Privacy Policy
1. Information We Collect
MyMilesAI is an automatic mileage tracker, so location is at the heart of what we collect. If you turn on automatic tracking, we collect GPS location data in the background — including while the app is closed or your phone is locked — so drives can start, record, and end without you touching your phone. For each drive we collect the start and end locations and addresses, the route path you drove, the distance, and timestamps. We also collect your trip classifications (such as Business, Personal or Charity), business purposes, client names and notes, your account email address, your name or display name (if you enter one, or if it is provided through a supported sign-in method such as Sign in with Apple or Google — and, for Google sign-in, the link to your Google profile picture that Google provides), your company name and, on the web dashboard, your phone number (only if you choose to add them), and a device push-notification token (used to deliver trip and reminder notifications). Trips classified as Medical in earlier versions of the app or dashboard remain in your history with that category.
If you add a vehicle, we store the details you enter: a vehicle name, make, model and year, license plate, and odometer readings. We store the places you save, such as Home, Work or a client, and places the app saves automatically after you have driven to the same spot several times (listed in Settings, where you can rename or remove them), each with a label, address and map coordinates, so trip addresses stay consistent and drives can be classified. We also store your country or region and tax-authority setting (which selects the mileage rates shown to you), your time zone, your app settings (such as units, default category and working hours), any custom mileage or reimbursement rate you set, and, for each trip, the tax authority, mileage rate and currency applied and the resulting deduction amount. Each time a trip’s category is set or changed, we keep a classification history entry (the previous and new category, how it was set — including, for automatic suggestions, a confidence score — the distance and the deduction amount); we keep a history of changes to a trip’s distance; and we keep counts of how you have classified drives between the same start and end addresses, so we can suggest categories.
Health-related information. A trip you classified as Medical, together with its date and its start and end addresses, can indicate that you travelled to obtain health care. We use that information only to keep the mileage record you asked for and to show its mileage amount; we do not sell it, do not use it for advertising, and share it only with the service providers listed in §5 that host and operate MyMilesAI. You can change a trip’s category or delete the trip at any time, and deleting your account erases the trip and its history.
Your phone’s motion & fitness activity is used on your device to detect when a drive starts and stops (this saves battery versus GPS alone). Raw motion sensor data is processed on your device. Current versions of the app do not upload motion readings or activity classifications; trips recorded with earlier versions may include an activity classification in their stored diagnostic details.
If you set up Bluetooth car detection, we store an identifier and the name of your paired car audio, Bluetooth or CarPlay device in your account so trips can auto-start when your phone connects to your car. We also collect diagnostic and usage information needed to operate and improve the service: crash, app-hang and error reports and diagnostic logs (linked to your account in our database, and to a pseudonymous identifier derived from your account in Sentry); your app version, device type and operating system; a random identifier created for each installation of the app; the identifier that iOS assigns to our apps on your device (RevenueCat receives it, and Sentry receives a value derived from it); records of how you use certain features, such as turning automatic tracking on or off, tapping Subscribe or Restore, or starting an export; and the IP address and browser or app details of each sign-in session. Sentry may infer an approximate location (country or region) from your IP address; we have set Sentry not to store the IP address itself. From our subscription processor RevenueCat we receive your subscription and purchase history and the country associated with your purchase.
You can turn automatic tracking off at any time in the app. While it is off, your drives are not recorded as trips (a drive already in progress when you turn it off is saved up to that moment), but the app may still use your location in the background (for example, when the app starts, when your phone connects to your car, or when you leave the place where your last drive ended), and location points used for this may be kept temporarily on your phone. They are not sent to us while tracking is off; if you turn tracking back on within an hour, points from a drive that was already under way may be used to record that drive. The app may also send diagnostic events that contain no location coordinates (for example, that you left the place where your last drive ended and whether that looked like a drive). To stop all location use, set MyMilesAI’s location access to “Never” in your iPhone’s Settings.
2. On-Device Processing
Trip classification (business vs personal) runs on your device. The classifier uses local heuristics — your named locations, time of day, and prior classifications at the same destination — to suggest a category, and you confirm or correct it. The classification decision itself never requires sending your location anywhere. Your trip records — including start and end locations and addresses, the full route path of each drive (so your dashboard and reports can draw the drive on a map), distance, times, classification, and your notes — sync from your device to your private cloud account.
