Privacy Policy

Last Updated: August 28, 2026

This Privacy Policy (herein referred to as the “Policy”) explains how Highway Miles LLC (herein referred to as the “Company,” “we,” “us,” or “our”) collects, uses, shares, and otherwise processes Personal Data relating to individuals who access or use the Services (herein referred to as “Users”). This Policy also explains the distinction between account-linked product analytics and separate navigation diagnostics used to investigate routing and navigation problems.

1. DEFINITIONS.

(a) “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing Personal Data.

(b) “Personal Data” means information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, including by reference to a name, identification number, location data, online identifier, account information, or one or more factors specific to that person’s identity. Precise location and detailed route history may constitute Personal Data even when direct account identifiers are not included.

(c) “Service(s)” means the Company’s mobile application, website, routing and navigation features, alerts, route sharing features, and any related products, services, content, or features provided by the Company.

(d) “User” means any natural or legal person who accesses or uses the Services, whether or not that person has an active paid subscription.

(e) “Subscriber” means a User who has an active paid subscription to the Services.

(f) “Navigation Diagnostics” means technical telemetry collected for engineering purposes to investigate routing, rerouting, snapping, missed-turn, route-deviation, traffic-refresh, restriction, performance, and similar navigation problems.

2. DATA COLLECTION.

The Company may collect Personal Data that Users provide directly, Personal Data collected automatically through the Services, and Personal Data received from service providers, app stores, payment processors, advertising providers, and other third parties involved in providing the Services. The categories collected depend on the features a User uses.

(a) Account and contact information. This may include a User’s name, email address, phone number, account or user identifier, authentication information, account status, and information needed to provide account-related communications and support.

(b) Subscription and transaction information. The Company may receive transaction identifiers, subscription entitlement and status, renewal or expiration information, billing provider, and other limited purchase-related information from Apple, Google, or related service providers. The Company does not receive or store full payment card numbers or complete payment-method details from App Store or Google Play purchases. Subscription entitlement or status may be associated with a Highway Miles account when necessary to provide ad-free access or other subscription functionality. Aggregate revenue or store reporting data may also be analyzed without being associated with a particular Highway Miles User.

(c) Location and navigation information. To provide truck routing and navigation, the Services may process precise device location, route origins and destinations, stops, route geometry, current route position, direction of travel, speed, heading, distance from route, traffic information, routing preferences, truck-profile parameters, route restrictions, reroutes, missed turns, route deviations, and related navigation information.

Active navigation while minimized. During a User-initiated active navigation session, Highway Miles may continue processing precise location when the application is minimized, another application is visible, or Highway Miles is otherwise not displayed in the foreground so the Services can continue turn-by-turn navigation, route progress, voice guidance, off-route detection, rerouting, ETA calculation, route-sharing progress where enabled by the User, and related navigation functions. On Android, Highway Miles uses a location foreground service for this active-navigation behavior and does not request the Android ACCESS_BACKGROUND_LOCATION permission for that purpose. Android may display an ongoing system notification while the location foreground service is active. On iOS, Highway Miles uses the operating system's location background mode and Core Location capabilities to continue a User-requested active navigation session while the application is in the background or minimized, subject to the User's device permissions and operating-system controls. This background or minimized-location processing is tied to User-requested navigation or route-sharing functionality and is not used solely to build advertising profiles or for unrelated tracking.

(d) Route sharing information. When a User deliberately starts a route-sharing feature, the Company may process the location, route, share-session information, and contact or identifying information needed to provide that feature. A recipient who has the private sharing link may receive the information made available through the share. Route-sharing data is separate from the Navigation Diagnostics analytics stream described below.

(e) Product and usage analytics. The Company may collect account and product activity such as sign-in or signup activity, subscription or entitlement status, feature usage, route counts, aggregate route distance or duration, app version and build, device platform, application performance, advertising interactions, search result counts, error categories, and similar operational metrics. Product analytics may be linked to a User’s Highway Miles account or analytics profile.

