Privacy policy

This policy covers Milometry 1.1.0 and earlier versions. Where they differ, it says so. You can see which version you have in Settings > About Milometry.

The short version

• No Milometry account, no sign-up, no email address needed to use the app.
• No Milometry server. Your journeys and location history are not sent to us.
• No analytics, tracking, advertising or crash-reporting code in the app.
• Location is used to record your drives, on your phone. Apple or Google receive single map points so that places get names and maps can be drawn.
• Exports and syncing are your choice and go only where you point them: a folder on your phone, a cloud folder you pick, your own network drive, or a file you share yourself.
• This website runs no analytics and no advertising. Reading it loads nothing from anyone else except the companies that host and protect it. The contact form’s anti-spam check loads only if you press the button to start it.

Who we are

Milometry is made by Remiam Limited, a company registered in England and Wales (company number 10829191), registered office 37 Southgate Street, Winchester, Hampshire, SO23 9EH. Remiam Limited is the controller for the personal data described in this policy that reaches us: messages you send us, and the limited information the app stores and this website give us about purchases, reviews and visits. We also decide how the app uses Apple’s and Google’s map services, as described below.

You can reach us at hello@milometry.com, through the contact page, or by post at the address above.

What this policy covers

This policy applies to:

• the Milometry app for iPhone, iPad and Android, and
• the milometry.com website, including the blog and the pages the app shows from it.

It does not cover the App Store or Google Play themselves, or any service you choose to send your files to. Those are covered by their own privacy policies.

What the app keeps on your phone

Milometry keeps everything it needs in a database and a set of files in the app’s own storage on your phone. None of the following is sent to us:

• Journeys: start and end times, distance, duration, speeds, the recorded route as a series of GPS points, and the place names looked up for the start and end.
• Classification: whether a trip is business or personal, the purpose you type, and any passengers you record.
• Places: locations you name, such as home, the office or a regular client, so that trips can sort themselves.
• Vehicles: the cars you add, their registration or nickname if you enter one, their odometer readings, a photo if you add one and, on Android, the name and hardware address of a car stereo you link to a car.
• Fuel and costs: fill-ups with litres, price and odometer, plus parking, tolls and other expenses.
• Receipt photos: images you attach to an expense, copied into the app’s own storage.
• Settings: your preferences, rates, reminder settings, and the details of any sync destination you set up (for a network drive, its address and username). A network drive’s password and the key for encrypted backups are kept apart from the database, in your phone’s secure storage (see Security). In versions before 1.1.0, both were stored in the database with the other settings.
• Activity log (Android): if you allow Physical activity, the last 300 changes between driving, walking, cycling and standing still, each with a time and no location.
• Calendar match: if you turn on the calendar option, the title of an event that kept the app quiet.
• Diagnostics log: the times and distances of recent trips, departures and technical events such as export errors. It never contains locations, and it stays on your phone unless you copy it and send it to us.

On iPhone, 1.1.0 keeps the database, receipt photos, vehicle photos and the figures for the widgets in the app’s private storage, which the Files app does not show. Only the exports and backups the app writes go in the folder you can see in the Files app (On My iPhone > Milometry). In versions before 1.1.0, the database, receipt photos and vehicle photos were in that visible folder too; 1.1.0 moves them the first time it opens. On Android, all of it is in the app’s private storage, which other apps cannot read.

We have no way to read, recover, restore or delete any of it. If you lose the phone or delete the app without exporting first, that data is gone, unless your phone’s own backup kept a copy (see Deleting everything).

Permissions the app asks for

The app asks for each permission when it first needs it, and you can change any of them at any time in your phone’s settings. Location is the one the app needs to record trips; without it you can still add trips by hand. The others are optional.

