Privacy Policy

The controller of your personal data is CODERABR DESENVOLVIMENTO DE SOFTWARES LTDA, CNPJ 65.494.300/0001-10, headquartered at Avenida Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, CEP 90560-001, Brazil. It decides how and why data is processed on the Platform.

For any privacy matter, contact us at contato@oficialburnout.com (see "Contact and data protection officer").

We collect only what the Platform needs to work:

• Account data: email, password (stored only in encrypted form, as a hash — nobody can read it, not even us), display name, @handle, profile photo, bio and city, if you provide them. If you sign in with Google or Apple, we receive that account’s identifier and the email the provider shares. We also record the date you accepted the Terms.
• Social networks, if you provide them: the Instagram, TikTok, YouTube and Facebook you choose to show, the way you type them (@ or link). They are public: they appear on your profile to anyone, even with a private profile, and on your live car’s card on the map. They are included in the copy of your data you can download in the app and are deleted with the account.
• Content you post: cars (make, model, version, year, nickname, spec sheet, modifications and photos), posts with photos and video (including the "before and after" post, with its two photos in order), polls (the question, the options and the duration) and the votes you cast in polls, stories, the story highlights you put together (name, cover and which stories) and your story archive, captions, comments (with a photo, if you send one), likes, tags of people and cars in photos, the credit of whoever took each photo, when you provide it, the people and cars you follow, your close friends list, clubs, the notices you pin in a club, the meets you create, mark attendance at or check in to (with the car you brought), and the audience you choose for each post and story.
• Shared and handed-over cars: who owns each car and who shares it; each of your periods in a car, as owner or sharing it, with the start, the end and how it ended (the car was handed over to someone else, moved to past cars or deleted, or you left it or were removed); and the offers to share or hand over a car, with the car, who sent it, who received it, when, the deadline and the answer (accepted, declined, cancelled or expired).
• A post or story waiting for its video: when you publish with a video that is still being converted, the content of the post (the caption, the car, the meet, the club, the tags, the poll, the audience and the options you chose) is kept on our server in a publication request. When the video is ready, the post or the story goes live, under the same rules as when you publish right away, and you get a notice. If the video fails or is not ready within 2 hours, the request fails, and you also get a notice. Taking the upload out of the queue, on the "Publicando" (Posting) screen, deletes the request. Signing out does not cancel the request: the post goes live when the video is ready.
• Posts you save: which posts you saved and when, and the collections you create, with the name and the posts of each one. Only you see them: whoever posted is not notified and never learns who saved, and your saved posts are not used to rank the feed. A saved post stops showing for you if it is deleted, hidden by moderation, if there is a block between you or if you lose access to it; a deleted post leaves your saved posts within a day.
• Photo spots you suggest: the spot belongs to a place, not to the person; who created each one is kept while the spot exists, so that you can correct your spot while no one else has posted there, for moderation and for the copy of your data, and is not shown in the app. To pick the place, the app sends only the map area and the point you marked, never the device’s position. Linking a post to a photo spot is the choice of whoever posts.
• Stations you add: the name, the brand, what the station sells and the point you marked. In the app, the station is shown without saying who added it. It stays linked to your account for 30 days, so that you can correct or delete the station, and for the limit of 1 per day, the reports rule and the copy of your data, and is unlinked sooner if you delete your account; after that it stays on the map without an author. The addition also goes into the audit logs, like every change.
• Block on adding places: if a station or a photo spot you added leaves the map because of reports, we keep the block, with the place that caused it and the dates, while the account exists.
• Routes you save: the name, the description, the kind of route (the fastest or no highways), who sees it (only you or everyone) and the points you marked, with the name of each. We do not keep the drawn path or your position during navigation. A public route shows on your profile and on the map to whoever can see your posts. A route goes away when you delete it or delete your account, and it is part of the copy of your data.
• Messages: what you write in conversations (direct, club, meet and Marketplace), the photos and posts you share in them, the profiles, stories, meets, clubs, listings and partner stores you send in them and the invitations to a club or a meet you make through them, and, when you choose to send one, a location: the point on the map and, if you give it, the name of the place. Only the people in the conversation read them. Whoever reads it sees what you sent only if they can see it in the app: a profile with a block, a story that has expired or is not meant for them, a members-only meet or a removed listing show as unavailable. An invitation to a club keeps the invited person pending in the club until they join or decline, and an invitation to a meet also shows in their notifications. When you delete a message, it disappears from the conversation for everyone and its location is erased right away; its text, photo and whatever was shared in it (a post, profile, story, meet, club, listing or store) are kept for 90 days and then erased, leaving only the record that there was a message (who sent it, when and in which conversation). Burnout’s moderation opens a conversation through the report of a message by someone in it, and then reads up to 150 messages before and 150 after the reported one, including deleted or hidden ones; without a report, only with a written reason, such as a request that arrived by email. Every opening is logged, with who opened it and for which report or reason.
• Marketplace listings: title, description, photos, price (and, when you lower the price, the previous one, which the listing shows), category, condition, the car a part fits, for vehicles the year, mileage, version, transmission, fuel and color, the city, if you mark it, the spot where the item is, and whether you accept trades. The listing also shows how many times it was opened and how many people favorited it; we count without storing who opened it, and the seller never sees who favorited.
• Marketplace search alerts: the text, category, city, make and model of the search you save, whether it is only for listings that accept trades, and which listings have already triggered each alert. The alert does not store your position: it uses the city you choose.
• Marketplace favorites: the listings you favorited, the price of each one when you favorited it and the price of the last drop you were told about.
• Marketplace ratings: the rating, the tags, the text, the listing they refer to and the seller’s reply. To know who can rate, we use the existence and the dates of messages from both sides in the listing’s conversation, without reading their content. When a rating is reported, moderation sees how many messages each side sent in that conversation and when, never the text.
• Reviews of stores on the map: the stars, the text and the dates of the review you write, the store’s reply and, if you have a store on the map, the replies you write to its reviews.
• Marketplace store, if you open one: the name, the store’s @, the description, the city, the logo and the cover, the store’s WhatsApp and Instagram, if you provide them, which of your listings are in the store and the stock of each one.
• Who viewed a story: when you view a story, its author knows you viewed it. Only the author sees that list, and it is deleted 24 hours after the story was posted, even if the story stays in the author’s archive or in a highlight. If you like a story, its author sees the like in that same list, and it is deleted along with the list.
• What goes past your screen: which posts were shown to you and how long you watched each video in Cenas (the app’s full-screen videos), and which sponsored content was shown to you (see "Recommendations and sponsored content").
• Days of use: each day your account used the app, only the day, without the time, device, place or what you did.
• Purchases: for Boost, the package, the boosted post or listing, the payment channel (App Store, Google Play or Stripe) and the purchase identifier; for coins, the pack, the app store and the purchase identifier; for the verified profile, the subscription data (see "Verified profile"). The payment itself stays with the app store or with Stripe.