3. Cloud Storage
Your trip data — including the route paths of your drives — is stored in your own private account on Supabase (PostgreSQL on AWS infrastructure), encrypted in transit (TLS) and at rest. Row-level security means other MyMilesAI users cannot read your trips. If you join a team, the team’s owner can see your e-mail address and that you are a member. Cloud storage exists so your history survives a lost phone, so you can sign in on a new device, and so you can access your dashboard at mymilesai.com/app/. We do not use your trip or location data for advertising. We do compute internal, aggregated measurements — such as the number of accounts and active subscriptions, the trips and miles recorded, and how often suggested trip categories are corrected — to operate the service and improve trip detection and classification.
Data retention. We retain your trip and account data for as long as your account is active. When you delete your account, your data is erased as described in §7. When you delete a trip, you can restore it from the web dashboard for 30 days; after that the trip record is permanently removed, but the classification history and distance-change history created from it, its “Trip saved” notification (which shows its start and end addresses) and your route-classification counts (which include the start and end addresses and the category you chose, for example Medical) are kept until you delete your account. Database backups are kept for up to 7 days (never more than six months) and then deleted automatically. Error reports and diagnostic logs are retained for up to 90 days; diagnostic details stored with a trip are kept as long as the trip.
4. How We Use Your Data
We use data to provide, secure, support, and improve mileage tracking; create mileage-record reports; sync accounts; deliver requested service and account communications; measure, in aggregate, how the service is used and how well features such as trip detection and category suggestions work; and administer subscription billing through Apple In-App Purchase and our subscription processor RevenueCat. We do not use trip or location data for advertising, and we share data only with the subprocessors and in the limited circumstances listed in §5.
5. Subprocessors
We use the following subprocessors to operate the service: Supabase Inc. (managed PostgreSQL, authentication, and Realtime); Functional Software, Inc. d/b/a Sentry (crash, error, and performance diagnostics); RevenueCat, Inc. (subscription and in-app-purchase management); Apple Inc. (App Store payments & receipts; and, through the Apple Maps Server API, address suggestions for text you type when adding an address, geocoding and reverse-geocoding of trip start and end points and saved places, route directions used to match a drive to roads, static map images of a trip’s route, for which the route shape and its start and end points are sent to Apple, and map tiles for the area shown when you open a map in the app; and the Apple Push Notification service, which delivers notifications to your device); Resend (Resend, Inc.) (transactional and reminder email delivery); Cloudflare, Inc. (website hosting/CDN and Turnstile bot-protection on web forms); Plausible Insights OÜ (Plausible Analytics — cookieless analytics on the mymilesai.com website only; it stores nothing on your device, does not track you across sites, and never sees your trip data); FormSubmit (formsubmit.co) (relays our website Contact form submissions — the name, email address, optional phone number, and message you enter — to our support inbox); Microsoft Corporation (Microsoft 365 email hosting for our support@, privacy@ and info@ mailboxes, where messages you send us and contact-form relays are received and stored); and Google LLC and Apple Inc. (OAuth sign-in providers, only if you choose to use them). We do not use Stripe at this time. We do not sell your data to anyone.
How these providers must treat your data. The providers that process personal data on our behalf — Supabase, Sentry, RevenueCat, Resend, Cloudflare, Plausible and Microsoft — do so under their data-processing terms with us, which restrict them to providing their service to us and require security measures at least equal to those described in this policy. Apple (App Store payments, Apple Maps and push notifications) and Google (sign-in) process the data they receive under their own privacy policies for the parts of the service they operate, and FormSubmit relays contact-form messages under its own privacy policy. Beyond the providers listed above, we disclose personal data only when required by law or legal process, or to protect the rights, safety or security of our users, Harijas LLC or others.
