Privacy Policy

Last updated October 18, 2026

1. Who we are

OttoMiles is developed and operated by Marc Chametzky, an individual developer in North Carolina, publishing under the Mementoria name. When this policy says “we” or “us,” it means him. OttoMiles is offered in the United States only, to adults.

2. Free tier: everything stays on your device

OttoMiles measures your delivery and rideshare miles using your iPhone’s location and motion sensors, and lets you log blocks, earnings, and expenses. Without an account, all of that data is stored only on your device. We have no server that receives it, and no way to see it. Deleting the app deletes it.

Two features on the free tier do contact third parties, and we want to be precise about them:

• Map imagery. The location editor (used to set your home and station locations) shows a map served by Esri and OpenStreetMap. Loading it shows those providers the area you are viewing, along with your IP address. The pin you save is never sent to them; only the map tiles for the viewport are requested.
• Address search. Address search is powered by Apple Maps: the address text you type, and a map location used to bias results toward your area, are sent to Apple to return matches.

Neither request carries your name, an account identifier, or your trip history. They are subject to Esri’s, OpenStreetMap’s, and Apple’s privacy policies respectively.

3. Your device backups

Trip and mileage data that OttoMiles stores on your device is included in your device’s own iCloud or computer backups, the same as your other app data. Those backups are held in your Apple account or on your computer, not by OttoMiles. We never receive them.

Detailed per-trip location logs are kept on the device for 30 days and then removed. Copies already inside an older backup are governed by that backup, not by us.

4. Accounts and OttoMiles Pro

You can create an account with an email address and password, an emailed sign-in link, Google, or Sign in with Apple. Accounts are provided through Google’s Firebase Authentication. We hold your email address and a random account identifier. We do not read your name or profile photo from Google or Apple. If you sign in with Google, Firebase Authentication itself keeps your Google account’s name and a link to its profile photo with your account.

Signing in does nothing by itself. With an active Pro subscription, the following syncs to our servers (Google Cloud, in the United States) so your records are available on every device you sign in on:

• Blocks and trips: dates, times, platform, station, miles driven, pay, tips, stop count, notes, the single farthest point reached on each trip, and Otto’s analysis of each stop on a block (Section 5). The raw GPS trace of a drive is never uploaded.
• Expenses: amounts, categories, notes, and receipt photos you attach.
• Settings: your display name, tax settings, vehicle, the home and station locations you configured (including their addresses and coordinates), and your place-lookup choice (Section 5).

Only you can read your data. Our access rules are keyed to your account identifier, and Google encrypts the data in transit and at rest.

5. Route insights (Pro)

With Pro, Otto analyzes the stops on each block to separate the miles you drove for the route from the miles you didn’t, and to show you how your routes break down. This section covers what that involves and where each piece is kept.

Stop analysis, synced with your blocks

For each stop on a block, the synced block records when the stop happened, how long you stayed, whether Otto counted it as a delivery or a personal stop, the kind of place it was (a home, a business, a parcel locker, a place drivers usually stop for themselves such as a gas station or coffee shop, or unknown), and mileage figures for the route around it, such as the extra miles an out-of-the-way stop added. These records contain no coordinates and no addresses. They sync for every Pro block, whether or not place lookups are on.

Place lookups: on with Pro, and you can turn them off

To tell what kind of place each stop was, OttoMiles looks it up with a mapping service. Place lookups are on with Pro, and you can turn them off at any time in Settings. Nothing is sent until you have acknowledged the in-app notice that explains them. Each lookup takes two hops:

• Your iPhone to our server. The app sends the block’s stops, in the order you made them, to our server, linked to your account. For each stop that means a search area (one point between where you parked and the farthest point of your walk, plus a radius in metres) and how long you stayed. While we compare this method with the one it replaces, the app also sends the point where you parked. Our server holds all of this only while it processes it and does not store it.
• Our server to Geoapify. Our server sends Geoapify, a mapping service, the search area of each spot it still needs to look up (its coordinates and radius) and, while we compare methods, the point where you parked, and nothing else: no account identifier, no times, and not in the order you made them. The requests come from our server, so Geoapify does not see your IP address. Their handling of requests is described in Geoapify’s privacy policy.

From each lookup we keep the kind of place at each stop (for example a house, a shop, or a parcel locker) and the categories of nearby places with their distances, stored with your account. We keep no stop coordinates, no street addresses, and no shared cache of looked-up places.

Turning place lookups off stops all new lookups. That choice syncs to your other devices whenever you are signed in, even if Pro has lapsed, and our server checks it too, refusing lookups for an account that has turned them off. With lookups off, Otto still analyzes your stops from your iPhone’s motion data, and that analysis still syncs as described above. Results already stored stay with your account until you delete it.

