Privacy Policy

Last updated: October 20, 2026

RallyTrax is an app for recording drives, generating pace notes, and replaying routes with a synthetic co-driver, with an optional Social layer for sharing drives with people you follow. This page describes what data the app collects, how it is used, and the choices you have. It applies to RallyTrax on Android (Google Play and the GitHub Releases sideload channel), iOS, watchOS, macOS, and the RallyTrax website (rallytrax.app, including the signed-in account area at app.rallytrax.app). The platforms do not all behave identically — where they differ (for example, how usage-analytics diagnostics are keyed on Android vs. iOS, or how crash reports are keyed on macOS), the difference is called out explicitly rather than described as if every platform worked the same way.

Summary

• RallyTrax records GPS data on your device while you are recording a drive. Recorded drives sync to your account so you can see them across your devices.
• Signing in (Google on Android, iOS, and the web account area at app.rallytrax.app; Sign in with Apple or email/password on iOS and app.rallytrax.app) gives RallyTrax your account name and email address, used for sign-in and cloud sync. We do not store or use your profile photo — public Social identities use only your initials or a generated avatar, never a photo.
• Social features are opt-in: a public profile, following other users, sharing a drive replay, joining a community, and RSVPing to an event are all things you choose to turn on. Nothing about your drives is public by default.
• RallyTrax offers a Premium subscription, purchased through the web checkout (processed by Whop) or through Apple's or Google's in-app purchase. RallyTrax never receives or stores your card number — see section 1.1 for what we do store.
• The website (rallytrax.app and app.rallytrax.app) uses Google's reCAPTCHA Enterprise, via Firebase App Check, to verify that requests to our servers come from a real browser rather than a bot or script.
• Wrist heart rate captured by the watch companion never leaves your device — it is not written to RallyTrax's cloud storage under any circumstance. Saving a workout to Apple Health is a separate, opt-in step.
• A handful of convenience features on Android — receipt scanning, license-plate/odometer photo checks, suggested drive and trip names, share captions, route briefings, Year in Review — send text (never images, never GPS coordinates) from your device to Google's Gemini service to generate a suggestion. Section 3 lists exactly what each feature sends.
• On Android, RallyTrax uses Firebase Analytics and Crashlytics to understand which features are used and to diagnose crashes; these are keyed to an install ID, not tied to your name or email. On Android and iOS, RallyTrax also sends a closed set of product-interaction events (for example, opening the replay screen or starting a recording) to a first-party analytics pipeline, keyed to a pseudonymous ID linked to your account — not your account ID itself, see section 1.2 — and kept 90 days; a "Share anonymous usage statistics" toggle in Settings, on by default, controls it. iOS crash reports (Crashlytics) are keyed to a separate one-way pseudonym, not your account. On macOS, crash reports (Crashlytics) are currently keyed to your account ID — unlike iOS, they are linked to your account (see section 1.2).
• Showing current weather and forecasts, maps, and place lookups means your device sends coordinates, or text you type, straight to the third-party services named in sections 1.2 and 4 (for example Google, Apple, the US National Weather Service, and OpenStreetMap services) — not through RallyTrax's servers. On Android this includes a background fuel-station lookup near your last known location about once every 30 days while location permission is granted. Recorded-drive historical weather is requested by RallyTrax's servers and stored with your private drive, as described in section 1.2.
• RallyTrax does not sell your data, does not show ads, does not use advertising or tracking identifiers, and does not share your data with advertisers or data brokers.

