Privacy policy

Who this policy covers

Milepost is operated by Sai Kambampati (“Milepost,” “we,” or “us”), who decides how and why the personal information described here is used and is its controller. This policy covers Milepost on iPhone, iPad, Mac, Android, Apple Watch and Wear OS; its CarPlay, Android Auto, widget, Live Activity and iMessage extensions; milepost.club; and the Milepost service and connected-agent tools. Features differ by platform and version. Contact sai@kambampati.studio about personal information or this policy.

App stores, operating systems, music players, sign-in providers and services you connect also process information under their own policies.

Information we collect

• Drives and location. While a drive records: precise coordinates with time, speed, direction and altitude; distance, duration, stops and pauses; recording settings; marked places with their notes; and weather along the route, with coordinates. These can reveal places such as your home or workplace.
• Drive detection on Apple devices. With Always and Precise Location access, recent background location and motion activity used to notice when you start driving, kept on your device as described below.
• Your content. Roadbook titles, journal text, marks and notes, photos you add, highlights, comments, reactions, your name, handle, profile photo and bio, and your sharing choices. Photos and text can contain information about other people.
• Garage and activity. Vehicle year, make, model, trim, color, nickname, specifications and artwork; driving statistics, streaks, stamps, milestones and your time zone.
• Account and social information. Account and installation identifiers, optional linked Google identity details, friends, invitations, per-friend settings, collaborators, blocks, safety reports, notification preferences and what you’ve seen.
• Music, when you turn it on. The title, artist and album of songs played during a drive and when they played. Milepost never records audio.
• Purchases. Store, product and transaction identifiers, purchase history, Pro status, store country and an anonymous RevenueCat customer identifier. We never receive your payment-card details.
• Device and service information. IP address, device and push tokens, App Attest or Play Integrity results, app and system versions, device model, time zone, feature use, and crash and diagnostic information, as detailed below.
• Communications. Feedback, support and privacy requests, reports and any tester or waitlist sign-up, including an email address if you give one.

We receive this information from you, from your device’s features, from app stores and sign-in providers, from services that provide features, and from other people who invite you, collaborate with you, comment on shared content or report you. Location is needed to record drives, and an account is needed to back up, sync and share. Everything else is optional; declining only limits the related feature.

Location, recording and permissions

Recording on Apple devices. On iPhone and iPad, Milepost collects precise location while a drive records, including when the screen is locked or another app is open. A drive starts when you start one in the app, on your watch or with Siri, when Auto-Record starts one, when you accept a prompt to record, or when your iPhone connects to CarPlay while Record on CarPlay is on, which it is by default. End the drive to stop recording.

Drive detection. Milepost asks for Always location access during setup. With that access and notifications allowed, Milepost watches for driving in the background, even when Auto-Record is off. It uses significant location changes, visit monitoring, a 150-meter area around where you last stopped, motion activity and brief location checks. It keeps up to six hours of recent background location on your device, plus your last parked spot, so a drive can start from where you actually started. With Auto-Record on, Milepost starts recording when it detects driving. With Auto-Record off, it asks “Want to record this drive?” and, if you accept, adds that recent route to the drive. Detection data stays on your device unless it becomes part of a drive you save, although your device’s own backups can include it. To stop drive detection, set Milepost’s location access to While Using the App, or turn off both Auto-Record and Milepost’s notifications; you can also mute prompts for a day or a week. Motion & Fitness access, requested when you turn on Auto-Record, helps tell driving from walking and stops, and that data stays on your device.

Recording on Android. On Android, Milepost collects precise location only while a drive records, with an ongoing notification. It never asks for “Allow all the time” location access and collects nothing when you aren’t recording. Drives start when you start one in the app, including from a widget, Quick Settings tile or your watch, or from Android Auto. While Record on Android Auto is on, which it is by default, opening Milepost on a car display starts or resumes a drive, and Milepost tells you the first time it does. The recording notification shows your street, car and speed on the lock screen only if your lock-screen settings show sensitive content.

Photos and camera. Milepost uses the system photo picker, so it receives only the photos you choose. Camera access lets you take photos of cars and moments and scan device-link codes. Photos Milepost uploads are re-encoded and don’t carry the original file’s embedded location (EXIF) metadata.

