Privacy Policy
Last updated: 6 October 2026
Roadpack helps people travelling in several vehicles stay coordinated. It collects as little as possible, and everything below applies whether or not you create an account.
Guest use (no account required)
- Your display name, vehicle color, and role, stored on this iPhone.
- A random guest identifier created on this iPhone.
- Precise location only while a trip is active, shared with people in that trip through our trip server.
- The route your vehicle actually drove on that trip, recorded while you share location and kept with the trip's saved recap. See The route you drove.
- Trip details you create (destination, stops, votes, and aggregate recap metrics) for the life of that trip.
- Messages you send in the trip chat are visible to everyone on that trip. Text is retained with the room until its scheduled purge after trip end. Photo and video attachments use separate media storage and can outlive the live room; keeping an attachment as a memory makes it available in the saved album. Roadpack never uses messages for advertising.
- A device push token and Live Activity push token, held only by that trip's room, used solely to notify people in that trip and cleared when it ends.
If you sign in with Apple
Signing in is optional for ordinary trip use. It is needed to keep saved crews, vehicle presets, and trip recaps across devices, and before using paid AI illustration when that feature is available. It creates:
- An account record with the display name and language you choose, and the developer-scoped identifier Apple supplies for Sign in with Apple. This identifier is separate from an Apple private relay email address.
- A session credential, valid up to 90 days, that authenticates requests to your account. You can sign out at any time to revoke it immediately.
- Saved crews (vehicle arrangements you name for reuse) and their invitations, vehicle presets, and trip recap summaries you've saved.
- A link between your account and any guest trip you were already in, so you can recover trip membership if this iPhone loses its local trip credential.
- A device token for account-level push notifications, separate from the per-trip token above.
Deleting your account revokes the Apple sign-in grant with Apple and permanently deletes your session, saved crews and invitations, vehicle presets, recaps, device tokens, and account record. This does not affect a guest trip you're currently in — that membership is separate and expires with the trip on its own.
Trip photos and videos
You can add photos or trimmed videos to a trip. They are visible to everyone on that trip and are stored in Roadpack's private Cloudflare storage. Optional AI processing shares selected photos only after the uploader approves the relevant provider and purpose, as described below. Microphone access is requested only for a video you deliberately record with the camera; uploaded clip audio is muted in generated memory films.
- Capture time and location metadata are read on this device to suggest a stop or route position. EXIF/QuickTime location is removed before upload; exact GPS is never sent or retained. The media row keeps only derived route progress, capture time, optional stop suggestion, and confidence.
- You can remove any photo you added, at any time. The trip organizer can remove any photo from their own trip.
- Deleting your account deletes every photo or video you uploaded, across every trip — including trips other people are still looking at.
- Photos outlive the trip room on purpose, so an album does not disappear the day after you get home. Removing them is always your choice.
Finding photos you already took
If you ask it to, Roadpack can look through your photo library for pictures taken along a trip you are on, and show you what it found. This never happens on its own — you tap Find photos from this trip, and iOS asks you for library access before anything is read.
- Only photos captured within the days of that trip are examined.
- Capture time and location are read on this device to work out whether a photo was taken along the route. They are not uploaded, and no part of the scan is sent anywhere.
- Nothing is added to the trip until you select it. Photos you do not pick are discarded when you close the screen — Roadpack keeps no list of what it looked at.
- A selected photo is uploaded exactly like one you added by hand: exact GPS is stripped first, and only derived route progress, capture time and an optional stop suggestion are kept.
- Declining library access affects nothing else. You can still add photos by hand, and every other part of the app works unchanged.
Roadpack Journal and AI generation
Complete Journal pages
The optional Journal feature creates a free local edition with original photographs first. Confirmed AI generation sends the selected source photographs and a short factual page brief to OpenAI for GPT Image 2.5 to create the whole illustrated page, including its text and paper design. When wording is personalized, those photographs are also sent to OpenAI Luna for one short moment caption that may be added to the approved brief. That caption call may web-search only the destination name from the trip facts; photographs are looked at, not searched, and they are never sent to destination-column research. A page can depend on several photographs, and each uploader must approve their own sources. The brief may include the destination, recorded date, stop sequence and attribution; expense totals appear only in an optional receipt page. No raw GPS trace or Apple basemap is included. Exact names, amounts and map details can still be rendered incorrectly, so nothing publishes automatically.
