MilesBuddy Privacy Policy

Last updated: August 31, 2026

This Privacy Policy explains how MilesBuddy ("MilesBuddy," "we," "us," or "our") collects, uses, stores, and discloses information when you use the MilesBuddy mobile application on iOS or Android (the "App"), contact support, or use related services (collectively, the "Service").

MilesBuddy is operated under the MilesBuddy name. For privacy questions or requests, contact us at milesbuddy.app@gmail.com.

1. Scope and platform differences

This Policy applies to the MilesBuddy Service on both iOS and Android. Some features and service providers differ by platform, App version, region, device settings, and whether you use the free or Premium tier.

For example:

• iOS versions may use Apple MapKit and Apple geocoding for address search, routes, maps, and human-readable location names.
• Android versions may use Google Play services for activity recognition and device location, and the device's system geocoder for human-readable location names.
• Some versions synchronize App content with Cloud Firestore. Some Android versions use an offline-first local database, import existing MilesBuddy cloud data on a read-only basis, and keep new changes queued locally until cloud writing is enabled.
• Analytics, crash reporting, remote configuration, advertising, and subscription features may be introduced, removed, or configured differently in a particular version. The relevant sections below apply when those features are enabled.

Third-party services, websites, and apps have their own privacy practices. This Policy does not govern information that a third party processes independently under its own policy.

2. Information we collect

2.1 Account and authentication information

We may process:

• your email address;
• your Firebase user ID and other account identifiers;
• your display name, sign-in provider, email-verification status, and account status, when available;
• authentication credentials, tokens, and session information needed to sign you in, keep you signed in, reset your password, secure your account, or delete your authentication account; and
• a limited, allow-listed diagnostic code when a sign-in attempt fails.

Firebase Authentication processes email/password and supported federated sign-in requests. If you choose a platform or third-party sign-in method, such as Google Sign-In where available, that provider also processes the information needed to complete the sign-in.

2.2 Location, motion, and trip information

MilesBuddy's core purpose is to record and organize mileage. Depending on the features you enable, we may process:

• precise or approximate location, including latitude and longitude;
• location timestamps, accuracy, altitude, speed, direction or bearing, location provider, and indicators that a location may be simulated;
• motion or activity-recognition information, including signals indicating that the device may be in a vehicle;
• trip start and end times, duration, distance, route points, start and end labels or addresses, and map preview images;
• trip classification, such as business, personal, medical, moving, charity, or unclassified;
• trip notes, processing status, associated vehicle, and deletion status; and
• tracking-session and event information used to prevent duplicate trips, recover an interrupted recording, and decide whether a candidate drive should become a trip.

If you enable automatic tracking, the App may access precise location in the background after you grant the relevant operating-system permissions. On Android, high-accuracy location is collected by a foreground service while MilesBuddy is recording a possible drive, and a visible system notification is shown. On iOS, background location and motion activity may be used to identify and reconstruct drives. Location and activity permissions are optional, but automatic trip recording will not work properly without them.

For manual mileage entries, we process the places, times, mileage, classification, and notes you enter. A manual entry may not require device location. On iOS, if you use address suggestions, route calculation, reverse geocoding, or map previews, the relevant search terms or coordinates are processed through Apple mapping services.

We do not provide precise trip routes, trip notes, vehicle photos, or start/end addresses to advertising partners for ad targeting.

2.3 Vehicle, report, and settings information

We may process:

• vehicle make, model, year, title, odometer value, notes, license plate, photo, status, and selected/current vehicle;
• report date range, vehicle, included trip categories, mileage totals, estimated reimbursement or tax-related values, and PDF/CSV export content;
• work-hour settings;
• onboarding status, sorting and display choices, automatic-tracking settings, notification preferences, and import/synchronization status;
• free-trip allowance, rewarded-trip credits, the month or period to which a quota applies, ad-display timing, and related entitlement history; and
• Premium status and feature entitlements.

Vehicle photos are selected by you. The App may resize, re-encode, and store a compact copy. Photo metadata that is not carried into the re-encoded image is not needed for the vehicle-photo feature.