• Location, while using the app: to record the route and measure the distance of a trip, to show where you are on the map, and to fill in the position of a fill-up. The route is written straight to the database on your phone.
• Location, always (in the background): only if you turn on automatic recording or the “Ask me afterwards” mode. The app notices when you leave a place you parked, so it can start and stop trips for you, and it keeps recording with the screen off. In “Ask me afterwards” mode it records the drive first and asks, once you have parked, whether to keep it; a trip you discard goes to the bin in the app. On Android this runs as a foreground service with a notification that stays visible while it is active. Turning those modes off stops it. In versions before 1.1.0, “Ask me afterwards” was called “Remind me”: it used background location in the same way, but sent a reminder as you drove off instead of recording the drive.
• Motion & Fitness on iPhone, Physical activity on Android (optional): used to tell a drive from walking or public transport. On Android the app keeps a short log on the phone of the last 300 changes (for example “walking at 08:12”), with no location. It is not used for any health or fitness purpose and is not sent to us.
• Calendar on iPhone (optional, off by default): if you turn on “Quiet during train and bus events” in Travel hours, the app reads the title, location and notes of events happening now, to spot a train or bus journey. It never writes to your calendar. The title of a matching event is kept on your phone. In 1.1.0 this option is not offered on Android. Earlier versions showed it on Android too, but Android never gave the app access to the calendar there, so it was not read.
• Nearby devices on Android (optional): used to tell which of your cars you are in, from the car stereo your phone connects to. The stereo’s name and hardware address are stored on your phone.
• Notifications: for reminders such as “you have trips to sort” and for trip status. They are scheduled and delivered on the phone itself. There is no push server, so no notification content passes through us or anyone else. In 1.1.0, Android shows the content of notifications about a trip being recorded or saved only once the phone is unlocked; the lock screen shows that there is one, not the place names. In earlier versions, Android’s own lock screen setting decided. On iPhone, whether previews appear on the lock screen is your choice in the phone’s Settings > Notifications > Show Previews.
• Photos: only when you choose a receipt or vehicle photo. The app reads the image you pick and copies it into its own storage; it does not browse your photo library.
• Face ID, Touch ID, fingerprint or passcode: only if you switch on the app lock. The check is done by your phone, which tells the app only “yes” or “no”. Your biometric data is never available to the app; it is checked by your phone’s own security hardware.
• Local network (iPhone): only if you set up syncing to a network drive on your own network, so the app can reach that drive.

When the app uses the internet

Milometry records, sorts and totals your trips without an internet connection. It contacts other services in these situations:

• Place names. To show “Bristol to Bath” rather than coordinates, the app asks your phone’s geocoding service: Apple on iPhone, Google on Android. That service receives a single map point each time: the start or end of a trip when it is saved (or later, once you are back online, which can happen in the background), your position when you log a fill-up, the pin when you save a place, and a spot you save as a station. When you search for a place in Plan, it receives the text you type. Your phone sends these requests in the usual way, with details such as your language and IP address, and Apple or Google handle them under their own privacy policies. There is no setting to turn place names off at the moment; a trip without place names is still recorded in full.
• Maps. Screens that show a map use Apple Maps on iPhone and the Google Maps SDK on Android. To draw the map, that service receives the map area on screen. Google’s SDK also sends Google its own usage and diagnostic information, under Google’s terms.
• Update check. Each time the app opens it asks the App Store (on iPhone) or Google Play (on Android) whether a newer version is available.
• Review prompt. Now and then the app asks your store to show its standard “rate this app” prompt. The store handles it; we only see reviews people choose to post.
• Our pages inside the app. The privacy, terms and contact pages open from milometry.com inside the app, so The website below applies to them. On the contact page, the anti-spam check loads only if you press the button to start it. In 1.1.0 the app shows only milometry.com pages this way, and keeps no cookies or site storage from them once you leave the page. In earlier versions, cookies and site storage from these pages could stay inside the app.
• Vehicle registration checks. If you tap a registration check on a vehicle, the app opens the official checking website (for example the GOV.UK MOT history service) in your phone’s browser. That website receives the registration you entered, and your browser’s own settings apply to it. In versions before 1.1.0, the website opened inside the app and could set its own cookies there.
• A folder you choose, including Google Drive or iCloud Drive. On Android you can pick a folder in any storage provider on your phone, including Google Drive. On iPhone you pick a folder in the Files app, such as iCloud Drive or Google Drive. The app uses your phone’s own folder picker: Milometry does not sign in to Google or any other provider, and holds no token or password for them. Once you pick a folder, the app can read, create and replace files in that folder until you remove it in the app or the provider withdraws access. When syncing is on, the app writes its exports and a backup file there. On Android it also copies your receipt photos there. Your provider then stores and syncs them like any other file.
• Your own network drive. If you set up a WebDAV or NAS destination, the app uploads export files directly to the address you entered, using the username and password you entered. Those details are stored on your phone and sent only to that address. In 1.1.0 the app refuses an address with a username or password written into it, and does not follow a redirect: if the server points somewhere else, the app stops and asks for the final address. It warns you before you use an http:// address, and asks you to confirm one that is not on your local network. Plain http:// still works, for example on your home network, but the files and the password travel unencrypted, so use https:// where you can. Earlier versions did not make these checks and followed redirects.
• Files you share. When you share a CSV, a PDF, a backup or an image, it goes wherever you send it.

