Milepost
Milepost works without an account, has no ads, and has no analytics or tracking. Your maps, favourites and history stay on your device. If you create an account or buy Pro, we keep only what's needed to run it.
This policy explains what information the Milepost app (“the App”) handles, why, and what control you have. The App is provided by [LEGAL NAME / COMPANY] (“we”, “us”).
- Information that stays on your device
- Information we collect
- Information other services receive
- What we don't do
- Legal bases
- Service providers
- Retention
- Your choices and rights
- Children
- Security
- Changes
- Contact
Information that stays on your device
These are stored only on your phone and are never sent to us:
- Downloaded rail regions and map data.
- Favourites, recent routes, route settings and preferences.
- Your location while you use the map, which is used to show your position and nearby mile markers.
Rail data is kept out of iCloud and device backups. Favourites and preferences are part of your normal device backup, which Apple or Google handles.
Information we collect
| Information | When | Why | Where it's stored |
|---|---|---|---|
| Email address, and a password stored as a secure hash | You create an account with email | Sign-in and account recovery emails | Supabase, our backend provider |
| Sign in with Apple identifier, and the email Apple shares (which may be a private relay address) | You use Sign in with Apple | Sign-in | Supabase |
| Account ID and plan (free or Pro, and its expiry) | You have an account | Unlocking Pro features you've paid for or been given | Supabase |
| Purchase and subscription status, account ID, and device identifiers chosen by the purchase SDK | You view or buy Pro | Processing and restoring purchases | RevenueCat, our purchase provider. Apple or Google processes the payment; we never see your card details. |
| Company license seat: your email, the organization and the seat | Your organization invites you, or you redeem a key | Giving you Pro paid for by your organization | Supabase. Your organization can see that you hold a seat. |
| Start and end coordinates of a driving route | Only when you ask for in-app directions (Pro) | Calculating the road route | Sent through our server to Mapbox to get the route. We don't store them; Mapbox processes the request under its own privacy policy. |
| A one-way hash of your IP address, with a timestamp | You request directions | Preventing abuse through rate limits | Supabase, deleted automatically after about a day. We never store the raw IP address. |
Information other services receive as you use the App
- Map tiles. The background map loads from OpenFreeMap. Like any web request, this reveals your IP address and the area of the map you're viewing.
- Region downloads. Downloading a region contacts our data server at [RAIL DATA HOST], which sees your IP address and the region requested. We don't link this to an account. Standard server logs are kept for [N] days.
- Navigation. If you hand off to Apple Maps, Google Maps or Waze, the destination is passed to that app and its privacy policy applies.
- Sharing. If you share a mile marker or location, it goes only to the app and person you choose.
What we don't do
We don't sell or rent personal information, show ads, use analytics or crash-reporting tools, track you across other companies' apps or websites, or collect your location in the background. If you use Face ID or Touch ID to protect your saved sign-in, it's handled entirely by your device, and we never receive biometric data.
Legal bases (EEA and UK)
We process account, purchase and directions data to provide the App and Pro to you (performance of a contract), and rate-limit data for our legitimate interest in preventing abuse.
Service providers
- Supabase: accounts, plan storage and server functions.
- RevenueCat: subscription management.
- Apple and Google: app distribution, payments and Sign in with Apple.
- Mapbox: road route calculation.
- OpenFreeMap: background map tiles.
- Brevo: account and invite emails.
Each processes data only to provide its service to us. Some may process it outside your country; where the law requires it, those transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
Retention
We keep account data until you delete your account. Purchase records may be kept as long as tax and accounting law requires. Rate-limit hashes are deleted after about a day.
Your choices and rights
- Delete your account at any time in the App under Account, then Delete account. This permanently erases your account and profile from our servers and, for Sign in with Apple, revokes the App's access to your Apple ID.
- Location: allow or deny location access in your device settings. The map works without it.
- Local data: Settings, then Reset database, clears downloaded data and preferences. Deleting the App removes everything stored on the device.
Depending on where you live (for example under the GDPR, the UK GDPR, the CCPA/CPRA or PIPEDA), you may have the right to access, correct, delete or export your personal information, or to object to how it's processed. Email privacy@milepostrail.com and we'll respond within the time the law requires. You can also complain to your local data protection authority.
Children
The App isn't directed at children under 13, or the minimum age in your country, and we don't knowingly collect their personal information. If you think a child has created an account, contact us and we'll delete it.
Security
Data in transit is encrypted with HTTPS. Account data is protected by access controls on our backend, so each user can read only their own profile. No system is perfectly secure, so we collect as little as we can.
Changes
We'll update this policy when the App's data practices change and update the date at the top. If the changes are significant, we'll tell you in the App.
Contact
[LEGAL NAME / COMPANY], [POSTAL ADDRESS], privacy@milepostrail.com