1. Information we collect

1.1 Information you provide

• Account information. To sign in, RallyTrax receives your name and email address — from Google Sign-In on Android, iOS, and the web account area at app.rallytrax.app; or from Sign in with Apple or an email/password account on iOS and app.rallytrax.app. RallyTrax never sees your password (Apple/Google handle authentication; an email/password account is authenticated by Firebase Authentication). We do not request or store a profile photo.
• Vehicle and content you create. Vehicles in your garage, fuel logs, service records, modifications and parts, pace notes, recorded drives (tracks), routes, and trips.
• Co-drivers and crews. Co-driver profiles you create, and crews — small private groups you form with other users. Manual crew check-ins carry an optional status message and optional location. Automatic crew-alert check-ins include your location when available (section 1.3). On Android and iOS, you can save a safety-contact phone number on your device for pre-filled texts; that number is not synced to your RallyTrax account.
• Social profile and activity, if you opt in. A public handle and display name, who you follow and who follows you, and any drive replays you choose to publish. See section 1.3.
• Purchases and subscriptions, if you subscribe to Premium. Subscribing is a choice you make on the Premium page or in-app; RallyTrax is free to use otherwise. Depending on how you subscribe, payment itself is handled entirely by Whop (web checkout), Apple (iOS in-app purchase), or Google (Android in-app purchase) — RallyTrax never receives or stores your card number or other payment instrument details. What RallyTrax's own servers store is a single entitlement record for your account: your plan tier, which of those three processors granted it, the product/plan identifier, when it expires (for a subscription), and when it was last validated. RallyTrax also receives payment-status webhooks (for example, "subscription renewed" or "payment refunded") from whichever processor you used, so your entitlement stays accurate. See section 4 for the processors and section 6 for how to manage or cancel a subscription.
• Receipt images and PDFs (Android only). When you use the "Scan receipt" feature, the file you pick is processed on your device by Google ML Kit. The image itself is never uploaded. The parsed text is stored locally (and synced to your cloud account if cloud sync is on), and the text read from the receipt, along with the parsed fields (shop name, totals, odometer), is sent to Google's Gemini API to structure the line items and draft a short summary note. See section 3 for details on the AI step.

