Privacy Policy

The short version

We collect as little data as possible because we genuinely cannot afford to store it. We don't sell your data. We don't share it with third parties. We don't run analytics or tracking scripts. We don't have the budget for any of that.

What we collect

• Email address — used for login and account recovery. That's it.
• Username — a display name you choose. Not your real name.
• Password — stored as a salted, hashed value. We never see or store your actual password.
• Country — which country's roads you're exploring (India or USA).
• Explored road IDs — a list of internal road IDs representing roads you've driven. These are just numbers, not locations.

GPS data

When you use the app, your phone sends GPS coordinates to our server to determine which roads you've driven. This GPS data is processed in real time, matched to road IDs, and then immediately discarded. We do not store your location history, GPS trails, or movement patterns. All we keep is a list of road IDs — numbers like 4521087 that mean nothing without our road database.

Mobile app permissions

The iOS and Android apps request these permissions:

• Location (foreground & background) — to track which roads you drive. GPS data is processed and immediately discarded. We only keep road IDs.
• Internet — to sync your explored roads and load map tiles.

That's it. No camera, no contacts, no storage, no microphone.

What we don't collect

• Your real name
• Your phone number
• Your location history or GPS trails
• Your IP address (we don't log it)
• Device identifiers or advertising IDs
• Usage analytics or behavioral data
• Anything we could sell to anyone

Authentication

We use a session token to keep you logged in. On the web, this is stored as a single httpOnly cookie. On the mobile apps, it's stored securely on your device. The token expires after 30 days. No tracking cookies, no third-party cookies, no cookie banners needed.

Third parties

We use OpenStreetMap tiles to render the map. When you view the map, the app loads tiles from OSM's servers, which is subject to their privacy policy. We also use Cloudflare for DDoS protection and CDN, subject to their privacy policy. That's it. No Google Analytics, no Facebook pixels, no Hotjar.

Data deletion

Want your data deleted? Email us and we'll wipe your account. There's not much to delete — an email, a username, and a list of numbers.

Changes to this policy

If we change this policy, we'll update the date at the top. We're a small project — if anything changes, it'll probably be because we're collecting even less data, not more.

Contact

Questions about your data? Reach us at our contact page.