Privacy Policy

Table of Contents

• What Information ApexTracker Handles
• What Stays on Your Device (and in Your iCloud)
• What is Sent to ApexTracker Servers
• Third-Party Services We Rely On
• Permissions the App Requests
• How We Use Information
• Mapping Platform & Acceptable Use
• Data Retention & Deletion
• Security
• Your Privacy Rights
• Children's Privacy
• International Users
• Changes to This Policy
• Contact Us

1. What Information ApexTracker Handles

1.1 Information You Provide Directly

In the App (kept on your device, synced through your iCloud):

• Motorcycle profile: make, model, year, VIN, nickname, tank capacity, mileage, photos
• Maintenance records: services performed, dates, mileage, costs, notes, receipt photos
• Saved addresses and saved routes
• Imported GPX route files
• App settings and preferences (units, voice guidance, weather alert thresholds, map layers, etc.)

On the Website:

• Beta program signup form: name, email address, motorcycle ownership information, riding experience level, intended use case
• Contact form: name, email, message contents, and any attachments you choose to send

If you contact support:

• Your email address and the contents of your correspondence
• Any logs, screenshots, or device details you voluntarily share

1.2 Information the App Generates Automatically

Ride data (stored on your device):

• GPS coordinates, speed, heading, and elevation captured while a ride is recording (the recorded track is not synced to iCloud). Live ride sharing sends current location and other ride information separately when enabled (section 3.3)
• Motion-sensor data: lean angle, acceleration, gyroscope readings used to compute riding dynamics (kept only on the recording device; not synced to iCloud)
• Trip duration, distance, ride stats, scores, and summaries (synced through your own iCloud when iCloud sync is available)

Identifiers used for services:

• Live ride sharing creates a random token for each share. It connects the updates for that ride and grants access through the link; it is not a persistent device identifier.

Diagnostics and crash reports:

• The App does not include a separate crash-reporting SDK. Mapbox SDKs process location, usage, and diagnostic information as described in section 4. If you have enabled Apple's "Share iPhone Analytics" in iOS Settings, crash reports may be shared with Apple and, through Apple, with us in aggregated form. That is controlled entirely by your iOS settings, not by the App.

1.3 Information We Do Not Collect

• We do not require, and the App does not create, an ApexTracker account. There is no username or password to register.
• We do not request the iOS Advertising Identifier (IDFA). We do not use live ride information for advertising or cross-app tracking. Mapbox's processing is described in section 4.
• We do not upload your contacts list. If you grant Contacts permission, the App searches it on-device. Selecting a contact address sends that address to Mapbox to find its coordinates. If you navigate there with Share live ride enabled, the destination name (which can include the contact's name and address label) and coordinates are included in the shared ride (section 3.3).
• The App does not read or write Apple HealthKit data and collects no heart-rate or fitness values.

2. What Stays on Your Device (and in Your iCloud)

ApexTracker is designed local-first. The following records are stored on your iPhone. This does not mean that all of their information stays on-device: the features described in sections 3 and 4 send selected information to our servers or service providers, including live ride information when you enable sharing.

• Every ride you record (GPS tracks, lean angle, speed, route)
• Motorcycles in your garage (including VINs and photos)
• Maintenance records, service schedules, and receipt images
• Saved addresses, saved routes, and imported GPX routes
• App preferences and trip-session state

iCloud sync (CloudKit):By default, the App uses Apple's CloudKit so that your garage, maintenance records, saved places, and ride summaries are available across the Apple devices signed into your iCloud account. Detailed GPS tracks and motion-sensor samples are not synced: they remain on the iPhone that recorded them, so deleting the App or losing that device removes them. This sync happens through Apple's infrastructure and Apple's privacy terms apply to it. ApexTracker does nothave access to your iCloud database, cannot read its contents, and does not store a copy on our servers. If iCloud sync fails or is unavailable, the App falls back to a local-only database. You can disable iCloud sync for ApexTracker at any time from your iOS Settings > Apple ID > iCloud.