• Coins and missions: your balance, your coin statement (what you earned, bought, spent and what was refunded or taken back), the day’s missions and your progress in them (for the mission of visiting the Marketplace, the day you opened it, the day only), the effects you own and use (including limited-edition ones), the profile rings you own and the one you use, the menu wheels you own and the one you use, and the effect and wheel gifts you gave and received: who gave, who received, which item and when. Whoever receives sees the @ of whoever gave, and whoever gave sees the @ of whoever received in the statement. The effects you use are shown to anyone who sees your profile and your cars; the profile ring, to anyone who sees your profile; the pin effect, to anyone who already sees your pin on the map; the menu wheel, only to you.
• Achievements: which ones you unlocked, when, whether the team revoked any and whether you chose to show them on your profile. They are computed from what you already do in the app (check-ins, meets you organize, Marketplace sales with a conversation, fuel prices that earned coins, paid invites, Pilot of the week, Crown, Car of the meet, complete spec sheet and error or problem reports the team confirmed); no position is used or stored for that.
• Car of the meet: your vote (at which meet, for which car, when, and vote changes). The vote is secret: nobody in the app sees who you voted for; moderation sees it, to curb fraud. The result (the winning car and the counts) is as public as the meet, and the trophy is shown on the car’s page.
• Meet polls and raffles: the car you enrolled in each poll, your vote (for which car, when, and vote changes) and the raffles you joined. The vote is secret while the poll is open; in the result, the count per car is public, never who voted for whom. Enrolled cars and raffle winners are shown on the meet’s page. These records are deleted with your account; the result of a poll or a raffle stays, without your name.
• Invites: your invite code, which never changes; who invited you and who joined with your code, with the code used, when the account joined, when the invite paid out and how many coins each one received. The person who invited gets a notice with the @ of whoever joined, and whoever joined sees who invited them.
• Club season: how much XP each thing you do adds, per week, to each club where you are an active member (check-in at a club meet, post in the club feed, a day’s mission claimed and help with the weekly missions), the club mission coins you received and whether you were a club’s Pilot of the week; and, in club duels, each club’s score for the week, which adds up the XP of the members who were already in the club when the duel was accepted.
• Fuel prices you report: the station, the fuel type, the price and when. The price stays linked to your account for 30 days, to prevent abuse and to award coins; after that, and if you delete your account, it stays on the map without an author. In the app, the price is shown without saying who reported it. The report also goes into the audit logs, like every change (see "Storage, security and retention").
• Store data, if you register a store on the map, and payment data, if it subscribes to a plan (see "Stores on the map and payments").
• Reports (who reported, what and why; for a reported message, a copy of it, with the text, who wrote it, the conversation and the time, because whoever wrote it can delete it before the moderation looks), blocks, the moderation history linked to your account and, if whoever organizes a meet removes you from its guest list, the mark that you were removed (who removed you and when stay in the audit logs).
• Technical data: access logs (IP address, date and time), request identifier, device type, operating system, app version and error logs. When you tap "Report" on an error screen or use "Report a problem", we receive the error code, the screen, what you write, any screenshots you attach and, if you allow it, the app version and device. An error report also carries the app’s last calls to the server and the screens you went through before the error: the address of each call (without its content, the search or the position), the result, how long it took and when it happened. They are removed when the account is deleted. The team may confirm that the error in one of your reports is real, whether it came from an error screen or from "Report a problem". The report then keeps the date of the confirmation and who on the team confirmed it, and each confirmed error counts once toward your achievements. In audit logs, the IP address is stored in encrypted form (hash).
• Push notifications, if you allow them on your device: the device’s push identifier (token), to send your account’s notices. It is deleted when you sign out, when you delete your account, when you remove the device from your account under Ajustes › Aparelhos conectados (Settings › Connected devices) or when the push service reports that the device no longer exists. If the device’s session ends some other way (when you change your password, for example), it stops receiving notices at once and is deleted, at the latest, together with the session record.
• Connected devices: for each device or browser where your account is signed in, the device type, model and system, the app version, when you signed in and when you last used it. We do not store the name you gave the device or your location. Burnout’s administration can see this list and remove a device from your account, for support and security; every lookup is logged.
• App language: the language you choose in the app is stored in your account, so that notices, notifications and emails are written in that language.
• Suggestions and the beta tester badge: what you write in the Suggestions tab, the area of the app it is about, the app version and platform it came from, and the status the team gives it (received, under review, planned, in the app, or not for now). The team reads the suggestions and may keep an internal note on each one, which you do not see. Accounts from before the app’s stable version have the beta tester badge, with the month and year they arrived. If you delete your account, the suggestion stays in the team’s report with no link to you, and the badge goes with the account.
• Favorite clubs: the clubs you are a member of and marked as favorites, and when, so they come first in your list of clubs. Only you see them.
• Team badge: if you are part of the Burnout team, since when. The badge is shown next to your name in the same places as the verified badge.
• Club card: the QR code of your card carries your Burnout identifier, the version of your QR code, the time in 30-second steps, the car you chose and a signature; it changes every 30 seconds and is valid for about 90 seconds. The app generates the QR code with a secret that stays on your device; our server does not store that secret (it recomputes it from a key of its own to check each scan) and stores only the version of your QR code. The QR code changes by itself whenever your sessions are ended (a password change or reset, a change in two-step verification or an action by the team) and when you ask for a new one. Who can scan the QR code: whoever organizes the meet, the club’s admins and moderators, and Burnout’s moderation. When your QR code is scanned at a meet, we keep that you arrived, the time, the car, that it was by card and who checked; the audit log also keeps the role of whoever scanned, with no position and without the text of the QR code, and the app tells you at once, inside the app, with no push notification. A scan of an invalid, expired or old QR code is recorded, with who scanned it, so the team can find abuse.
• Location, only when you choose: if you turn on "Aparecer ao vivo" (Go live) under "Meu carro no mapa" (My car on the map), your device’s position while the app is open on screen; if you start a "rolê" (a ride), your device’s position for the time you choose (1, 2, 3 or 5 hours), also with the app in the background; in both cases, each position is valid for at most 90 seconds; in the Marketplace, your approximate position, when you sort listings by distance or filter by radius; if you report police on the map, the place where you are when you report; if you say there is no more police on an alert, the place where you are at that moment, once, which is not stored; and, when you check in to a meet, your device’s position at that moment, once, which is not stored (see "Location and map").
• Convoys: the convoy you create (the destination, which is a meet or a place, the meeting point, the departure time and the name, if you give one) and, in each convoy you join, when you joined, left and arrived. While you are in a convoy, your device’s position and your car’s heading go to the people in it and are not stored (see "Location and map").
• Police reports: the place of the report, rounded to about 110 m, and the time. For 24 hours the report stays linked to your account, to prevent abuse and to let moderation remove false reports; after that, it is deleted. When you say there is no more police on an alert, we keep that you said so about that report, for the same period. The place where you are is used only to check that you are near the alert, and is not stored. The submission also goes into the audit logs, with who sent it and when, without the place.

Photos and videos: when we receive a photo or a video, we automatically remove its metadata (such as EXIF), including any GPS location the camera may have recorded.

License plates: before it goes public, every photo goes through an automatic check that looks for vehicle license plates and blurs them in the published photo, so that no one’s plate is exposed. The check only points out where each plate is, without reading the characters. Videos do not go through it.