Cookies and browser storage. mymilesai.com does not use cookies, advertising or cross-site tracking. When you sign in to the web dashboard, your browser keeps your sign-in session in its local storage so you stay signed in; it is removed when you sign out, and the dashboard signs you out automatically after 15 minutes of inactivity. The dashboard also keeps, on your device only: the time of your last activity (for that automatic sign-out); any trips you logged that have not uploaded yet (so they are not lost if you go offline); and, only if you enter one, your own mileage rate. On our sign-in and sign-up pages, Cloudflare Turnstile stores a security token to protect those forms from automated abuse.
Tracking and “Do Not Track.” We do not track you across other websites or apps, and we do not permit third parties to collect information about your activity on mymilesai.com over time and across other sites. Plausible records page views without cookies or persistent identifiers. Because we do not engage in cross-site tracking, the site does not change how it operates when it receives a “Do Not Track” signal.
6. Speedometer
The in-app speedometer is for reference only and is not calibrated to DMV, state, or federal standards. Do not rely on it for legal purposes.
7. Your Rights
You may export your trip records as PDF, CSV or QuickBooks CSV from the web dashboard, or as PDF, Excel (.xlsx) or QuickBooks CSV from the iOS app. You may delete individual trips (restorable from the web dashboard for 30 days; see §3) or delete your entire account in the iOS app, from Settings or from the screen shown when you do not have an active subscription. If you do not use the iOS app, e-mail privacy@mymilesai.com from your account’s e-mail address and we will delete your account. If your account has been suspended or terminated, you can still request a copy of your data or deletion of your account by e-mail at the same address.
Account deletion is permanent: after you confirm with the 6-digit code we email you, your account and the data in our live database are erased right away, except for the records listed here; if a step fails, we finish the erasure automatically. These survive deletion: (1) for security and financial-audit purposes, a pseudonymous deletion-audit record (an internal account identifier, timestamps and any technical error text — no name, email, location, or trip data), pseudonymous payment-webhook logs (subscription events from RevenueCat containing an internal account identifier and the product, price, currency and country), including the provider’s event payload as received, and pseudonymous notification-delivery logs (an internal identifier and a hashed network address — no message content); (2) if you asked us to stop sending you emails or marked one of our emails as spam, a one-way hash of your email address, so we keep honoring that request; (2a) if we sent you a trial or renewal reminder, a pseudonymous delivery record for that e-mail (an internal identifier, the reminder kind, the send status and provider message id — no message content or address); (3) error reports already sent to Sentry, which carry a pseudonymous identifier rather than your name or email, until they expire within 90 days; (4) copies in our database backups, for up to 7 days (never more than six months) until those backups are deleted; (5) emails you exchanged with us at our support, privacy or info mailboxes; and (6) records of your App Store subscription transactions held by Apple and by our subscription processor RevenueCat, and records of the emails we sent you held by our email provider Resend, under their own retention policies — deleting your MyMilesAI account does not delete Apple’s transaction records. Deleting your account does not cancel your subscription; cancel it in your Apple Account subscription settings (on your iPhone: Settings › your name › Subscriptions) if you do not want to be billed again.
Wherever you live in the United States, you can ask us to tell you what personal data we hold about you, give you a copy, correct it, or delete it, by emailing privacy@mymilesai.com from your account’s email address. These requests are free of charge up to twice a year. We verify the request against your account and respond within 45 days (we may extend once by 45 days when reasonably necessary and will tell you if we do), and we will not treat you differently for asking. If we decline a request, you can appeal by replying to our response; we answer appeals in writing within 45 days. We do not sell personal information or share it for cross-context behavioral advertising, and we use precise location only to provide the service you asked for. EU/UK residents may exercise GDPR rights (access, rectification, erasure, portability) by emailing privacy@mymilesai.com; California residents may exercise CCPA/CPRA rights at the same address (we offer these rights to all US residents under this section whether or not a state law requires it).
8. Changes to This Policy
We may update this policy from time to time. When we do, we will post the updated policy on this page and change the effective date at the top; a material change is posted here before it takes effect and, if you have an account, we notify you at your account e-mail address. This policy describes how we handle information; it does not change the End User License Agreement & Terms of Use you accepted in the app, which changes only when you accept a revised version in the app.
9. Contact
Questions about this policy? Email privacy@mymilesai.com. Harijas LLC (MyMilesAI), 668 Industrial Park Dr, 4323, Manteca, CA 95337 (mailing address), United States.