens are not copied off the device by the OS.
• Device keys at rest: the provisioning registry stores Rider Unit key backups encrypted.
• Rate limiting and abuse controls on authentication, telemetry ingest and event endpoints.

An honest limitation. Today, park-level broker credentials are shared per park. Dashboard-level privacy for rider-to-rider messages is enforced at ingest and works, but a party holding a park's broker credential could subscribe to more topics than the dashboard shows. Per-device broker credentials and tighter access lists are a committed roadmap item (section 22). We would rather tell you this than let you assume otherwise.

No system is perfectly secure, and we do not claim ours is.

---

14. International transfers

We operate from the United States and our infrastructure is hosted in the United States. If you use HeadzUp from outside the US, your information is transferred to and processed in the US, which may not provide the same level of protection as your home country.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum, as applicable, together with supplementary technical measures (encryption in transit, access scoping, minimisation). A copy of the clauses we use is available on request at [email protected].

---

15. Your rights and choices

These apply to everyone, regardless of where you live. Some jurisdictions add to them — see sections 16 to 18.

In the app and on the site

• Location — deny or revoke the permission in your phone's settings at any time. A ride cannot run without it.
• Pilot telemetry — Settings → Pilot telemetry → off.
• Messages, friends, meetups, incidents — only sent when you choose to send them.
• Marketing email — untick at sign-up, or unsubscribe from any marketing email. Service and safety notices are not marketing and cannot be unsubscribed from while you have an account.
• Notifications, sound and voice — controlled in Settings and in your phone's settings.
• Sign out — Settings → HeadzUp Account → Log Out.

By writing to us at [email protected], from the address on your account:

• Access — a copy of the personal information we hold about you.
• Portability — that copy in a structured, commonly used, machine-readable format.
• Correction — fix anything inaccurate.
• Deletion — delete your account and the personal information we hold about you. We complete verified requests within 30 days (and will tell you if we need the extension the law allows). We will keep what we must to comply with law, and a park may keep what it needs for its own incident and safety records — we will tell you when that applies.
• Objection and restriction — object to processing based on legitimate interests, or ask us to restrict it while a dispute is resolved.
• Withdraw consent — at any time, without affecting what was done beforehand.
• Authorised agent — someone may act for you with written authority; we will still verify you.

How we verify you. We match the request against the email or phone on the account and, where a request is high-risk, ask you to confirm from the app while signed in. We do not ask for more identifying information than the request requires, and we do not keep verification material.

Cost. Free, unless a request is manifestly unfounded or excessive, in which case we will say so before charging anything.

Appeal. If we refuse a request, our response will tell you why and how to appeal. Appeals go to [email protected] with "Appeal" in the subject line; we respond within the period your state's law allows and, if we again refuse, tell you how to complain to your regulator.

---

16. United States state privacy rights

This section supplements the rest of the policy for residents of states with comprehensive privacy laws — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — and for any state whose law comes into force after this date.

Notice at collection. The categories in section 4, collected for the purposes in section 7, retained per Appendix C, disclosed to the recipients in section 9. Sensitive personal information is limited to precise geolocation and, at an event only, the identification documents described in section 11 — used only for the purposes described there.

Statutory categories collected in the last twelve months (using the CCPA's vocabulary): identifiers; personal information under Cal. Civ. Code §1798.80(e) (name, phone, email); commercial information (subscription); internet or network activity (app interaction, diagnostics); precise geolocation; audio-adjacent only in the sense that dictation is converted on-device and never transmitted; professional information for park staff accounts; and inferences — none, we draw no profiles.

Sale and sharing. We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding twelve months, including that of anyone we know to be under 16. We have no financial incentive programs.

Your rights — to know, access, correct, delete, obtain a portable copy, opt out of sale/sharing and of profiling with legal effects (we do none), limit the use of sensitive personal information (see section 8), appeal a refusal, and not be discriminated against for exercising any of them. Exercise them as described in section 15.

Opt-out preference signals. Our website honours the Global Privacy Control signal. Since we neither sell nor share, the signal has nothing to switch off — but it is recorded and respected.

Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing.

Nevada (NRS 603A): we do not sell covered information. Requests to [email protected].

Washington My Health My Data / Nevada SB370: we do not collect consumer health data. Location data is not used to infer health status, and is not shared with any party who could.

Minors: see section 19.

