PRE-LAUNCH DOCUMENT

App privacy policy.

Version 1.2 review draft | Updated 11 October 2026 | Effective date pending public-launch approval

Driveable helps independent drivers keep work, vehicle, earnings and expense records. This policy explains what information is handled, why it is needed, where it goes, how long it is kept and the choices available to you. It covers the Driveable mobile app, connected service, browser app and our own website at https://driveable.co.nz/. It does not replace the privacy notices of an app store, your device provider or an external website you choose to visit.

We do not sell your data. We do not sell, rent or trade your personal information, including your location, earnings, expenses or receipts, to advertisers, data brokers, delivery platforms, insurers or other businesses. We do not sell datasets made from your work records, including datasets with identifying details removed. We do not use your records for targeted advertising. Necessary service processing and limited disclosures are explained below; they do not give a provider permission to sell your records.

1 Who is responsible

Hugo McLean, a New Zealand sole trader trading as Driveable, is responsible for the personal information described in this policy. Business/contact address: pending public service address, New Zealand. The same operator collects and holds the information, including when providers store it on our behalf.

Our Privacy Officer can be contacted at support@driveable.co.nz. Please mark privacy requests “Privacy Officer”. General support is available at support@driveable.co.nz and https://driveable.co.nz/support. Please do not send a password, full payment-card number or unnecessary identification in an initial request.

2 A short explanation of the choices

A Driveable account is required to use the app. It stores records with our cloud provider so they can be retrieved after signing in. Supported offline actions save on the device first and upload when the app reconnects and syncs. A successful local save and a successful upload are different events.

Earlier test versions offered a local-only workspace. That option is no longer available. Any earlier local-only records remain separate from signed-in accounts and are not automatically transferred when you sign in. Signed-in offline use still involves later synchronisation; vehicle searches and other online features need a connection.

Receipt recognition reads the selected image on the device. If you then save the photo with an expense in a connected account, the photo is uploaded to private cloud storage as part of synchronisation. Processing a photo locally for recognition is different from saving that photo in your account.

We do not sell personal information or use your work records, receipt contents or precise location for targeted advertising. We do not operate an advertising network or intentionally track you across other companies' apps and websites for advertising. Android scanner diagnostics are explained separately below.

3 Information you provide

Account and access information

For a connected account, we collect your email address and a generated account identifier. Our authentication provider receives the password you submit to authenticate you and handles password protection and verification. The installed app stores sign-in tokens in encrypted device storage. Browser sign-in tokens are held in memory for the current page session and are not saved to localStorage. Offline work records and preferences use separate storage. Do not send passwords to support.

Email and authentication information are required for a Driveable account. If you choose not to supply them, you cannot use the app's account workspace. You can still view the public website without creating an app account. We do not request your IRD number, driver licence number, date of birth, bank login or payment-card details as part of the present account form.

Where enabled, you can sign in with Apple or Google instead of a Driveable password. The provider confirms your identity and shares basic identity details you authorise, including an account identifier, email address and any supplied name. Google login does not request access to Gmail, Drive or Calendar. Apple may provide a private relay address when you choose Hide My Email; Apple controls forwarding to your personal inbox. These providers receive the information needed to complete their sign-in flow, not your Driveable shifts, earnings, receipts or GPS recordings through our login integration.

Driveable's authentication service associates the provider identity with your account. Verified identities may be linked to the same Driveable account when the authentication service matches their verified email address. A private Apple relay address may create a separate account from an existing email login. Check which account you are using before entering records; sharing an email address or choosing a different login button does not guarantee that records will be transferred between accounts.

For Apple login, we capture an Apple authorisation grant and store it encrypted on the server, bound to your Driveable account and Apple client. This lets the account-deletion worker revoke Apple's access tokens before removing the account. Apple signing and grant-encryption keys stay in protected server configuration, not the app. Signing out or removing Driveable from your Apple settings is different from deleting your Driveable records. Use Driveable's account-deletion flow to request record removal.

