Last updated: November 1, 2026
TripTrack is an iOS application for recording personal car trips. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the TripTrack mobile app and any server infrastructure we operate ("Service").
The developer of TripTrack ("we", "us") acts as the data controller for personal data processed through the Service. Contact: privacy@trip-track.app.
TripTrack works in two distinct modes. The data we process depends on which mode you use.
If you do not sign in, TripTrack stores all your data — trips, GPS tracks, photos, vehicle profiles, preferences — exclusively on your device using Apple's CoreData framework. Your trips, tracks, photos and preferences do not leave the device, and we do not create an account for you.
Three things do leave the device even in guest mode, and we would rather name them than claim otherwise:
If you sign in with Apple, your data can be synchronized with our server so it is available on your other devices. Cloud sync is opt-in and can be disabled at any time in the app (Profile → Cloud Sync).
One case does not depend on cloud sync. A trip you choose to publish, and the photos attached to it, are uploaded to our server even when cloud sync is off — that is what publishing means. New trips are private by default, and a private trip is uploaded only when cloud sync is on.
The app sends crash reports, app-hang and watchdog-termination events, session start/stop records and a 10 % sample of performance traces to Sentry (Functional Software, Inc.), acting as our data processor. Events are ingested and stored in Sentry's European region (ingest.de.sentry.io).
Each event carries: your account identifier (a UUID — no name, no email), an installation identifier generated by the SDK, device model, OS version, free memory, battery level, locale, calendar and time-zone name, and a trail of network requests in redacted form — the method, the status code, and the shape of the URL, with query strings, fragments and every identifier inside the path removed before the event leaves the device.
We do not send screenshots, view hierarchies, session replays, performance profiles, request or response bodies, file paths, access tokens, or your home location. The device-and-app hash that the SDK derives from Apple's identifierForVendor is removed before sending as well.
Diagnostics are sent in both modes, including guest mode, and they do not depend on cloud sync; the app has no separate switch for them. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in keeping the app working. Retention: events are deleted automatically once the retention period configured in our Sentry organisation expires. To object, write to privacy@trip-track.app.
With your consent in Settings → Privacy → Help improve TripTrack, we receive counts of recording starts, successful local saves (excluding discarded short recordings), save failures, Atlas screen opens, and save-speed buckets. We also receive UTC calendar days for consent, delivery, and the first two saved recordings since consent, plus whether your local library already contained trips. These are counters for a consent period, not a copy of your trip history. This option is off by default and works independently of sign-in and Cloud Sync.
A new random code groups these counters; the server stores its SHA-256 hash. We do not attach an account ID, advertising ID, route, coordinates, distance, photos, notes or vehicle data. This is pseudonymous first-party analytics, not advertising tracking. As with any request, our infrastructure sees the connecting IP address (see 3.3).
Turning the option off immediately clears the local counters and queues deletion of the server counters for the next connection. A deletion marker prevents delayed uploads from restoring them. Inactive records and deletion markers expire after 90 days. Opting in again creates a new code and starts fresh; uninstalling the app alone cannot send a deletion request. The legal basis for these optional counters is your consent, which you can withdraw at any time without affecting app features.
PRO and tips are bought through the App Store. Only Apple sees your payment method, card and receipt; we never receive them. Apple sends our server a notification about each purchase, renewal, cancellation, billing problem and refund. If you are signed in, the app also sends us the purchase confirmation signed by Apple, and the purchase is linked to your account; if you are not signed in, the purchase stays anonymous and is not linked to anyone.
For a subscription we keep: the plan, whether it is a free trial, the end date, whether auto-renew is on, the status (active, grace period, expired or refunded) and Apple's transaction number. We use them so that PRO works on your second phone and so that people you share your profile with can see the paid look you chose. We keep no card, address or payment details.
The developer can see these records in an internal section of the app that is available only to the developer's own account: how many people are on a trial or paid, when a period ends and whether auto-renew is on. There are no names or e-mails there — only the last digits of the transaction number, the app language, the account creation date and the number of trips. For each subscription event the developer's phone also receives a notification with the plan, the price and the store country, without a name or e-mail. This is not advertising and is not shared with third parties.
For users in the European Economic Area, the United Kingdom, and jurisdictions with similar rules, we process each data category on the following lawful bases (GDPR Art. 6):
| Data | Purpose | Legal basis |
|---|---|---|
| Apple user ID, account UUID, device UUID | Create and authenticate your account | Contract — Art. 6(1)(b) |
| Email, display name | Account identification, social features, account recovery | Contract — Art. 6(1)(b) |
| GPS trips (uploaded on opt-in) | Deliver the sync service you enabled | Contract — Art. 6(1)(b) |
| Photos (file metadata stripped) | Deliver the sync service | Contract — Art. 6(1)(b) |
| Public profile, follows, reactions, trip shares | Deliver social features you enabled | Contract — Art. 6(1)(b) |
| PRO subscription records and App Store notifications (§3.7) | Provide the subscription you bought on all your devices; answer billing questions | Contract — Art. 6(1)(b) |
| Crash, performance and session diagnostics (§3.5) | Find and fix defects; keep the app working | Legitimate interests — Art. 6(1)(f) |
| Server access logs, IP addresses, abuse-report records | Security, abuse prevention, accountability | Legitimate interests — Art. 6(1)(f), Recital 49 |
| Account-deletion audit record (timestamp + opaque hash only) | Demonstrate compliance with Art. 17 requests | Legal obligation + legitimate interests — Art. 6(1)(c)+(f) |
We do not rely on consent as a legal basis for the core service. Using a feature (tapping Record, enabling cloud sync, making your profile public) is your affirmative action to use that feature under Art. 6(1)(b). This is intentional — it means there is no ambiguous "consent withdrawal" question for core features; you simply disable the feature and processing stops.