(f) Navigation Diagnostics. For engineering diagnosis, the Company may collect precise technical navigation telemetry including precise GPS coordinates, route geometry, route position, speed, heading, distance from route, reroute and missed-turn details, traffic information, routing parameters, relevant truck-profile parameters, API response times, application version and build, and navigation or routing errors. The handling of this data is described in Section 5.

(g) Support and User-submitted content. The Company may collect information submitted through customer support, feedback, driver reports, map or point-of-interest correction controls, and similar features.

(h) Device, advertising, and diagnostic information. Depending on the platform, device settings, consent choices, and third-party SDKs in use, the Services or third-party providers may process IP address, device or advertising identifiers, application and device information, operating system information, crash information, performance information, security or fraud-prevention signals, and application interactions.

(i) Search and geocoding information. When a User chooses to search for a destination, business, point of interest, address, or other place, the Services may process and transmit the search query, search location or proximity, selected result, and related request information to the Company or to search and geocoding providers as necessary to return results or create a route. The Company does not intentionally use literal search queries for account-linked PostHog product analytics or provide literal search queries to advertising providers for targeted advertising.

(j) Truck and commercial-vehicle profile information. The Company may collect and maintain vehicle and routing parameters selected or entered by a User, such as vehicle height, weight, length, axle information, trailer or combination characteristics, hazardous-material settings, cargo-related restrictions, toll or ferry preferences, route-avoidance preferences, and similar parameters used for commercial-truck routing. Truck-profile information may be associated with a Highway Miles account so it can be used during future routes. Relevant truck-profile parameters may also be included in the separate Navigation Diagnostics stream when reasonably necessary to determine why a route was generated or why a navigation event occurred; when included there, they are subject to the identity-separation safeguards described in Section 5.

3. PROCESSING OF PERSONAL DATA.

(a) The Company processes Personal Data to create, manage, secure, and maintain User accounts; provide routing, navigation, search, alerts, traffic information, route sharing, and other Services; identify and authenticate Users; determine subscription and advertising eligibility; process and manage subscriptions; provide customer support and service-related communications; process User-submitted feedback and corrections; display, deliver, measure, and improve advertising for Users who do not have an active ad-free subscription; analyze product usage and operational costs; diagnose routing and navigation problems; improve routing, rerouting, snapping, missed-turn detection, traffic handling, restrictions, and application performance; prevent fraud, abuse, and security incidents; improve and develop the Services; and comply with applicable legal, regulatory, and contractual obligations.

(b) The Company will generally process Personal Data where the processing is necessary to perform a contract with the User, where the processing is in the Company’s legitimate interests and is not overridden by the User’s data protection interests or fundamental rights and freedoms, where the Company has the User’s consent, or where the Company has a legal obligation to process the Personal Data.

(c) If the Company processes Personal Data based on the User’s consent, the User may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred before consent was withdrawn.

4. SERVICE PROVIDERS AND SHARING OF PERSONAL DATA.

(a) The Company may provide Personal Data to service providers and vendors as reasonably necessary to provide, operate, secure, maintain, monetize, and improve the Services, including providers of authentication, routing, maps, geocoding, traffic information, hosting, infrastructure, payment and subscription processing, advertising, analytics, customer support, security, and related business operations. The Company requires service providers to process information for the services they provide, subject to their applicable terms, privacy policies, and contractual obligations.

(b) The Company currently uses WorkOS to support account registration and authentication.

(c) The Company currently uses TomTom for routing, navigation-related routing services, traffic information, and certain geocoding or search functions; Mapbox for map display and related map services; and Stadia Maps for certain geocoding or search functions. These providers may receive location, route, search, device, or request information that is reasonably necessary to return the service requested by the User. The particular providers used for a request may change as the Services evolve.

(d) When a User purchases a subscription, payment and transaction information may be processed by Apple through StoreKit and the App Store or by Google through Google Play Billing and Google Play. Payment information is submitted directly to the applicable app store. The Company may receive transaction identifiers, subscription status, entitlement information, and limited billing-related information, but does not receive or store full payment card numbers or complete payment-method details for those purchases.