Music. With Save Apple Music on, Milepost reads what the Music app is playing during a drive. On Android, Save Music uses notification access to find and control media playing in supported apps: it reads track details and the player’s name, and can play, pause or skip. It doesn’t read or store your notifications’ messages. You can turn either setting off, and revoke notification access in Android Settings.

Watches, cars, widgets and Live Activities. These surfaces receive what their feature needs, such as the current drive, your garage, your latest Roadbook and friends’ recent shared Roadbooks with route previews. Apple Watch uses your account to load friends’ Roadbooks and reactions from our server. On Wear OS, the phone sends your watch up to eight friends’ latest Roadbooks, your last route, and your street and speed while you drive. CarPlay and Android Auto remember which car you’re in on your device, and Android Auto reads the car’s make, model and year from the car; these aren’t uploaded. To start a Live Activity when a drive begins in the background, the iPhone app sends the activity’s display state (the drive’s identifier, start time, distance, speed and alert text, never the street) through our server to Apple’s push service. We don’t store it. Notifications and lock screens can show this information to anyone who can see your device.

You can change permissions in your device’s settings at any time. Removing location access stops recording and can interrupt a route.

Accounts, sign-in and backup

Your account. Milepost creates an account for your installation without an email address when you first start using it. On Android, that happens when the welcome screen opens. Each installation is registered with Apple App Attest or Google Play Integrity so our server can check that requests come from genuine Milepost apps. On Apple devices, a credential stored in iCloud Keychain keeps the same account across your devices.

Backup. Milepost backs up your Roadbooks, including Private ones, drafts and rough routes, with their photos, plus your profile, garage, social and account data, so it can restore and sync them. Private Roadbooks aren’t visible to other people, but they are stored on our servers. On Apple devices, Cloud Backup is turned on during setup and stays on while you have an account; if iCloud Keychain or our service is unavailable, data stays on the device and sync retries. On Android, backup to your Milepost account is automatic. Milepost’s Android and Wear OS apps exclude their data from Android’s cloud backup and device transfer.

Google sign-in on Android. If you sign in with Google, Google sends an identity token that our server checks and doesn’t keep. We store your Google account identifier, email address and its verification status, name, profile-photo URL and sign-in times to link and recover your account. Your Google name and photo can fill in your Milepost profile, and that photo becomes your public profile photo unless you change it. Milepost never receives your Google password and has no access to your Gmail or contacts. On a device where you used Google before, Milepost may sign you in automatically. Log Out disconnects the device from your account and erases your Roadbooks, photos, garage, profile and friends from it. Apple devices don’t sign in with Google; they can show and unlink a Google account linked from Android.

Linking and merging. Where offered, approving a device link merges two accounts into one, combining Roadbooks, garage, profile and social information as shown in the approval. Link requests keep both devices’ identifiers, platforms and models for about 24 hours. We keep the identifier of a merged account so its devices reach the surviving account, and agent connections move with it. Approve a link only for a device or account you control.

How we use information

We use information to record, back up and sync drives; run profiles, garages, friends, sharing, collaboration and notifications; provide maps, weather, place names, music artwork and car artwork; maintain purchases; provide support; secure accounts, check app integrity, moderate content and prevent abuse; understand how features are used and fix problems; and meet legal obligations. We use a tester or waitlist email only for the program you joined.

We don’t sell personal information, use it for targeted advertising, or use it to train AI models. We don’t use your routes to infer sensitive characteristics such as your health, religion or sexual orientation.

Legal bases. Where the law requires a legal basis, we rely on our contract with you to provide your account, recording, backup, sharing, friends, purchases and support. We rely on our legitimate interests for security, integrity checks, abuse prevention and moderation, diagnostics and reliability, and product analytics; we balance those interests against your rights, and you can object as described below. We rely on your consent for optional device access you grant, such as Always location for drive detection, motion, photos, camera, music and notifications, and you can withdraw it in your device settings. We rely on legal obligations when the law requires processing.

Automated checks. Milepost uses automated checks to keep sexual content out of what people share, described under AI features. A flagged item isn’t published. These checks don’t produce legal or similarly significant effects, and you can ask a person to review any result.