Precise location and special category data. GPS coordinates are not special-category data under GDPR Art. 9 per se. We do not derive, infer, or cluster users by visited-place type (e.g., health, religion, sexuality). We do not run machine-learning inference on trip coordinates. If our practice changes, this policy will be updated in advance.
The following parties process data on our behalf or alongside us. Sentry does so from the first launch, in guest mode too; the others only once you sign in or turn cloud sync on:
We do not sell or share your personal information. There are no advertising or tracking SDKs in the app, no advertising networks, and no cross-app or cross-site tracking. We use exactly one third-party SDK, and it is diagnostic: Sentry (§3.5). It also records session starts and stops, which amounts to a count of app launches — so we no longer claim that we run no analytics at all. We do not share data with advertisers. We do not use your content to train machine-learning models.
Diagnostic events (§3.5) are ingested and stored in Sentry's European region and are not transferred outside it by us; Sentry itself is a US-headquartered company, and our processing is governed by its Data Processing Addendum.
Our primary hosting is in the European Economic Area. Photo storage on Cloudflare R2 uses an EU-jurisdiction bucket; however, as a US-headquartered company, Cloudflare is subject to US law. We rely on Cloudflare's EU-US Data Privacy Framework certification and Standard Contractual Clauses as transfer mechanisms. Sign in with Apple authentication routes through Apple Inc. (United States) under the EU-US DPF. If you are in a jurisdiction with stricter cross-border rules, using cloud sync constitutes your informed consent to this transfer.
Depending on your jurisdiction, you have the following rights:
We respond to verified requests within 30 days.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately.
TripTrack is directed to adults and is not intended for children. The minimum age to use the App is 16 (matching the strictest GDPR Art. 8 threshold across EU member states). We do not knowingly collect personal data from children under 13 in the United States (COPPA), and will delete any account we learn belongs to a user under 13. If you believe a child has provided us with personal data, please contact us for prompt removal.
California (CCPA/CPRA). We do not sell or share your personal information as defined by California law. We do not use personal information for cross-context behavioral advertising. If you are a California resident, you may contact us to exercise rights to know, delete, correct, or access your data. We will verify your identity via the email on file.
Nevada (SB 220). Nevada residents may opt out of any future sale of their covered personal information by emailing privacy@trip-track.app. We currently do not sell personal information.
Washington (My Health My Data Act). Precise location data collected by the App may, in some cases, incidentally reveal visits to health-related facilities (e.g., a medical office, gym). To the extent any such data is classified as "consumer health data" under Washington law: (a) we collect it only when you actively record a trip; (b) we do not sell it; (c) we do not share it with advertisers; (d) we do not geofence health-facility locations; (e) you can delete it at any time by deleting the relevant trip or your account. Before any material change to this practice, we will obtain your separate opt-in consent. To exercise rights under RCW 19.373, email privacy@trip-track.app.
Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, etc.). Residents of states with comprehensive privacy laws have rights similar to California's under their respective statutes. To exercise any such right, email privacy@trip-track.app.
We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email. The "Last updated" date at the top always reflects the current version.
Questions, complaints, or data subject requests:
This policy also covers TripTrack for Android. The purposes, rights, security, international processing and retention terms in the policy apply to Android, with the platform details below. You can record and keep your diary without creating an account. Cloud Sync is off by default. Android stores the diary in the app's local database rather than iOS Core Data.
Android uses Sign in with Google. When you choose it, the app receives a Google ID token and, when supplied, your display name and email address. Our server verifies the token and uses its Google account identifier to create or recognise your TripTrack account. The app also sends a random installation identifier, a one-time verification value, Android platform/app version and, when configured, a device name to distinguish sessions. We never receive your Google password, mailbox, contacts or calendar. The app does not import a Google profile photo into your diary. Credentials are encrypted using a key held in Android Keystore and kept outside Android backup and device transfer.
Signing in is optional and does not turn on private-library synchronisation. Android Google accounts and iPhone Apple accounts are currently separate; matching email addresses do not link them. Account authentication and the profile features you use are processed to provide the service, under the same legal basis as their iOS equivalents in this policy.