2.4 Advertising and consent information

The free tier may display ads, including optional rewarded ads that grant additional trip credits. When advertising is enabled, the Google Mobile Ads SDK, Google User Messaging Platform, and advertising vendors selected through the consent interface may process:

• IP address, which may indicate a general location;
• advertising ID, app-set ID, vendor identifiers, and other device or account identifiers where permitted;
• App launches, taps, ad requests, impressions, video views, reward completion, and other interactions;
• ad-delivery, attribution, frequency, fraud-prevention, and performance information;
• device, operating-system, App, and SDK information; and
• diagnostics such as launch time, hangs, energy usage, or ad errors.

Depending on your consent choices and applicable law, ads may be personalized, non-personalized, limited, or delivered only as technically necessary. Personalized advertising may use information about activity across apps or websites. On iOS, the App will request App Tracking Transparency permission before accessing the advertising identifier or engaging in tracking that requires permission. In the EEA, UK, and other regions where required, an advertising consent interface will be provided before consent-dependent ad processing.

Premium subscribers do not receive third-party ads while the App recognizes an active Premium entitlement. Advertising records created before subscription, and limited records needed for security, fraud prevention, accounting, or legal compliance, may still be retained.

2.5 Subscription and purchase information

If you purchase Premium, Apple App Store or Google Play handles payment. We do not receive your complete payment-card or bank-account details. We may receive or process:

• product and offer identifiers;
• purchase token, transaction or order identifier, receipt or signed transaction data;
• purchase, renewal, cancellation, expiration, refund, revocation, grace-period, and billing-status information;
• storefront, country, currency, price, and tax information made available by the store; and
• an account-linked or pseudonymous identifier used to verify a purchase and grant the correct entitlement.

We use this information to validate purchases, prevent fraud and duplicate entitlements, restore purchases, provide Premium features, and handle support, refunds, accounting, and legal obligations.

2.6 Usage, analytics, diagnostics, and remote configuration

When enabled for a platform or App version, Firebase Analytics may collect App-instance or device identifiers, general device and region information, App launches, screens, taps, feature usage, purchase/ad events, and custom events such as sign-in success or failure. Analytics data may be linked to a MilesBuddy user ID in some versions.

Firebase Crashlytics may collect crash traces, diagnostic logs and breadcrumbs, App and operating-system versions, device model and technical state, installation identifiers, crash time, and a MilesBuddy user ID where configured. We use this data to diagnose crashes and improve reliability. Please do not place sensitive information in a support report or any free-form field intended for diagnostics.

Firebase Remote Config may process installation and technical information to deliver settings such as trip limits, ad timing, feature availability, reminders, or mileage-rate configuration.

The current Android codebase does not enable Firebase Analytics, Crashlytics, Remote Config, or ads unless a later build adds and configures them. The current iOS codebase may enable those Firebase and advertising services.

2.7 Support, communications, and shared exports

The App can open an email composer addressed to our support mailbox. MilesBuddy does not automatically attach account, trip, route, location, or diagnostic data. We receive only the information you choose to send. Your email provider independently processes the message.

When you export or share a PDF or CSV report, the App creates the file and presents the operating system's share interface. The recipient app or person you select then processes the report under their own terms and privacy policy. Reports may contain vehicle, trip, address, date, mileage, classification, note, and estimated-value information.

2.8 Existing cloud data

If you previously used MilesBuddy, the App may retrieve your existing vehicles, trips, route points, reports, work-hour settings, photos or previews, and preferences from the Firebase project associated with your account. This allows cross-version or cross-platform restoration. Android's compatibility importer may read this existing data without changing it.

3. How we obtain information

We obtain information:

• directly from you when you register, enter mileage, edit a trip or vehicle, choose a photo, create a report, purchase Premium, watch a rewarded ad, or contact support;
• automatically from your device when you grant permissions or use the App;
• from Apple, Google, Firebase, advertising providers, and app stores when they provide authentication, mapping, location, advertising, purchase, configuration, analytics, or diagnostic services; and
• from existing MilesBuddy cloud records associated with your authenticated account.

4. How and why we use information

We use information for the following purposes and, where applicable, rely on the following legal bases:

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Some features may stop working after permission or consent is withdrawn.