Camera, microphone and gallery: to post, the app may ask for the camera, the microphone and access to the photos and videos on your device. The app’s camera takes photos and records videos of up to 60 seconds; the microphone is only requested when you record a video, for its sound, and without it the video is silent. The app’s gallery shows the photos and videos on your device, newest first, for you to choose what to post, without reading the location saved in the photos; on iPhone and on Android 14 or newer, you can allow only some of them. Nothing leaves your device unless you choose it, and the chosen photos are converted to JPEG on the device itself before uploading.

Music during navigation: on Android, if you turn on notification access for Burnout, the app reads on the device what another app is playing (the track name, the artist, the cover and the app playing it), only to show it on the navigation screens and to send that app the commands to play, pause and change tracks. The app downloaded from our website does not ask for this access. None of this leaves the device or is stored, and the app does not read the content of your notifications: from Android 12 on, it asks the system to send it none. The access is optional, and you can turn it off whenever you want in the Android settings. On iPhone, the app only opens Spotify or YouTube Music. On both systems, to show the buttons that open these apps, the app asks the device whether they are installed, and that answer does not leave the device either.

We do not ask for or collect: tax ID (CPF), license plate, chassis number or vehicle registration (RENAVAM), your card number (payment data goes to Stripe or to the app store), your device contacts, your calendar (to add a meet to your calendar, the app opens your phone’s new-event screen already filled in, without reading or storing anything from it), advertising identifiers, or sensitive personal data (such as racial origin, religion, political opinion, health or biometrics). If you choose to publish something like that in a post, comment, message or listing, it becomes visible by your own decision.

• To create and maintain your account, sign you in and protect access (including blocking repeated wrong-password attempts).
• To show your profile (with the social networks you provide and, if you subscribe, the verified badge), cars, posts, stories, comments, listings, meet attendance and check-ins to other people, as the Platform works and to the audience you choose.
• To build the feed, Cenas, search, the Marketplace, the map (including your car live and the ride, if you use those features, and the hotzones), in-app notifications, meets and clubs. The "near you" notice of a new meet uses the city on your profile, not your location, and can be turned off in the notification settings.
• To deliver messages to the people in each conversation.
• To check, when you check in to a meet, that you are within 200 m of the meet’s point or, at the meets of clubs that choose the card, to verify the QR code of your card scanned on site by the club’s team; and to let whoever organizes a meet remove someone from its guest list.
• To notify you, in the notification center and by push, when a listing matches one of your search alerts and when the price of a favorite drops; each kind of notice can be turned off in the notification settings.
• To show the reviews of stores on the map and the ratings of Marketplace sellers, compute each store’s score and each seller’s reputation, and know who can rate.
• To count the votes for the Car of the meet, announce the result, pay the coins, deliver the trophy and the effect, and prevent fraud (moderation sees who voted for whom).
• To fetch the weather forecast for each meet’s point (see "Who we share data with").
• To show your achievements and the bug hunter badge on your profile, deliver the exclusive effects and prevent fraud.
• To record effect and wheel gifts, show whoever received one who gave it, apply the weekly limits and prevent fraud (moderation sees who gave what to whom).
• To prepare the copy of your data when you ask for it, and to show and end the devices connected to your account.
• To write notices, notifications and emails in the language you chose in the app.
• To read your suggestions, decide what goes into the app, and tell you, in the app and by push, when your idea is planned or in the app. This notice has no switch, because it answers a request of yours.
• To show who looks after each car, its ownership history and your past cars gallery, and to bring the offers to share or hand over a car to whoever receives them, with a notice, and the acceptance to whoever sent them. These notices have no switch, because the offer waits for an answer and expires in 7 days.
• To recommend posts, Cenas videos and people, and to choose where to show sponsored content.
• To activate the Boost you bought, deliver it, show the buyer how many people it reached, and end it if the purchase is refunded.
• To charge the verified profile subscription, show the badge while it is paid up and remove it when the subscription ends, when a charge is declined or when the team removes it.
• To track mission progress, award coins, record what you buy and spend with them, and show the effects you use.
• To pay invite coins, count the monthly limit of paid invites and prevent invite fraud (moderation sees who invited whom and how much was paid).
• To count clubs’ XP and level, set up the weekly missions, the ranking, the Crown and the Pilot of the week, pay club mission coins and prevent fraud in the season (moderation sees where each club’s XP came from, including who added it).
• To show on the map the fuel prices the community reports and to check suspicious prices.
• To show on the map the community’s police alerts, prevent abuse and remove false reports.
• To show your store on the map according to its plan, review it before it goes live, charge the subscription through Stripe, and show the store how many times its card was opened and how many taps each link got, without identifying who opened or tapped.
• To show your Marketplace store, with the products and the stock you enter, and open a conversation with the store’s WhatsApp for whoever taps the button.
• To send emails required for your account: verification codes, password recovery and important notices about the Platform or these documents.
• To send push notifications, if you allow them on your device, about what happens on your account: who acted (name and @), an excerpt of the comment, the name of the car, meet or club, a poll’s question, in Marketplace notices the summary of the saved search and the listing’s title and price, in a rating the @ of whoever rated and the start of the text, for the Car of the meet and duels the name of the rival club and the score, the end of a photo or video upload made in the background, the notice that the copy of your data is ready, the name of an achievement you unlocked and, for messages (direct, club, meet and Marketplace), who wrote and the start of the text (up to 120 characters) or, without text, what was sent (a photo, a location, a profile, a story, a meet, a club, a listing or a store) and, in an invitation, the name of the club or the title of the open meet, which may show on the lock screen, depending on your device settings; a message request says only who asked, without the text. The app’s notification settings also apply to push: there you turn off, one by one, the kinds of notice the screen lists (prize and gift notices, such as Pilot of the week, an achievement, someone who joined with your invite or an effect or a wheel you were given, and the notices of offers to share or hand over a car have no switch of their own) and choose "Não perturbe" (do not disturb) hours, when notices arrive without sound; and you turn everything off in your device settings.
• To moderate the community: review reports (for a reported message, reading the conversation around it; without a report, only with a written, logged reason), remove or hide content, apply suspensions and prevent fraud, spam and abuse, including the automatic check of meets’ names and descriptions.
• To investigate and fix errors, confirm the reports that point to a real error and improve the Platform. When the team confirms an error you reported, you get a notice, in the app and by push, once per error. This notice has no switch, because it answers something you did.
• To count how many people use the Platform per day, week and month, and to estimate, before a purchase, how many people a boost can reach, from the days of use.
• To comply with legal, regulatory, tax and accounting obligations and to exercise rights in judicial, administrative or arbitration proceedings.

We do not sell, rent or hand over your personal data for third-party advertising.