1.2 Information collected automatically

• Precise location (GPS). Collected while you are actively recording a drive, and stored as part of that drive so it can sync and be replayed. On iOS, recording continues in the background (screen off, phone in a cradle) via a background-location permission. Location also appears in manual crew check-ins if you attach it, automatically in crew-alert check-ins when available if you enable Crew alert, in live position sharing if you arm it, and in a drive replay you publish (see section 1.3).
• Sensor and vehicle data. During recording, RallyTrax reads device motion (accelerometer, gyroscope, barometer where available) to improve pace-note accuracy and power the cornering/g-force display, plus OBD-II vehicle telemetry if you connect a compatible adapter over Bluetooth. This data is treated as part of the drive you recorded.
• Wrist heart rate (watchOS, opt-in). If you record a drive from the RallyTrax watch companion, heart rate is read from the workout session but never leaves your device or your watch — it is not written to Firestore, not included in any synced drive, and not part of any Social surface. Saving the session to Apple Health is a separate opt-in step, and that copy stays inside Apple Health.
• Identifiers. Your account is keyed by a Firebase user ID, and, if you claim one, a public handle. The app also uses a Firebase installation ID, generated per install and used internally by Firebase/Crashlytics for install-level grouping — it is not linked to your account by anything in RallyTrax.
• Weather lookups on your device. To show current conditions and forecasts, the app sends a latitude and longitude straight from your device to a weather service — not through RallyTrax's servers. Neither these coordinates nor the weather that comes back is saved to your RallyTrax account. Which service is used depends on the platform and the feature:
  • Android — trip forecasts (Google Weather). When you open a trip, the app sends the coordinates of the trip's first stop that has a location to Google's Weather API and gets back a 5-day forecast for that spot.
  • Android and macOS — stage weather by elevation (US National Weather Service). On the Stage Briefing for an imported stage (Android) or the Stage Prep view in the macOS planner, tapping the refresh / "Fetch forecast" button on the weather card sends a few points along that stage — one per elevation band — to the US National Weather Service (api.weather.gov), which only covers the United States. The app keeps an on-device cache that maps those points to the National Weather Service's forecast grid, so it can skip that lookup next time; the forecast itself is not kept.
  • iOS and macOS — trip forecasts (Apple WeatherKit). When you open a trip on iOS, or a trip in the macOS trip planner, the app sends the coordinates of the trip's first stop that has a location to Apple's WeatherKit and gets back a daily forecast for that spot.
• Recorded-drive weather (OpenWeather). When a recorded drive syncs, RallyTrax's servers send OpenWeather up to three points along that drive, rounded to three decimal places (roughly 100 metres), with UTC sample-hour timestamps. OpenWeather returns estimated historical conditions, such as temperature, precipitation, wind, and visibility, for your drive report and usage-based car maintenance. These are samples, not continuous measurements or measurements of road grip. The conditions are stored with your private drive record for as long as your account exists. Deleting a drive hides it from the app, but its stored weather remains with that private, deleted-marked record until you delete your account; deleting your account erases it.
• Map data and place lookups. Some map features send coordinates, or text you type, straight from your device to a map-data service — not through RallyTrax's servers. The answers are used on your device; they reach your RallyTrax account only as part of something you save, such as a station name on a fuel log or a drive's name:
  • Android — place names for drive and trip names (Android's geocoder). After you finish a recording, and when a suggested trip is named, the app looks up the town or area for the drive's start, its end, and any long stops along the way using Android's built-in geocoder, which on most phones is provided by Google Play services. Answers are cached on the device by a roughly 100-meter grid square, so the same spot isn't looked up again. This happens whether or not the AI name suggestions in section 3 are on; only the resulting place names, never the coordinates, are passed on to Gemini.
  • Android — fuel stations (Overpass, OpenStreetMap data). To recognize fuel stops and fill in the station name on a fuel log, the app asks the Overpass service (overpass-api.de) for OpenStreetMap fuel stations near a point. About once every 30 days, if you have granted location permission, it sends your device's last known location in the background to fetch stations within 50 km. During a recording, if you stop for 2 minutes at a spot with no station already stored, it sends that spot; and when you open a fill-up that has a location but no station name, it sends that location. The stations that come back are stored on your device.
  • Android — place search (Android's geocoder, then OpenStreetMap Nominatim). When you search for a place in the route creator, the text you type is sent to Android's geocoder (Google Play services on most phones); if that finds nothing, it is sent to OpenStreetMap's Nominatim service. Coordinates you type are handled on the device.
  • macOS — Stage Prep elevation and bridges (US Geological Survey, Overpass). When you open Stage Prep for a route, the app sends the route's points, plus points a short distance to either side, to the US Geological Survey's elevation service (epqs.nationalmap.gov) to build the elevation profile, and sends a box around the route to the Overpass service to find bridges. Elevations are cached on the Mac by point.
  • iOS and macOS — Apple Maps (MapKit). In-app maps, route thumbnails, and the map behind a shared drive video are drawn by Apple Maps, which receives the area being shown; the drive itself is drawn on your device. Place search sends the text you type to Apple (on macOS, together with the map area you are looking at). On macOS, the trip and route planners also ask Apple Maps for driving directions between your stops, which sends those stops' coordinates, and tapping the map to add a stop sends that point to Apple to look up its name.
• Bot / abuse verification (website). rallytrax.app and app.rallytrax.app use Google's reCAPTCHA Enterprise, through Firebase App Check, to verify that a request to our servers (signing in, viewing your account, or checking out) comes from a genuine browser rather than an automated script. This runs before you take any action on those pages; Google processes standard device and browser signals for this purpose. See Google's Privacy Policy.
• Diagnostics and app activity. On Android: app usage and crash data via Firebase Analytics and Firebase Crashlytics, keyed to an anonymous install ID — which screens you view, which features you interact with, device model, OS version, and crash stack traces. On Android and iOS: RallyTrax also sends product-usage analytics through a separate, first-party pipeline — a fixed, closed list of interaction events (for example, opening the replay screen, starting or saving a recording, using a specific feature, reacting to a feed post, or the app hitting an error). Every event is one of a small set of pre-defined types carrying only pre-defined values: there is no free-text field, and an event can never carry your name, handle, email, GPS coordinates, or a specific drive/route/vehicle identifier. Events are keyed to a pseudonymous ID that our servers derive from your account ID — not your account ID itself, and never computed by or visible to the app — but because our servers can re-derive it, it is linked to your account, which is how we find and remove these rows if you delete yours (section 6). Events are kept 90 days and used only to understand product usage: never for advertising, and never sold or shared with anyone for tracking. A "Share anonymous usage statistics" toggle in Settings controls this on both platforms — on by default; turning it off stops new events immediately, though it doesn't retroactively delete what's already been sent (those rows still age out after 90 days, or sooner if you delete your account). Crash reporting is a separate system: on iOS, Crashlytics crash reports are keyed to a pseudonym derived on-device from your account ID plus a device-local secret (a one-way hash, reset if you reinstall) rather than your account ID directly, and crash breadcrumbs are scrubbed of your email, handle, display name, and coordinates before they're sent. On macOS: RallyTrax uses Crashlytics for crash reports, and those reports are currently keyed to your Firebase account ID — unlike iOS's pseudonym, a macOS crash record is linked to your account until it ages out (section 5). We intend to bring macOS to the same pseudonymous scheme as iOS; until this page says otherwise, treat macOS crash data as account-linked. Neither macOS nor watchOS sends the product-usage events described above today.
• Closed testing (tester accounts only). If we have flagged your account as a tester, RallyTrax also sends us one small diagnostic record per drive after that drive syncs: device model and OS version, app version, GPS-quality counters, which car was chosen for the drive and why, and pace-note generation statistics. That record never contains GPS coordinates. Tester drives also sync their full drive telemetry to your own account — the time, position, speed, and acceleration samples recorded along the drive — and the developer may review it to improve the app. The "Share drive diagnostics with RallyTrax" switch in Settings turns off both the diagnostic record and this telemetry sync. None of this is collected until the app has shown you its one-time closed-testing notice. These records and this telemetry are deleted with your account.