We do not use solely automated decision-making that produces legal or similarly significant effects about you.

5. Device permissions and choices

Depending on your platform and selected features, the App may request:

• foreground, precise, approximate, or background location;
• motion and fitness or activity recognition;
• notifications;
• access to a photo you select; and
• tracking permission on iOS for advertising purposes.

You can change these permissions in iOS or Android settings. You can turn automatic tracking off in MilesBuddy. Turning it off stops future App-initiated trip detection, subject to the operating system completing any already-running operation.

Where available, use Settings > Privacy choices in the App to review or change advertising consent. You can also use your device's privacy and advertising controls. Declining personalized advertising does not remove ads from the free tier; it may cause non-personalized, limited, or technical ads to be shown. If the law or available ad inventory prevents an ad from being served, a rewarded trip credit may not be available at that time.

6. Storage and disclosure

6.1 On-device storage

MilesBuddy stores account-scoped data in the App's local database, preferences, and private files or cache. This can include trips, route points, raw location samples awaiting trip finalization, vehicles and photos, reports, settings, quota/entitlement records, and temporary exports.

Android App data is excluded from Android cloud backup and device-to-device transfer by the App's configuration. iOS data may be included in an encrypted device backup according to your Apple settings and Apple's practices. Clearing App data or uninstalling may delete local information, but it does not necessarily delete Firebase, Apple, Google, advertising, purchase, recipient, or backup records.

6.2 Service providers and other recipients

We disclose information only as described in this Policy, including to:

• Google Firebase: Authentication, Cloud Firestore, Analytics, Crashlytics, Remote Config, and related infrastructure, depending on the platform and build. Google generally acts as our processor for customer data in Firebase. See Privacy and Security in Firebase and the Firebase Data Processing and Security Terms.
• Google and advertising vendors: Google Mobile Ads, consent management, ad delivery, measurement, personalization where consented, fraud prevention, and rewarded-ad verification. The current vendor list and purposes are shown in the advertising privacy interface. See Google's Privacy Policy.
• Google Play services and Android system providers: authentication where offered, location and activity recognition, geocoding, operating-system services, and Google Play Billing. Device settings affect how Google processes location. See How Google uses location information.
• Apple: App Store billing, StoreKit, App Tracking Transparency, device services, MapKit, local search, directions, geocoding, notifications, and other Apple platform functions used on iOS. See Apple's Privacy Policy.
• Email and destination apps: your selected email provider, share-sheet destination, file storage provider, or report recipient, only when you initiate the action.
• Professional advisers and authorities: auditors, lawyers, accountants, insurers, courts, regulators, or law enforcement where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish and defend legal claims.
• A successor organization: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.

We require service providers processing information on our behalf to protect it and use it only for authorized purposes, subject to applicable law and their contractual obligations.

7. Advertising, sale, and targeted-advertising disclosures

We do not sell your precise trip routes, addresses, notes, vehicle photos, email address, or report content for money.

The free tier uses or plans to use third-party advertising. If you consent to personalized ads, identifiers and advertising/interaction information may be disclosed to Google and participating advertising vendors for personalized or cross-context behavioral advertising. Some U.S. privacy laws may define that disclosure as "sharing," "targeted advertising," or a "sale" even when no money is exchanged for your personal information.

You may opt out of consent-based personalized advertising through the App's privacy choices where available and through applicable device controls. We do not discriminate against you for exercising a privacy right. Opting out does not prevent contextual or limited ads and does not create a right to receive a rewarded credit when no eligible ad can be served.

We do not use or disclose precise location, authentication credentials, or other sensitive data to infer personal characteristics for advertising.

8. Retention

We retain information only for as long as reasonably necessary for the purposes described above, including to provide the Service, maintain records, prevent fraud, resolve disputes, enforce agreements, and comply with law.