Receipt OCR:When you scan a maintenance receipt with the camera, text recognition runs on-device using Apple's Vision framework. The image and the extracted text never leave your phone (other than through your own iCloud sync).

3. What is Sent to ApexTracker Servers

ApexTracker operates two small backends. A Cloudflare Worker at apextracker-api.onemoretab.softwareserves the Website's service-status page. A self-hosted routing service at api.apextracker.app generates Round Trip routes, receives route feedback, and relays live ride information. What each receives is described below:

3.1 Round Trip Route Generation

• When you plan a Round Trip, the App sends your starting point, the distance you asked for, the riding profile, route preferences, and any remembered road locations to avoid to our routing service, which returns the loop. A start point is required — a route cannot be planned without knowing where it starts.
• What is not sent: your name, email, Apple ID, motorcycle details, maintenance records, or your complete recorded ride history. Remembered road locations can come from earlier rides you rated.
• What we keep.Round Trip is new, and we check the quality of the loops it produces so we can find and fix bad ones. For that we log the shape of each generated route — its length, how much of it doubles back, how twisty it is, and similar measurements — together with the settings you chose.
• Your starting point is deliberately blurred before it is stored. We reduce it to a grid cell roughly 5 km (3 miles) across and keep only that cell, never the precise coordinate. This is coarse enough that it identifies a general area rather than an address, and it exists so that a poor route can be regenerated for diagnosis in the same road network.
• The application's route-quality log entries contain no name, device identifier, or account. Quality and feedback entries can be correlated using the route seed, settings, and coarse starting area to diagnose a route. They are retained for a short operational window and are used only to improve route quality.

Optional route feedback: When you submit a Round Trip rating, the App sends the star rating, selected issue categories, ride distance, and, when available, the route seed, riding profile, and precise starting coordinate to our routing service. The service reduces the starting coordinate to the same coarse grid cell for its route-quality log.

3.2 Operational Logs and Rate Limiting

• Like any web service, our Cloudflare Worker logs request metadata (path, status code, IP address, timestamp) for security, abuse prevention, and rate limiting. These logs are retained briefly and are not used to build a profile of you.

3.3 Share Live Ride

• Your choice:Share live ride is a Pro feature and is off by default. You enable it in Settings > Safety & privacy > Share live ride and confirm Enable. iOS 2.2.1 (5) requires this confirmation again if you enabled sharing in an earlier release. While it remains enabled, starting navigation starts sharing automatically, whether or not you send the link to anyone. Enabling it does not upload your saved ride history.
• What is sent: A random sharing token and your precise latitude and longitude, with heading, speed, estimated time to arrival, and remaining distance when available. Updates are sent approximately every five seconds during navigation. The initial updates also include the destination name and coordinates, the planned route geometry when available, and your rider display name if you have set one. These details are retried until an update succeeds. The server adds start and update timestamps and the sharing status.
• Where it goes: The App sends these updates over HTTPS to our self-hosted service at api.apextracker.app, which uses Redis to hold the latest update and the sharing details. The viewer at apextracker.app/live/ is hosted on Vercel, receives data from that service, and uses Mapbox to display the map. Our hosting and network providers process the requests needed to deliver this feature.
• Who can access it: Anyone who has the link can access the shared ride information without an account or sign-in, including someone to whom a recipient forwards it. The map displays your position, planned route, destination name, rider name if provided, ETA, and remaining distance. The data delivered to the viewer also includes the other fields listed above, even when they are not displayed on the map. Treat the link as sensitive; it does not restrict access to named recipients.
• Stopping: In iOS 2.2.1 (5), turn off Share live ride or end navigation to stop collecting new sharing samples. Turning the switch off also prevents sharing on later navigation sessions. An update already in transit may finish before the App sends its end request; end delivery is retried briefly and depends on connectivity. In versions through iOS 2.2.1 (4), the switch alone does not stop a share already in progress: end navigation as well. Stopping does not immediately erase the last server record or information already received by a viewer. See section 8.

