How Paddock handles your information. Written to be read, not to be survived. If something here is unclear, email [email protected] and we will fix the wording.
Account: your email address, username, and password, which is stored hashed by our authentication provider and is never visible to us. Also whether the account is a personal or a business one. When you sign up we email a six-digit code to your address, and the account is verified when you enter it; the code expires after an hour. We do not ask for a phone number to sign up and do not send text messages to verify new accounts. An account made before October 4, 2026 may still have a phone number on file that it verified with.
Profile: whatever you choose to put there: display name, photo, bio, and your car's year, make, model and colour. All of it is optional except the username.
Location: your device's position, plus speed, heading, and your phone's battery level, while sharing is on. Battery is there so a convoy can see who is about to lose their phone. Separately, while automatic drive saving is on and the app has location access, the drives you take are saved to your account whether or not sharing is on, as long as Paddock is open on your screen; with the app in the background or the screen off, saving needs location sharing to be on as well. This is the sensitive one and it gets its own section below.
Content: messages you send, including a location you deliberately share in chat and photos you send in a chat; meets you create, RSVPs, photos you upload, and reports you file. A photo sent in a chat is stored privately: only the people in that chat can open it, through a link that expires after an hour. People in the chat can like it, and they see who liked it. A hazard or a camera you mark on the map: what kind it is, where you were and which way you were heading when you marked it. Other drivers see the mark, never who made it. Threads posts and replies, each with its author's username, name and profile picture and an optional photo; and the likes you give, which are counted on the post and which tell its author your username in a notification. A convoy you post to the Events tab: its name, description, time, start, destination and route.
Business listings: when you open a paying business's listing, send it a message with Ask, or tap Call, Website or Drive here on it, we add one to that business's total for the day. The total has no name in it: the business sees how many, never who, and the record that stops you being counted twice in a day is deleted once that day is over, the next time a count is recorded.
Notifications: a push token identifying your device so we can deliver notifications, and your choices about which kinds you want.
Beta and launch updates: if you separately check the optional updates box on the website, we keep your email address, the time you consented and where the signup came from. Asking for beta access does not subscribe you automatically.
Invites: if you joined from somebody's invite or referral link, we record who invited you, so referral rewards can be credited and abuse can be traced. We also record an identifier for the device the account was made on, and only ever ask it one question: how many Paddock accounts are on this phone. It is your operating system's per-app device identifier, not an advertising identifier: it cannot be linked to any other company's data, it is never shared, and it resets if you delete the app. It exists because the referral reward is paid for by us, and without it one person with one phone can make accounts until they have earned it.
Business accounts only: your business's public name, category, address, phone, website, opening hours, up to six photos, a current offer, advertising tier, map placement, and promoted meets. This applies to advertisers, not to ordinary accounts. A business with an active plan also has a public web page at https://getpaddockapp.com/b/ followed by its page name. Anyone can open it without an account. It shows the business's name, category, address, phone, website, position on the map, opening hours, photos, picture, approved listing text, current offer and next public meet.
Purchases: which entitlements your account has, plus a transaction identifier and an account token from Apple. Every purchase goes through Apple, so we never see your card number or your billing details at all.
Technical: crash reports and basic error logs. More detailed diagnostic logs, which can include positions and what the app was doing on a drive, are collected only from test accounts the team has enrolled for testing, never from anybody else. We do not use third-party advertising SDKs, we do not add analytics SDKs to measure how you use the app, and there is no ad tracking identifier in this app. The one thing close to that is the map: Mapbox's map software can send Mapbox usage data from your phone, but only if you switch that on; it is off unless you do. See Who else touches it.
Your current position is stored so it can be shown to the convoy you are driving with. For that live map we keep one current position per person: each update overwrites the last, and anything older than 24 hours is deleted automatically by a scheduled job that runs every hour.
Saved drives are different, and they are a record of where you went. While automatic drive saving is on and the app has location access, the app saves each drive: the route you drove, when, how far and how long. This does not depend on location sharing while Paddock is open on your screen: a drive is saved for you even when sharing is off and nobody can see you. With the app in the background or the screen off, drives are saved only while location sharing is on, because background location runs only then. You can turn automatic saving off in Settings → Drive recording and record only when you choose to. A saved drive does not keep where it starts and ends: the first and last 300 metres of the route are not stored, and its start and end are named by neighbourhood and city rather than by street address, because a drive usually begins or ends at home. Its distance and time still count the whole drive. A drive that never gets 300 metres from where it started and ended is not saved. Saved drives are visible to you and nobody else. They are kept until you delete them, one at a time on the drive's page or all at once by deleting your account. We do not sell location data, and we do not share it with advertisers, data brokers, or anyone else outside the app.