1.3 Social — what's public and what isn't

RallyTrax's Social features are opt-in. Nothing below happens until you choose it.

• Public profile. If you claim a handle, your public profile shows your handle, display name, and an avatar — either your initials or a small set of generated designs. RallyTrax does not support photo avatars; there is no upload path for one.
• Following. You can follow other users; some accounts require the account holder to approve a follow request before you can see their gated content. Public feed cards never include raw route geometry or a precise bounding box.
• Drive replays. Publishing a replay is a separate, explicit action per drive. Published replay data is visible only to your approved followers, trims at least 100 meters off each end of the route to obscure your start/end address, and includes only a fixed set of drive channels — never vehicle telemetry, never heart rate or other biometric data.
• Crews. A crew is a small private group. Members can post manual check-ins with optional location and status; check-in data is visible only to members of that crew, not the public. Automatic crew-alert check-ins are described below.
• Crew alert and safety contact (Android and iOS). Crew alert is opt-in and off by default. While recording with a paired watch and an active watch workout, a detected impact raises an "Are you OK?" prompt on your watch. If the prompt times out unanswered, or you choose to send the alert, the app automatically writes an SOS check-in to your crew, if you belong to one. It includes the recorder's available location and an alert note, visible to that crew's members only. On Android, the automatic check-in note also includes a maps.google.com link containing the location. The app also sounds a local alarm and offers a pre-filled SMS to the safety contact you saved on the device: Android posts a notification that you tap to open your own SMS app; iOS presents a message composer if a contact is saved and texting is available. The SMS includes a location link when available (Google Maps on Android, Apple Maps on iOS). RallyTrax does not send the SMS automatically — you must tap Send in the composer. Without a saved contact, Android offers the share sheet instead; iOS skips the SMS composer. This feature never calls emergency services.
• Manual "Need assistance" check-ins. On Android, selecting "Need assistance" in the crew check-in composer and confirming it writes your status, your note, and location only if you attached it, to the crew's check-in ledger. It also offers the same pre-filled SMS notification and local alarm, independently of the Crew alert switch; the SMS contains a Google Maps location link only if you attached location. On macOS, confirming "Need assistance" posts a crew check-in with your note and optional attached location, but does not open an SMS composer or sound an alarm. iOS currently has no manual check-in composer.
• Live position to crew (Android and iOS). This is separate from publishing a replay or enabling Crew alert. You must arm live sharing to a chosen crew from the Record screen for each recording session; it is not on automatically. While armed, the app updates one latest-position document at crews/{id}/live/{uid} about every 10 seconds, rather than saving a position history there. It contains your account ID, latitude and longitude, speed and heading when available, the selected vehicle ID when available, recording state, and arming, update, and expiry times; Android also includes elevation when available. Only signed-in members of that crew can read it under our Firestore rules — not followers or the public. Competition mode prevents live writes. Manually stopping sharing, ending or discarding the recording deletes the live document after a final stopped-position update when a location is available. Android also attempts this cleanup on service teardown. The document carries an expiry time four hours after arming for server-side TTL cleanup if normal deletion is missed; that cleanup is not instantaneous at expiry. On iOS, the "Live crew sharing" Early-features switch also stops sharing when turned off. macOS displays crew live positions but does not publish its own.
• Communities. A community is a more public front for a crew: if a host makes one, its directory row (name, description, region, and a coarse member-count band — never an exact count, member list, or who hosts it) can be listed publicly. Who is actually a member, and who has what role, is membership data that lives only in the backing crew and is never part of the public directory row.
• Events. RSVPing to an event is opt-in and per-event. Whoever can see the event sees roughly how many people are going, as a band — never an exact number and never a list of names; the host alone also sees the exact number going. If you turn on "Show my name to others going," the host and the other people going also see your display name and avatar — leave it off and you're counted but never named, to anyone, including the host. A maybe or declined RSVP is never shown to anyone, including the host, and nobody is notified of it. For a publicly listed event with a host-chosen meeting point, the exact coordinates are released only once you RSVP going — until then you see only the host's label. A named public venue is always visible to anyone who can see the event, RSVP or not, and a community- or invite-hosted event's full location is visible to that event's audience (community members / invited people) without needing to RSVP at all.
• Trip-intent signal. If you and others opt a shared trip into "anticipation," the app can show a coarse, banded read (e.g. "a few people are around") once at least 3 people qualify — it never reveals who, or an exact count below that threshold.

