Privacy Policy
Last updated: 2026-10-28
Mile-Shift is a local-first mileage and shift-tracking app. Your trip and shift data lives on your device and is never sent to a server operated by us. This document describes exactly what data the app handles, where it lives, and every network connection the app makes.
TL;DR
- Your trips, shifts and mileage history stay on your device. We do not have a server-side copy of where you have been.
- The app starts with a 30-day free trial — no account and no payment required. To keep using it after the trial you subscribe ($1.99/month or $19.99/year) via Apple's standard in-app purchase sheet. Subscribing requires a Mile-Shift account so we can confirm the purchase belongs to you; Apple — not us — manages the payment and your Apple ID.
- What does leave your device: the subscription receipt we verify for signed-in subscribers; a place search you type (plus the map area around you, so results are nearby) sent to OpenStreetMap's Nominatim service; on Android, the start and end points of a drive handed to Android's own geocoder to name them in the trip-end notification (both lookups stop when you turn address lookup off in Settings); and map tiles for the area shown on a map, loaded from Google Maps on Android and Apple Maps on iPhone. Your phone's own backup (iCloud or Finder on iPhone, Android's backup to your Google account), when it is on, includes the app's database. Details in sections 1 and 3.
- No ad networks, no analytics SDKs, no tracking.
1. What we collect — by mode
Trial mode (default — no Mile-Shift account)
Nothing about you reaches our servers. During the trial the app talks to the App Store (or Google Play) only to load subscription prices. We do not know your Apple ID, name, email, or payment method.
Place search and address lookup (both modes)
- Place picker: when you search for a place or drop a pin in the Places screen, the text you typed (or the pin's coordinates) and a map area around your current position are sent to OpenStreetMap's Nominatim service (operated by the OpenStreetMap Foundation) to return nearby addresses. Nothing is sent unless you search. Nominatim's privacy policy applies to that request.
- Trip-end notification (Android): the start and end points of an auto-detected drive are passed to Android's built-in geocoder (Google Play services on most devices) to render "Origin → Destination" in the notification. The result is shown and discarded; we never store or receive it.
- Receipt scanning: uses Google ML Kit text recognition, which reads receipt photos entirely on your device. The photo is never uploaded.
Signed-in mode (required to subscribe)
To confirm your subscription and keep it working across reinstalls, we store the following on AWS infrastructure operated by us in the United States (us-east-1):
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account identifier; verification & password reset | Until account deletion |
| Cognito user ID (UUID, not your name) | Stable identity across email changes | Until account deletion |
| Subscription state (active / expired / refunded) | Entitlement check on app launch | + 7 years (tax/billing audit) |
| App Store / Google Play transaction ID | Validates that you really paid; handles refunds | + 7 years |
We do not store: GPS trip data, addresses, trip purposes, working hours, mileage history, or any of your driving behavior. Those stay on your device.
2. Subscription billing
Subscribing (iOS): the 30-day free trial runs entirely on your device — no purchase, no card, no Apple sheet. When you choose to subscribe, Apple's StoreKit sheet authenticates you using your Apple ID (Face ID / Touch ID / password) and the plan you selected ($1.99/month or $19.99/year) auto-renews until cancelled. You can cancel anytime in Settings → [your name] → Subscriptions on your iPhone. Apple manages this entire flow; we are not informed of your Apple ID and we never see your credit card or bank details.
Auto-renewal disclosure (Apple App Store rule 3.1.2(a)): subscriptions automatically renew unless you cancel at least 24 hours before the end of the current period. Your Apple ID is charged for the renewal within 24 hours of the period end. Refunds and cancellations are managed entirely through your App Store account.
3. Where your data lives
On your device
All trip data, shift data, addresses, and preferences are stored in a SQLite database inside the app's sandbox:
- iOS:
~/Library/LocalDatabase/mileshift.db - Android:
/data/data/app.mileshift.mobile/databases/mileshift.db
In your phone's own backups
If your phone's backup is on, the app's database is part of it: iCloud Backup or a Finder backup on iPhone (receipt photos included), and Android's automatic backup to your Google account on Android (database only, within Android's size limit). These backups live in your Apple or Google account; we have no access to them. Turning off your phone's backup for Mile-Shift keeps the data on the device only.
On our servers (signed-in mode only)
- DynamoDB in AWS
us-east-1— one row per user, plus billing audit history. - Cognito User Pool in AWS
us-east-1— your email + hashed password + sign-in metadata. - CloudWatch Logs — request logs (no trip data), kept for up to 90 days.
We do not use any analytics, ad networks, or tracking SDKs of our own. Third-party SDKs in the app: Google ML Kit reads receipt photos on your device; on Android, the Google Maps SDK draws maps and Google Play services provide location and activity recognition. They may send their own diagnostics to Google under Google's terms. None of them receives your trip history from us; a map loads tiles for the area it shows, which for a trip map is the area of that trip.
4. Permissions the app requests
| Permission | Why | When |
|---|---|---|
| Location (When-In-Use) | Draw your current location on the Today map; record GPS during a manually-started trip. | First time you tap Start trip. |
| Location (Always) | Detect drives automatically without you having to open the app. | Only when you toggle Auto-detect drives on in Settings. |
| Motion & Fitness (iOS) | Distinguish driving from walking/cycling so we don't record a walk as a trip. | Only when Auto-detect is on. |
| Notifications | Show a small indicator while a drive is being recorded, the running shift, job and shift reminders, and trial / billing alerts. | Only after you opt in. |
| Physical activity (Android) | Notice when you start driving so auto-detect can record the trip. | Only when Auto-detect is on. |
| Calendar | Show today's appointments and add your shifts and jobs to your calendar. | Only when you turn on calendar sync. |
| Camera and photos | Photograph or pick a receipt to scan it on your device. | Only when you add a receipt. |
Your recorded trips are never transmitted off-device. The only coordinates that leave the phone are the ones described in section 1: the search area of a place search, (Android) a drive's start and end points for the notification label, and the area of the map tiles a map loads.
5. Account deletion
You can delete your Mile-Shift account at any time from Settings → Account → Delete account. On confirmation:
- Your Cognito user record is permanently removed.
- All Mile-Shift DynamoDB rows tied to your account (subscription audit history) are deleted within 30 days.
- Trip data on your device is not affected — the app keeps working offline.
Active Apple subscriptions must be cancelled separately through Settings → Apple ID → Subscriptions, since Apple controls that billing relationship.
6. Children
Mile-Shift is not intended for anyone under 13.
7. Changes to this policy
We will surface any material change in the app before it takes effect. The version date at the top of this document is authoritative.
8. Contact
Questions about this policy: privacy@mile-shift.com