In each case the connection is between your phone and that service. No copy comes to us.

What the app does not do

• It does not create an account or ask for your name, email or phone number.
• It does not send your journeys, routes, receipts or figures to us, or to anyone else unless you export or sync them. The single map points described above are the exception.
• It contains no analytics, attribution, advertising or session-recording code.
• It does not collect an advertising ID, and does not track you across other apps or websites.
• It does not sell, rent or share personal data for advertising.
• It does not read your contacts, messages, call history or health data.

The website

milometry.com is a set of static files hosted by DigitalOcean, with the files stored in the Netherlands (Amsterdam), and delivered and protected by Cloudflare’s network. To send you a page, their servers receive your IP address, your browser type, the page you asked for and the time. They keep this in technical and security logs under their own retention periods. We do not have routine access to those logs and never use them to build a profile of anyone.

The site runs no analytics and no advertising. Its fonts, icons, images and video all come from milometry.com itself, so reading the site loads nothing from anyone else except its host. The anti-spam check on the contact form is the one exception, and only if you start it (see If you contact us).

Cookies and browser storage. Cloudflare sets one cookie, __cf_bm, which lasts 30 minutes and helps tell people from bots. It is strictly necessary to keep the site available. The site also remembers two choices in your browser’s local storage: the language you read the site in (ms-language) and, when you pick one or dismiss the prompt that suggests one, the country whose mileage rules you want to see (ms-locale). Pages opened from inside the app remember that for the rest of the session (ms-embed, in session storage). None of these are sent to us or anyone else. If you would rather they were not kept, clear this site’s data in your browser; the site works the same without them, it just asks again.

The App Store and Google Play buttons are images stored on this site. Pressing one takes you to Apple or Google, whose own privacy policies then apply. On iPhone and iPad, Safari may show its own banner for the app, which Safari fetches from Apple.

If you contact us

When you email hello@milometry.com we receive your email address, what you write and anything you attach. Our email is provided by Zoho, which stores it in its United States data centre. We use it to answer you and, for bug reports, to fix the problem. Please do not send exports or receipts unless we ask for them.

If you copy the app’s diagnostics log and send it to us, we receive the times and distances of your recent trips and the app’s technical events. It never contains locations.

The contact form sends what you type (the category, your name if you give it, your email address, your message, and the device, app version or store details if you fill them in) to Web3Forms, which delivers it to our inbox as an email. Web3Forms is run from India and acts as our processor under its data processing agreement. It stores the message on Amazon Web Services and uses Cloudflare and Hetzner to run its service, and it checks your IP address and email address with two spam filters, CleanTalk and Akismet, both in the United States. It records your IP address and the time you sent the form, and keeps its copy for up to three years. Nothing is sent while you are typing, only when you press Send.

Because bots target the form, it uses a check from hCaptcha, run by Intuition Machines, Inc. in the United States. The check does not load with the page: it loads only when you press the button in the form to start it. Once loaded, it receives your IP address, details of your browser and device, and how you move, tap and type while you use the form, so it can tell whether you are a person. It is not sent your message. hCaptcha may set its own cookies, and it uses this information under its own privacy policy at hcaptcha.com/privacy. Our legal basis is legitimate interests: without it, the form fills with spam and we cannot find real messages. If you would rather not use it, email us instead and none of this runs.