1.4 Information we do not collect

• Photos or videos — there is no camera, photo library, or photo-upload path anywhere in the app. Public avatars are limited to initials or a small set of generated designs.
• Audio or microphone recordings — the app does not record audio; the co-driver's spoken pace notes are on-device text-to-speech playback only.
• Wrist heart rate or other biometric data on any server — it never leaves the watch/device (see 1.2).
• Your address book, message history, calendar, or browser history. A safety-contact number you type is stored on your device and used only for the pre-filled texts described in section 1.3; we do not read your contacts or messages.
• Advertising or tracking identifiers (e.g. IDFA) — RallyTrax does not show ads and does not use data for tracking, as defined by Apple or otherwise.
• Your card number or other payment instrument details — a Premium purchase is handled entirely by Whop, Apple, or Google (see section 1.1); RallyTrax's own servers never receive or store it.

2. How we use your information

3. AI features — what is sent to Google

Several convenience features are processed by Google — the app sends a request to Google's Gemini service (via Firebase AI Logic) and shows you the result. In every case the request is text assembled on your device: no images and no GPS coordinates are ever included. Requests go from your device to Google directly — they are not routed through RallyTrax's own servers, and RallyTrax does not store them server-side. The result (a name, note, caption, or summary) is saved only as part of your own content, where you can edit or delete it like anything else you typed. What happens if a request fails differs by feature — some fall back to a plainer, non-AI result; others simply don't offer a suggestion. Each bullet below says which. Feature by feature, what is sent and why:

• Receipt scanning (Android). When you scan a service receipt, the text read from it on your device (see section 1.1) — plus the parsed shop name, totals, and odometer — is sent to structure the line items and draft a short service note for the maintenance log. The receipt image itself is never uploaded. If the request fails, RallyTrax falls back to a short local summary built from the parsed line items.
• License-plate and odometer photo check (Android). When you add a vehicle from a photo of your plate or dashboard and the on-device reader is unsure, the text it extracted — which can include your plate number — is sent to pick the most likely plate code or odometer reading. The photo itself is never uploaded. If the request fails, RallyTrax falls back to the on-device reader's own best guess.
• Suggested drive and trip names (Android). After a recording (and for trip suggestions), place names along the drive — from reverse geocoding, e.g. "Mill Valley → Stinson Beach", not coordinates — plus headline stats (distance, duration, surface, difficulty, time of day) are sent to suggest a name. You can always rename. If the request fails, RallyTrax falls back to a locality- and time-based name it builds on-device.
• Share captions (Android). If you tap "Suggest caption" when sharing a drive, its headline stats, character tags, your vehicle's nickname, and an optional place name are sent to draft a caption. There is no non-AI fallback for this feature — if the request fails, no caption is suggested and the field is left for you to fill in.
• Pre-drive route briefings (Android). When you tap "Preview briefing" on a curated route in Explore, that route's name, region, and stats are sent to write the short spoken briefing. There is no non-AI fallback for this feature — if the request fails, no briefing plays.
• Year in Review (Android). Aggregate stats for your year of driving — totals, surface mix, time-of-day mix — are sent to write the closing persona and summary. There is no non-AI fallback for this feature — if the request fails, that closing slide is skipped.