4. Third-Party Services We Rely On

The App, Website, and our backends use the following services. Each service's own privacy policy applies to the information it receives.

• Mapbox — Map tiles, search, geocoding, directions, voice guidance, and round-trip routing. The App sends your location, search queries, and selected origin/destination/waypoints to Mapbox in order to render maps and produce routes. See Mapbox Privacy Policy.
• Mapbox SDK telemetry:The App's Mapbox SDKs also process location, usage, and diagnostic data. Mapbox's Maps SDK sends de-identified location and usage data by default when the App causes it to be gathered. Its map attribution control provides a telemetry opt-out. See Mapbox's telemetry documentation. This processing is separate from Share live ride.
• Apple WeatherKit— Current conditions, forecasts, and severe-weather alerts along your route. Coordinates are sent to Apple's WeatherKit service. See Apple Privacy Policy.
• Open-Meteo — Used as a fallback weather provider when WeatherKit is unavailable. Coordinates are sent to api.open-meteo.com.
• NHTSA vPIC — The public U.S. government VIN-decoder API (vpic.nhtsa.dot.gov) is used only to decode a VIN you enter into its year, make, and model. The App sends only the VIN. The App does not look up or check for vehicle recalls.
• Manufacturer maintenance schedules— When you ask the App to look up a factory service schedule, it fetches the public schedule page for your motorcycle's make, model, and year (from maintenanceschedule.com). This fetch happens only when you initiate it, respects the site's robots.txt, and identifies itself with a User-Agent that names ApexTracker. Only the make, model, and year are sent; nothing about you or your rides is included.
• Ride Conditions data feeds — The optional Ride Conditions overlay shows wildfire, smoke, air-quality, and precipitation-radar information on the map. To load it, the App sends the coordinates of the map area or route you are viewing to these public data providers: NASA FIRMS (satellite fire detections), NIFC (National Interagency Fire Center wildfire perimeters), AirNow (U.S. EPA air-quality index), and RainViewer (precipitation radar tiles). None of these requests include your name, device ID, or ride history. The NASA FIRMS and AirNow feeds are accessed with free public API keys that ship inside the App; these keys grant read-only access to public environmental data.
• Apple App Store / StoreKit — Subscription transactions for ApexTracker Pro are processed entirely by Apple. ApexTracker never sees your payment details. Apple provides us with anonymous transaction status used to determine your entitlement.
• Apple iCloud (CloudKit) — Used to sync your App data across your own Apple devices. Operated by Apple under your iCloud account.
• Cloudflare — Hosts the Worker API at apextracker-api.onemoretab.software and provides its protection and KV-backed rate limiting.
• Vercel and Fortinet FortiAppSec — Vercel hosts the Website, including the live ride viewer. FortiAppSec provides network protection for our self-hosted service at api.apextracker.app. Requests to the viewer and relay include standard web request information such as IP address and requested URL; a live-viewer URL contains the sharing token. This is separate from the Cloudflare Worker.

Switchback (switchback.apextracker.app): Our companion trip-planning website is a separate browser-based service. When you visit it, standard web request data (IP address, user agent, requested URL) is processed by our hosting and edge providers. Routes you build in Switchback can be exported as GPX and imported into the App; nothing is automatically pushed from Switchback into your ApexTracker data unless you import it yourself.

5. Permissions the App Requests

iOS will prompt you before granting each of the following. You can review or revoke any of them later in Settings > Privacy & Security or Settings > ApexTracker.