Work and vehicle records

We process the categories of work and custom service names you enter; vehicle make, model, year, type, fuel or energy type and selected variant; physical odometer readings; work-use assumptions; optional vehicle value; cost inputs; and reminder dates or distances. These details allow us to organise your records and calculate the estimates you ask for.

We process shift start and finish times, distance totals, manual corrections and notes, the vehicle selected, entered earnings and tips, and calculated costs and summaries. These financial and work details can reveal patterns in your activity. There is no automatic bank or delivery-platform feed in the current app.

Expenses and images

We process expense dates, prices, categories, work-use percentages, fuel or energy quantities, notes, linked vehicles or shifts, and any receipt image you attach. Images may contain merchant names, locations, transaction details, partial card numbers or other incidental information. Only provide what is needed for your record. Remove unrelated customer or passenger information before selecting the image.

The receipt photo is optional. You can enter an expense manually without a camera or photo-library permission. Some values are necessary to save a valid expense; others, such as notes and a photo, are optional. Choosing a category does not mean Driveable determines tax eligibility.

Referrals and support

If you use a referral code, we record the code, referring and referred account identifiers, attribution status and any verified reward status. Other participants see their code and summary counts, not your email, identity, detailed purchases, earnings or receipts through the referral screen. We do not upload your contacts. You choose whether and how to send an invitation using the operating system's share sheet.

If you contact us, we receive your message, contact details and any attachments you choose to send. We use them to respond, investigate and keep an appropriate record of the issue. We may record a minimal history of privacy requests, deletion requests and the terms or permissions you accepted to administer them and demonstrate our obligations.

4 Location during a shift

With permission, the installed mobile app accesses precise coordinates, timestamps and accuracy information during an active shift. It uses these on the recording device to estimate distance, reject implausible readings, show recording gaps and recover an interrupted shift.

Recording can continue while you use another app or lock the screen. Taking a break in Driveable pauses the work timer and location recording. Break time and travel are excluded from the shift; tap Resume work to start recording again. Finishing the shift stops recording. Removing permission, disabling location, force-quitting or operating-system restrictions can interrupt recording. If you forget to finish a shift, movements during that still-active shift may continue to be recorded.

Raw coordinates are stored in the recording device's local database. The current sync design sends shift times, total break duration, distance totals, correction notes, the selected vehicle and related earnings/cost records to your connected account; it does not send the raw GPS trail to our application database. A saved distance total is still personal work information, even though it is not a route.

The app removes the raw recording after the completed shift has been successfully saved through its local finish process. An unfinished or unsaved recording may remain on the device until the shift is saved or the relevant app data is erased. Device backups or operating-system services are separate from Driveable's sync and may have their own handling. We do not promise that information processed locally can never be included in a device backup.

Location is not used to monitor private travel outside active shifts, provide advertising, assess insurance or creditworthiness, or automatically report you to a delivery platform or IRD. The browser does not run this background GPS recording. If a future feature would upload routes or use location for a different purpose, we will explain it and obtain any required consent before doing so.

5 Receipt recognition and Android diagnostics

On iPhone, receipt recognition uses Apple's on-device Vision framework. On Android, it uses a bundled Google ML Kit text-recognition model. In the browser, it runs in a local worker using reader files served by Driveable's web host. The current recognition flow does not send the image or recognised text to a remote generative-AI service for analysis.

The recognised text is used to propose editable expense fields. It is not separately saved as an OCR transcript by our application. Saving an expense stores the confirmed fields and, if attached, its image. Discarding a scan does not create a saved expense, although operating-system temporary files or an original photo you already have may remain under your device's controls.

Google's ML Kit Android SDK also reports diagnostic and usage information, including app and device versions, a per-installation identifier, performance and error events, and technical characteristics of recognition requests. Google uses this for SDK diagnostics and usage analytics. This is separate from reading the receipt locally. We do not use that information for advertising. See Google's disclosure at https://developers.google.com/ml-kit/android-data-disclosure and its privacy policy at https://policies.google.com/privacy.

You can choose manual expense entry without using receipt recognition. Camera and photo access can be changed in device settings. Once an image has been attached and uploaded, revoking camera permission does not delete that saved image; use the deletion options or contact the Privacy Officer.