On Android, open Settings → "AI features" to choose "Cloud AI", "On-device only", or "Off". For a signed-in account, this is one preference for your RallyTrax account, not a separate choice for each feature. "Cloud AI" allows the Google processing described above on supported devices. "On-device only" allows AI processing only on the device you are using, with no fallback to a cloud AI service; features that need cloud AI stay unavailable. "Off" means no AI processing. Manual features keep working.

Your choice and the version of the consent wording you agreed to are saved on your device. When you are signed in, they are also sent to Firebase to sync with your RallyTrax account.

The upcoming iOS and macOS update adds an "AI features" settings screen for this account preference. Those Apple builds do not include an AI engine; recording a preference does not enable one.

Other devices receive your choice only when it syncs to your account and those devices sync in turn. In the upcoming Apple update, the settings screen shows when account sync is pending, unconfirmed, or has failed, and warns that other devices may still use their previous choice. If sync fails, your choice stays saved on that device. On those Apple devices, tapping "Try again" or reselecting the same choice sends the original choice again, keeping the time and version of the consent wording recorded with it — it does not count as a new consent decision or replace a later choice made on another device.

4. Sharing and disclosure

RallyTrax does not sell your data and does not share it with advertisers or data brokers. Data is shared only with the third-party service providers below, and only as needed to deliver the corresponding feature. Your Social profile, follows, and any drive replays you publish are visible to other RallyTrax users as described in section 1.3 — that visibility is a feature you opt into, not third-party sharing.