When wording personalization is enabled, the destination name (not photos, stop streets, or traveler names) may be sent to OpenAI with web search to draft short welcome, history, and culture columns. Unsourced or failed research is omitted and the page keeps recorded trip facts. Journal page wording does not use OpenRouter.
Journal permissions and device preferences can be changed in Settings. Changing a device preference stops new requests from that device; withdrawing an individual photo's permission also invalidates dependent hosted pages and queued work. Receipts are excluded from shared images, PDFs, text exports and published editions unless the user explicitly includes private costs. Canonical artwork and its approved text, source references, revisions, permission dependencies and usage records are stored to support progress recovery, checking and free restoration. Older published editions are not overwritten by the new experience.
Removing a source photo, withdrawing AI permission or deleting a linked account invalidates dependent hosted keepsakes and running jobs. Copies already downloaded, cached offline or printed cannot be recalled. We keep limited purchase transaction and allowance accounting records to prevent duplicate grants and billing abuse; these do not contain photographs or article text. Aggregate operational counts and token usage exclude private trip content.
Follow links
A trip organizer can create a link that shows where the pack is heading and when it arrives. That page never shows who is travelling, where anyone is right now, or the invite code. Links can be revoked at any time and stop working shortly after a trip ends.
Purchases
If you buy Roadpack Pro, purchases are processed by Apple or Google and verified by RevenueCat on our behalf. RevenueCat receives your subscription status and the anonymous identifier Roadpack already uses for your device, or a server-issued account-linked identifier when you connect paid AI allowance. It does not receive your name, your location, or anything about your trips, and it is not used for advertising or cross-app tracking. Payment details never reach Roadpack.
Anonymous usage and export diagnostics
Rewind sends a short summary of completion, seeks, pace changes, viewed-content counts, and share or export outcomes. Export diagnostics include bounded stage names and duration buckets. These summaries contain no account, device, trip, photograph, or traveller identifiers, exact locations, file URLs, or raw error messages. The server combines them into daily counters to help us improve playback and export reliability.
Roadpack also keeps anonymous daily counts of how the app is used: trips created, joined, started and ended, which features are used, and when the Pro screen is shown or a purchase completes. Each count is a number for one day and one app version, chosen from a fixed list on our server. It contains no account, device, trip, place or traveller identifiers.
What we do not do
- We do not sell personal data or use it for advertising.
- Your live position is stripped when a trip ends. An abandoned trip is scheduled to end after 24 hours of inactivity, and its live room is scheduled for deletion 24 hours after ending. Saved recaps, route geometry, the route each vehicle drove, media, and account recovery records use separate storage and can outlive that room.
- We do not keep a location history outside a trip. Nothing is recorded before a trip starts, after it ends, or while you have location sharing turned off.
- We do not use tracking identifiers such as IDFA.
- Live location sharing is limited to your trip participants through Roadpack's infrastructure. Map, place search, and routing features also use external map providers, including Apple and Google, and can send the coordinates or places needed for those features. Weather requests send an approximate location (rounded to roughly 10km) to Open-Meteo.
The route you drove
While a trip is active and you are sharing location as your vehicle's driver, Roadpack records the road your vehicle actually takes, as a series of points taken every few seconds while moving. It is used to draw your trip's Rewind and Journal as it really happened, including detours and stops you didn't plan, rather than only the route you planned.
- It is recorded only during an active trip, only while you share location, and only from the phone publishing that vehicle's position.
- Points are rounded to about a metre. They are sent to the trip's room and held there until the trip ends.
- When the trip ends, a simplified copy is saved with the trip's recap, which people on that trip can see. It is deleted when the recap is deleted or when you delete your account.
- Photo locations are still never uploaded; this is separate from your photos.
Your choices
Stop sharing location from trip settings. That also stops your vehicle's route being recorded. End or leave a trip to stop sharing. Sign out or delete your account from Settings at any time. Reset the guest identity in Settings to clear the name stored on this iPhone.