We process personal data under the legal bases of Article 7 of the LGPD:

• Performance of a contract (item V): to provide the Platform you requested when creating your account and the paid services you sign up for, such as the verified profile and your store’s plan. This includes checking in to a meet: when you tap "Fazer check-in" (Check in), your device’s position is read once, at your request, only to check that you are there (the device’s location permission is still your choice, in its settings).
• Compliance with a legal obligation (item II): for example, keeping access logs as required by the Internet Civil Framework and keeping billing records as required by tax law.
• Legitimate interest (item IX): security, fraud and abuse prevention, moderation, recommendations, usage measurement and improvement of the Platform, always respecting your rights and expectations.
• Consent (item I): for the use of your device’s location — including showing your car live on the map, also in the background during a ride, sorting the Marketplace by distance and reporting police on the map or saying there is no more police, if you use those features — for access to the camera (for photos and videos and, if you check people in at a club, to scan another person’s card) and photo library, and for push notifications. You grant and revoke it in your device settings and, for the live car and the ride, in the app itself.
• Regular exercise of rights (item VI): to defend Burnout in legal proceedings.

The app may ask for permission to use your device’s location. It is optional and is used to center the map and show distances; without it, the map opens on the whole of Brazil and the Marketplace does not sort by distance.

Events near you: with location allowed, the Nearby tab of events sends the server only an area around you, with its sides on a grid of about 11 km, and never your position; the distance and the order of the meets are worked out on the phone.

City for the feed: with location already allowed, the app finds the city you are in without turning on GPS and without sending your position: it asks the map for the area around you, on the same grid, and takes the city of the nearest Burnout point. The city goes along with the feed request, and the server uses it only to order the feed of that moment, when your profile has no city, without storing it. The phone keeps only the city name, for up to 24 hours, and deletes it when you sign out or remove the location permission.

City from your location: in the city field (at sign-up, in the city question and in Settings), the "Use my location" button asks for permission if it does not have it yet and finds your city the same way, without sending your position: the app asks the map for the area around you, on the same grid, and picks on the device itself the city of the nearest Burnout point. Only the city you save goes to your profile.

Location in a conversation: it only leaves the device when you tap to send it, as your current position or a point you choose on the map. It stays in the message, and the people in the conversation see it, until you delete the message or the account.

To show what exists in an area, the app sends our server the map area around what is on your screen, rounded, and never your position, and the distance to a meet, a club or a store, including in the Partners tab, is calculated on the device itself. Outside a ride, we do not collect location in the background, and we never keep a history of your location: not even a check-in at a meet stores your position, only that you arrived.

Marketplace: when you sort listings by distance or filter by radius, the app sends our server your approximate position, used only to calculate the distance to each listing. It is not stored and does not go into logs. A search alert does not store your position: it uses the city you choose.

Photo spots and stations: when you suggest a photo spot or add a missing station, the app sends our server only the map area around what is on your screen and the point you marked, never the device’s position. The spot belongs to a place, not to the person; who created it is kept for moderation and is not shown in the app.

Routes: to draw a route, the app sends straight to Stadia Maps the points you marked (the start, which can be where you are now, the stops and the destination), the kind of route and the language of the instructions. Stadia also receives the device’s IP address, as any internet service does, and no data from your account; the path it returns stays only in the phone’s memory, for up to 30 minutes. If you publish a route that starts where you are, the app asks first, because that point becomes visible to whoever sees the route.

Navigation: navigation only works with the app open on the screen. Your position is read from the GPS and used on the phone itself, to follow the route, say the next maneuver and warn about speed cameras; it does not go to the Burnout server and is not stored. When you leave the route, the app asks Stadia for a new path from where you are now, the same way. The voice of the instructions is generated by the device itself.

Speed cameras: they come from OpenStreetMap, only in the countries where Burnout shows them (today, Brazil), and the Burnout server fetches them by area, with no data about who uses the app. On the map, the app asks the server for the cameras in the area on the screen, like fuel stations; during navigation, for those in an area of about 6 km around the car, on a grid of about 2 km, and never for your position.

My car on the map: your position only leaves the device if you turn on "Aparecer ao vivo" (Go live). The app asks at sign-up, in the location step, whether you want to go live at your exact position: if you tap "Aparecer ao vivo", it turns on; if not, it stays off, and you can turn it on later under Ajustes › Privacidade (Settings › Privacy). With it on, and only while the app is open on screen, the app sends your position every 3 seconds, and your car appears on the map to whoever you choose: everyone, which is the default, including people who open the map without an account, or only your followers (with a private profile, only followers). People you blocked, or who blocked you, do not see it. Your car appears at the exact point where you are. Until October 7, 2026 there was also the "Bairro" (neighborhood) option, which rounded the position to about 1 km; it was removed, and people who were live with it had "Aparecer ao vivo" turned off, so they choose again whether to appear. Whoever looks at the map at the size of a city or closer sees live cars moving in real time. On a more zoomed-out map, no car is shown: only white presence dots, one per square of about 28 km with someone live whom the viewer could see, without saying who or how many; these dots also show to people who open the map without an account.

The live car position is valid for at most 90 seconds and is kept only in the server’s memory: it is not written to disk or to the database, it does not go into logs and it does not form a history. When you turn the feature off, choose "Ninguém" (nobody), end the ride or, outside a ride, leave the app, it is deleted immediately; if the app is closed abruptly, it disappears on its own within 90 seconds, and at the end of the ride’s time it stops showing immediately.

Safe zones: under Ajustes › Privacidade › Zonas seguras (Settings › Privacy › Safe zones), you mark places, such as your home, with a radius of 200 m, 500 m or 1 km. Inside a safe zone, your position does not leave the device, with the app open or on a ride, and your car leaves the map at once. The zones stay only on your phone, encrypted, are never sent to our server and are deleted when you sign out.

Ride ("rolê"): if you start a ride, you choose for how long (1, 2, 3 or 5 hours), and during that time your device’s position is sent even with the app in the background, to the same audience chosen under "Meu carro no mapa" (with "Ninguém", there is no ride). For that, the app asks for location permission "all the time"; on Android, a notification stays on screen while the ride lasts. The ride ends on its own when the time is up, or when you end it. We keep only until when it is valid, and the position follows the live car rules above: it is kept only in the server’s memory, is valid for at most 90 seconds and does not form a history. The start and the end of the ride, with the hours chosen, go into the audit logs, without any position.

Convoy: whoever creates a convoy sets the destination (a meet or a place), the meeting point on the map and, optionally, the departure time and a name; a meet’s convoy only takes people who marked "Vou" (going). Joining a convoy is choosing to appear to its other cars: while you are in it, with the app open, the app sends your device’s position and your car’s heading, and the server passes them only to the people in the same convoy, even with "Aparecer ao vivo" (Go live) off; on the live map, for other users, you still appear only if it is on. That position is never stored: it stays only in the server’s memory, the latest one for each car, is not written to disk or to the database, does not go into the logs, and is gone when you leave the convoy, when it ends or when its window passes (up to 6 hours after the departure time, or after its creation if it has no time). Speed is never sent. To say you arrived, your phone itself checks whether you are within 150 m of the destination and sends only the time of arrival, without the position. The convoy and the times each person joined, left and arrived are deleted 30 days after the convoy ends.

Hotzones: when the map shows an area the size of a city or smaller, the app points out where 3 or more people are sharing their position right now, in areas of about 550 m. Everyone sharing their position counts, whatever audience they chose, but the map shows only the center of the area and how many people are in it, never who they are or exactly where. The count is made on the spot, from the server’s memory, and none of it is stored.

