Security & Trust

What stays on-device, what still touches infrastructure

The landing copy, the Security page, and the Privacy Policy now describe the same model: trip-route data stays local by default, while account and service operations are documented separately.

● Local

On-device by default

Trip logs, saved places, and reimbursement settings stay on your device by default.
You review, correct, and export from the device state you control.
Optional iCloud backup is available on iOS when you turn it on.

● Cloud

Service infrastructure

Account data, support, crash diagnostics, and optional analytics are processed through service infrastructure.
Road map matching can use anonymized route segments to improve route quality.
Exports and third-party connections send data only when you explicitly initiate those actions.

Operational details

Trust needs specifics, not just a badge in the footer

These are the operational surfaces users and evaluators usually ask about when deciding whether to trust a mileage tracker with location data.

Retention and deletion

Account deletion removes personal data within the documented window, except where legal retention still applies.

Export and audit trail

PDF, CSV, and XLSX exports preserve country and tax-year context so historical filing evidence remains interpretable.

EU infrastructure posture

Service-side infrastructure is hosted in the EU or protected with adequate safeguards when a provider requires broader delivery.

Support boundaries

Support data is handled separately from trip logs so operational access and route history are not described as the same thing.