Privacy Policy

MapQueue ("we", "our", "the app") is a navigation application that provides turn-by-turn directions, multi-stop route planning, and collaborative driving features. This policy explains what data we collect, how we use it, and your rights.

Account Information: When you create an account, we collect your email address, display name, and profile picture (optional). If you sign in with Apple or Google, we receive your email address and name from that provider; we never receive your password. Business Profile (optional): if you fill in a business name, address, phone, or email for your mileage reports, we store them with your account so they can be printed on the documents you export. Location Data: We collect your device's location to provide navigation, display your position on the map, and share your location with invited co-drivers (the "Shotgun" feature, formerly called "Roadies") during active drive sessions. Location data is collected in both the foreground and background while navigation is active. Device Information: We collect your device's push notification token to deliver notifications such as drive invites and friend requests. Trip & Mileage Records: We store records of your drives — stop addresses, distances, durations, completion status, and optional business/personal tags — to power your trip history and mileage reports. Earnings Data (where the feature is available): if you enter what a route paid, we store that amount with the trip record. Entering earnings is always optional. Photos, Signatures, and Receipts: If you use Proof of Delivery, photos and signatures you capture are uploaded to our media storage provider (Cloudinary) and linked to the trip and stop. If you attach a receipt to an expense, that image is stored the same way. Camera and photo library access are requested only when you use these features. Voice Search: if you search for an address by voice, the audio is processed by your device's speech-recognition service (Apple or Google, depending on your phone) to turn it into text. We receive only the resulting text, never the recording. Stop Notes and Hazard Reports: notes you attach to a stop are stored with that trip. If you report a road hazard, we store the hazard type, location, and your user ID; other drivers see the hazard, never who reported it. Screenshot Import: If you import stops from a screenshot, the image you select is sent to our servers solely to extract address text and is not retained after processing. Photo library access is requested only when you use this feature. Hazard Reports: If you report a road hazard, we store the hazard type and location to display it to nearby drivers. Diagnostics: crash reports and error logs go to Sentry, tagged with your user ID so we can trace a crash to an account if you report it. Emails, phone numbers, tokens, and coordinates are stripped before they leave the device. Product Analytics: we send usage events (screens used, navigation started, reroutes, subscription screen views) to PostHog, keyed by your user ID. We do not send your email address, name, or precise location to PostHog. Guest use is recorded against a random device identifier.

For users in the European Union and other jurisdictions with GDPR or similar data protection laws, we process personal data on the following legal bases: Consent: Location data, device identifiers, and personalized advertising require your explicit consent, which you can withdraw at any time through device settings. Legitimate Interest: We process anonymized usage data and crash reports to improve app stability and security. Contractual Necessity: We process account information (email, name) to provide the service and maintain your account. Right to Withdraw Consent: You can withdraw consent for location tracking, personalized ads, and push notifications at any time by: - Disabling location permissions in device settings - Changing your advertising choices in the app under Settings > Ad Privacy Options (shown where consent is required), or opting out of personalized ads in device settings - Disabling push notifications in app settings Data Processing Agreement: Organizations processing data on behalf of users can request a Data Processing Agreement (DPA) by contacting privacy@mapqueue.com.

- Provide turn-by-turn navigation and route calculation - Share your real-time location with accepted friends during drive sessions - Send push notifications for drive invites and friend requests - Cache route data locally on your device for offline navigation - Monitor app stability through anonymized crash reports - Authenticate your account and maintain your session

MapQueue requests both foreground and background location permissions. Background location is used only during active navigation so directions continue when you switch apps. Location sharing with Shotgun co-drivers only occurs during active drive sessions that you explicitly start. Your location is never shared without your action. You can revoke location permissions at any time through your device settings. The app will continue to function with limited features.

We work with trusted partners to provide and improve MapQueue: - Supabase (AWS, United States): authentication and database hosting - Mapbox: map tiles, routing, and geocoding (receives the coordinates being routed or searched, not your identity; the map SDK's own usage telemetry is switched off) - HERE Technologies and OpenStreetMap services: backup routing and road data such as speed limits (coordinates only) - Expo: push notification delivery (a notification's text, such as a co-driver's name or destination, passes through Expo, Apple, and Google to reach the phone) - Sentry: crash reporting and error monitoring - PostHog: product analytics, keyed by user ID - Cloudinary: storage of profile pictures, delivery photos, signatures, and receipt images - Google AdMob: display of advertisements, personalized where you have consented - RevenueCat: subscription management - Apple and Google speech services: voice-search transcription on your device's platform Each service operates under its own privacy policy. We only share data with these services as necessary to provide app functionality.