• Location (When In Use and Always, with Precise Location):Required to record rides, provide turn-by-turn navigation, find nearby points of interest and fuel stops, and trigger weather alerts along your route. "Always" access is needed to keep recording while the App is in the background or your phone is locked. Location is not used when no ride or navigation session is active and you are not on the Navigate tab.
• Motion & Fitness: Required to compute lean angle, acceleration, and other riding-dynamics metrics during a ride.
• Camera: Used to scan maintenance receipts. Text extraction runs on-device.
• Photo Library: Used to attach images to ride logs and maintenance records.
• Contacts: Optional. Lets you pick a navigation destination by searching your contacts. Matching happens on-device; a selected address is resolved by Mapbox, and its destination name and coordinates are shared if Share live ride is enabled (sections 1.3 and 3.3).
• Notifications: Used for maintenance reminders, weather alerts, and trip-session resumption prompts.
• Background modes: Location (continuous ride/navigation tracking), audio (uninterrupted voice prompts), and remote notifications (timely reminders).
• CarPlay: Lets the App display navigation and ride status on supported in-vehicle displays.

6. How We Use Information

We use information only to operate and improve the App, and only as described above. Specifically, we use information to:

• Run the features you invoke (record a ride, navigate to a destination, scan a receipt, fetch a forecast, load ride conditions, and share a live ride)
• Enforce rate limits on our API to prevent abuse
• Respond to support requests and beta-program enrollment
• Comply with legal obligations and protect the safety of riders, our users, and the public

7. Mapping Platform & Acceptable Use

ApexTracker's map, search, routing, and round-trip features are powered by Mapbox. By using the App you agree to comply with Mapbox's end-user terms in addition to ApexTracker's Terms of Service. In particular, you agree not to:

• Scrape, mass-download, redistribute, or cache map tiles, search results, route geometry, or other Mapbox content outside of the App's normal use
• Reverse-engineer or extract API keys from the App or its network traffic
• Use the App for real-time fleet tracking, dispatch, or other commercial use cases that require a separate Mapbox plan
• Use ApexTracker, its API, or any third-party services it relies on (Mapbox, NHTSA, etc.) to harass, defraud, or endanger any person, or to violate any law
• Attempt to circumvent rate limits, authentication, or other security controls on our API

ApexTracker provides navigation, weather, and ride-conditions features as aids to a properly licensed and equipped rider. They are not a substitute for safe riding practices, attention to road conditions, or local traffic law. You ride at your own risk.

8. Data Retention & Deletion

• On-device data:Persists until you delete it from within the App or uninstall the App. Uninstalling removes the local database; data already synced to your iCloud will remain in iCloud unless you also remove it from iCloud (Settings > Apple ID > iCloud > Manage Storage > ApexTracker).
• Beta signup / contact form submissions: Retained while we are running the beta and responding to your inquiry, then deleted on request or when no longer needed.
• Round Trip route-quality logs:The blurred (~5 km cell) start area, the settings you chose, and measurements of the generated route's shape. Retained for a short operational window (typically 30 days or less) and used only to find and fix poor routes. Not linked to you or to any device.
• Live ride sharing: The relay stores the latest position and sharing details, replacing the position on each update. The active Redis record expires about 15 minutes after its last update, or about five minutes after the relay receives an end request. Ending navigation does not delete it immediately. The last record can remain accessible through the link after the ride ends or updates stop. The updated web viewer hides position, route, name, and ETA when sharing ends, expires, or no fresh update is received for about 20 seconds. This display safeguard does not delete the server record or recall information already received or saved by a recipient. Redis also writes recovery snapshots to disk. A snapshot can persist after the active record expires, including while the service is idle; link expiry is not a guarantee of deletion from those files. Requests can also create operational logs containing IP addresses, timestamps and request URLs, which may include the sharing token. Snapshot files and operational logs have retention separate from the active record, including logs held by hosting and network providers.
• API request logs: Retained for a short operational window (typically 30 days or less) for abuse prevention and debugging.