6 Technical information and website storage

When your device connects to our service, our authentication, database, storage, email and website-hosting providers can process ordinary connection information such as IP address, request time, user agent, requested resource, response status and security or error logs. We use relevant operational information to deliver requests, investigate faults, prevent abuse and protect accounts. The selected provider configuration and retention periods are listed in section 12.

The app and browser store session information, settings, local records, queued uploads, receipt caches, search-result caches and unfinished form drafts so the service can work and recover after interruption. Browser storage is not the same as a public server database. Clearing it can sign you out and remove unsynchronised or local-only information.

Driveable's current application does not integrate a separate behavioural advertising, session-replay or marketing analytics service. This does not exclude operational logs, Google ML Kit diagnostics or the app stores' own statistics. The public website separately offers optional Google Analytics measurement. It starts only after the visitor opts in; advertising features are disabled. Work records, earnings, receipt contents and GPS recordings are not sent to that website analytics service. The visitor can change the website choice separately from app permissions. Any future app analytics integration would require a separate notice and review.

7 Vehicle searches and outside services

Online vehicle searches send the make, model, year and other relevant search filters to the selected catalogue service. NZ catalogue requests use NZTA fleet data hosted through Esri ArcGIS. The optional US catalogue uses FuelEconomy.gov. These providers also receive connection information such as the IP address needed to answer the request. They are not sent your Driveable password, account identifier, expenses, earnings or raw GPS trail by this search feature.

The present vehicle search does not request or look up number plates, VINs or registered-owner identities. A future plate-lookup feature would need a separate review and updated explanation before collecting those identifiers.

Opening an IRD, NZTA, store-management or other external link connects you to that provider under its own privacy practices. Information you independently give it is not automatically sent back to Driveable. Review those notices where relevant.

8 Why we use the information

We use information to create and authenticate accounts; store and synchronise records you choose to save; calculate requested estimates and summaries; run shift recording and reminders; show supported widgets; recognise selected receipts; retrieve vehicle matches; respond to support and privacy requests; administer legitimate referral activity; prevent misuse; secure the service; and meet applicable legal obligations.

We limit use to these stated purposes or a compatible or legally permitted purpose. We do not make a tax-deductibility decision, credit decision, employment decision, insurance decision or similar significant legal decision about you. Automated calculations and receipt suggestions are tools you review, not decisions made on behalf of a tax authority or employer.

Providing optional information is voluntary. Without it, the feature needing it may be unavailable or less complete. Contractual acceptance is not blanket consent to every data use. A location, camera, marketing or other permission remains subject to the specific explanation and choice provided for that purpose.

9 Who can receive information

Authorised personnel and service providers may access information only as needed for their relevant work and subject to appropriate confidentiality, security and purpose restrictions. For providers acting for us, we require protections consistent with this policy, applicable law and the app-store requirements. We remain responsible for how we select and manage those providers.

Supabase provides connected-account authentication, the application database and private receipt storage. Apple and Google provide the optional sign-in methods described in section 3; their own account and privacy settings apply to those services. Cloudflare hosts our website and its waitlist service, and stores our encrypted recovery backups in private R2 storage. A private GitHub Actions workflow runs the scheduled backup export; it temporarily processes account data and receipt files to create the encrypted archive. Only the public recovery key is used by that workflow; the private recovery key is kept separately by the operator. The archive is encrypted before it is uploaded to R2. This backup encryption is separate from the ordinary connected-account service and does not mean all app data is end-to-end encrypted. Purelymail provides our account-message delivery and support mailbox. Google's Android scanning diagnostics are described in section 5. Processing locations and retention settings for these providers must be verified before this review draft takes effect.

Where subscription features are enabled, RevenueCat receives the internal Driveable account identifier and purchase information needed to verify and restore Pro access, manage subscription status and provide subscription reporting. That identifier can be linked to your Driveable account; it is not anonymous. Our current integration does not deliberately send RevenueCat your receipt photographs, work earnings, GPS trail, email address or advertising identifier. The app stores process the payment. Testing with RevenueCat's Test Store is separate from a live App Store or Google Play purchase.