The MapQueue website (mapqueue.com) sets no cookies and loads no tracking pixels, analytics, or advertising scripts. Nothing is stored in your browser, no profile of your visit is built, and your browser makes no requests to third parties while reading these pages — fonts and images are served from our own domain. That is why you see no cookie banner here: there is nothing to consent to and nothing to opt out of. Our hosting provider (Vercel) keeps standard server request logs, including IP address, browser type, and the page requested, to serve the site and protect it from abuse. Those logs are not used to track, profile, or advertise to you. This section describes the website only. Data collected inside the MapQueue app is described elsewhere in this policy, and advertising shown inside the app is covered under "Advertising & Monetization" above.

Your account data is stored securely using Supabase (hosted on AWS). Authentication tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore). Route data and preferences are cached locally using AsyncStorage. If you use MapQueue without an account, your drives, searches, and preferences are stored only on your device and are not sent to our servers. If you later create an account, completed drives and recent destinations saved on the device are copied into that account so your history carries over. You can clear this data at any time by deleting the app. We do not sell, rent, or share your personal data with third parties for marketing purposes.

Active Drive Data Your live position and destination are cleared from our servers when you end a drive. Your trip record — stop addresses and their coordinates, distance, duration, and completion — is kept in your trip history so your mileage log works. You can delete individual trips or groups of trips in the app at any time. Account Data Retention - Profile information (name, email, photo) retained while account is active - Saved locations (home, work, favorites) retained while account is active - Settings and preferences retained while account is active Account Deletion Settings > Delete Account deletes your account immediately and permanently. There is no grace period and it cannot be undone. Deleted with it: profile information, trip history and mileage records, delivery photos, signatures and receipt images (including the copies held by our media provider), saved locations and recent searches, hazard reports, preferences, co-driver connections, drive sessions, and push tokens. If you cannot access the app, email privacy@mapqueue.com and we will delete the account for you within one month. Hazard Reports Hazard reports you submit are shown to nearby drivers for a limited time and then expire. Your user ID is stored with the report so we can act on abuse, but it is never shown to other drivers. Your reports are deleted when your account is deleted. Subscription Data RevenueCat handles payment information (not stored by MapQueue). Subscription status is retained while active. Cancellation processed through your device's app store (Apple or Google). Upon cancellation, ad-free status ends immediately. Cookie Deletion No persistent cookies on MapQueue app. On website, cookies deleted via browser settings or privacy mode.

In the event of a confirmed data breach or security incident affecting personal data, we will: - Assess the scope and nature of the breach - Notify affected users promptly (within 72 hours where required by law) - Provide information about the breach, its consequences, and mitigation steps - Report to relevant authorities as required by law (GDPR, CCPA, etc.) Users are advised to monitor their accounts for suspicious activity and contact us immediately if they suspect unauthorized access.

MapQueue uses Supabase (AWS) which may involve transferring personal data from the EU to the United States and other countries. We implement safeguards to protect data: - Standard Contractual Clauses (SCCs) with data processors - EU adequacy decisions where applicable - Appropriate technical and organizational measures - Your explicit consent for data transfers where required Data transfers comply with GDPR Article 46 and GDPR Chapter V requirements. The same safeguards apply to transfers from the United Kingdom under the UK GDPR, from Australia under Australian Privacy Principle 8, and from New Zealand under the Privacy Act 2020. Country-specific details are set out in the sections below.

