MileBuck Privacy Policy

Your account has an identity from Apple, Google, or your phone number. We store the identity needed to recognise your next sign-in, the name or email the provider supplies, and the devices signed in to your account. For phone sign-in, we keep the number you texted from and its last four digits so we can recognise and display it.

We store trip dates, distances, vehicle, category, odometer readings, expenses, driver profile, and subscription status in readable form to show your list and totals on a new phone. Your GPS points, route, place names, and notes are encrypted on your phone before upload. MileBuck stores that encrypted copy without the key needed to read it.

We also receive app and device version details, a device identifier, product usage events, and error reports to operate the service, diagnose failures, and protect accounts. Payment details are handled by Apple or Stripe, depending on where you buy; we receive purchase and entitlement status, not your full card number.

If you choose Sign in with Google, Google provides a stable account identifier, your verified email address, and your name through the standard openid, email, and profile permissions. We verify the Google identity token, then use that information to create or find your MileBuck account, sign you in, and show your account identity. We store the identifier, email, and name with your account. We do not keep the Google identity token after verification or use this information for advertising.

Signing in does not give MileBuck access to your Gmail, contacts, photos, or general Google Drive files. Google Drive access is a separate, optional permission described below.

If you separately allow the drive.appdata permission, the iPhone app can create, list, read, and remove files in MileBuck’s own hidden Google Drive app-data folder. It cannot browse the rest of your Drive. The app puts a copy of your route encryption key there so it can restore your routes on a new phone. It reads that copy only when checking or restoring the backup.

This key copy is readable by Google because Google Drive is not an end-to-end encrypted vault. Narro’s servers do not receive the Drive copy or the raw key. The Drive access token stays on your phone and is sent directly to Google for these Drive requests; it is not sent to MileBuck’s server. You can decline this backup and still sign in with Google.

We use account data to authenticate you and sync your trips. Trip metadata powers your mileage log and totals. Encrypted route data lets your own devices restore maps and notes. Device and usage information helps us operate, secure, and improve MileBuck.

Cloudflare runs our API and encrypted file storage, and PlanetScale hosts account and trip metadata. RevenueCat handles subscription status; Twilio delivers phone sign-in texts; PostHog processes product usage events; and Sentry processes error reports. These providers receive information needed for their roles. An optional Drive key copy goes directly to Google from your phone.

We do not sell Google user data, share it with advertisers or data brokers, or use Google Workspace API data to develop, improve, or train generalized AI or machine learning models.

Connections to the API use HTTPS. Route details are encrypted on your phone before upload. The route key stays on your phone and in your iCloud Keychain, with an optional Google Drive copy you choose. Our server can hold only a version wrapped by a separate backup key that you control. We can see the trip metadata listed above, but we cannot decrypt the route details.

If every copy of your route key is lost, neither MileBuck nor anyone else can restore the maps, place names, and notes. Your trip dates, distances, and totals remain available.

We keep your account identity, trip metadata, and encrypted route backup while your account is active. You can delete the account from the app’s Account settings. That starts removal of your identity and sessions, trip records, and encrypted route files from our servers. A scrubbed account record may remain to preserve purchase history without your name or email.

Account deletion cannot erase data on a signed-in phone that is offline, a key copy in your own iCloud Keychain, or the optional hidden Google Drive app-data copy. You control those provider copies separately. Revoking Drive permission stops future app access but does not itself delete the existing copy. A store subscription must also be canceled with the store where you bought it.

For a privacy question or deletion help, email help@milebuck.com. We will update this page when our data practices change and give an in-app notice when a change affects how Google user data is used.

The separate Terms of Use govern use of the app. This page is MileBuck’s privacy policy.