In general:

• local account data remains until you delete it, sign out using the App's secure sign-out flow, delete the account, clear App data, or uninstall, subject to device backups and technical failures;
• accepted location points that form a trip are retained with that trip until the trip or local account data is deleted;
• Android raw location samples for a trip candidate are deleted after the candidate is finalized or discarded, while limited tracking-session metadata may remain until account cleanup;
• Android vehicle-photo drafts are designed to expire after seven days, and temporary report exports after approximately 24 hours; account cleanup also removes them;
• cloud-synchronized vehicles, trips, reports, settings, and related records remain in Cloud Firestore until deleted through the applicable cloud-data process or a verified request, subject to backups and legal retention;
• authentication records remain while your Firebase Authentication account is active and for any additional period required by the provider or law;
• purchase and subscription records may be retained for the life of the account plus the period needed for entitlement restoration, refunds, fraud prevention, tax, accounting, and legal compliance;
• ad, consent, analytics, and diagnostic information is retained according to our configuration, legal requirements, and provider terms. Firebase states that Crashlytics retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems; and
• support correspondence is retained while needed to address the request and maintain appropriate business and legal records.

Deletion from active systems may not immediately remove information from encrypted backups, security logs, store records, or records a third party must retain by law.

9. Sign-out and account deletion

Signing out is different from deleting an account.

• Sign out: MilesBuddy attempts to stop tracking and notifications and clear that account's local App data from the device. Cloud records and the authentication account remain, so you may sign in again.
• Delete account: The current in-App deletion flow deletes the active Firebase Authentication identity and attempts to clear account-scoped data from the device. It does not currently delete existing Cloud Firestore documents. Deleting your MilesBuddy account also does not automatically cancel an App Store or Google Play subscription.

Before deleting an account, cancel any active subscription through the store if you do not want it to renew. To request deletion of existing MilesBuddy cloud documents or other personal information, email milesbuddy.app@gmail.com from the account email where possible. We may need to verify your identity. We will respond and act as required by applicable law, subject to permitted exceptions and records we must retain.

Deleting MilesBuddy does not delete your Apple ID, Google Account, email account, or information independently retained by Apple, Google, an ad provider, a payment provider, or a report recipient.

10. International transfers

MilesBuddy and its service providers may process information in countries other than the country where you live. These countries may have different data-protection laws. Where required, we rely on recognized safeguards such as adequacy decisions, contractual protections, and standard contractual clauses. Firebase services may process data on global Google infrastructure, subject to Google's applicable location commitments and transfer safeguards.

11. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. These include account-scoped local storage, access controls, encrypted network transport provided by platform SDKs, restricted file sharing, limited diagnostic messages, and cleanup on sign-out. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Protect your account credentials, device passcode, exported reports, and access to your email or platform account. Contact us if you believe your MilesBuddy account has been compromised.

12. Your privacy rights

Depending on where you live, you may have rights to:

• access or obtain a copy of personal information;
• correct inaccurate information;
• delete information;
• restrict or object to processing;
• receive portable information you provided to us;
• withdraw consent;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• appeal a refusal to act on a request; and
• complain to a data-protection authority.

You may edit or delete certain trips, vehicles, reports, settings, permissions, and advertising choices directly in the App or device settings. For other requests, email milesbuddy.app@gmail.com. Specify the account email and the right you want to exercise, but do not send your password, authentication token, or full route history by email. We may ask for reasonable verification and may deny or limit a request where permitted by law.

If European data-protection law applies, MilesBuddy is the controller for the App data described in this Policy, while providers such as Google may act as processors for particular services. You may object to processing based on legitimate interests and lodge a complaint with the supervisory authority where you live, work, or believe an infringement occurred.

California and certain other U.S. residents may request the categories and specific pieces of personal information collected, correction, deletion, and information about disclosures, and may opt out of qualifying sale, sharing, or targeted advertising. We will not discriminate against you for exercising these rights. You may use an authorized agent where the law permits, subject to verification.

13. Children

MilesBuddy is a mileage and driving-record application and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If local law requires a higher age for a child to consent to data processing, a parent or legal guardian must provide any required authorization. If you believe a child has provided information without appropriate authorization, contact us so we can investigate and delete it as required.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, law, or our practices. We will change the "Last updated" date and provide additional notice in the App or by another appropriate method when a change is material. If consent is legally required for a new purpose, we will request it.

15. Contact us

For privacy questions, rights requests, or complaints:

MilesBuddy
Email: milesbuddy.app@gmail.com