Koast (“the app”, “we”) is published by Archive Vivante Inc.
(Quebec, Canada). This policy explains what data we collect, why, and your
rights. It follows the spirit of Law 25 (Quebec) and PIPEDA (Canada).
1. Data we collect
Account: email address, display name, and optionally your vehicle info (model, year, color, notes, photo).
Location: your real-time GPS position during a ride (and in the background while a ride is active, even with the screen locked) so you and your convoy show up on the map. Location is only active during rides.
Activity: your rides (distance, duration, top speed), your crews, your crew messages, your points and levels.
Shared photos: photos you add to your crew’s ride albums. Stored privately (access via temporary signed link), visible only to crew members.
Notifications: a push notification token to send you convoy alerts and announcements.
Technical: app version, device type, error logs.
Koast assistant (memory): the durable facts you share with the voice assistant (your vehicle, driving preferences and habits, your crew) are remembered to personalize its answers. The assistant does not store sensitive data, and you can erase everything at any time (Settings → “Forget my Koast memory”).
Garage (vehicle maintenance) — optional, and only what you enter: vehicle identity (make, model, year, plate, VIN, odometer), service entries, reminders, fill-ups, warranties.
Glovebox — optional: the documents you upload yourself (driver’s licence, proof of insurance, vehicle registration, invoices). ⚠️ These may contain sensitive personal information. They are stored in a private area, accessible only by you: neither your crew members nor the Koast team can access them, including for moderation. Each opening uses a temporary link that expires within minutes.
Calendar — optional: if (and only if) you tap “Add to my calendar”, the app requests access to write one due date. It never reads your other events.
If you choose to invite your crew, the app may read your contacts on your device only, to help you send an invite — it is never uploaded or stored on our servers. We do not collect advertising data and we never sell your data.
2. Why (purposes)
To run the real-time convoy, navigation, push-to-talk voice, ranking/gamification, safety, moderation, and to send you useful notifications. Basis: your consent (which you can withdraw) and the performance of the service you request. We may also write to the email address on your account for service-related reasons (fixing an issue on your profile, informing you about your account) and, occasionally, to invite you to take part in a test or a program. You can opt out at any time by replying to the message.
3. Who it’s shared with
Your crew members see your position and info in real time during a ride — that’s the heart of the app, which you consent to by joining a convoy. The photos you add to ride albums are visible to your crew members only.
Moderation: our team (administrators) can view and remove content (including photos) to enforce the rules and the law — notably on report. This access is restricted and logged.
Technical providers (under contract): Supabase (database/hosting, data stored in Canada — ca-central region), Mapbox (maps/routes), LiveKit (live, non-recorded voice), Expo/Apple (notifications, distribution). They only process data to provide the service to us. Your data is hosted in Canada.
AI providers (optional features): when you use the Koast voice assistant, the ride planner or skin generation, the strict minimum is sent to AI sub-processors to produce the result: Anthropic (assistant + planner + assistant memory), Google (skin generation), OpenAI (premium assistant voice), TomTom (traffic/routes). This processing happens in the United States. They do not use your data to train their models and we do not sell it.
Safety recalls and VIN decoding (optional, free): when you request a check, Koast sends only the VIN, or the make, model and year, to NHTSA (National Highway Traffic Safety Administration, an agency of the United States government), which publishes this data openly. No identifying data is transmitted: not your name, email, location or plate. Responses are cached on our servers to avoid querying the service repeatedly.
Authorities: only if the law requires it.
4. Retention
We keep your data as long as your account exists. Live positions are not kept as a history of your movements. The detailed GPS trace of a ride (if you save it) is kept for at most 90 days, then automatically deleted; only the summaries (distance/duration) remain.
Your service book is kept as long as you keep the vehicle in your garage — that’s the point: it must follow you from one phone to the next and serve at resale. Deleting a vehicle immediately erases its service history, reminders, fill-ups and documents. Deleting a document from the glovebox erases the file itself, not just the row in the list.
You can delete your account and all your data at any time in the app (Profile → Legal → Delete my account), or write to us (see §6).
5. Security
Access is protected by authentication, database-level access rules (Row-Level Security), and restricted server functions. No system is perfect, but we apply reasonable industry measures.
6. Your rights (Law 25 / PIPEDA)
Access: get a copy of your data.
Rectification: correct your info from the app.
Deletion: erase your account and data (“right to be forgotten”).
Withdraw consent: turn off location/notifications in your phone settings, or delete your account.
Assistant memory: erase what Koast learned about you, at any time (Settings → “Forget my Koast memory”).
Koast is for people 16 and older (you confirm your age at sign-up). We do not knowingly collect data from younger people; under Law 25, a parent’s or guardian’s consent is required under age 14.
8. Changes
We may update this policy; the date at the top shows the latest version. Significant changes will be announced in the app.
9. Contact
Archive Vivante Inc. — Personal information protection officer: contact@grouperzk.com