• Google Firebase (Authentication, Firestore, Storage, Analytics, Crashlytics, App Check with reCAPTCHA Enterprise, Cloud Functions, BigQuery) — backs sign-in, cloud sync, Social, crew, and crash-reporting features across RallyTrax's apps and the website; backs anonymous usage diagnostics on Android, and — via Cloud Functions and BigQuery — the pseudonymous product-analytics pipeline on Android and iOS described in section 1.2 (crash reporting is keyed per platform as also described there); reCAPTCHA Enterprise verifies genuine-browser requests to the website (section 1.2). See Firebase Privacy Notice.
• Whop — processes the web checkout for a Premium subscription (section 1.1): collects your payment details directly (RallyTrax never sees them) and tells RallyTrax's servers only the resulting subscription/payment status, which RallyTrax uses to set your entitlement. See Whop Privacy Policy.
• Apple — Sign in with Apple (iOS and web sign-in), WeatherKit (trip forecasts on iOS and macOS: receives the coordinates of a trip's first located stop, section 1.2), Apple Maps / MapKit (maps, place search, and on macOS driving directions and place names for tapped points: receives the map area shown, the text you search for, and planner stop coordinates, section 1.2), HealthKit (opt-in workout save; heart rate never leaves your device), and the App Store's in-app purchase for a Premium subscription on iOS (section 1.1) — Apple processes the payment; RallyTrax receives only a signed purchase record it verifies to set your entitlement. See Apple Privacy Policy.
• Google Play — processes Android in-app purchase for a Premium subscription (section 1.1): Google processes the payment; RallyTrax receives only a purchase token it verifies with Google to set your entitlement. See Google Privacy Policy.
• Firebase AI Logic (Gemini) — processes the AI features described in section 3: receipt line items and service notes, plate/odometer photo checks, drive and trip names, share captions, pre-drive briefings, and Year in Review summaries. Receives text only — OCR text, parsed receipt fields, place names, and headline stats. Receives no images and no GPS coordinates. See Firebase AI Logic Policies.
• Google Maps — fetches map tiles for the in-app maps. See Google Privacy Policy.
• Google Weather (Google Maps Platform) — trip forecasts on Android: receives the coordinates of a trip's first located stop, sent from your device (section 1.2). See Google Privacy Policy.
• OpenWeather — recorded-drive historical weather: receives up to three points rounded to three decimal places and UTC sample-hour timestamps from RallyTrax's servers; the returned conditions are stored with your private drive as described in section 1.2. See OpenWeather Privacy Policy.
• US National Weather Service (api.weather.gov) — stage weather by elevation on Android and macOS, US only: receives a few points along a stage when you ask for the forecast (section 1.2). See NWS Privacy Policy.
• Android geocoder (Google Play services) — on Android, turns a drive's start, end, and stop coordinates into place names, and place-search text into locations (section 1.2). See Google Privacy Policy.
• OpenStreetMap Nominatim — fallback place search on Android: receives the text you type (section 1.2). See OpenStreetMap Foundation Privacy Policy.
• Overpass API (overpass-api.de) — OpenStreetMap data for fuel-station detection on Android and bridge detection in macOS Stage Prep: receives your last known location, a stop during a recording, or a fill-up's location (Android), or a box around a route (macOS) (section 1.2). See Overpass API.
• US Geological Survey (epqs.nationalmap.gov) — elevations for macOS Stage Prep: receives a route's points (section 1.2). See US Department of the Interior Privacy Policy.
• OpenStreetMap (OSMDroid) — fallback map provider when Google Maps is unavailable. See OpenStreetMap Privacy Policy.
• OpenFreeMap — when someone opens a link to a drive replay you published, RallyTrax's servers draw its preview image and fetch the background map tiles for the area of that published (already trimmed) route from OpenFreeMap (tiles.openfreemap.org). That preview-image request comes from our servers, not your device, and carries only which map tiles are needed. Separately, when a visitor views the replay map at /r/[slug], their browser directly loads the Positron map style, map tiles, map fonts and icons from tiles.openfreemap.org for the area being viewed. OpenFreeMap therefore receives the visitor's IP address and standard browser request headers, as well as the requested map area through the tile requests. See OpenFreeMap Privacy Policy.
• unpkg.com — the replay page loads MapLibre GL 4.7.1's stylesheet (maplibre-gl.css) directly from this content-delivery service in the visitor's browser. MapLibre's JavaScript is bundled with our website, not loaded from unpkg. Like other browser asset requests, the stylesheet request exposes the visitor's IP address and standard browser request headers to unpkg; it does not send the drive's coordinates or your RallyTrax account ID.
• Google Fonts — website pages, including the replay page, load font stylesheets from fonts.googleapis.com and font files from fonts.gstatic.com in the visitor's browser. These requests expose the visitor's IP address and standard browser request headers to Google, not the drive's coordinates. The replay page requests Google Sans Text and Roboto Mono.
• Links you share into the app — if you share a Google Maps, Apple Maps, or Waze short link, or a Komoot tour link, into RallyTrax to import a route, the app fetches that link from the service it points to (following its redirects only within that service) to read the route. Only the link is sent — not your location.
• Google ML Kit — on-device text recognition for receipt scanning (Android). Runs entirely on your device; receipts are not uploaded.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, or property of users or the public.

5. Data retention

• On-device data (drives, garage, logs) — kept until you delete the entry or uninstall the app.
• Cloud-synced data (drives, trips, garage, Social profile, follows, published replays, crew data) — kept in Firebase while your account exists. You can delete individual items any time from within the app, or delete everything by deleting your account (see below).
• Live crew position. Only the latest position is stored, not a history. Stopping sharing or ending/discarding the recording attempts to delete it; an expiry time four hours after arming provides server-side TTL cleanup if that deletion is missed (not an immediate deletion deadline). Deleting your account also deletes your crew live-position documents.
• Diagnostics. On Android, Firebase Analytics retains event-level data for up to 14 months. The first-party product-analytics events described in section 1.2 (Android and iOS) are retained 90 days on a rolling basis; deleting your account removes them sooner (see "Delete your account" in section 6). Crashlytics retains crash records for up to 90 days on every platform that sends them (Android, iOS, macOS) — how a crash record is keyed differs by platform; macOS records are account-linked (see section 1.2).

