Security

Last updated: 7 September 2026

Roadpack handles live location, which is among the most sensitive data an app can hold. This page describes how it is protected and how to report a problem.

Data in transit

All traffic between the app and Roadpack’s infrastructure uses TLS. The app does not accept unencrypted connections, and App Transport Security is enforced. Live trip updates travel over an authenticated connection scoped to a single trip room.

Data at rest

Trip records, account records, and media are stored in Cloudflare infrastructure with encryption at rest. Photos and videos are held in private object storage that is not publicly listable and is reachable only through authenticated, expiring URLs.

Access control

• Trip scope. Live location is readable only by members of that trip. A trip credential does not grant access to any other trip.
• Invite codes are high-entropy secrets. Possession of a code is what grants trip membership, which is why they should be shared only with the people you want in the trip. An organiser can end a trip to revoke everyone at once.
• Follow links are separate, lower-privilege tokens. They expose destination and arrival time only — never who is travelling, never any individual position, and never the invite code. They can be revoked at any time and expire shortly after the trip ends.
• Sessions. Signing in with Apple issues a session credential valid for up to 90 days. Signing out revokes it immediately.
• Staff access to production systems is restricted and used for operating the service, not for browsing trip content.

Collecting less

The strongest protection is not holding data in the first place.

• Live participant coordinates are stripped when a trip ends.
• Exact GPS is removed from photos and videos on the device, before upload. It is never transmitted or stored.
• Photo library scanning happens entirely on your device; nothing is uploaded unless you select it.
• Usage diagnostics carry no account, device, trip, or traveller identifier, no exact location, no file URLs, and no raw error messages.
• Roadpack uses no advertising identifier and no cross-app tracking.

Payments

Payment details never reach Roadpack. Purchases are processed by Apple and verified by RevenueCat, which receives subscription status and an anonymous identifier — not your name, your location, or anything about your trips.

Reporting a vulnerability

If you believe you have found a security issue, please report it privately to security@roadpack.app before disclosing it publicly. Include enough detail to reproduce the issue.

• We aim to acknowledge reports within 3 working days.
• We will keep you updated while we investigate and tell you when a fix ships.
• We will not pursue legal action over good-faith research that respects other people’s privacy, avoids degrading the service, and does not access or modify data that is not yours.

Please do not test against real trips belonging to other people. If you need test data, ask and we will help.

Contact

Security reports: security@roadpack.app
Privacy questions: privacy@roadpack.app

Roadpack is published by Arjun Mishra, Vancouver, British Columbia, Canada.