App Store and Google Play

Apple and Google sell the app on our behalf and handle payment, refunds and tax as their own business, under their own privacy policies. We never see your card details. Their consoles show us sales totals and reviews and, if you have chosen in your phone’s settings to share diagnostics with app developers, crash reports and usage figures. We use these to keep our accounts, reply to reviews and fix problems.

Legal bases for processing

The app keeps your journeys, vehicles, expenses and receipts in its own storage on your phone. We cannot see, copy, recover or delete them, and nothing in the app sends them to us. What the app does send by itself is a single map point, to your phone’s map service (Apple or Google), so that trips, fill-ups and places get names, and the map area you are looking at, so that the map can be drawn. We designed the app to do that so you see readable journeys, which is a legitimate interest (Article 6(1)(f) of the UK GDPR).

For the personal data that reaches us, our legal bases are:

• Answering emails and form messages, including any diagnostics you send: legitimate interests (Article 6(1)(f)), to help people who contact us.
• Handling data protection requests and complaints: legal obligation (Article 6(1)(c)).
• Hosting, security and the anti-spam check: legitimate interests, to keep the site and the form working and safe.
• Sales records: legal obligation, to keep tax records.
• Reviews and crash reports from the stores: legitimate interests, to answer reviews and fix problems.
• Place names and maps in the app: legitimate interests, as described above.

Your right to object. Where we rely on legitimate interests, you have the right to object. Email us and we will stop unless we have a compelling reason to continue.

The permission prompts your phone shows (location, notifications, photos and the rest) are your phone’s controls over what the app can use on the device. You can change them at any time in your phone’s settings.

How long anything is kept

• On your phone: until you delete it. See Deleting everything.
• Emails and form messages: while we deal with your question and for up to 24 months afterwards, then deleted. Deleted email is cleared from our provider’s systems within about two months. Web3Forms keeps its own copy of a form message for up to three years.
• Records of privacy requests and complaints: three years after we close them.
• Sales records from Apple and Google: as long as UK tax law requires.
• Hosting and security logs: held by DigitalOcean and Cloudflare for their own periods. The Cloudflare cookie lasts 30 minutes.

Security

Milometry’s data is kept in the app’s own storage on your phone, protected by your phone’s encryption when you have a passcode set. There is no copy on a server of ours.

On iPhone, the app’s folder is visible in the Files app (On My iPhone > Milometry), so that you can reach your exports. In 1.1.0 that folder holds only the exports and backups the app writes there; anyone who can unlock your phone can open those. In versions before 1.1.0, it also held the app’s database, receipt photos and vehicle photos, so anyone who could unlock your phone could copy them from the Files app, or with a computer the phone trusts, without passing the app lock.

Passwords and keys. In 1.1.0, a network drive (WebDAV) password and the key that encrypts your backups are kept in your phone’s secure storage: the keychain on iPhone, and encrypted with the Android Keystore on Android. They are kept for this phone only and are left out of phone backups, so they do not move to a new phone. After a move, enter the network drive password again, and if you set a backup passphrase, enter that again too: until you do, the app holds its backups back rather than write them unencrypted. The passphrase itself is never stored. In versions before 1.1.0, the password and the backup key were stored in the app’s database, which on iPhone was in the visible folder and on Android was part of Google’s automatic backup.

App lock. The app lock asks for Face ID, Touch ID, a fingerprint or your phone’s passcode before the app’s screens are shown. In 1.1.0 it covers the app from the moment it opens and, on iPhone, in the app switcher, and if the check fails the app stays locked and offers “Try again”. If your phone has no screen lock at all, there is nothing to check against and the app opens. The lock hides the app; it does not encrypt your data, and widgets, notifications, the Live Activity and CarPlay can still show trip details. In versions before 1.1.0, the lock did not cover the app switcher, and opened the app if the check itself went wrong.

Backup files. If you set a passphrase for backups, the backup file is encrypted with it. Without one, the backup file is readable by anyone who has it. The backup file leaves out the saved passwords and keys. In 1.1.0 it also leaves out the network drive’s address and username, the title of a calendar event that kept the app quiet, and the Android activity log, so after restoring a backup you set up the network drive again. In earlier versions those three were included, and so was a password if it had been typed into the address itself.