Station statistics, combined across drivers

We combine Pro drivers’ stop analysis into statistics for each delivery station, such as typical stops per block, time per delivery, the mix of homes and businesses, and miles. All subscribers can see them. They are built only from figures like these, never from locations. A station’s statistics are shown only when enough drivers contribute to them, and statistical noise is added so that no single driver’s data can be picked out. Only Pro blocks contribute: free-tier data never leaves your iPhone. Station statistics are never sold.

What stays on your iPhone

Apart from the lookup hop above, the precise location of each stop stays on your iPhone, along with the GPS trace of your drive. The map of a block’s stops is drawn from that on-device data, so it is available only on the iPhone that recorded the block, for 30 days (Section 3).

6. Purchases

Pro is sold through Apple’s App Store. Apple processes the payment and holds your billing details; we never see your card, your name, or your Apple ID. When you subscribe, our server receives a signed receipt from Apple that tells us which product you bought and when it expires, and we record that expiry against your account so the app knows you are entitled.

7. Diagnostics (both opt-in)

Crash reports

Crash reporting is off until you turn it on. When enabled, crashes are sent to Firebase Crashlytics with a stack trace, your device model, and iOS version. Crash reports never include location or trip data and are not linked to your account. Google keeps them for 90 days.

Feedback and logs

When you send feedback from inside the app, you choose what to attach. What’s included is shown to you before you send: your description, the screenshot (after your edits), tracking diagnostics (permission state, watcher state, last sample, recent arrival, cold-wake flag), and, if you tick “Attach recent logs,” recent app logs, which include your precise location history for recent drives (up to 30 days), the step counts and motion readings (such as walking or driving) from your iPhone’s motion sensors, the tracking actions you took (such as starting or stopping tracking and answering the app’s notifications), and timings such as how long a background sync took, sent only with that report. Every report also carries the app version, device info, and your account identifier. Your email is never included.

Reports are filed as issues in our private issue tracker (Linear), which only we can read; an attached screenshot is copied into the issue with the report. Reports may be summarized by an AI-assisted triage step (currently Anthropic’s Claude) so we can act on them quickly. Attached log bundles are automatically deleted from our storage after 30 days. Screenshots and the report itself are kept until you ask us to remove them, or you delete your account.

8. Protecting our services

To keep bots away from our servers, the app uses Firebase App Check. On iPhone this relies on Apple’s App Attest, which sends Apple a hardware-backed attestation that the app is genuine. It does not identify you.

9. What we don’t do

• No analytics or usage-tracking SDKs. We do not know how often you open the app.
• No advertising, and no tracking across other apps or websites.
• No selling, renting, or sharing of your personal data with anyone.
• No use of your data to train models or build profiles.

10. Service providers

The companies that process data on our behalf, and for what:

• Google (Firebase and Google Cloud): accounts, cloud storage for Pro, crash reports, App Check. Firebase’s software also sends Google basic technical details (device, operating system, app identifier, and developer platform), never linked to you, which Google uses to measure platform and version adoption.
• Google Sign-In: signing in with Google, if you choose it. Google records the permission you grant OttoMiles and may use your IP address to estimate your general location for fraud prevention.
• Apple: the App Store and subscriptions, Sign in with Apple, address search, App Attest.
• Geoapify: place lookups for Pro (Section 5), unless you turn them off. It receives stop coordinates and search radii only, from our server.
• Esri and OpenStreetMap: map imagery in the location editor.
• Linear, GitHub (Microsoft), and Anthropic: feedback you choose to send.
• Cloudflare and GitHub Pages: serve this website and route our email.

We share with each only what that job needs, as described above.

11. Retention and deletion

• Account data (Sections 4 and 5), including stop analysis and place-lookup results, is kept while your account exists. If your Pro subscription lapses, sync stops but your cloud copy is kept so re-subscribing picks up where you left off.
• Stops sent for place lookups: held only while our server processes them, never stored.
• Feedback log bundles: deleted after 30 days. Crash reports: 90 days. Other feedback records: until you ask.
• Per-trip location logs on your device: 30 days, then removed by the app.

To delete your account and everything we hold about you, email [email protected] from the address on your account. We will remove your Firebase account, all synced data, receipt photos, entitlement record, and feedback records (including their copies in our issue tracker) within 30 days and confirm by email. Station statistics already computed (Section 5) are aggregate figures that contain none of your records, so they are not recalculated. An in-app deletion option is coming. You can also ask for a copy of your data or a correction the same way.

12. Security and breaches

We use Google’s encryption in transit and at rest, per-user access rules, and no shared credentials. If a breach affects your personal information, we will notify you and the relevant authorities as North Carolina and other applicable state laws require.

13. Children

OttoMiles is for adults who drive for gig platforms. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.

14. This website

ottomiles.app is a static site served by GitHub Pages behind Cloudflare. It sets no cookies and runs no analytics. Those providers see your IP address and request in their ordinary server logs.

15. Changes

If we change this policy in a way that matters, we will update the date at the top and, for material changes affecting account holders, tell you in the app or by email before they take effect.

16. Contact

Privacy questions and requests: [email protected]. Everything else: [email protected].