Your data

This page is the short version. The privacy policy is the whole thing, and it is the one that counts: it names every field, every party and every retention window.

With no account, nothing leaves the phone

Your trips and your coverage are stored on the phone and nowhere else. A phone that never signs in and never sends a problem report never opens a connection to the server.

What is sent, once you sign in

A trip goes up after it has finished recording, when the phone next has a network. Nothing is sent while you are driving.

• The trip record — when it started and ended, how far it went, how it was recorded, and any name or notes you typed.
• A simplified trace — the points thinned so the kept line stays within 50 meters of the one your phone recorded, with times floored to the minute. The full-resolution trace is never uploaded.
• The stretches you matched — each one as a position along a named route in a named state, with a direction and a time. No coordinates: a position on a route is a distance along it.

Trips you recorded before signing in stay where they are. The app holds them back and sends none of them until you tap Upload N trips, and uploading copies them rather than moving them.

What stays on the phone

The full-resolution points of every trip. Nothing prunes them and no timer removes them; they are there until you delete the trip, wipe the app’s data or remove the app.

Once you are signed in the phone also keeps a cached copy of what the server serves it, so a trip recorded on another phone can show up in your list as “Trip not on this phone”.

Signing out

Signing out on the phone returns that phone to device-only. The trips that phone recorded stay on it. The cached copy of your account is emptied, so a trip that reached the phone only from the server stops showing until you sign in again. Your account, and everything already uploaded, stays on the server until you delete the account.

Signing out does not revoke that phone’s sign-in on the server. It lapses after 90 days, or you can revoke it under Signed-in phones in the web app.

Deleting

• A trip — deleted everywhere, along with the coverage it credited and the trace it uploaded.
• A trace, keeping the trip — in the browser only. The miles stay; the line is gone for good, and that trip can never be matched again.
• Delete all data, in the phone’s Settings — wipes that phone and signs it out. The server is never told, so an account still holds what it was sent.
• Delete account, in the browser — takes the account and everything on it, in one step, with no undo.

A problem report

A report leaves the phone only when you press Send, and nothing is gathered at any other time. It carries your message, the app and Android versions, the phone’s model, which permissions are granted, whether the phone is signed in, your last ten trips as summary rows with no coordinates, and the app’s own recent log lines. The server also writes down the IP address the report arrived from and the name the request gave for itself. Reports are deleted after 90 days, both of those with them.

One thing goes only if you tick the box: the trace of your most recent trip. The box is off every time the form opens. Getting help is where the form lives.