(e) The Company uses PostHog for product analytics and for a separate Navigation Diagnostics stream, as described in Section 5.

(f) The Company uses Google AdMob, provided by Google, to display advertisements in the mobile application to Users who do not have an active ad-free subscription. Google and advertising partners may collect or receive information through the Google Mobile Ads SDK for advertising, analytics, measurement, security, and fraud-prevention purposes, as described in Section 6.

(g) The Company uses Meta App Events and Meta advertising-related components for application-event measurement, advertising attribution, and advertising-related functionality. Depending on platform permissions, consent choices, and applicable law, Meta may receive device or advertising identifiers, application-event and interaction information, and related technical information. On Apple platforms, advertiser tracking and advertiser-identifier collection are controlled in accordance with the device's App Tracking Transparency authorization status.

(h) The Company uses Google Firebase services, including Google Analytics for Firebase, for application analytics and related technical services. Firebase Analytics may automatically collect basic application-usage events, device or platform information, and predefined user properties as provided by the Firebase SDK. The Company does not intentionally provide the separate Navigation Diagnostics dataset described in Section 5 to Firebase Analytics.

(i) The Company may preserve, access, or disclose Personal Data when a User deliberately uses route sharing or another feature that requires disclosure to a recipient; when required by applicable law, a valid subpoena, court order, or other lawful process; to protect the rights, safety, and security of Users, the Company, or others; to investigate fraud, abuse, security incidents, accidents, safety incidents, or claims involving navigation or routing; to enforce agreements; to establish, exercise, or defend legal claims; to comply with a legal hold; or in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction.

(j) The Company does not sell precise Navigation Diagnostics or account-linked driving histories to advertisers or data brokers, and the Company does not use the diagnostic route identifier described below for advertising.

(k) The Company does not intentionally disclose detailed Navigation Diagnostics, detailed precise route histories, speed or heading histories, or detailed truck-profile information to data brokers, advertisers, insurers, employers, motor carriers, or consumer reporting agencies for the purpose of profiling an individual driver's driving behavior, insurance underwriting, employment decision-making, or targeted advertising. This limitation does not prevent disclosures specifically directed by a User, disclosures reasonably necessary to provide a User-requested feature, disclosures to service providers operating on the Company's behalf, disclosures required by law, or disclosures reasonably necessary to establish, exercise, or defend legal rights.

5. PRODUCT ANALYTICS AND NAVIGATION DIAGNOSTICS.

(a) Product analytics. The Company maintains normal product analytics for account, subscription, feature, application, and operational analysis. This analytics stream may be linked to a User’s account or analytics profile and may include an account or User identifier, email address, subscription or entitlement information, feature usage, route counts, app version and build, device or platform information, advertising interactions, and general application performance or error information where those data are available or relevant. The Company does not intentionally send a User’s name or phone number to PostHog for account-linked product analytics.

(b) The Company does not send precise GPS coordinates, detailed route geometry, route origins or destinations, precise search proximity, speed, heading, missed-turn coordinates, or detailed reroute-location information to the account-linked PostHog product-analytics stream. Literal search text and raw search-provider responses are also not intentionally included in that identified product-analytics stream.

(c) Separate Navigation Diagnostics. Detailed navigation telemetry is sent to a separate PostHog project used for engineering diagnosis. The application is designed so this diagnostic stream does not receive a User’s email address, name, phone number, Highway Miles User ID, advertising identifier, billing information, or a persistent device or installation identifier, and the application does not call PostHog identify functions for this diagnostic stream. PostHog person-profile processing is disabled for diagnostic events.

(d) When a new navigation route begins, the application generates a random diagnostic route identifier. This identifier is used only to associate technical events belonging to the same route, including related reroutes and traffic refreshes. It is not derived from a User’s account information, email address, phone number, device identifier, advertising identifier, or a hash of those values. A different random identifier is generated for a different route. The Company does not maintain a lookup table that maps diagnostic route identifiers to Highway Miles User accounts.