Phone backups. On Android, Google’s automatic backup includes the app’s database and photos, so your trips, settings and diagnostics log can come back when you set up a new phone. In 1.1.0 it leaves out the saved passwords and keys, and the settings of the background drive watcher. On iPhone, an iCloud or computer backup includes the app’s data as iOS decides; the saved passwords and keys do not move to a different phone.

So the security of your journey history is the security of your phone. Use a passcode, keep the operating system up to date, and export a backup somewhere you trust if the history matters to you.

Transfers outside the UK

We never receive your app data, so we never transfer it. If you send exports to Google Drive, iCloud or another service, that is your choice of provider under your agreement with them, not a transfer by us.

Some of the services we use are outside the UK:

• Email (Zoho): United States, under the transfer terms in Zoho’s data processing agreement.
• Contact form (Web3Forms): India, with storage and spam filtering in the United States and the EU, under the EU standard contractual clauses with the UK Addendum in Web3Forms’ data processing agreement.
• Anti-spam check (hCaptcha): United States, under the UK Extension to the EU-US Data Privacy Framework.
• Website hosting (DigitalOcean, Cloudflare): files stored in the Netherlands, which the UK recognises as adequate; both companies are American and rely on the UK Extension to the EU-US Data Privacy Framework.

Email us for a copy of the relevant safeguard.

Your rights

Under the UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. For anything held on your phone you can do all of this yourself, straight away: everything is visible in the app, editable in the app, exportable as CSV or PDF, and deletable in the app. We cannot do it for you, because we do not have it.

For messages you have sent us, and anything else we hold, email us or use the contact form and choose “Privacy or data request”. We answer within one month. If a request is complex we may take up to two more months, and we will tell you if so. We may ask you to confirm you are the person who sent the original message.

Children

Milometry is a tool for drivers and is not aimed at children. We do not knowingly collect personal data from children, and the app does not ask for an age or an identity.

Deleting everything

In the app, Settings > Reset & start again deletes the trips, routes, places, vehicles, fill-ups, expenses, receipts, vehicle photos and settings held by the app.

In 1.1.0, Reset also stops any recording and background watching, compacts the database so that deleted records do not linger in the file, and deletes:

• the diagnostics log;
• the export and backup files the app has written to its own folder (on iPhone, the files in On My iPhone > Milometry whose names start with “Milometry”, such as “Milometry Backup.json”). Files you put there yourself are left alone;
• temporary copies of exports, PDFs and share images;
• the network drive password and backup key saved on the phone;
• on iPhone, the link to the sync folder you picked;
• notifications already delivered.

On Android, Reset makes the app forget the sync folder you picked, but Android keeps the app’s permission for that folder until you delete the app. Cookies that earlier versions let websites store inside the app are not cleared by Reset.

In versions before 1.1.0, Reset did not delete the diagnostics log, the export and backup files the app had written to its own folder, temporary copies of exports, notifications already delivered or, on iPhone, the link to the sync folder. To remove the files, delete them in the Files app, or delete the app.

Deleting the app removes its data from the phone. On iPhone, though, the keychain can keep the saved network drive password and backup key after the app is deleted, so use Reset first if you want those gone too. On Android, Google’s automatic backup may keep a copy of the app’s data and restore it if you install the app again, and an iPhone backup in iCloud or on a computer may contain it too. Neither Reset nor deleting the app can remove copies in your phone’s backups, in folders or drives you synced to, or in files you shared: delete those where they are. We cannot delete any of it for you, because we never had it.

Changes to this policy

If we change how the app or the site handles data, we will update this page and change the date at the top. Material changes will also be noted in the app’s release notes. Earlier versions of this policy are listed at the bottom of this page, with the dates they applied.

Contact and complaints

Email hello@milometry.com with any privacy question and we will answer it properly. By post: Remiam Limited, 37 Southgate Street, Winchester, Hampshire, SO23 9EH.

If you are unhappy with how we have handled your data, tell us first: use the contact form and choose “Privacy or data request”, or email us. We will acknowledge your complaint within 30 days and tell you what we have done about it.

You can also complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

See also our terms and conditions.