Police alerts (danger zones): when you tap "Polícia" (Police) on the map and confirm, the app sends our server the place where you are at that moment, read from the GPS, and the server keeps that place rounded to about 110 m. When the map shows an area the size of a city or smaller, it shows the areas of about 450 m where police were reported in the last 3 hours, with how many reports, how many people said there is no more police, when the last one was and when the area leaves the map; never the point of the report, who reported or who said there is no more police. Each report stays on the map for 3 hours and leaves sooner when 2 people, other than whoever reported, say there is no more police ("não tem mais polícia"); the layer can be turned off on the map. To say there is no more police, the app sends the place where you are at that moment only for the server to check that you are within 400 m of the alert. That place is discarded at once and does not go into the database, the logs or the audit records. In the first 24 hours, moderation sees who reported and who said there is no more police, to remove false reports and curb abuse.

Check-in at meets: when you tap "Fazer check-in" (Check in) at a meet, the app reads your device’s position once and sends it to our server, which measures the distance to the meet’s point (a check-in counts within 200 m of it) and discards the position right away: it is not stored in the database, in the audit logs or in the technical logs. We keep only that you checked in to that meet, the time and the car you chose (or that you came without a car). The check-in also marks you as going ("Vou"). Whoever can see the meet sees you under "Quem chegou" (Who arrived), with the car, and on the first check-in of each occurrence the meet’s chat shows the people in it that you arrived and with which car. That notice sends no push notification and cannot be reported, and it leaves the chat if you are removed from the guest list or delete your account. At the meets of clubs that choose check-in by card, whoever organizes the meet, the club’s admins or moderators, or Burnout’s moderation check people in through the app: the checker’s camera (camera only, no microphone) reads the QR code of your card on their device, and nothing from the image is sent; the checker’s device position is read once per scan, only to confirm they are within 200 m of the meeting point, and is discarded: it goes neither to the database nor to the audit logs. Voting for the Car of the meet neither uses nor stores a position.

The locations shown on the Platform are the ones people choose to publish: a meet’s meeting point, set by whoever creates it; a club’s headquarters, visible only to its members; the live car of whoever turned that feature on; a store’s address and spot on the map; and the spot a seller marks on a Marketplace listing, which is shown to anyone who views the listing — mark a public place, not your home. Map images come from map providers, with OpenStreetMap data: in the app, OpenFreeMap; on the map of the website’s store area, MapTiler. They receive your IP address and the area requested in order to deliver those images, and MapTiler also receives the text you searched when you look up your store’s address in the website’s store area. A meet’s city and state, and the suggested name and address of the place, come from the point marked on the map: Burnout’s server queries Nominatim, from OpenStreetMap, with only that point and none of the creator’s data. The place search on the app’s map is done on Burnout’s server, over a copy of the places data of the Overture Maps Foundation (the name, category, address and location of businesses, published under an open license): the searched text and the map area do not leave the server. When the text looks like an address or the name of a city, or the copy does not find the place, the server also queries Nominatim, with the searched text and the map area on the screen, rounded to about 1 km, and none of the searcher’s data. The businesses in the search come from public sources gathered by Overture Maps; anyone who wants their own business corrected or removed from Burnout’s search can ask at contato@oficialburnout.com.

Anyone with a store, workshop or parts dealer can register it in the website’s store area, with their Burnout account, and subscribe to a plan for it to appear on the map (see the Terms of Use). In that case, we also process:

• Store data: name, category, address, city and spot on the map, the contacts and social networks the store wants to publicize (website, WhatsApp, Instagram, Facebook, TikTok and YouTube), the logo, the cover and the photos. They are public: they appear on the map and on the store card, in the app and on the website. We also keep the account that registered the store and the result of the team’s review, with the reason, if the store is rejected.
• Payment: it is made on Stripe, which receives and stores the card data under its own privacy policy. We do not see or store the card number. From Stripe we receive the customer and subscription identifiers, the plan, the payment status and the renewal and cancellation dates; we also keep the store name and the email used for payment.
• Store numbers: when someone opens a store’s card on the map or taps one of its links, we add one to that day’s counter. We do not keep who opened or who tapped: the store only sees the totals.
• Store reviews: the store sees the reviews it receives, with the public profile of whoever rated (name, @ and photo), the stars, the text and the date, and can reply publicly, in the store’s name. The reply is shown next to the review to anyone, and the store can report a review; the score and the reviews do not depend on the plan.

The store area session is kept in a website cookie (see "Cookies and similar technologies").

If you subscribe to the verified profile (see the Terms of Use), we keep the subscription status: whether it is paid up, until when it is valid, whether it will renew, whether the last charge was declined, whether the team removed the badge and where it comes from: a subscription on the website, through Stripe, on the App Store or on Google Play, or the team, which may grant it. We also keep the customer and subscription identifiers on Stripe, or the purchase identifier on the app store, to link the billing to your account.

Payment is made on Stripe or on the app store, which receive the card data under their own privacy policies. We do not see or store the card number.

The badge appears next to your name everywhere the app shows you (on your profile, on posts, in Cenas, on stories and comments, in conversations, in searches and people lists and on the live map), and it only says that the account has the badge. Only you see where it comes from and until when it is valid.

To subscribe on the website, you sign in with your Burnout account, and the session is kept in a website cookie (see "Cookies and similar technologies").

Cenas, Explore, the continuation of Following and people suggestions are ranked for each person. For that we use: the people and cars you follow, the people close to your network, your likes and comments, the cars you own and the ones you like, your city, the clubs you are in and the posts that went past your screen, with the time you watched each video in Cenas. We do not use sensitive data, your device’s location or anything from outside the Platform. Each people suggestion shows its reason.

The record of the posts that went past your screen and of watch time in Cenas is kept for 90 days and is deleted along with the account.

Sponsored content: boosted posts and listings carry the "Patrocinado" (Sponsored) label, and to choose which one to show we use the same signals as the recommendations. When a sponsored item is shown to you, we record that it was shown to your account, how many times and when, to count its reach and to avoid showing the same one too often. Whoever boosted it only sees the totals (people, times and taps), never who saw it. This record is deleted 90 days after the boost ends.

You may ask for information about the criteria behind these recommendations and for a review of a decision made solely by automated means that affects your interests (Article 20 of the LGPD), by writing to contato@oficialburnout.com.