6. Your choices and rights

• Decline location. RallyTrax asks for precise location to record drives. While you grant it, the Android app also uses your last known location about once every 30 days to look up nearby fuel stations (section 1.2). You can attach location to a manual crew check-in or arm live position sharing; if you enable Crew alert, automatic alert check-ins include location when available without a per-post choice. You can decline at install or revoke it later in system Settings. Drive recording, the background fuel-station lookup, and new location on check-ins, alerts and live sharing will then be unavailable, but the rest of the app continues to work.
• Keep Social off. Claiming a handle, following people, publishing a replay, joining a community, and RSVPing to an event are all separate opt-in actions. If you never claim a handle, no public profile is created.
• Control crew location sharing. Location on a manual check-in is optional per post. Automatic crew-alert check-ins include available location once you opt into Crew alert. Turning Crew alert off stops automatic alerts straight away, including during a recording: detection stops and a pending impact prompt can no longer send an alert (on iOS the prompt is also dismissed). Both kinds of check-in are visible only to that crew's members. Live position sharing requires separate arming each recording session and can be stopped from the Record screen; see section 1.3.
• Control your event roster visibility. "Show my name to others going" is a per-RSVP toggle — turn it off and you're still counted, but never named to other attendees.
• Manage or cancel a subscription. A web-checkout (Whop) subscription is managed from your account page; an App Store or Google Play subscription is managed from that store's own subscription settings, not from RallyTrax. Cancelling stops future charges — you keep Premium until the end of the period you've already paid for.
• Export your drives. Each drive can be exported as a GPX file from the share menu on its detail screen. On Android, you can also enable Google Drive backup of your GPX files from Settings.
• Delete your account. RallyTrax offers an in-app "Delete account" action on Android and iOS (macOS has no in-app delete yet — use the email route below). Deleting your account removes your cloud-synced drives, cloud GPX backups, routes, trips, and vehicle data; your public profile, handle, and avatar; your follow relationships in both directions; your crew memberships and check-ins; your published replays and Social cards; and your notifications and registered devices — and, as its final step, it deletes your sign-in account itself. (Crash records and Android's Firebase Analytics diagnostics are not removed by this purge — they age out on the retention schedules in section 5; on macOS crash records remain account-linked until then, see section 1.2. The first-party product-analytics events described in section 1.2, on Android and iOS, are removed by this purge.) The server-side operation that performs this full purge is deployed and in service today; the gap we are closing is in the apps — in app versions shipped to date, on every platform that offers the button, the in-app delete action has not always routed through every step of that purge. Updated apps that always run the complete purge are rolling out: the iOS update is finished and ships with the next App Store release, and the equivalent Android update is in review. Until you've confirmed a delete completed — or if you'd rather have us handle it directly — email the address below and we will remove your cloud-synced data within 30 days.
• Opt out of analytics. The first-party product-analytics events described in section 1.2 — live on Android and iOS — have a one-tap opt-out: the "Share anonymous usage statistics" toggle in Settings, on by default. Turning it off stops new events immediately; it doesn't delete what's already been sent — those rows still age out after 90 days (section 5), or sooner if you delete your account. Separately, on Android, email the address below to opt out of Firebase Analytics diagnostics and Crashlytics crash reporting tied to your install; an in-app toggle for those is still on the roadmap.
• GDPR / CCPA. If you are in the European Economic Area, the UK, or California, you have the rights of access, correction, deletion, restriction, and portability over your personal data. To exercise these rights, email the address below.

7. Children

RallyTrax is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, please contact us and we will delete it.

8. Security

Cloud-synced data is transmitted over HTTPS and stored in Firebase using Google's standard encryption at rest and in transit. Authentication tokens are stored in the platform's encrypted keystore (Android Keystore / iOS Keychain). No method of transmission or storage is perfectly secure; we make commercially reasonable efforts to protect your information.

9. International transfers

The services named in section 4 — including Firebase and other Google services (Google Maps, Google Weather, Google Fonts, and Android's geocoder in Google Play services), Apple's services (including WeatherKit and Apple Maps), OpenWeather, the US National Weather Service, the US Geological Survey, OpenStreetMap Nominatim, the Overpass API, OpenFreeMap, and unpkg.com — may process data on servers located outside your country of residence, including in the United States. By using the app you consent to this transfer.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes — including adding any new category of data collection — will be reflected here and, where required, announced in-app before they take effect.

11. Contact

Questions about this policy or your data? Email arnavsacheti@outlook.com.