For residents of California, you have the following rights under the California Consumer Privacy Act (CCPA): Right to Know: You have the right to request what personal information we collect, use, and disclose. Right to Delete: You have the right to request deletion of personal information collected from you, subject to certain exceptions. Right to Correct: You have the right to correct inaccurate personal information. Right to Opt-Out: You have the right to opt-out of the sale or sharing of your personal information. We do not sell personal information to third parties for marketing purposes. Right to Limit Use: You have the right to limit our use of sensitive personal information (location data, financial information) to necessary business purposes. No Discrimination: We will not discriminate against you for exercising your CCPA rights. You will not face discriminatory pricing, service, or quality differences. Sale of Minors' Data: For California residents under 16 years old, we require opt-in consent before selling or sharing their data. For minors under 13, we require parental consent. Verification: We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf. Response Timeline: We will respond to verified requests within 45 days (or up to 90 days if complex). We will not charge a fee unless requests are manifestly unfounded or excessive. California "Shine the Light": We do not share personal information with third parties for their own direct marketing without your consent. How to Submit a CCPA Request: - Email: privacy@mapqueue.com - Include: Your full name, email, specific request, and any relevant information - Include the statement: "California Resident - CCPA Request" For more information about CCPA rights, visit the California Attorney General's website.

For users in Canada, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Knowledge & Consent: We collect, use, and disclose personal information only for the purposes described in this policy, with your knowledge and consent. Continuing to use MapQueue after reviewing this policy constitutes consent to these practices. Right to Access: You may request access to the personal information we hold about you and information about how it has been used and disclosed. Right to Correction: You may request correction of inaccurate or incomplete personal information. Profile details can be edited directly in the app. Withdrawal of Consent: You may withdraw consent to our collection and use of your personal information at any time, subject to legal or contractual restrictions, by adjusting app permissions (such as location access) or deleting your account. Deletion: You can delete your account and associated personal information from Settings > Delete Account, following the same process and timeline described in Data Retention & Deletion above. Cross-Border Transfers: Your personal information is processed and stored on servers that may be located outside Canada (including the United States). It is protected by the safeguards described in this policy wherever it is processed. Challenging Compliance: If you have concerns about our handling of your personal information, contact us first at the email below. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

For users in the United Kingdom, we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. International Transfer: MapQueue stores and processes your data on servers in the United States (Supabase). This is an international transfer under UK GDPR. It is protected by the safeguards described in this policy, and our processors provide appropriate contractual protections for UK data. Your Rights: You have the rights described in "Your Rights & User Controls" below, including access, correction, erasure, restriction, portability, and objection. Most can be exercised directly in the app (profile editing, Settings > Delete Account). Complaints: Contact us first at the email below. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

For users in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Overseas Disclosure: Your personal information is stored and processed on servers in the United States (Supabase). By using MapQueue you consent to this overseas disclosure, and it is protected by the safeguards described in this policy. Access & Correction: You may request access to, or correction of, the personal information we hold about you. Profile details can be edited directly in the app; you can delete your account from Settings > Delete Account. Complaints: Contact us first at the email below. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

For users in New Zealand, we handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles. Disclosure Outside New Zealand: Your personal information is stored and processed on servers in the United States (Supabase) and is protected by the safeguards described in this policy. Access & Correction: You may request access to, or correction of, the personal information we hold about you. Profile details can be edited directly in the app; you can delete your account from Settings > Delete Account. Complaints: Contact us first at the email below. You may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

MapQueue is a navigation app built for licensed drivers. It is rated 16+ in the Apple App Store and Google Play, it is not directed at children, and it is not intended for anyone under 16. We do not knowingly collect personal data from anyone under 16. Where the law where you live sets a different age of consent for online services, we do not knowingly collect personal data from anyone below that age either. If you believe a child has created an account or provided us with personal data, contact us at privacy@mapqueue.com and we will delete the account and its data. Advertising: we do not tag our advertising for child-directed treatment and we do not knowingly build advertising profiles for children. If we learn that a user is a child, we stop serving personalized advertising to that account.

You have the right to: - Access the personal data we hold about you - Request correction of inaccurate data - Request deletion of your account and data - Withdraw consent for location sharing at any time - Opt out of push notifications through device settings - Change or withdraw your advertising consent in the app under Settings > Ad Privacy Options, or opt out of personalized ads in device settings - Disable location tracking by toggling location permissions in app settings - Manage or cancel subscriptions through app settings or device app store - Request data access or deletion by emailing privacy@mapqueue.com for GDPR/CCPA requests

We update this policy when our practices change. The date at the top always shows the current version. For a change that affects how we use your personal data, we notify you in the app or by email before it takes effect. Continued use of MapQueue after notice means you accept the updated policy. Earlier versions are available on request.

For questions about this privacy policy or to exercise your data rights, contact us at privacy@mapqueue.com.