• Other people on the Platform: your public profile (name, @handle, photo, bio, city, the social networks you provide and the verified badge, if you subscribe, and the beta tester badge, with the month and year you arrived), your cars and everything you post are visible as the Platform works and to the audience you choose for each post and story; your Marketplace listings and your Marketplace store, which shows your name, @, photo and city as its owner and the WhatsApp and Instagram you put on it, to anyone, even without an account; messages, to the people in the conversation; your store’s data, on the map; your check-in at a meet, with the car you brought, under "Quem chegou" (Who arrived), to whoever can see the meet, and the notice that you arrived, in the meet’s chat, to the people in it; and, if you turn on "Aparecer ao vivo" or start a ride, your car’s position and its card on the map, with your social networks, to the audience you choose; and, without identifying anyone, the hotzone counts, the presence dots of the zoomed-out map and the police alerts, to those who use the map. In polls, nobody sees what you voted for, not even whoever made the poll: the app shows only how many votes each option got and the percentage; whoever made the poll sees the result from the first vote, the others after voting or when it ends. The credit of whoever took a photo is public, disappears when that person removes their name and respects "Quem pode me marcar" (Who can tag me). Reviews of stores and ratings of sellers, and the replies to them, are public, with name, @ and photo; a seller sees how many people favorited each listing, never who. Your story highlights stay on your profile for whoever can see your posts, and a close-friends story inside a highlight stays only for them. Whoever can see your profile sees your achievements and the month they came in, never the day or which meets, sales, clubs or errors, and the bug hunter badge next to your name, with the highest level and the month and year the first one came in; with a private profile, only whoever you accept, and with "Conquistas no perfil" (Achievements on profile) off, only you. A club’s pinned notice is shown only to its active members, and each member’s role (admin or moderator) is shown in the member list. Whoever checks your card sees your name, @, photo, role in the club, since when you are a member and the car. Think about it before posting.
• In the links the app shares: a link to a profile, a meet or a club opens, for people without the app, a page on the website with what the app shows to people who are not signed in. Profile: the name, the @, the photo, the city, the bio, the verified badge and how many cars, posts and followers the person has. Open meet: the name, the cover, the description, the day, the place, how many people are going, who organizes it, the club and the partner store (a members-only meet does not appear). Club: the name, the emblem, the city, the description, how to join, how many members it has and how many meets are scheduled. Your invite link shows your @, name, photo and city, and your code. These pages ask search engines not to index them, but anyone with the link can see them.
• In a convoy: the people in the same convoy see your car’s position and heading while you are in it. Whoever opens the convoy in the app (with its link, and if they can see the destination) sees the destination, the meeting point, the departure time, who leads it and the list of who is in it, with each person’s name, @, photo and time of arrival. Whoever opens the convoy’s link on the website, even without an account, sees only its name, the destination, the name of the meeting point, the departure time, who leads it (name, @ and photo) and how many cars there are; never the point, anyone’s position or who is in the convoy.
• In the club season: each club’s level, XP of the week, ranking position and Crown are shown to anyone (an invite-only club stays out of the ranking and the Crown). The Pilot of the week and how much they added are shown on the club page and in the member list and, except in an invite-only club, on their profile. The club ranking, with each member’s @, name, photo and how much they added in the week, is shown only to the club’s active members. The week’s duel (the two clubs, the score and the result) and each club’s duel record are shown to anyone; a challenge still without an answer, only to the members of the two clubs.
• On each car’s page: whoever can see the car (if its current owner’s profile is private, only the people they accept) sees who owns it and who shares it today and its ownership history, with each period of whoever owned or shared the car: the person’s name, @, photo and verified badge, the role, from when to when and how it ended. Your name stays in the history of a car that went to someone else, even with a private profile; people who deleted their account and people with a block between them and the viewer appear without a name. Your past cars (the ones you handed over, moved to past cars or stopped sharing) appear on your profile, with the period and the role, to whoever can see your profile; a car that is now with someone with a private profile appears without a photo or link to the people they have not accepted.
• Providers that operate the Platform on our behalf, only as needed for the service: server hosting; storage of photos, videos and the encrypted copy of your data, and delivery of photos and videos (Cloudflare); email delivery; maps (OpenFreeMap in the app and MapTiler on the website); addresses and cities on the map (Nominatim, by the OpenStreetMap Foundation, which receives from Burnout’s server only a meet’s point or, when the text looks like an address or a city or Burnout’s search does not find the place, the searched text with the map area on the screen, rounded to about 1 km); routes (Stadia Maps, which receives from the app the points of each route, the kind of route and the language, with the device’s IP address and no data from your account); weather forecasts at meets (MET Norway, the Norwegian Meteorological Institute, data under CC BY 4.0, requested by Burnout’s server with only the meet’s point rounded to about 1 km: none of your data, not your position or your IP address, goes to it); web payments (Stripe); sign-in with Google and Apple; push notifications (Expo, by 650 Industries, which receives the device’s push identifier and the text of each notice, and Google’s Firebase Cloud Messaging, which delivers them on Android; on the iPhone, delivery goes through Apple’s notification service); and the app stores (Apple App Store and Google Play), which also process purchases made in the app.
• OpenAI, for the automatic check of meets: when you create or edit a meet, its name and description go to OpenAI (GPT-5 nano model), which analyzes them on Burnout’s behalf only to block text that announces or invites people to street racing, dangerous stunts or blocking public roads, evading enforcement, betting or another crime. Your name, your @, your location and your photos are not sent. Under OpenAI’s API data policy, what it receives is not used to train its models, and the request is made without being stored in Burnout’s OpenAI account. If the text is refused, the meet is not created or changed, the app tells you and asks you to change the text, and the audit logs keep that it was refused, with the type and the reason, without the text.
• Amazon Web Services (AWS), for the license plate check: each photo you send goes, as a reduced copy (up to 2,048 pixels on the longer side), to an AWS service in São Paulo, which analyzes it on Burnout’s behalf only to find vehicle license plates and returns where they are. Your name, your @ and the caption are not sent, and the location recorded by the camera has already been removed from the photo. The copy is analyzed in memory and discarded when the answer is sent, without being stored.
• Authorities: when there is a court order, a request from a competent authority or a legal obligation, including to help investigate crimes.
• Corporate transactions: in a merger, acquisition, consolidation or sale of assets, data may be transferred to the successor, which will remain bound by this Policy.

We use technical and administrative measures to protect data: encrypted connections (TLS), passwords and codes stored in encrypted form, access to systems restricted to those who need it, and audit logs of every change. No system is 100% secure; if a security incident may cause relevant risk or harm, we will notify Brazil’s National Data Protection Authority (ANPD) and the people affected, as required by Article 48 of the LGPD.

We keep data while your account exists. In addition:

