Privacy Policy

Effective [EFFECTIVE DATE] · Last updated [DATE]

This policy explains what the mileset app keeps, where it keeps it, who helps us run it, and what you can ask us to do with your data. mileset is a proof of concept in early testing, and this policy describes what the app does today. Where something is planned but not built yet, we say so.

1. Who we are

mileset is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] ("we", "us"). For personal data processed through mileset, we are the data controller.

Questions or requests about privacy: privacy@mileset.app [PLACEHOLDER: confirm this mailbox exists and is monitored].

[EU/UK REPRESENTATIVE, IF REQUIRED]

2. Using mileset without an account

An account is optional. Without one, everything you plan (trips, cities, itinerary items, booking details and app settings) is saved in the app's private storage on your device. We don't store any of it on our servers.

Some features need our server and therefore need you to be signed in: syncing between devices, place suggestions while you type, and travel times between your stops. Without an account you can still type place names yourself.

Some things happen on your device either way and involve Apple, not us. Maps in the app are drawn by Apple's MapKit, and "Open in Maps" hands a place to Apple Maps. See Who we share data with.

When the app starts, it contacts our sign-in provider, Clerk, to check whether you are signed in. Like any server, Clerk receives your IP address and basic device and app information when it does.

3. What we collect, and why

Account details (only if you sign in)

You can sign in with Apple, with Google, with a passkey, or with a one-time code sent to your email. There are no passwords. Clerk runs sign-in for us and keeps your account record: your email address, the sign-in method you used, and whatever name and email Apple or Google share with it (with Sign in with Apple you can choose to hide your email). Clerk also processes your IP address and device information to keep sign-in secure. Our own server receives only an identifier for your account, inside a signed sign-in token. We use it to know which trips are yours.

Your trips (on your device, and on our server if you sign in)

The trips you create, and everything in them:

• Trips: title and dates.
• Cities: name, time zone and order.
• Itinerary items (activities, stays, flights, trains, other transport): title, kind, whether it's planned or confirmed, start and end times and their time zones, place names, and, when you pick a suggested place, its coordinates (latitude and longitude, plus an arrival point for a journey).
• Booking details you enter: provider, confirmation code, flight or train number, seat, room, type of transport, and notes.

Why: to show your plan, to keep it in sync across your devices, and to work out travel times between your stops. Booking details can include things like a seat number or a note about a reservation. Don't put information in notes that you wouldn't want stored.

Change history (on our server, if you sign in)

For every change to a trip, our server records which trip and which record changed, whether it was created, edited or deleted, the account that made the change, and when. It doesn't record what the old or new values were. The server also remembers which edits it has already applied, so a retry after a dropped connection isn't applied twice.

Why: reliable syncing, sorting out conflicting edits, recovering from mistakes, and the "Recent changes" list in the app.

Place search (if you sign in)

When you type in a place or city field, the app sends the text you've typed to our server, together with the coordinates of the trip's city (not your own location) so nearby results come first. Our server passes those to Geoapify and returns the suggestions. If you pick one, its name, coordinates and time zone become part of your trip.

Travel times between stops (if you sign in)

To estimate how long it takes to get from one stop to the next, our server sends the coordinates of the two stops, the way you're travelling (walking, transit or driving) and, for a future trip, the departure time to the Apple Maps Server API. If Apple doesn't answer, the server falls back to its own straight-line estimate. These estimates are advisory only.

Server logs

Like most web services, our server keeps a technical log of the requests it receives: the time, your IP address, the address requested (which for place search includes the text you typed and the city coordinates), the response code and how long it took. We use these logs to keep the service running, to fix problems and to prevent abuse.

App settings

Your theme, accent colour, background and haptics preferences are stored only on your device.

What we don't collect

• Your location (see Location).
• Your contacts, calendar or photo library. If you import a screenshot, you choose that one image and it's read on your device.
• Advertising identifiers. The app has no ads and no tracking.
• Payment details. mileset has nothing to buy yet.

4. Location

mileset only asks for your location when you tap "Show my location" on the Map tab, never when the app starts. It asks for "While Using the App" permission only, never "Always", and Approximate Location works too.

Once you allow it, Apple's MapKit draws your position on the map and centres the map on you. The mileset app itself never reads your coordinates, so it can't store them or send them to us or anyone else. You can turn location off at any time in iOS Settings, and Settings > Privacy in the app shows the current state.

5. Imported bookings

You can import a booking from a PDF, a screenshot or pasted text. mileset reads it on your device, using Apple's on-device PDF and text recognition, and turns it into a draft for you to check. The file and the text are not uploaded to us or anyone else, and mileset doesn't keep a copy. Only the items you choose to add become part of your trip.

6. Who we share data with

We don't sell your personal information, and we don't share it for advertising. We use the service providers below to run mileset. They may only use your data to provide their service to us.

We keep answers from Geoapify and Apple in memory only, so repeated requests don't have to be sent again: place suggestions for up to 10 minutes and travel times for up to 30 minutes. They are never written to our database. A place you pick becomes part of your trip, as described in section 3.

We may also disclose information if the law requires it, to protect people's safety, or as part of a merger or sale of the service. If that happens, this policy will continue to apply to your data.

Trips are private to your account unless you share one by link, as described below. mileset doesn't have collaboration (editing a trip together) yet.

