Privacy Policy
Last updated: 2026-09-15
Mile-Shift is a local-first mileage and shift-tracking app. Your trip and shift data lives on your device and is never sent to a server operated by us. This document describes exactly what data the app handles, where it lives, and every network connection the app makes.
TL;DR
- Your trips, shifts and mileage history stay on your device. We do not have a server-side copy of where you have been.
- The app starts with a 30-day free trial — no account and no payment required. To keep using it after the trial you subscribe ($1.99/month or $19.99/year) via Apple's standard in-app purchase sheet. Subscribing requires a Mile-Shift account so we can confirm the purchase belongs to you; Apple — not us — manages the payment and your Apple ID.
- Three things do leave your device, and only these: the subscription receipt we verify for signed-in subscribers; a place search you type (plus the map area around you, so results are nearby) sent to OpenStreetMap's Nominatim service; and, on Android, the start and end points of a drive handed to Android's own geocoder to name them in the trip-end notification. Details in section 1.
- No ad networks, no analytics SDKs, no tracking.
1. What we collect — by mode
Trial mode (default — no Mile-Shift account)
Nothing about you reaches our servers. During the trial the app talks to the App Store (or Google Play) only to load subscription prices. We do not know your Apple ID, name, email, or payment method.
Place search and address lookup (both modes)
- Place picker: when you search for a place or drop a pin in the Places screen, the text you typed (or the pin's coordinates) and a map area around your current position are sent to OpenStreetMap's Nominatim service (operated by the OpenStreetMap Foundation) to return nearby addresses. Nothing is sent unless you search. Nominatim's privacy policy applies to that request.
- Trip-end notification (Android): the start and end points of an auto-detected drive are passed to Android's built-in geocoder (Google Play services on most devices) to render "Origin → Destination" in the notification. The result is shown and discarded; we never store or receive it.
- Receipt scanning: uses Google ML Kit text recognition, which reads receipt photos entirely on your device. The photo is never uploaded.
Signed-in mode (required to subscribe)
To confirm your subscription and keep it working across reinstalls, we store the following on AWS infrastructure operated by us in the United States (us-east-1):
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account identifier; verification & password reset | Until account deletion |
| Cognito user ID (UUID, not your name) | Stable identity across email changes | Until account deletion |
| Subscription state (active / expired / refunded) | Entitlement check on app launch | + 7 years (tax/billing audit) |
| App Store / Google Play transaction ID | Validates that you really paid; handles refunds | + 7 years |
We do not store: GPS trip data, addresses, trip purposes, working hours, mileage history, or any of your driving behavior. Those stay on your device.
2. Subscription billing
Subscribing (iOS): the 30-day free trial runs entirely on your device — no purchase, no card, no Apple sheet. When you choose to subscribe, Apple's StoreKit sheet authenticates you using your Apple ID (Face ID / Touch ID / password) and the plan you selected ($1.99/month or $19.99/year) auto-renews until cancelled. You can cancel anytime in Settings → [your name] → Subscriptions on your iPhone. Apple manages this entire flow; we are not informed of your Apple ID and we never see your credit card or bank details.
Auto-renewal disclosure (Apple App Store rule 3.1.2(a)): subscriptions automatically renew unless you cancel at least 24 hours before the end of the current period. Your Apple ID is charged for the renewal within 24 hours of the period end. Refunds and cancellations are managed entirely through your App Store account.
3. Where your data lives
On your device
All trip data, shift data, addresses, and preferences are stored in a SQLite database inside the app's sandbox:
- iOS:
~/Library/LocalDatabase/mileshift.db - Android:
/data/data/app.mileshift.mobile/databases/mileshift.db
On our servers (signed-in mode only)
- DynamoDB in AWS
us-east-1— one row per user, plus billing audit history. - Cognito User Pool in AWS
us-east-1— your email + hashed password + sign-in metadata. - CloudWatch Logs — request logs (no trip data), kept for up to 90 days.
We do not use any analytics, ad networks, or tracking SDKs. The ML Kit library used for on-device receipt scanning is the only third-party SDK in the app, and it does not receive your location or trips.
4. Permissions the app requests
| Permission | Why | When |
|---|---|---|
| Location (When-In-Use) | Draw your current location on the Today map; record GPS during a manually-started trip. | First time you tap Start trip. |
| Location (Always) | Detect drives automatically without you having to open the app. | Only when you toggle Auto-detect drives on in Settings. |
| Motion & Fitness (iOS) | Distinguish driving from walking/cycling so we don't record a walk as a trip. | Only when Auto-detect is on. |
| Notifications | Show a small indicator while a drive is being recorded, and trial / billing alerts. | Only after you opt in. |
Your recorded trips are never transmitted off-device. The only coordinates that leave the phone are the ones described in section 1: the search area of a place search, and (Android) a drive's start and end points for the notification label.
5. Account deletion
You can delete your Mile-Shift account at any time from Settings → Account → Delete account. On confirmation:
- Your Cognito user record is permanently removed.
- All Mile-Shift DynamoDB rows tied to your account (subscription audit history) are deleted within 30 days.
- Trip data on your device is not affected — the app keeps working offline.
Active Apple subscriptions must be cancelled separately through Settings → Apple ID → Subscriptions, since Apple controls that billing relationship.
6. Children
Mile-Shift is not intended for anyone under 13.
7. Changes to this policy
We will surface any material change in the app before it takes effect. The version date at the top of this document is authoritative.
8. Contact
Questions about this policy: privacy@mile-shift.com