Legal

Privacy Policy

Written to be readable, not lawyered. Your drive history never leaves your phone.

Last updated: 19 October 2026 · Jurisdiction: England & Wales

Overview

AutoGhost ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

What We Collect

On-Device Only (Never Transmitted)

  • Motion sensor data: We use your device's Activity Recognition (Android) or Core Motion (iOS) to detect when you are in a vehicle. This data is processed entirely on-device and is never transmitted, stored server-side, or shared with anyone. We never know WHERE you are — only that your device is in motion consistent with being in a vehicle.
  • App usage data (Android only): When driving is detected, we check if you open apps from your selected block list. This data stays on your device and is never transmitted.
  • Drive records: Your drive history (timestamps, duration, streaks, badges) is stored locally on your device using encrypted on-device storage.

Collected and Stored Server-Side

  • Name and email address: Collected during registration for customer support and, if you start a free trial, for the two trial emails described under "Trial emails" below. Stored securely in our database (hosted on Supabase with encryption in transit and at rest).
  • Device identifier: A randomly generated ID (not your device's hardware ID) used to link your support record.
  • Subscription data: Processed by RevenueCat, our subscription management provider, to manage your subscription. RevenueCat assigns an anonymous subscriber ID — no personal information is shared with RevenueCat beyond what is required for purchase processing.

Optional: Global Leaderboard (Opt-In Only)

The Global Leaderboard is a completely optional feature. It is off by default. You can enable it from Settings → Data → Global leaderboard.

If you opt in, we upload the following to our Supabase database:

  • Your chosen handle — a 3–20 character alphanumeric name that YOU pick. This is shown publicly on the leaderboard on autoghost.org. Do not use your real name unless you're comfortable with public display.
  • An opaque device hash — a one-way SHA-256 hash of a randomly generated device UUID (not your device's hardware ID) plus a fixed salt. The raw device ID is never uploaded. The hash cannot be reversed to identify your device.
  • A recovery PIN hash — a one-way SHA-256 hash of an 8-digit PIN you receive at enrolment and the device hash. Used to restore your leaderboard identity after reinstalling the app. We can never see or recover your PIN. If you lose it and reinstall, you cannot recover your leaderboard entry.
  • Aggregate stats — cumulative drive count, cumulative drive time in seconds, current streak, longest streak, badge count, current level, and the timestamp of your first drive.

We do NOT upload:

  • Your real name, email address, or device hardware ID
  • Any location or GPS data
  • Any individual drive records, times of day, routes, or destinations
  • Any information about which apps you have chosen to block

How the leaderboard data is used:

  • Aggregate stats are displayed on your personal rank card in the app and on the public leaderboard at autoghost.org/leaderboard
  • Ranking is calculated by level, longest streak, and total blocked drive time
  • We use a server-side trigger to reject impossible values (e.g. more than 12 hours of drive time per day) as an anti-cheat measure. Rejected writes are logged for our review but contain no personal information beyond the handle.

Opting out: You can opt out at any time via Settings → Data → Global leaderboard → Opt Out. This deletes your row from our database entirely. There is no server-side retention after opt-out.

Restoring on a new device: Enter your handle and PIN via the opt-in screen's "I have a handle from another device" option. If both match server-side, your local install is re-linked to the same leaderboard entry.

Anonymous usage stats (on by default, you can turn this off)

To find problems and improve AutoGhost, the app sends anonymous usage stats to our own database (Supabase). This is on by default; on phones set to an EU/EEA region it starts off and you can choose to turn it on. You can switch it off at any time in Settings → Data → Share anonymous usage stats (also shown at the end of setup). When it is off, nothing is sent.

What is sent: a random install ID created on your phone (not your device's hardware ID, and never linked to your name, email or support record), your platform, app and OS version, and simple events such as: which setup step you reached, whether a permission was granted, how many apps you chose to block (a number only), that a drive was completed (with its length in broad ranges such as "15–30 minutes" and how it ended), whether a subscription or trial started or failed, badge earned, and error names.

What is never sent: your name, email, location or GPS, routes, exact times or lengths of drives, which apps you block, anything you type, or advertising identifiers. No third-party analytics or advertising tools are involved, the data is never shared or sold, and it is not used for tracking across other companies' apps or websites.

Why: to make the app work better (for example, to spot when drive detection or sign-up fails) and to understand, in aggregate, where people get stuck. Because the stats are anonymous and can't be tied back to you, we can't find or delete one person's stats on request; switching the setting off stops all further collection.

Not Collected

  • GPS or location data: AutoGhost never accesses your location. We use motion sensors only.
  • Contacts, photos, or files: We never access any of your personal files or contacts.
  • Browsing history: We do not monitor your browsing activity.
  • Advertising identifiers: We do not collect IDFA, GAID, or any advertising identifiers.

How We Use Your Data

  • Name and email: To identify your account if you contact customer support, and to cross-reference subscription issues with RevenueCat.
  • Trial emails: If you start a free trial, we will only contact you towards the end of it — at most two short emails: one asking for your feedback on AutoGhost, and one reminding you that your trial is ending so you can decide whether to subscribe. That is the only email contact we make. No newsletters, no promotions outside your trial, and we never sell or share your email address. Every email has a one-click unsubscribe link, and you can also opt out at any time by emailing team@autoghost.org. We send these under the UK "soft opt-in" rule because you have started a trial with us; unsubscribing never affects your trial or subscription.
  • Motion data: To detect driving and activate app blocking. Processed on-device only. Per Apple's guidelines, motion and fitness data is used solely for the direct benefit of the user and is never used for marketing, advertising, or data mining.
  • App usage data: To count distraction attempts during drives (shown to you on drive completion). Processed on-device only.

Third-Party Services

  • RevenueCat: Processes subscription purchases. RevenueCat receives anonymised transaction data from the App Store / Google Play. See RevenueCat's Privacy Policy.
  • Resend: Delivers the trial emails described above. Resend receives only your name and email address for the purpose of sending those emails. See Resend's Privacy Policy.
  • Supabase: Hosts our database. Your name, email, and device ID are stored securely. If you opt in to the Global Leaderboard, your handle + device hash + aggregate stats are also stored. See Supabase's Privacy Policy.

We do not use any third-party analytics, advertising, or data broker services. Our anonymous usage stats (above) are first-party: they are stored only in our own Supabase database.

Data Retention

  • On-device data: Drive records older than 800 days are automatically aggregated into monthly summaries. Individual records are deleted. (This retention window is required for the Global Leaderboard's multi-year consistency metrics.)
  • Server-side data (support record): Your name and email are retained until you request deletion.
  • Server-side data (Global Leaderboard): Your handle + hashes + stats are retained until you opt out. Opting out deletes the row immediately with no retention window.
  • Anonymous usage stats: kept for 13 months, then reduced to weekly totals (counts only) and the individual events deleted.

Your Rights

  • Access: You can view all your data within the app (Settings > Profile, drive history, achievements).
  • Deletion: You can delete all your data at any time via Settings > Delete My Data. This removes all local data from your device AND deletes your server-side support record AND deletes your leaderboard entry (if any).
  • Leaderboard-only opt-out: If you want to remove your leaderboard entry without deleting the rest of your account, use Settings > Data > Global leaderboard > Opt Out.
  • Opt out of trial emails: Use the unsubscribe link in any trial email, or email team@autoghost.org. You will receive no further emails.
  • Portability: All your data is visible within the app.

Children's Privacy

AutoGhost is designed for drivers aged 17 and older. We do not knowingly collect data from children under 17.

Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app.

Contact Us

For privacy questions or data requests, contact us at: team@autoghost.org