Sharing a trip by link. You can make a read-only link to one of your trips and send it to anyone. Anyone who has the link can see the trip's plan without signing in: its title and dates, its cities, and each item's name, kind, times and place names. Booking details are never included: no confirmation codes, booking references, seat or room numbers, providers or notes, and nothing about your account. Treat the link like the plan itself and share it only with people you want to see it. You can stop sharing at any time from the app, and the link stops working straight away; deleting the trip also stops it. Shared pages are not listed in search engines and are not stored by our website. To prevent abuse, our website briefly counts visits to shared links by IP address, in memory only.

7. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, these are the legal bases we rely on:

• To perform our contract with you (GDPR Art. 6(1)(b)): your account, storing and syncing your trips, place suggestions and travel times.
• Our legitimate interests (Art. 6(1)(f)): keeping the service secure and reliable, server logs, preventing abuse, change history used to resolve conflicts, and short-lived caches that keep costs and delays down. We've weighed these interests against your rights, and you can object (see Your rights).
• Legal obligations (Art. 6(1)(c)): when the law requires us to keep or disclose information.

Location permission is a choice you make in iOS. Because the app never receives your coordinates, we don't process your location.

8. US state privacy rights (including California)

In the past 12 months we have collected the following categories of personal information, as described in section 3: identifiers (email address, account identifier, IP address), the details you enter about your trips and bookings, and internet activity (server logs). We use them only for the purposes in section 3.

• We do not sell personal information and we do not share it for cross-context behavioural advertising.
• We don't use sensitive personal information to infer characteristics about you. We don't collect precise geolocation (see Location).
• You have the right to know what we hold, to ask for a copy, to have it corrected or deleted, and not to be treated differently for using these rights. See section 13. You can use an authorised agent; we may ask them to prove they are acting for you.

9. How long we keep data

• On your device: until you delete it in the app or remove the app. Signing out stops syncing but leaves the trips on that device.
• On our server (signed-in users): for as long as you keep your account, or until you ask us to delete it.
• Deleted items: when you delete an item, it disappears from the app at once and on all your devices, but our server currently keeps a deleted marker with the record so syncing stays reliable. [TODO: decide a purge period for deleted records, then state it here, for example "permanently removed after N days".]
• Change history: kept for as long as the trip exists. [TODO: confirm, or set a limit.]
• Account records at Clerk: until your account is deleted.
• Server logs: [N] days. [TODO: depends on the hosting provider.]
• Place suggestions and travel times: in memory only, for up to 10 and 30 minutes, then deleted.
• Backups: [TODO: describe backup retention once hosting is chosen.]

10. Security

• Each trip belongs to one account, and our server checks that account on every request. No one else can read your trips through the app or the API.
• Sign-in uses short-lived signed tokens, checked against Clerk's published keys. There are no passwords for anyone to steal.
• Data is encrypted in transit between the app and our server. [TODO: confirm HTTPS/TLS on the production host.]
• Data at rest: [TODO: confirm database and backup encryption with the hosting provider.]
• On your device, trips are kept in the app's private storage, protected by iOS and your device passcode.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities when the law requires it.

11. International transfers

Our providers may process data in countries other than yours, including the United States. [TODO: list where each provider processes data: Clerk (US), hosting region, Geoapify, Apple.] When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on the provider's certification under the EU-U.S. Data Privacy Framework where it has one. [TODO: confirm per provider.]

12. Children

mileset isn't directed to children. You must be at least 13 to create an account, or 16 if you are in the EEA or UK (or the age of digital consent where you live, if that is different). [TODO: confirm the minimum age; it must match the Terms.] We don't knowingly collect personal data from children under those ages. If you think a child has given us personal data, email us and we'll delete it.

13. Your rights, and how to use them

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy (access and portability);
• correct it;
• delete it;
• restrict how we use it, or object to uses based on legitimate interests.

What you can do in the app today: edit or delete any item and its booking details; sign out (your trips stay on the device); turn location off in iOS Settings; or remove the app to delete everything stored on that device.

What needs an email for now: the in-app "Delete account" and "Export my data" options aren't built yet, and neither is deleting a whole trip. Until they are, email privacy@mileset.app from the address you sign in with, or tell us which sign-in method you use. We'll delete your account at Clerk and your trips and change history on our server, or send you a copy of your data. We aim to reply within 30 days. We may need to confirm it's really you first.

If you're in the EEA or UK, you can also complain to your local data protection authority. We'd be grateful if you contacted us first so we can try to help.

14. Notifications

mileset doesn't send notifications yet, and it doesn't collect device push tokens.

[TODO: describe reminders here once they're built.]

15. Things we don't do yet

We will update this policy before any of these are added:

• Analytics: there is no analytics SDK in the app or on the site. [TODO: if product analytics is added, name the provider, the events collected and any opt-out here first.]
• Crash and error reporting: none yet. [TODO: if a crash reporter such as Sentry is added, name it, describe what a report contains and how long it is kept.]
• Editing a trip together: not available yet. Read-only links are described in section 6.
• Server-side or AI-assisted import: not available. Imports are read on your device.
• Paid plans: none yet, so we collect no payment information.
• Waitlist: the sign-up form on this website isn't active. [TODO: name the provider and the retention period before turning it on.]

This website has no cookies, analytics, third-party scripts or web fonts. It runs on our own server alongside the app's API, hosted by Fly.io, which may log visitors' IP addresses for security. Shared trip pages are counted per IP address only as described in section 6.

16. Changes to this policy

We'll update this policy as mileset changes, and change the "Last updated" date at the top. If a change materially affects how we use your data, we'll tell you in the app or by email before it takes effect.

17. Contact

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
privacy@mileset.app