Profiles, sharing and friends

Public profile. Every account has a public profile page at milepost.club/user/ followed by its handle, which is a generated handle until you choose one. It shows your name, handle, photo, bio, garage, statistics from your Public Roadbooks (such as activity, streaks and time spent in speed ranges) and your Public Roadbooks. Our public profile data also includes when you joined. Public Roadbooks and the profile pages of handles you chose can appear in search engines; a profile with a generated handle is kept out of search. Don’t put information you want to keep private in your profile.

Roadbook audiences. Each Roadbook is Private (only you), Friends (your friends in Milepost) or Public (anyone with its link, on the web, in friends’ feeds and on your public profile). New Roadbooks usually start as Friends, so check the audience before you save a drive. Private Roadbooks are still backed up.

What shared Roadbooks include. A Friends or Public Roadbook includes its complete route, including where it starts and ends, with times, speeds, stops, weather, marks and notes, photos, music, vehicle and statistics. Anyone with a Public Roadbook’s link can view its page and download its route data, including every recorded point with its time, speed and altitude.

Friends. Anyone who opens your invite link in Milepost becomes your friend; the link doesn’t expire. Creating an invite uploads a preview card with your name and photo that anyone with the link, including link-preview services, can see. Friends see your Friends and Public Roadbooks, your garage, your driving streaks (which count all your drives, including Private ones) and your time zone. Friends who choose Drive Started alerts are notified whenever you start a drive, including drives that Auto-Record, CarPlay or Android Auto start. To stop sharing with one friend, including those alerts, turn off Share My Roadbooks on their profile, or remove or block them.

Reactions, comments, mentions and collaboration show your name and activity to the other people involved. An approved collaborator can add to a Roadbook, and changing access doesn’t recall copies they already have. A friend who connects an AI agent can let it read what you share with them, as described under Connected agents.

Changing an audience, removing a friend or blocking someone limits future access through Milepost. People who saved copies or screenshots, search engines and connected services may keep what they already received. Blocking doesn’t hide anything you’ve made Public.

Services Milepost uses

We use service providers for hosting, storage, notifications, maps, weather, vehicle data, purchases, analytics, security and AI features. Those processing information for us are bound by contracts or terms that require them to protect it consistently with this policy and applicable law. Some, such as Apple, Google and agent services you connect, also process information under their own policies. We don’t sell personal information or share it for targeted advertising.

Hosting. Our backend runs on Fly.io with PostgreSQL databases and Tigris object storage. Photos and other media are private and served only to people allowed to see them.

Apple. On Apple devices, Apple provides location, maps, weather, Music, iCloud Keychain, App Attest, push notifications, purchases and Apple Intelligence. These features send Apple what they need, including coordinates. On both Apple devices and Android, Milepost looks up saved songs’ title, artist and album, with your region, through Apple’s iTunes Search API to show artwork, which is cached on your device. See Apple’s privacy policy.

Apple Intelligence. On supported Apple devices, Milepost suggests Roadbook titles with Apple Intelligence, using Apple’s Private Cloud Compute when available and otherwise the device. A request can include the drive’s day and time, distance and duration, cities along the route, whether it started or ended somewhere you go often (such as home), your marks and notes, text Milepost reads on the device from signs in your photos, recent titles and your vehicle’s name. Photo descriptions for VoiceOver and sign reading happen on your device. Apple Intelligence is controlled in your device settings.

Siri and Spotlight. Milepost adds your published Roadbooks (dates, places, car, marks and story) to your device’s Spotlight index so Siri can use them, and lets Siri and Shortcuts start and end drives.

Google. On Android, Google Maps Platform provides maps, weather and route repair. Weather requests send your exact location when a drive starts and every 30 minutes while it records, and route repair sends the points on either side of a gap. Android’s system geocoder, provided by Google Play services, looks up street names while you record and place names for saved routes. The Maps SDK collects technical and device information, IP addresses, a pseudonymous SDK identifier, map interactions and crash information, which Google can use under its own policies. Google also provides Firebase Cloud Messaging (installation identifier, push token, app version), Play Integrity, sign-in, Google Play billing, the Wear OS data layer, and on-device ML Kit subject cut-outs in Body Shop, whose SDK can send Google operational information. Use of Google Maps features is subject to the Google Maps/Google Earth Additional Terms of Service and Google’s privacy policy.