UptimeRobot monitors operational health endpoints for account-deletion cleanup and scheduled backups. Its alerts tell Driveable's operator about service failures; recovery emails are disabled. The public health response contains availability status only, not queue counts, customer records, receipt images or GPS points. The operator's alert email and monitoring connection information are processed by that service.

The stores and device providers can process information under their own policies, including downloads, purchases if offered, system permissions, operating-system diagnostics and device backups. For enabled subscription features, the relevant store and RevenueCat may send us a transaction identifier, product, entitlement, renewal, cancellation or refund status. We do not receive complete card details from a store purchase.

We may disclose specific information where required by a valid legal process, reasonably necessary to protect rights or prevent serious harm, or otherwise permitted by law. We assess requests and limit disclosure to what is necessary. There is no routine automatic reporting of your expense records or location to IRD, NZTA, your customers, employers, delivery platforms, advertisers or other drivers.

If the business is sold or reorganised, we may provide necessary information to professional advisers and a successor under confidentiality and appropriate safeguards. We will give relevant notice and preserve applicable privacy rights. Records may transfer only as part of continuing the Driveable service, subject to this no-sale and no-targeted-advertising commitment. This does not permit a separate sale of customer records or repurposing them for unrelated advertising.

10 Overseas handling

The selected Supabase project region is Sydney, Australia. This identifies the primary project hosting region, not a guarantee that every support activity, technical log, subprocessor or backup is confined to Australia. Cloudflare, GitHub, Purelymail, RevenueCat, UptimeRobot and Google's diagnostics may also process information in other countries under their provider arrangements. A website domain or a database location hint does not by itself guarantee that all processing stays in New Zealand or Australia. Provider and retention verification remains a public-launch requirement.

New Zealand's Privacy Act continues to apply to our responsibilities. Where a provider processes information solely on our behalf, we assess that agency arrangement and its safeguards. Where an overseas recipient uses information for its own purposes, we assess the applicable cross-border disclosure rules and safeguards separately. We do not rely on a general acceptance of these terms as an unrestricted waiver of overseas privacy protection.

You can ask the Privacy Officer about material providers and safeguards. Overseas authorities may have lawful access under their local laws. We do not represent that privacy law is identical in every country or that selecting an Australian database region by itself fulfils all New Zealand obligations.

11 Keeping information secure

We use authenticated access, account-based database restrictions, private receipt storage and encrypted network connections for our connected service. Receipt links generated for viewing expire after a short period. Access is limited according to operational need. Security requires ongoing review, provider management, account controls and prompt attention to reported issues; it is not a guarantee against every breach.

Local files, session storage and offline records rely in part on your device or browser security. Driveable does not currently claim separate end-to-end encryption or that all local data is independently encrypted by the app. Use a device passcode, keep software updated and avoid sharing an unlocked device or browser profile. Signing out is not equivalent to erasing every cached local record.

If we learn of a privacy breach, we will assess and respond to it. Where it has caused or is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and affected people as soon as practicable, subject to the lawful exceptions. We will give relevant information about the incident and protective steps. Report suspected exposure promptly to support@driveable.co.nz or the Privacy Officer.

12 How long information is kept

We keep information only for a purpose for which it may lawfully be used. The following schedule applies after the production retention controls have been verified and this policy takes effect. A specific legal hold or statutory obligation can require a narrower set of records to be kept longer; it does not justify retaining every part of an account indefinitely.

The 24-month periods above are service retention commitments, not a statement that legislation requires that exact period. We will not retain a customer's entire account for seven years merely because the customer has their own tax-record duties. You should keep your own durable copies for the period your circumstances require.

13 Access and correction

You can ask whether we hold personal information about you and request access or correction by contacting the Privacy Officer. Tell us enough to locate the information and identify the change or copy you need. We may verify identity proportionately and may ask you to clarify a broad request; do not send government identification unless we explain why it is necessary and provide an appropriate method.