(e) Because detailed location and route history may itself reveal sensitive or identifying information, the Company does not represent Navigation Diagnostics as inherently anonymous merely because direct account identifiers are excluded. The separation is intended to prevent routine account-level linkage while preserving the technical information needed to diagnose navigation problems.

(f) The diagnostic stream disables PostHog GeoIP enrichment, so the Company does not intentionally add IP-derived city, postal-code, latitude, longitude, or similar GeoIP fields to Navigation Diagnostics. Like other internet services, PostHog may receive a source IP address as part of the network connection used to transmit an event and may process that connection information under its own service configuration, security controls, and retention practices.

(g) Navigation Diagnostics are used for engineering and quality purposes, including investigating reroutes, missed turns, route deviations, routing failures, navigation crashes, restriction conflicts, low-clearance or truck-profile issues, traffic handling, snapping, driver-reported routing problems, API performance, and similar technical behavior. They are not used by the Company to build an advertising profile of a driver.

6. ADVERTISING, APP MEASUREMENT, AND AD-FREE SUBSCRIPTIONS.

(a) The mobile application may display third-party advertisements to Users who do not have an active ad-free subscription. Users with an active ad-free subscription are not shown these third-party advertisements within the mobile application while that subscription remains active. Subscription entitlement or status is used to determine whether advertising should be displayed.

(b) The Google Mobile Ads SDK may automatically collect or receive information such as a User’s IP address, which may be used to estimate general location; device and advertising identifiers where available and permitted; application launches, taps, ad views, advertisements viewed, and other product interactions; and diagnostic, crash, performance, and related technical information. Google may use this information to provide and measure advertising, perform analytics, improve advertising services, and detect or prevent fraud and abuse.

(c) Meta App Events and Meta advertising-related components may automatically log application events and may process device or advertising identifiers, application interactions, advertising-attribution information, and related technical information. The availability and use of advertising identifiers depend on the platform, applicable law, device settings, and consent or tracking authorization where required.

(d) Depending on applicable law, the User’s consent choices, device settings, platform restrictions, and the available ad-serving mode, advertisements may be personalized, non-personalized, limited, or based on contextual information. Where required, the Company or its advertising provider will request consent or provide privacy choices before using information for personalized advertising. Users may also use privacy and advertising controls made available through their device, operating system, Google account, the advertisement itself, or an in-app privacy-options entry point where available.

(e) The Company does not provide the separate Navigation Diagnostics dataset described in Section 5 to Google AdMob for advertising or use a diagnostic route identifier to target advertising.

(f) Google processes information under its own terms and privacy policies. Additional information is available at How Google uses information from sites or apps that use its services and in the Google Privacy Policy.

(g) Meta processes information under its own terms and privacy policies. Additional information is available in the Meta Privacy Policy.

(h) The Company does not sell Personal Data for monetary consideration. Depending on applicable law, disclosures of device or advertising identifiers, approximate location, application interactions, advertising data, or similar information to advertising or measurement providers may be considered a “sale,” “sharing,” “targeted advertising,” or a similar regulated activity even when no money is paid for the data. Where applicable law provides an opt-out right, the Company or its providers will make applicable privacy choices available through in-app controls, platform or device settings, consent controls, or another legally permitted mechanism.

7. RETENTION OF PERSONAL DATA.

(a) The Company retains Personal Data for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with legal and contractual obligations, resolve disputes, enforce agreements, prevent abuse, and protect the Services, Users, and the Company. Different categories of data may have different retention periods based on their purpose.

(b) Detailed Navigation Diagnostics are retained only for a limited period reasonably necessary for engineering diagnosis, quality analysis, security, and related technical purposes. When detailed telemetry is no longer reasonably needed, the Company may delete it or retain aggregate statistics that do not require retaining the original detailed route history, such as aggregate reroute rates, error counts, response-time statistics, or application-version metrics.

(c) Account, subscription, support, transaction, security, and legal records may be retained for longer periods where needed to provide the Services, maintain business and tax records, investigate an open support, safety, fraud, or security matter, comply with law, respond to legal process, resolve disputes, establish or defend legal claims, comply with a legal hold, or enforce agreements.