Notifications. Apple and Google deliver push notifications. They carry what they show, such as names and handles, Roadbook titles, comment and mention excerpts, vehicle names and agent names, and some carry route data for watches and widgets.

Opening a route elsewhere. If you open a route in Google Maps, Waze or Apple Maps, Milepost sends that service the route’s start, stops or destination coordinates.

Vehicle information. Vehicle searches go through our server to CarAPI. Results may be cached briefly, and search terms are left out of our logs. See CarAPI’s privacy policy.

Purchases. Apple or Google processes payments. RevenueCat receives purchase and subscription information with an anonymous customer identifier to validate and restore Pro. On Apple devices, its SDK also receives your device’s app-vendor identifier, store country, language and app and system versions, and, when Share App Analytics is on, a one-time Apple Ads attribution token that shows whether an install came from an Apple Ads campaign. When you redeem a Milepost access code, we link the anonymous identifier to your installation to grant access. We never send RevenueCat your routes, photos, journal text, name or email. See RevenueCat’s privacy policy.

AI features

Car artwork. When you add a photo of your car in Body Shop, Milepost sends it, resized to 1,280 pixels, with your car’s details to OpenAI to draw artwork. This starts as soon as you choose the photo, and Regenerate sends it again. Requests without a photo send only the car’s details and may reuse shared artwork. Our server doesn’t store your source photo. It stores the generated artwork in a shared cache by car details and angle, so it can appear in friends’ garages, public profiles and on other devices, and be reused for matching cars. The app also keeps a local copy. Photos can show people, license plates or places, so crop them first if you prefer.

Stamp artwork. Stamp artwork sends a city, state or milestone label to OpenAI when new artwork is needed. Stamps are shared and cached by label, but a place label can still reveal somewhere you’ve been.

Content checks. When you set your name or handle, change your profile, create an invite card, share or save a Roadbook that isn’t Private, or let an agent edit your garage, Milepost sends the text and photos involved to OpenAI’s moderation service to check for sexual content, including content involving minors. Flagged content isn’t published, and a flagged Roadbook stays Private. Comments aren’t checked automatically, and if the check is unavailable, content can be published without it. We don’t keep moderation inputs.

Reaction emoji. When you save a Friends or Public Roadbook, Milepost sends its title, journal, moment notes and types, weather conditions and up to three low-resolution photos to OpenAI to choose its reaction emoji. Private Roadbooks and drafts are never sent. We ask OpenAI not to store these requests, don’t log their inputs, and keep only the chosen emoji.

OpenAI processes these requests for us, doesn’t use them to train its models, and may keep them for up to 30 days to monitor for abuse; it doesn’t retain moderation requests. See OpenAI’s data controls. Generated artwork and automated checks can be wrong; email us about an inappropriate result or a check you disagree with.

Connected agents and assistants

AI agents. You can connect ChatGPT, Claude or another compatible AI agent to your Milepost account. A Milepost device registered to your account must approve each connection, and the first approval or denial counts. Depending on the access you approve, an agent can read your profile, garage, Roadbooks and journal notes and your routes, up to 500 points per request. It can also read your friends and the Roadbooks they share with you, including their names, notes, photo references, streaks, time zones and route previews that show exact start and end points, plus other people’s comments. Write access can let it edit your profile and Roadbooks, change your garage, publish drafts, change audiences, and react or comment, which appear under your name. The agent’s service handles what it receives under its own policy, such as OpenAI’s or Anthropic’s.

For each connection we store the agent’s name and callback address, the IP address and browser used to sign in, the approved access, timestamps and digests of its credentials. Pending approvals expire after 10 minutes, authorization codes after one minute, access tokens after one hour and connections after 30 days; agents that register themselves are removed 90 days after their last use. Expired records are removed the next time the store is used, and all of them are removed when you revoke access in Settings → Recording & Privacy → Connections or delete your account. Revoking stops future access but can’t erase what an agent already received. Anyone who knows your handle can request a connection, so approve only one you started.

Assistants on your device. On Android, system assistants you allow, such as Gemini, can use Milepost’s app functions to read your current drive, Roadbooks, notes, statistics and garage, and to start, pause or end drives or add marks. On Apple devices, Siri and Shortcuts can start and end drives and use your published Roadbooks from your device’s Spotlight index.