For the leaderboard we keep one more thing: a running total of how far and how long you have driven, added up on your phone and stored as a single pair of numbers per week. That is not a trail either. No coordinates are involved at any point, and a total cannot say where you went, only how much. Convoys and meets on the board are counted from the ones you already joined and said yes to. The whole board is visible only to people you have added as friends, never to strangers, and deleting your account deletes it with everything else.
Only people who are in a live convoy with you can see where you are. Not friends, not people nearby, not anyone browsing: a shared, running convoy is the whole of it. A leader can post a convoy to the Events tab and the map, and any signed-in account can then join it without the code. Any signed-in account can see a posted convoy's route and the names and pictures of the people in it, and anyone who joins is in the convoy, and so also sees where everyone in it is on the map. Join one and those members can see you; leave it, or let it end, and you are off their map in the same second. Outside a convoy nobody can see your position at all. Ghost mode goes further and hides you even from a convoy you are in. While sharing is on, your phone still sends its position to us in ghost mode. Nobody can see it, and it is deleted within 24 hours like any other; turn sharing off if you do not want it sent at all, and automatic drive saving off as well if you do not want your drives kept either. This is enforced inside the database rather than only in the app, so a bug in one screen cannot show a position the rule says is private. "Only while moving" means your position disappears when you stop. Blocking somebody removes you from their map immediately and permanently, in both directions, including inside a convoy you both happen to be in. It also hides your messages from each other in a convoy, meet or group chat you both belong to, including any position either of you sent in one.
On iOS and Android the app can collect location in the background so a convoy keeps working with the screen off. Your operating system shows an indicator while that is happening, and you can revoke the permission in system settings at any time. The app degrades to foreground-only rather than breaking.
Deleting your account deletes your location rows immediately rather than waiting for the 24-hour expiry.
Run the features you are using: put people on a map, deliver messages, show meets near you, connect voice, unlock what you paid for. Keep the service safe: review reports, enforce blocks, and investigate abuse. Contact you about your account when we have to. If you opted into beta and launch updates, send those updates until you unsubscribe.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. Sponsored pins are targeted by where the map is looking and nothing else.
For people in the EU or UK, our legal basis for account, convoy, messaging, navigation and purchase processing is performing the service you request. We use legitimate interests to prevent fraud and abuse, secure accounts and investigate reports, while weighing those interests against your rights. We use your separate consent for optional marketing email, which you may withdraw without affecting your account. We keep records when a tax, accounting or other legal obligation requires it. You may object to processing based on legitimate interests by contacting [email protected].
Only the companies needed to run the app, each of which sees only what it needs:
Supabase hosts the database, authentication and file storage, and sends the verification code we email at sign-up, through its own mail service or through our email provider. Text-message verification, which used Twilio, is not used for new accounts. LiveKit carries live voice audio; it is not recorded or stored. Like any connection, a call leaves LiveKit with a record that a connection joined a room and for how long, under their retention, never the audio itself. When you ask for directions to a convoy, the route points are sent through our server to a routing provider (Google Routes or Mapbox) to calculate it; when those are unavailable, the route is calculated by the public OSRM routing server run by FOSSGIS e.V. Address and place searches, and searches for fuel or charging stops along a route or near you, are sent through our server to Mapbox, to the Photon geocoder run by komoot (which is built on OpenStreetMap), to the OpenStreetMap Overpass service, and to the U.S. Department of Energy's station database, sometimes with your approximate position or your route. Speed limits come from Mapbox: along a route, the road ahead is sent; while you drive without one, the last 90 seconds or so of the path you drove is sent instead. Both go through our server. Live traffic on the map comes from Mapbox, which your phone loads along with the map. Camera warnings along a route are found by sending the route ahead, through our server, to the OpenStreetMap Overpass service and to our own list of cameras that cities publish. Those requests are made by our server, so they do not include your Paddock account identifier, but the provider sees our server's address, what was asked and the position or route in it, and each has its own privacy policy. Apple processes every iPhone payment. The map is drawn by Mapbox, on the phone and on the CarPlay screen. Mapbox provides the map for us and processes these requests. Your phone connects to Mapbox directly to load the map, so Mapbox, like any website, sees your IP address and which parts of the map your phone loads. Mapbox's map software also has a switch for sharing Mapbox usage data from your phone. It is off unless you turn it on, in You → Settings → User preferences → Map, which you can reach after you sign in; what that data contains is described in Mapbox's own privacy policy. When Mapbox cannot be reached, Apple Maps (Google Maps on Android) draws the map instead. Apple Maps also answers place and business searches made on your phone, with your approximate position. Expo delivers app updates, crash reports and push notifications. Our email provider delivers optional beta or launch updates when you opt in. If you book a demo through our website, Calendly handles the booking and loads on that page, and our website is served through Cloudflare.