TripTrack collects precise location to record your driving route, distance, speed and elevation. If you enable automatic recording and grant background access, this includes starting and recording a trip when the app is closed or not in use. You can pause or finish a recording, disable auto-record, or revoke permissions in Android Settings. Android's Activity Recognition permission supplies movement/vehicle transitions to help detect driving. These signals are processed on the phone; we do not upload activity-recognition histories or use them to measure health or fitness.
With Nearby devices permission on supported Android versions, TripTrack can read a linked car stereo's name and connection state. Its saved name and local device identifier, and Android Auto connection information used as a stereo trigger, stay in the app's local settings. TripTrack does not upload these connection records in Cloud Sync and does not access the microphone, record audio or scan your address book for this feature. You choose the available automatic recording mode and can unlink a stereo or turn the feature off.
While a trip is being recorded, Android runs a location foreground service. Its ongoing notification shows recording state and live trip numbers and provides Pause, Resume and Finish. The notification is displayed by Android on your device; it is not an additional transmission to our server. Finishing a trip ends that recording service.
Android maps use MapLibre with OpenFreeMap's online tile service. Loading a map sends tile coordinates and zoom level, your network address and normal HTTP/device metadata to that provider and its delivery infrastructure. The requested area can correspond to your trip or home, even in guest mode with Cloud Sync off. It is not a full route upload to TripTrack. OpenFreeMap's policy describes its own logging: normal access logs omit IP addresses, error logs may contain an IP address and URL for seven days, and security-incident IP logs may remain for up to 30 days. See OpenFreeMap's privacy policy. Place names are obtained through Android's system Geocoder; the service provider depends on the phone and may receive the coordinates needed to answer the request.
Private trips and their photos/vehicle data upload after you sign in and enable Cloud Sync. A trip you choose to publish and its photos upload even with Cloud Sync off. Profile information and photos you add to your profile are account features independent of that switch. Turning Cloud Sync off stops future private-library uploads; it does not delete previously uploaded copies. Signing out does not itself delete the account or its stored content.
If you configure a home privacy zone and enable trimming, TripTrack removes route and preview points inside it from outgoing trip payloads and omits photo/checkpoint coordinates inside it. The original local route remains complete. Image files are re-encoded without embedded GPS or other EXIF metadata; separate photo time/location fields follow the trimming rules. A zone does not hide text, visible details in a photo, trip statistics, map tile requests or geocoder queries.
Android system backup may copy database/preferences according to your phone's backup settings. TripTrack's connection records are not sent to our API, but we cannot describe all local preferences as excluded from the operating system's backup. Credentials and photo files stored in the app's no-backup directory are excluded. Maps need a connection to load; recording can continue offline.
The optional “Help improve TripTrack” counters described in this policy also apply to Android. They are off by default and independent of sign-in and Cloud Sync. A random code for each consent period groups the counters and is stored as a hash on the server. Disabling the option clears local counters and queues server erasure; inactive records and deletion markers expire after 90 days. Uninstalling alone cannot send an erasure request.
Release builds configured for diagnostics send JVM/native crash and app-hang reports, session start/stop records and a 10% sample of lifecycle performance traces to Sentry, our diagnostics processor. This also applies in guest mode and independently of Cloud Sync and optional usage counters. Reports contain the signed-in account UUID, a random SDK installation identifier, device/OS/app information and scrubbed technical context. Default personal-information and IP enrichment are disabled. Sensitive field values, including names, email, tokens, home coordinates and photo URLs, are redacted. Request bodies/cookies, credential headers, URL identifiers and query strings are removed. Network breadcrumbs, failed-request capture and HTTP/file tracing are disabled. We do not attach screenshots, view hierarchies, session replays, user files or performance profiles. Native stack frames remain part of crash diagnostics.
Sentry processes reports in the region configured for our project and removes them when our configured retention period expires. The purpose is finding and fixing defects, under the legitimate-interest basis described in this policy. To object, contact privacy@trip-track.app. Builds without a diagnostics DSN, including debug builds, do not start Sentry. Support logs are shared separately only when you choose to export/send them.
The existing retention periods remain: account and synced content for the life of the account; possible deletion after three years of inactivity with prior email notice; individual deleted trips, photos and vehicles physically erased within 30 days; database backups retained no more than 30 days; server access logs up to 14 days; abuse/moderation records up to two years; and a non-identifying timestamp and opaque account-deletion audit hash that may be kept indefinitely. Optional usage records and deletion markers expire after 90 days of inactivity. Refresh tokens are rotated on use and revoked on sign-out or account deletion. There are no Android purchases in this launch build.
In Android, open Me → Settings → Account & Sync → Delete account and confirm. The app first asks the server to delete your account and associated live data immediately. After success it also erases this phone's local library and account state. If the server request fails, local data is retained so you can retry. Use “Clear server data” to remove uploaded library content while keeping the account; it first disables Cloud Sync. Deleting the app alone does not delete your account. You can also request account deletion or a copy of your data at privacy@trip-track.app; we verify ownership and respond within 30 days.
This section is the account deletion page linked from Google Play: it lists the steps in the app and the e-mail route that works without the app.