Analytics, diagnostics and the website

Product analytics. On iPhone, iPad and Mac, Share App Analytics (Share Usage Analytics on Mac) sends product events to Mixpanel. It’s on by default, including from first launch and during setup. Events cover screens and features used; counts of drives, friends and vehicles; each drive’s distance, duration and number of location points; the distance, duration, audience and photo and mark counts of Roadbooks you view, including friends’; where you share; purchase products and outcomes; failure categories; daily performance summaries, including time spent in the foreground, background and background location; crash signatures; and app version, platform and device type. Events use a random device identifier and, once you have an account, your account’s random identifier, so your Apple devices count as one person. We don’t send routes, coordinates, journal text, photos, names, handles, email addresses or vehicle details. We turn off Mixpanel’s IP-based location and automatic device, system, screen, carrier and network details, but Mixpanel still receives your IP address when your device connects. Apple Watch events go through your iPhone and follow its setting. Deleting your account starts a new identifier after a final “Account Deleted” event. You can turn analytics off in Profile → Settings → Recording & Privacy, or with Share Usage Analytics in the Mac app’s Settings → Privacy. An existing off choice stays off.

Android doesn’t send product events. At each launch, it fetches feature settings from Mixpanel using Mixpanel’s random identifiers, the platform and the app version. See Mixpanel’s privacy policy.

Diagnostics. Apps on Apple devices report failures to our server whether or not analytics is on, because we need them to keep Milepost working. A report includes the app version and build, system version, hardware model, the operation that failed and a short sequence of steps; crash and hang reports add code addresses from the affected thread, never screen contents or text. Android doesn’t send automatic failure reports. Request diagnostics use random identifiers and broad request types, not request contents, credentials, search terms or full URLs.

Feedback. Leave Feedback sends your text (up to 4,000 characters), app version and build, system version and device model; on Apple devices it can link to a recent failure. Saved routes, photos and journal entries aren’t attached. Failure reports and feedback are accessible only through protected administration tools and are deleted 30 days after we receive them; reports waiting on an Apple device are dropped after 30 days. Email correspondence is separate and kept as needed to handle and document your request.

Server logs. Our servers keep application logs for about 30 days. They record request types and outcomes, timing, random request identifiers, Roadbook identifiers and hashed account and device references, not IP addresses, content, search terms or full URLs.

Website. Milepost no longer uses Google Analytics on its website. The homepage and this page clear the previous analytics choice and Google Analytics cookies set by Milepost; this does not erase information Google already received. milepost.club uses no analytics or advertising trackers. It sets one essential cookie, which lasts ten minutes, while you approve an agent connection. Public Roadbook pages load Apple MapKit JS, so Apple receives your IP address and the map area. Our servers receive ordinary request information such as your IP address. Because we don’t track you across other sites or apps or let others do so through Milepost, Do Not Track signals don’t change what we do, and there’s no sale or sharing of personal information for a Global Privacy Control signal to opt out of.

Retention and deletion

We keep account and cloud content while your account exists; inactive accounts aren’t deleted automatically. Other records have their own periods: server logs about 30 days; failure reports and feedback 30 days; agent records as described above; device-link requests about 24 hours; tester and waitlist emails until the program ends or you ask us to remove them. Registrations from installations that never create an account are deleted after about six months. Safety reports are kept for up to a year after they were made, even if an account involved is deleted, so we can handle safety and legal matters. Deleted data can remain in database backups for a limited period until they’re replaced.

Deleting a Roadbook removes it from your devices and the people you shared it with, and turns off its link. Our server keeps the deleted Roadbook, its photos, and the reactions, comments and reports on it until you delete your account, so another device doesn’t restore it. Email us to erase a Roadbook from our servers sooner.

Deleting your account in Profile → Settings on iPhone, iPad or Android erases from our servers your profile and handle, linked Google identity, garage, Roadbooks (including deleted ones), photos and other media, share links, friends and invitations, comments and reactions you made or that were made on your Roadbooks, device and push credentials, agent connections, streak and sync data, and diagnostic reports. The Mac app doesn’t offer account deletion. You can also request account deletion without the app.