9. Security

• All network requests from the App use HTTPS/TLS.
• Private credentials are held server-side and are never embedded in the App.
• The App does ship a small number of publishablekeys by design: a Mapbox public access token (restricted to the App's bundle identifier and usable only for map, search, and routing requests), and the free public API keys for the NASA FIRMS fire feed and the AirNow air-quality feed. These keys provide read-only access to map and public environmental data; they cannot be used to reach any personal information.
• Live-sharing reads are accessible using the token in the link without an application key or sign-in. App requests to update or end a share require an application key included in the App. Because anything shipped in an app can be extracted, we treat that key as an identifier rather than a secret: our servers enforce rate limits and abuse controls.
• Data on your device is protected by iOS's Data Protection (file-level encryption tied to your device passcode/biometrics). We strongly recommend enabling a passcode and Face ID/Touch ID.
• iCloud sync is encrypted in transit and at rest by Apple.

No system is perfectly secure. If we become aware of a breach involving personal information that we hold, we will notify affected users and applicable regulators in line with the timelines required by law.

10. Your Privacy Rights

10.1 Universal Controls (no request needed)

• View, edit, or delete in-app data: Garage, Rides, Service, and Settings tabs let you remove individual motorcycles, rides, maintenance records, saved addresses, etc.
• Export your data:Use Settings > Export Data to produce a portable copy of your records.
• Disable iCloud sync:iOS Settings > Apple ID > iCloud > Apps Using iCloud > ApexTracker.
• Revoke any permission:iOS Settings > ApexTracker.
• Disable weather alerts or the Ride Conditions overlay: Settings tab and map Layers panel inside the App.
• Stop live ride sharing:In iOS 2.2.1 (5), turn off Settings > Safety & privacy > Share live ride or end navigation to stop new sharing samples. On older versions, end navigation as well as turning the switch off. See sections 3.3 and 8 for delivery and retention limits.
• Cancel your subscription:Settings > Manage Subscription, which opens Apple's subscription manager.
• Uninstall the App:Removes the local database. Combine with disabling iCloud sync (or removing the App's iCloud data) to fully clear your records.

10.2 Rights Under GDPR, UK GDPR, and Similar Laws

If you are in the EEA, the United Kingdom, Switzerland, or another jurisdiction with comparable data-protection laws, you have the right to:

• Access the personal information we hold about you (which is generally limited to beta-signup, contact-form, support, live-sharing records while retained, and route feedback)
• Have inaccurate information corrected
• Request erasure of your information
• Object to or restrict processing
• Receive a copy of your information in a portable format
• Withdraw any consent you previously granted
• Lodge a complaint with your local supervisory authority

The legal bases on which we rely are: performance of a contract (providing the service you requested), our legitimate interests (security, abuse prevention, product improvement), your consent (where required for permissions or marketing emails), and compliance with legal obligations.

10.3 Rights Under the CCPA / CPRA (California)

California residents have the right to know what personal information we collect and disclose, to request deletion of personal information we hold, to correct inaccurate information, to limit use of sensitive personal information, and to not be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising.

10.4 How to Exercise These Rights

Email hello@onemoretab.software from the address associated with your request. We aim to respond within 30 days. We may need to verify your identity before acting on a request. Most App data lives on your device or in your iCloud and is not in our possession; we will tell you if a request is outside our reach and how to act on it yourself.

11. Children's Privacy

ApexTracker is intended for licensed motorcyclists. The App and Website are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

12. International Users

ApexTracker is operated from the United States. If you use the App or Website from outside the United States, information described in this policy may be processed in the United States and in the regions where our service providers operate (including Cloudflare's global edge network, Vercel, Fortinet, Mapbox, and Apple). Where required, we rely on appropriate transfer mechanisms (such as the Standard Contractual Clauses) for international transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top and, for material changes, post a notice in the App or on the Website. Your continued use after the change takes effect indicates acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, our data practices, or you would like to exercise a privacy right, please contact us:

Acknowledgment

By using ApexTracker, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. If you do not agree, please do not use our services.

Document Version 2.5 · Effective October 17, 2026 · Last reviewed October 17, 2026