---

17. European Economic Area, United Kingdom and Switzerland

If the GDPR or UK GDPR applies to you:

• Controller: Off Road Xperience, LLC, 6330 Oak Valley Drive, Cumming, Georgia, USA, [email protected]. Where a park operator determines its own purposes, that park is a separate controller — section 3.
• Legal bases: section 7.
• Rights: access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests, and at any time to direct marketing), and the right not to be subject to solely automated decisions producing legal or similarly significant effects (section 21).
• Withdrawing consent does not affect processing carried out before withdrawal.
• Transfers: section 14.
• Complaints: you may lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national DPA; in Switzerland, the FDPIC. We ask that you raise it with us first so we can fix it.
• Representative: we do not currently offer HeadzUp in the EEA or UK, so no Article 27 representative is appointed. If we begin offering it there, we will appoint one and name them here before we do.

---

18. Canada

If PIPEDA or a substantially similar provincial law (Quebec's Law 25, Alberta's or BC's PIPA) applies:

• We collect, use and disclose personal information only for the purposes identified in section 7, with your knowledge and consent, except where the law permits otherwise.
• Express consent is obtained for sensitive information — including precise location — through the permission prompts and the acceptance of this policy at sign-up.
• You may withdraw consent, subject to legal and contractual restrictions and reasonable notice; if you withdraw location consent, HeadzUp cannot function.
• Your information is stored and processed in the United States and is subject to lawful access by US authorities — section 14.
• Under Law 25, you may request that automated processing be explained; we perform none that produces a decision about you (section 21).
• Complaints may be made to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Our privacy officer is reachable at [email protected].

---

19. Children and minors

HeadzUp accounts are for adults. You must be at least 18 to create a HeadzUp account, hold a subscription, or accept our terms.

A rider under 18 may use HeadzUp under an account held and accepted by their parent or legal guardian, who is responsible for that use. Where a park issues a loaner Rider Unit to a minor, the park's own check-in and waiver process governs, and the adult who signed for the minor is the account holder for our purposes.

We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has given us information, write to [email protected] and we will delete it. We do not sell or share the personal information of anyone under 16, and we do not knowingly process a minor's data for targeted advertising or profiling.

If a guardian asks us to delete a minor's data, we will — subject to the same legal and incident-record exceptions in section 15.

---

20. Storage on your device, cookies and similar technologies

The app stores data locally on your phone: your settings, your sign-in token (in secure storage), your friends list, recent messages, cached node information, and the unsent portion of the black-box buffer. This is device storage for the app to work, not tracking. Uninstalling the app removes it. The Android build opts out of the OS's cloud backup, so this data is not copied off your device by the system.

The dashboard sets a session cookie or holds a session token so staff stay signed in. It is strictly necessary, first-party, and expires with the session.

The website sets no cookies for analytics, advertising, or profiling, and loads no third-party script by default. Where bot protection is enabled, Cloudflare Turnstile is loaded on the sign-up form only and sets what is necessary to run the challenge.

Map tiles on the dashboard are requested from a third-party basemap provider (see Appendix B). That provider necessarily sees the requesting IP address and which tiles were requested, which implies the map area being viewed. Rider positions themselves are drawn locally and are never sent to the tile provider.

We do not use pixels, beacons, fingerprinting, or any cross-site tracking technology.

---

21. Automated decision-making

The proximity alert is automated: the app computes distance, closing geometry, speed and heading, and raises an alert when its thresholds are met. It decides about a moment, not about a person — it produces no legal or similarly significant effect about you, no score, no profile, and no consequence outside the alert itself. It is deliberately biased toward alerting: where a value is unknown, the system does not treat it as safe.

We do not use profiling to make decisions about your account, your subscription or your access.

---

22. Features that are planned but not yet live

Listed so that this policy covers the system we are building, not only the one shipped today. Each will operate as described here; where one materially changes what we collect or who sees it, we will update this policy and tell you before it launches.

---

23. Changes to this policy

We will post any change at headzupoffroad.com/privacy and update the version and effective date at the top. Material changes — a new category of data, a new category of recipient, or a new purpose that is not compatible with the original one — will be announced in the app and, where the law requires it, will not apply to information already collected until you have been given notice and, where required, have consented.

Superseded versions are archived and available on request.

---

24. How to contact us

Off Road Xperience, LLC
6330 Oak Valley Drive
Cumming, Georgia, United States

• Privacy matters, and all rights requests: [email protected]
• Support: [email protected]
• Web: headzupoffroad.com

Write "Privacy Request" in the subject line and tell us which right you are exercising and which email or phone is on your account. If you would rather ask the park you ride at to pass it on, that works too.

---

---

Appendix A — Data map by surface

---

Appendix B — Subprocessors and service providers

Current at the effective date. We update this list when it changes; a current copy is always available at [email protected].

Where a park self-hosts the dashboard, that park — not this list — determines who else touches its data.

---

Appendix C — Retention schedule

---

HeadzUp is a rider-awareness product. It does not prevent collisions and it is not a safety system. Ride aware, ride together.