• Access logs: kept for at least 6 months, as required by Article 15 of the Internet Civil Framework, or longer under a court order.
• Technical API records (logs, with the date and time of each request and the account, when signed in): available for lookup for 90 days and then kept in an encrypted archive with restricted access, for as long as needed for security, auditing and legal defense.
• Audit logs, reports and moderation history: kept for as long as needed for security, fraud and repeat-abuse prevention, and legal defense, within the legal time limits.
• Copy of a reported message: while the report is pending and up to 90 days after the decision (resolved or dismissed).
• Deleted message: gone from the conversation at once; its text and any post shared in it are kept for 90 days and then erased, leaving only the record that there was a message (who sent it, when and in which conversation). If the message is part of a report still awaiting a decision, its content is kept until the decision.
• Billing records for stores and the verified profile, and Boost and coin purchase records: kept for the period required by tax and accounting law.
• Verified profile subscription status: while the account exists.
• Coin balance and statement, missions and effects: while the account exists.
• Who reported each fuel price: 30 days linked to the price; after that, the price stays on the map without an author, and the report remains only in the audit logs.
• Posts that went past your screen and watch time in Cenas: 90 days.
• Days of use: 6 months, and deleted with the account.
• Who saw each sponsored item: deleted 90 days after the boost ends; the reach totals stay with the boost.
• Stories: they come off 24 hours after they are posted. If the story archive is on (it comes on and is turned off on the Arquivo de stories (Story archive) screen), the story is kept in your archive, which only you see, until you delete it. A story you put in a highlight stays on your profile until you remove it. The list of who viewed is deleted 24 hours after posting. A deleted story leaves at once for everyone, and its file is deleted from storage within an hour (copies cached on the file delivery network disappear within 24 hours). A reported story, expired or deleted, stays stored, shown to no one, until the moderation decides, and is deleted afterwards.
• Publication request for a post or story that waited for its video: deleted 7 days after the post goes live or the request fails.
• Saved posts and collections, Marketplace search alerts and favorites: until you delete them or delete your account. The record of which listings triggered each alert goes with the alert.
• A review of a store or a seller rating: until you delete it or delete your account; once deleted, the text leaves at once; the copy kept in a report stays up to 90 days after the decision.
• Votes for the Car of the meet: 90 days after the result; the result stays with the meet.
• A club’s pinned notice: one that leaves the top (replaced, removed or expired) is deleted 90 days later; a report against it still awaiting a decision keeps the notice until the decision.
• Achievements and exclusive effects: while the account exists.
• Effect and wheel gifts: while both accounts exist; when one of them is deleted, the record stays without that person’s name.
• Copy of your data: the file stays encrypted in our storage for 7 days after it is ready, or until you ask for a new one, and is then deleted; the record of the request (when it was requested, when it was ready and how many times it was downloaded) stays 90 days after the copy expires or fails, and the audit logs follow their own period.
• Connected devices: while the session is active and up to 60 days after its last use; then the session record is deleted, along with that device’s push identifier.
• Check-in by card: that you arrived, the time, the car and who checked, while the meet and your account exist; the checker’s position is not stored.
• Verification and password-recovery codes expire and are never reused.
• Device push identifier: until you sign out, delete your account, remove the device from your account or the push service reports that the device no longer exists, and at most while the record of that device’s session exists. The text of each notice is not stored on our server; Expo and Google handle it under their own policies.
• Data we must keep by law, or to exercise rights, is kept only for that purpose.
• Live car position, also during a ride: at most 90 seconds, only in the server’s memory, and deleted immediately when you turn the feature off, end the ride or, outside a ride, leave the app.
• Ride: only until when it is valid; the start and the end, with the hours chosen, stay in the audit logs, without position.
• Convoy: each car’s position, only in the server’s memory and only while the person is in the convoy; the convoy (the destination, the meeting point, the departure time and the name) and the times each person joined, left and arrived are deleted 30 days after the convoy ends, or earlier, when the account of the person who leads it is deleted.
• Hotzones: nothing is stored.
• Police reports: the report, with the rounded place and the time, who reported and who said there is no more police, 24 hours; on the map, up to 3 hours after the report, or less, if 2 people say there is no more police. The audit record of the submission (who sent it and when, without the place) follows the retention of the audit logs.
• Who added each station: 30 days linked to the station; after that the station stays on the map without an author, and the addition remains only in the audit logs. A station deleted by whoever added it is erased for good 30 days later.
• Who suggested each photo spot: while the spot exists, because that is what lets you correct your spot. A spot older than 48 hours with no posts is deleted; if you delete your account, the spot stays linked to the anonymized account.
• Blocks on adding places: while the account exists; they go with the deletion.
• Position used in the Marketplace: not stored.
• Marketplace store: while it is open. When you close the store, it is deleted, its products go back to being your own listings and the stock is deleted.
• Check-in at a meet: that you arrived, the time and the car, while the meet and your account exist; the arrival notice in the meet’s chat, until you are removed from the guest list or delete your account; the position used to measure the distance is not stored.
• Removal from a meet’s guest list: the mark that you were removed, while the meet and your account exist; who removed you and when stay in the audit logs, for their period.
• A meet’s name and description sent to OpenAI: not stored in Burnout’s OpenAI account; the logs OpenAI keeps to monitor abuse follow its API data policy (currently up to 30 days). A refusal stays in the audit logs, without the text, for their period.
• A photo copy sent to AWS for the license plate check: not stored. The service’s technical logs (photo size, number of plates and the time of the check), without the photo, are kept for 14 days.
• Invites: who invited whom, while both accounts exist; when either one is deleted, the invite record is deleted. The coins the invite paid stay in the statement of whoever received them, while that person’s account exists.
• Club season: the XP you added stays with the club while it exists; if you delete your account, it stays without your name. The Pilot of the week badge lasts until Sunday and goes with the account.
• Shared and handed-over cars: your periods in each car stay in its history while your account exists and, after deletion, without your name. The offers to share or hand over a car, with the answer, are kept while both accounts exist; one left unanswered expires in 7 days.

Under Article 18 of the LGPD, you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of your data to another provider, under ANPD regulations;
• deletion of data processed based on your consent, and information about the consequences of not consenting;
• information about whom we share your data with;
• withdrawal of consent;
• objection to processing carried out in breach of the LGPD.

You can do much of this in the app itself: edit your profile; download a copy of your data under Ajustes › Privacidade › Baixar meus dados (Settings › Privacy › Download my data) (what it holds is in the next paragraph); see and remove from your account the connected devices, under Ajustes › Aparelhos conectados (Settings › Connected devices); delete posts, cars, listings and messages; and delete your account. For a store, in the store dashboard on the website. For anything else, write to contato@oficialburnout.com from your account’s email. We may ask for information to confirm your identity. You may also file a complaint with the ANPD.

The copy of your data is a .zip file built on our server in a few minutes: dados.json, with your data in JSON, a format other services can read; your photos and videos, as they are in the app (without EXIF, location or metadata); and a LEIA-ME.txt (read me) file. When it is ready, you get a notice in the app, a push notification and an email, which carries no link. The file is stored encrypted (AES-256), with the key only on our server, and is available for 7 days. To download it, the app asks for a link that only your account, signed in to the app, can generate; the link is valid for 15 minutes to start the download and is not kept in the logs. You can ask for a new copy every 24 hours (a failed one does not count), and asking for a new one ends the previous one at once. It includes everything you put in the app, including what you deleted and we still keep and what moderation hid, each marked as such. It also includes your connected devices and the ones that receive push notifications, without the push identifier. Your periods in each car, as owner or sharing it, past cars included, and the offers to share or hand over a car that you sent or received are in it too. The error and problem reports you sent come with the date the team confirmed the error, if it did. Other people appear only by their @, and only where the record is your choice: whom you follow, blocked, added to close friends, tagged, invited, gave a gift to or talked to, and the other side of each offer to share or hand over a car. Left out: the messages you received, other people’s comments and likes on your posts, the list of who follows you (only the number goes in), the notices you received, secrets (password, access tokens, the two-step verification secret and payment codes), moderation’s internal notes, the copy kept as evidence of a report and the technical logs, which follow the periods of this Policy. It also includes the convoys you were in that have not been deleted yet, with the destination, the meeting point, the departure time, your role and when you joined, left and arrived. Live location, ride location, convoy location and check-in location are not stored, so there is nothing to copy. Whatever is not in the copy, ask for by email, as above.