Roadbooks, photos, garage, profile and other data saved on your devices stay there until you remove them or the app. On Apple devices, Cloud Backup stays off until you choose Restore, which creates a new account and backs up the Roadbooks still on the device. On Android, a new account is created only when you sign in with Google or use a feature that needs one, such as inviting a friend, and it then backs up the Roadbooks still on the phone. Offline devices and queued media cleanup may need to reconnect before every copy we control is removed.

Safety reports by or about you stay for up to a year after they were made. To confirm deletion and stop offline devices or collaborators from bringing erased data back, we also keep content-free records indefinitely: a random deletion identifier, the new account’s identifier if you start again, former Roadbook identifiers, hashes of erased media identifiers, completion times and removal markers for collaborators. Generic car and stamp artwork stays in a shared cache.

Deleting your account doesn’t cancel a store subscription, revoke permissions in your Google Account, or erase records held by Apple, Google, RevenueCat, Mixpanel or OpenAI. Ask us about those; we may need a device identifier or store order number to find them. Providers may have their own legal, security and financial retention duties. Copies other people or services already saved can’t be recalled.

Security

We use encrypted connections, access controls and app-integrity checks to protect information, and we store account and device sign-in tokens only as one-way digests. Our servers need to read your data to back it up, sync it and share it with the people you choose, so Milepost isn’t an end-to-end encrypted vault. No system is completely secure. Keep your devices secure, approve only connections you started, and tell us about suspected unauthorized access.

Other disclosures and international processing

We may disclose relevant information when required by law or valid legal process; to address fraud, security incidents or threats to someone’s safety; to protect legal rights; or to professional advisers bound by confidentiality. If Milepost is involved in a merger, acquisition or transfer, information may be transferred subject to applicable law, with notice where required.

Milepost is operated from the United States, and our providers process information in the United States and other countries whose privacy laws may differ from yours. Where the law requires transfer safeguards, we and our providers rely on a permitted basis, such as an adequacy decision or standard contractual clauses. Contact us to learn more.

Your choices and rights

Choices in Milepost. You can change location, motion, photo, music and notification access in your device settings; turn Auto-Record, Record on CarPlay, Record on Android Auto, Save Apple Music, Save Music and Share App Analytics on or off; mute drive prompts; choose each Roadbook’s audience; turn off Share My Roadbooks, mute alerts, remove or block each friend; report people and Roadbooks; revoke connected agents; and delete Roadbooks or your account. Turning a feature off stops its future use of your data; it doesn’t erase earlier records.

Your rights. You can ask us to tell you what personal information we have, give you a copy, correct it or delete it by emailing sai@kambampati.studio. Depending on where you live, you may also have rights to portability, to restrict processing, to withdraw consent, to use an authorized agent, to appeal our decision, and to complain to your data protection authority or attorney general.

Your right to object. You can object at any time to processing based on our legitimate interests, including product analytics. Turning off Share App Analytics stops analytics; for anything else, email us.

We’ll respond within the time the law allows, generally one month in the EU and UK and 45 days in US states that grant these rights. We verify requests using as little information as we can; don’t send passwords, account tokens or payment-card details. If we deny a request, you can appeal by replying to our decision, and if we deny your appeal, you may contact your attorney general or data protection authority. We don’t discriminate against anyone for exercising a privacy right.

Sensitive information. Precise location is sensitive personal information under several US state laws. Milepost collects it only after you allow location access and uses it to record, map, back up and share drives as described here. We don’t sell it, use it for targeted advertising or profiling, or use it to infer characteristics about you.

Washington and Nevada. Our consumer health data privacy policy explains how we handle location data that could show a health care visit, and your rights over it.

California. The categories above include identifiers, commercial information, internet or app activity, precise geolocation, music listening details, and user-provided photos and other content. We don’t share personal information with third parties for their direct marketing. Applicable rights depend on each law’s coverage and exceptions; this policy doesn’t claim a certification or universal exemption.

Children and teens

Milepost is for people 13 and older, and we don’t knowingly collect personal information from children under 13. If we learn we have, we’ll delete it. Teens under the age of majority should use Milepost with a parent’s or guardian’s permission. Contact us if you believe a child under 13 has given us personal information.

Changes and contact

We’ll update the effective date when this policy changes and tell you about material changes in Milepost or another appropriate way, asking for consent where the law requires it before using information for a materially different purpose. Send questions to sai@kambampati.studio.