(d) When the Company no longer has a legitimate need to retain Personal Data, the Company will delete, de-identify, or aggregate it where reasonably practicable. If immediate deletion is not possible, the Company may securely retain the data with restricted processing until deletion is possible. Third-party providers may retain information in accordance with their own retention policies and legal obligations.

(e) Detailed Navigation Diagnostics or related records associated with an open technical investigation, safety investigation, customer complaint, litigation, reasonably anticipated litigation, or legal hold may be retained longer than the ordinary diagnostic period to the extent reasonably necessary and permitted by applicable law.

8. SECURITY OF PERSONAL DATA.

The Company uses technical and organizational measures designed to protect the Personal Data it collects and processes. These measures include limiting the linkage between account identity and detailed navigation diagnostics as described in this Policy. No method of transmission or storage is completely secure, and the Company cannot guarantee absolute security. Users who have concerns about the security of their Personal Data should contact the Company.

9. PRIVACY RIGHTS AND CHOICES.

(a) Depending on applicable law and the User’s jurisdiction, a User may have rights relating to Personal Data, including rights to request access, correction, deletion, portability, restriction of processing, or information about certain disclosures, and rights to object to certain processing or withdraw consent where processing is based on consent. These rights are subject to applicable exceptions and verification requirements.

(b) Users may control location permissions through the privacy settings provided by iOS or Android. Disabling location access may prevent or materially limit navigation and other location-dependent features. Advertising and consent choices may also be available through the device, operating system, Google-provided controls, or in-app privacy options where applicable.

(c) A User may contact the Company at [email protected] to make a privacy request or ask a question about the Company’s data practices.

(d) Users may request deletion of a Highway Miles account and associated data using the instructions at https://www.highwaymiles.net/guides/delete-account. Users who want to request deletion of data without deleting an account may use the instructions at https://www.highwaymiles.net/guides/delete-data, subject to applicable legal, security, fraud-prevention, transaction-record, and other permitted retention exceptions.

(e) Depending on applicable law and the User's jurisdiction, a User may have the right to opt out of certain uses or disclosures for targeted advertising, cross-context behavioral advertising, sale, or sharing. Available choices may depend on the User's platform, consent status, device settings, and advertising provider. Users may also contact [email protected] with questions about available privacy choices.

(f) Because the separate Navigation Diagnostics stream is intentionally designed not to contain a User's email address, name, Highway Miles account identifier, WorkOS identifier, advertising identifier, or persistent device or installation identifier, the Company may not be able to locate a particular diagnostic record merely by searching for a User's account or email address. This separation is intentional and is designed to reduce routine association between detailed location diagnostics and account identity.

(g) If a User provides a specific diagnostic reference and the Company can reasonably locate the corresponding diagnostic record, the Company will process any applicable privacy request concerning that information in accordance with applicable law and subject to permitted exceptions.

(h) Where applicable law gives a User the right to appeal a decision concerning a privacy request, the User may submit an appeal to [email protected] with the subject “Privacy Appeal.” The Company will review the appeal and respond within the period required by applicable law and, where required, provide information about any available method to submit a complaint to the applicable governmental or regulatory authority.

10. CHILDREN AND AGE ELIGIBILITY.

The Services are intended for Users who satisfy the eligibility requirements in the Highway Miles Terms and Conditions, including being at least eighteen (18) years old and legally capable of entering into a binding agreement. The Services are not directed to children under thirteen (13), and the Company does not knowingly collect Personal Data from children under thirteen in violation of applicable law. If the Company learns that it has collected Personal Data from a child in violation of applicable law, it will take reasonable steps to delete the information.

11. MODIFICATION.

The Company keeps this Policy under regular review and may update it from time to time as the Services, service providers, legal requirements, or data practices change. The Company will update the “Last Updated” date when changes are made and will provide additional notice where required by applicable law or where changes are material.

12. CONTACT DETAILS.

If you have any questions, concerns, or requests regarding this Policy or the Company’s privacy practices, please contact us at [email protected].