How long we keep things
Retention is set by what the data is for. Nothing below is kept "just in case".
| Data | Kept for | Then |
|---|---|---|
| Live participant coordinates | The active trip only | Stripped when the trip ends. An inactive trip ends after 24 hours; its live room is deleted 24 hours after that. |
| Trip chat messages | With the trip room, until its scheduled purge after the trip ends | Deleted with the room |
| Trip photos and videos | Until you or the trip organiser remove them | Deleted on request, and on account deletion across every trip |
| Saved recaps and route geometry | Until you delete the recap or your account | Deleted with the account |
| The route your vehicle drove | During the trip, in its room; then a simplified copy with the saved recap | Room copy deleted with the room; recap copy deleted with the recap or the account |
| Account record and saved crews | Until you delete your account | Permanently deleted |
| Session credential | Up to 90 days | Expires, or is revoked immediately when you sign out |
| Push and Live Activity tokens | The active trip, or the life of the account for account-level notifications | Cleared when the trip ends or the account is deleted |
| Purchase and allowance accounting records | As long as required for tax and anti-abuse purposes | Retained without photographs or article text |
| Anonymous usage counters | Aggregated into daily counters | Never tied back to a person, device or trip |
Legal basis for processing (UK and EEA)
If you are in the United Kingdom or the European Economic Area, UK GDPR and EU GDPR apply. We rely on:
- Contract. Running a trip you joined: your location inside that trip, the route your vehicle drove on it, the trip record, chat, and the itinerary. Without this the app cannot do its job.
- Consent. Photo library scanning, AI illustration, and any optional feature that asks before it acts. You can withdraw consent at any time in Settings, and withdrawal stops future processing.
- Legitimate interests. Keeping the service reliable and preventing abuse, using anonymous counters that contain no identifiers.
- Legal obligation. Purchase and tax records.
Your rights
Wherever you live, you can ask us to:
- Access a copy of the personal data associated with your account.
- Correct anything inaccurate — display name, vehicle presets, and crew details are editable in the app.
- Delete your account and everything tied to it. This is available in the app; see deleting your account.
- Export your data in a portable format.
- Object to or restrict processing based on legitimate interests.
- Withdraw consent for any optional feature, without affecting anything else.
Write to privacy@roadpack.app. We respond within 30 days. If you are in the UK or EEA and are not satisfied, you may complain to your national data protection authority.
California
Under the CCPA and CPRA you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. Roadpack does not sell or share personal information, and has not done so in the preceding twelve months. We do not use personal information for cross-context behavioural advertising, and we do not knowingly collect or sell the personal information of anyone under 16. Exercising these rights will never result in a worse experience in the app.
Children
Roadpack is not directed at children. You must be at least 13 to use it, and at least 16 in any country where that is the minimum age for consenting to data processing. We do not knowingly collect personal information from children below those ages. Children often travel as passengers on a trip; a passenger who is not signed in and not driving does not have an account or a shared location of their own. If you believe a child has created an account, write to privacy@roadpack.app and we will delete it.
Where your data is processed
Roadpack's trip infrastructure runs on Cloudflare, which processes data across a global network. Where data leaves the UK or EEA, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Named third parties are listed above: Apple, Google, RevenueCat, OpenAI (only for features you explicitly approve), and Open-Meteo.
Changes to this policy
If we change how Roadpack handles your data in a way that materially affects you, we will update this page, change the date at the top, and notify you in the app before the change takes effect. Continuing to use Roadpack after that means the updated policy applies.
Contact
Privacy questions and data requests: privacy@roadpack.app
Everything else: support@roadpack.app
Who is responsible for your data
Roadpack is published by Arjun Mishra, Vancouver, British Columbia, Canada, who is the data controller for the purposes of UK and EU GDPR and the business responsible under the CCPA. Reach the controller at privacy@roadpack.app.
Roadpack is also subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA). If you are in Canada and are not satisfied with our response to a privacy request, you may complain to the Office of the Privacy Commissioner of Canada or to the Office of the Information and Privacy Commissioner for British Columbia.