Under Article 20 of the LGPD, you may also request a review of a decision made solely on the basis of automated processing, such as the automatic refusal of a meet’s text, by writing to contato@oficialburnout.com.

You can delete your account in the app under Ajustes › Excluir minha conta (Settings › Delete my account), or on the website at oficialburnout.com/excluir-conta, signing in with your account. From the request, you have 14 days to change your mind: during that time your account keeps working and you can cancel the deletion in the app or on the website.

After that, the deletion cannot be undone: your profile, cars (except a shared car, as below), posts, stories, highlights, story archive, listings and Marketplace store are taken down, and the files of your photos and videos are deleted (copies cached on the file delivery network disappear within 24 hours); comments, likes and messages you left are unlinked from you and show as "Conta excluída" (deleted account); your profile stops showing in the conversations where someone sent it, and the chat invitations made by you or to you stop being invitations; the conversations about your listings become read-only; your attendance answers and check-ins at meets, with the arrival notices in the chat, are deleted, and your club memberships leave the lists; the clubs you founded stay up for their members, without your name, @ and photo; the convoys you lead are deleted, and you leave the others; and your @handle is released and may be used by someone else. We keep only what the law requires or what is needed for security and legal defense, as described in "Storage, security and retention".

The meets you created stay up while they have a participant: another person, with an active account, who answered going ("Vou") or interested ("Tenho interesse") or checked in (your own answer and those of people removed from the guest list do not count). On them, the app shows "Burnout · quem criou saiu" (Burnout · the creator left) where the organizer would be, with no profile link, and, if the meet belongs to a club, the club’s admins keep taking care of it. Meets with no participant are deleted for good, along with their answers, check-ins, chat and related notices, and the same happens when the last participant of one of those meets also deletes their account. Other people’s posts linked to a deleted meet stay up, only without the link.

If you own a shared car, it stays with the people who share it: the new owner is whoever has shared it the longest and has not asked to delete their own account, and the car carries on without the photos you added to it and the posts you made with it, which go with your account. Your other cars, including those in past cars, go with the account, and you leave the cars you shared with other people. Your periods stay in the ownership history of each car you were in, without your name, and the offers to share or hand over a car that you sent or received are deleted.

If you have a store on the map, deleting your account takes your stores off the map and cancels their subscriptions on Stripe when the period ends, with no refund for the current month. To stop billing sooner, cancel the subscription in the store dashboard. Boosts you bought stop being shown, with no refund, and the record of sponsored items shown to you is deleted.

When the deletion is completed, the verified badge comes off and a subscription made on the website is canceled, with no refund for the current period; one made on the App Store or Google Play you cancel in the store itself, since the store charges it.

Your coins, statement, effects and menu wheels are deleted with the account, and the balance is not refunded; a purchase made in an app store follows that store’s refund policy, since the store charged it. The fuel prices you reported stay on the map, without an author, and your police reports and your "não tem mais polícia" marks lose their author and go when their time is up. From the request on, your invite code stops working. When the deletion is complete, the record of who invited you and of who joined with your code is deleted; the coins those invites already paid to other people stay with them. The XP you added to clubs stays with them without your name, and the Pilot of the week badge is removed.

Also with the deletion: the votes you cast in polls keep counting in the result, with no link to you; the posts you saved and your collections are deleted; the photo credit with your name comes off the photos; the photo spots you suggested stay linked to the anonymized account, the stations you added stay on the map without an author, and your blocks on adding places are deleted; your reviews of stores are deleted and each store’s score is recomputed, and, if you have a store on the map, the replies you wrote too; the ratings you received as a seller are deleted, and the ones you wrote show as "Conta excluída" (deleted account); your search alerts and favorites are deleted; the votes you cast for the Car of the meet and the ones received by the cars that go with the account are deleted, and the result those cars won while they were yours stays with the meet, without the car and without your name; a car that is now with someone else keeps the votes it received and the result and trophy it won while it was yours, without your name; the notices you pinned in clubs are deleted; the XP you added in a duel stops counting in the score; the QR code of your card stops being valid and, in the check-ins you verified, your name comes off; achievements, with the bug hunter badge, and exclusive effects are deleted, and the error reports you sent stay, without your name and without the calls and screens that went with them, because the error belongs to the app; the effects and wheels you gave as gifts stay with whoever received them, without your name, and the ones you received go with the account; the publication requests are deleted, and, from the deletion request on, a post or story that was still waiting for its video no longer goes live; the copies of your data and their requests are deleted, the file first; the connected devices leave the account and their records are deleted; and the language stored in the account is deleted.

The website oficialburnout.com does not use advertising or tracking cookies. In the areas of the website you sign in to with your account (the store area and the verified profile area), we use a single cookie, needed to keep you signed in: the session, valid for up to 30 days and deleted when you sign out. The app stores on your device only what it needs to work, such as the session token, which keeps you signed in, the push identifier, your preferences, your safe zones (encrypted), a copy of the images you have already seen, so they open faster, error reports not yet sent and, so the club card QR code works offline, its secret and your cars’ names. When you publish a post or a story, the app copies the photos and the video into its own folder and keeps them on the device, with the text and the choices of the post, in an upload queue, until the post or the story goes live or until you take it out of the queue on the "Publicando" (Posting) screen; then the copies are deleted. An upload that stopped on a failure (the connection dropped three times in a row, or the server refused it) stays in the queue until you try again or take it out. When you sign out, that account’s uploads still in the queue leave the device, with their copies, and an upload that has been in the queue for more than 7 days also leaves when the app opens.

When you sign in with Google on the website, the button is loaded by Google itself, which may use its own cookies under Google’s policy. Payment happens on Stripe’s page, under Stripe’s rules and cookies.

If we ever start using analytics or advertising tools, this Policy will be updated first and, where the law requires, we will ask for your consent.

The Platform is for people aged 18 or over only. We do not knowingly collect data from children or teenagers, and there is no parental-consent route.

If we identify an account belonging to someone under 18, it will be closed and its data deleted. If you know of such a case, let us know at contato@oficialburnout.com.

Some providers (such as Stripe, Cloudflare, OpenAI, Expo, Google’s Firebase Cloud Messaging, the app stores, sign-in with Google and Apple, the map provider, Stadia Maps, which receives the points of each route, the OpenStreetMap Foundation, which receives only a meet’s point or the searched text, and MET Norway, which receives only the rounded point of a meet) may process data on servers outside Brazil. In those cases, the transfer follows Article 33 of the LGPD — for example, when necessary to perform the contract with you, or with contractual data-protection safeguards.

The license plate check, at Amazon Web Services (AWS), runs in Brazil, in São Paulo: the photo copy does not leave the country.

We may update this Policy to reflect changes to the Platform or the law. The date of the version in force is at the top of this page. Relevant changes will be announced in the app or by email before they take effect.

Controller: CODERABR DESENVOLVIMENTO DE SOFTWARES LTDA, CNPJ 65.494.300/0001-10, Avenida Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, CEP 90560-001, Brazil.

Channel of the officer in charge of personal data processing (Article 41 of the LGPD) and privacy support: contato@oficialburnout.com. We reply within 15 days.