Draft — pending legal review. This text explains our intended practices in plain language and may change before launch.
Privacy policy
Last updated October 15, 2026
Backmiles (“we”) makes a mileage log app for iPhone and Android and this website. A mileage log knows where you go, so we collect only what the app needs to log your drives, and we're specific below about where it goes. Questions: privacy@backmiles.com.
The short version
- We use your location to detect and log drives. That's the product; we don't use it for ads.
- We don't sell or rent your personal information.
- Location, addresses and routes never go to our analytics or ad tools.
- A Google Timeline file you import is read on your phone and never uploaded.
- If you drive for someone else's business, they see your business drives; your personal drives show as totals only unless you choose to share.
- You can export or delete your data from the app at any time.
What we collect in the app
Account
Your email address, name (if you give one), and sign-in method (Apple, Google or email code).
Location and drives
With your permission, precise location in the background, and motion activity, to detect when you drive. For each drive we store start and end time, start and end points, addresses, the route, distance, how it's sorted (business or personal), purpose, notes, parking and tolls you add, and the vehicle. We also store the places Smart has learned (a point, a radius, a name and how you usually sort it) and your work hours if you set them.
Business details
Business name, start or incorporation date, home location (to recognise commutes), and the mileage rate you use.
Purchases
Your plan and subscription status. Payments are handled by Apple or Google; we never see your card details.
Product analytics and diagnostics
If you allow it (Settings → Privacy in the app), which screens you use and what you tap, with text, images and maps masked in any session recording. Money and distances are sent only as broad ranges. Crash reports and error diagnostics are sent to keep the app working; they contain a random user ID, not your location or content. In the EEA, UK and Switzerland, analytics are off until you turn them on.
Imported location history
When you import a Google Maps Timeline (or other) file, it is read on your phone. We save only the drives you choose to keep; the raw file is never sent to us, and the app's copy is deleted after reading.
How we use it
- To provide the app: detect, store, sort and report your drives, sync them between your devices and your team.
- To run Smart sorting and, if you use them, optional AI extras (see below).
- To manage your subscription and driver seats.
- To fix bugs and improve the app, using analytics only if you allow it.
- To answer you when you contact us, and to send account emails (sign-in codes, invites).
Legal bases where GDPR applies: performance of our contract with you (the app), your consent (analytics, ad cookies, background location permission), and our legitimate interests (security, crash diagnostics, fraud prevention).
Teams: who sees what
If you join a business as a driver, the owner and admins of that business can see your business drives in full (where, when, how far, purpose) and can edit and report on them. For your personal drives they see only totals (when and how far), never places, addresses or routes, unless you turn on sharing. Every change to a drive is kept in that drive's history. If you leave or are removed, your past business drives stay with the business as its records; your personal drives stay with you. The app shows you exactly what the owner can see before you join.
If you're an owner adding employees: you are responsible for giving any notice your local law requires for tracking employees' business driving.
Services we use (processors)
These companies process data on our behalf, under contracts, only to provide their service to us.
| Service | What for | What they receive |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Your account, drives, places and business data |
| RevenueCat | Subscription status across Apple and Google | A business ID and purchase receipts |
| Apple, Google | App stores, payments, sign-in (if you choose them) | Purchase and sign-in data under their own policies |
| Google Maps Platform | Showing maps of your drives in the app | Map areas being displayed |
| OpenCage | Turning drive start and end points into addresses | Coordinates or address searches, without your name or ID; queries aren't logged |
| openrouteservice (HeiGIT gGmbH, Germany) | Distance for drives you add by hand | Start and end coordinates only |
| OpenRouter (Google Gemini) | Optional AI extras in Pro (suggest a purpose, draft a note, explain a sort) | Place categories and labels you've named, never coordinates or routes; only when you use the feature |
| PostHog | Product analytics, feature tests, session replay (masked) | Usage events with a random ID, if you allow analytics |
| Sentry | Crash and error reports | Diagnostics with a random user ID; IP addresses not stored |
| Resend | Sending email (sign-in codes, invites, support replies) | Your email address and the message |
| Vercel | Hosting this website | Standard request data (IP, browser) for delivery and security |
This website, cookies and ads
The website uses a small essential cookie to remember your privacy choice and your region's default. With your consent (or, outside the EEA, UK and Switzerland, unless you opt out) it also uses:
- Analytics: PostHog, Google Analytics and Hotjar, to see which pages help. Form fields are masked in recordings.
- Advertising: Google Ads, Meta and, if we run ads there, TikTok and LinkedIn pixels, to measure whether our ads lead to app downloads. We also pass ad campaign tags (for example utm_campaign) to the App Store or Google Play when you tap a store button.
Change your choice any time with “Cookie settings” in the footer. We honour the Global Privacy Control signal as an opt-out of sale or sharing.
Your rights
Depending on where you live (for example under GDPR, UK GDPR or California's CCPA/CPRA), you can ask to access, correct, export or delete your personal information, object to or restrict some uses, and withdraw consent. Most of this is built into the app (Settings → Account: export, delete). For anything else email privacy@backmiles.com. We reply within 30 days (45 for CCPA requests) and won't treat you differently for using your rights.
Do not sell or share: we don't sell personal information. Ad pixels on this website can count as “sharing” for cross-context advertising under California law; use “Do not sell or share my personal information” in the footer (or a GPC signal) to turn them off. The app doesn't use ad trackers.
You can also complain to your local data protection authority.
How long we keep data
- Drives and reports: while your account exists, because tax records are often needed for years. Deleted drives are kept 30 days so you can restore them, then erased.
- Account deletion removes your data from our live systems within 30 days and from backups on their normal cycle.
- Analytics data: up to 2 years. Crash reports: up to 90 days. Support emails: up to 3 years.
Security and transfers
Data is encrypted in transit and at rest with our providers, and access is limited by account and team rules enforced in the database. Some providers process data in the United States or elsewhere; where required we rely on standard contractual clauses or similar safeguards.
Children
Backmiles is for adults who drive for work. It isn't meant for anyone under 16 and we don't knowingly collect their data.
Changes
We'll update this page when our practices change and tell you in the app for anything significant. See also our terms.