Privacy Policy
Last updated: August 2026
Introduction
Bracco (the "App") is developed and operated by Matteo Crippa ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.
The App is a vehicle GPS tracking companion. It shows the live position and history of a compatible GPS tracker you own, lets you create geofences, and sends push alerts (for example when your vehicle is moved with the ignition off, or when an alarm is triggered). Because the App processes precise geolocation data, this policy is more detailed than most.
By using the App, you agree to the collection and use of information in accordance with this policy. You can withdraw your geolocation consent at any time, as described below.
Information We Collect
Information you provide
- Account: your email address and a password (stored only as a salted, one-way cryptographic hash — PBKDF2 — never in plain text).
- Devices: the 15-digit IMEI of your GPS tracker, an optional name, and the tracker's SIM phone number used to configure it by SMS.
- Geolocation consent: a record of your explicit consent to location processing, with its version and timestamp.
Information collected automatically
- Precise location: the position, speed, heading, ignition and battery state reported by your tracker, the trips it records, and the raw frames it sends.
- Push notifications: a device token so we can send alerts to your phone.
- Purchases: the subscription product you bought, transaction identifiers, and subscription status/expiry. Payments are handled entirely by Apple; we never see your payment details.
- Minimal analytics: an internal identifier and the event name (e.g. "signup", "purchase") for aggregate statistics. This does not include your email, IP address, or location.
How We Use Your Information
- To provide the service: authenticate you, register your trackers, record positions, show history, and compute trips and data usage.
- To send alerts you have enabled (geofence enter/exit, device online, alarms, possible towing).
- To verify your email and reset your password.
- To process in-app subscriptions via Apple.
- To prevent abuse and fraud (rate limiting and short-lived connection logs).
Legal Basis for Processing
Under the General Data Protection Regulation (GDPR):
- Precise geolocation processing: your explicit consent (Article 6(1)(a)). Consent is given with an unticked checkbox at sign-up and can be withdrawn at any time.
- Account, authentication, support, and purchases: performance of the contract (Article 6(1)(b)).
- Abuse and fraud prevention: legitimate interest (Article 6(1)(f)).
Consent and Withdrawal
You are asked to consent to the processing of your vehicle's location data at sign-up, using a separate, unticked checkbox. Your consent is documented.
You can withdraw consent at any time from Settings → Geolocation consent in the App. When you withdraw:
- recording of new location data stops immediately, and
- all stored location history is permanently deleted.
The rest of your account (email, devices) remains active.
How We Share Your Information
We do not sell, rent, or trade your data, and we do not use it for advertising. We share data only with the service providers required to run the App:
- Cloudflare, Inc. — backend hosting (Workers, a database configured in the EU) and transactional email.
- Oracle Corporation — network infrastructure (Oracle Cloud, EU region) that receives data from your tracker.
- Apple Inc. — App Store distribution, push notifications (APNs), and in-app purchase processing.
- OpenStreetMap (Nominatim) — reverse geocoding, i.e. turning coordinates into a street address. Coordinates are sent only when needed, are cached per device, and are otherwise minimized.
International Data Transfers
Your data is stored primarily in the European Union/EEA. Where a provider (such as Cloudflare or Apple) processes data outside the EU/EEA, the transfer is protected by appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.
Data Retention
| Data | Free plan | Pro subscription |
|---|
| Positions | 7 days | 6 months |
| Raw tracker frames | 7 days | 30 days |
| Data-usage summary | Current month | 6 months |
| Analytics events (id + event only) | 90 days |
| Account data | Until you delete your account |
When these limits expire the data is deleted automatically. Deleting your account permanently deletes everything associated with it.
Your Rights
Under the GDPR you have the right to:
- Access your data;
- Data portability / export — download your data from Settings → Export my data;
- Rectification of inaccurate data;
- Erasure — delete your account from Settings → Delete account;
- Restrict processing and object to it;
- Withdraw consent at any time;
- Lodge a complaint with your data protection authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it).
To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by applicable law (30 days).
Data Security
We use appropriate technical and organizational measures: passwords hashed with PBKDF2, HTTPS in transit, EU-region data storage, retention limits, restricted access, and hardened, non-privileged infrastructure. No system is 100% secure, but we take reasonable measures to protect your data.
Children's Privacy
The App is not intended for children under the age of 16. We do not knowingly collect data from children.
Data Breach Notification
If a data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be announced in the App or by email at least 30 days before they take effect. The "Last updated" date at the top will always reflect the latest version.
Governing Law
This policy is governed by the laws of Italy. The following privacy laws apply to our processing of your data:
- General Data Protection Regulation (GDPR) — European Union
- ePrivacy Directive — European Union
- Codice Privacy (D.Lgs. 196/2003 and subsequent amendments) — Italy
Contact Us
For questions about this Privacy Policy or your data, please use the support page above.