We may also disclose information if we are legally required to, or if we believe in good faith that it is necessary to prevent imminent harm to somebody.
Live location rows: 24 hours. A scheduled job on our database deletes rows older than that every hour, whether or not you are still using the app. It is not something we do by hand or on request. Separately, the database keeps the time and place of your last position update for at most about 15 minutes, visible to nobody, so it can refuse impossible jumps; it is deleted on schedule and with your account. A location you deliberately send as a chat message is kept for 7 days and then deleted, whether or not the rest of the conversation is still there.
Marks on the map: a hazard you mark stays up for under an hour and is deleted about an hour after that. A camera you mark stays on the map until you remove it, until drivers passing it say it is not there, or until you delete your account; once it is off the map it is deleted within a week.
Saved drives: until you delete the drive or your account, without their first and last 300 metres, which are never stored.
Threads: a post, with its replies, likes and photo, until you delete the post or your account. A posted convoy is listed until the leader takes it down, until about six hours after its start time, or until the convoy ends. A week after any convoy ends, its start, stops, destination and route are erased, and the convoy itself is deleted 90 days after it ends.
Messages: until the conversation is deleted. Convoy chat goes with its convoy, which is deleted 90 days after it ends. Other messages, and the chat of a meet, stay as long as the thread does. A photo sent in a chat is deleted within a day of its message being deleted, and at once when you delete your account, unless it is part of a report still being reviewed. Deleting your account deletes the messages you sent, wherever you sent them, including any position you shared in one. Voice audio: never stored.
Profile and account data: kept in active systems until you delete your account. When deletion succeeds, the account and owned uploads are removed from active systems; copies in backups may remain until those backups expire.
Beta and launch update signups: until you unsubscribe or ask us to delete the signup. Each update includes an unsubscribe link.
Demo and beta requests sent from our website: deleted after 180 days, or sooner along with the account that uses the same email address.
Support requests and booked calls: what you write to support, from the app's Help screen, the website or by email, with your name and email address, is kept while the request is open and for 180 days after it is closed; a call you book with us is kept for 180 days after it happens. After that, and at once when you delete your account, the name, the email address and the words are erased, and what remains is the request's number, its category and its dates, with nothing that says who it was. Notes the team wrote for itself about a request, for example the record of a fraud, are kept without your text.
Push tokens: until you sign out, delete the account, or turn notifications off, whichever comes first, and in any case deleted if a device has not used one for 90 days.
Reports and moderation records: kept after account deletion, because they are the record of why an account was removed and deleting them would let a banned user erase the reason. What is kept is the report itself: the reason, a frozen copy of what was reported, and the username it was about. It is no longer linked to a live account once that account is gone.
Payment records: as long as applicable tax and accounting law requires, typically seven years.
Change your sharing setting, or switch to ghost mode, any time in You → Settings.
Delete your account in You → Settings → Delete account. It happens immediately and cannot be undone. If you cannot get into the app, email [email protected] from your account's email address and we will do it within 30 days; instructions are also at https://getpaddockapp.com.
Unsubscribe from beta and launch updates with the link in any update, or email [email protected]. Unsubscribing does not affect beta access or your app account.
Request a copy of your data, or ask us to correct it, by emailing [email protected]. We may ask you to confirm your identity before disclosing account data and will normally respond to an EU or UK rights request within one month.
If you are in the EU or UK you have rights of access, correction, erasure, portability, restriction and objection under the GDPR, and you can complain to your local supervisory authority. If you are in California you have rights of access, deletion, correction, and to know what we collect under the CCPA, and we will not treat you differently for exercising them. We honour Global Privacy Control signals on our website.
Paddock is not for anyone under 13. We do not knowingly collect information from children under 13, and we do not ask for a date of birth. We ask you to confirm you meet the age requirement instead, and we collect no more than we need to. If you believe a child under 13 has an account, email [email protected] and we will delete it.
Traffic is encrypted in transit. Access to your rows is enforced in the database itself rather than only in the app, so a bug in one screen cannot expose another person's location. Passwords are hashed and we cannot read them.
No system is perfect. If we discover a breach affecting your data we will notify you and any regulator we are required to notify, promptly.
Our servers are in the United States. If you use Paddock from elsewhere, your information is transferred to and processed in the United States, which may have different privacy laws than your country.
If this policy changes materially we will tell you in the app before it takes effect.
Paddock
[email protected]