We will respond to access and correction requests as soon as reasonably practicable and within the applicable New Zealand statutory timeframe, normally twenty working days. If a lawful extension or refusal applies, we will explain the reason and your complaint options. If we do not make a requested correction, you may ask for a statement of the correction sought to be attached to the information. We will take the steps required by law.

We will provide available information in an appropriate usable form. This is separate from whether a self-service export button is offered. Information that exists only on your device may need to be retrieved from that device; we cannot obtain a raw GPS record that was never sent to us. We will explain those practical limits rather than claiming to hold information we do not have.

14 Account deletion and local copies

You can initiate deletion in the app's account settings or at https://driveable.co.nz/support#account-deletion, including when you no longer have the app installed. The web page identifies Driveable and explains the request, verification, data removed, exceptions and timing. The support page explains the available request routes; email support if the in-app option is unavailable in your test build. Support remains available if you need assistance.

We will confirm the request is authorised and explain its consequences. Our target is to remove the account and associated active-service records within thirty calendar days of a verified request, subject to a shorter legal deadline or a clearly explained lawful retention requirement. We will confirm completion. Any unavoidable delay will be explained, with a revised timeframe; verification will not be used to unnecessarily frustrate deletion.

Deletion covers the authentication account, profile, vehicles, shifts, expense records, receipt objects and referral information associated with you, except information we specifically need and are legally entitled to retain. We restrict retained information to that purpose and remove or de-identify it when the reason ends. Backup expiry follows section 12; deletion is not a promise of instant physical erasure of every backup copy.

Copies on offline devices, your camera roll, screenshots, exports or backups you control may remain outside our reach. Reconnect devices so account deletion and local cleanup can be applied, or erase the relevant app/browser data yourself. Clear local-only app data to remove a local workspace. Deleting the installed app normally removes its local app storage but does not cancel a subscription or necessarily delete data already saved in a cloud account or platform backup.

If you have an active store subscription, cancel its renewal separately using the store's subscription settings. We do not make waiting until that subscription expires a condition of requesting account deletion. Keep any records you require before confirming deletion.

15 Other choices and permissions

You can change location, camera and photo permissions in device settings. The app only needs the permissions relevant to the feature you choose. Denying a permission can stop that feature but should not prevent access to unrelated records and expense entry. You can disable supported Live Activities or remove a Lock Screen widget through the app or device controls.

A widget or Live Activity may display that a shift is active, elapsed time, recorded kilometres and a recording-status indicator on a locked device. People near the phone may see it. That display does not publish your earnings or receipt contents. Removing the widget does not itself finish the underlying shift; use Finish shift or disable location access when appropriate.

If you separately join our website launch list, Cloudflare stores your email address, signup time, consent version, list status and unsubscribe reference. We use these to send the launch and early-access updates you request. Joining does not create an app account or authorise a payment. You can unsubscribe through a link in an update or ask support@driveable.co.nz to remove you. The website also processes connection details to respond to requests and limit abuse; its application rate-limit records use a keyed, time-windowed value derived from the connection address.

We send necessary account, security, service and request-response messages as part of operating the service. Promotional emails require the permissions applicable to that communication and an effective opt-out. We do not treat an account signup or a receipt upload as permission to send unrelated marketing. Withdrawing a marketing preference does not prevent essential security or service messages.

16 Information about other people and indirect collection

Driveable is intended for your own work records. Do not use notes or receipt images to create a customer, passenger or employee database. If you provide someone else's personal information, have an appropriate basis to do so and give them any notice you are responsible for providing.

We may receive information indirectly through a receipt, an authorised representative, a support report, a referral attribution or a store billing notification when subscription features are enabled. We assess whether collecting and using it is necessary and lawful. Where New Zealand's indirect-collection notification requirements apply, we take reasonable steps to notify the person of the collection, purpose, recipients, responsible organisation and access/correction rights, or document an applicable exception. We do not assume that putting this policy on a website alone satisfies every notification requirement.

We use third-party information only for the relevant stated purpose and take steps to remove unnecessary sensitive information when it is brought to our attention. Contact the Privacy Officer if your information appears in another person's record and you have a privacy concern.

17 Children and availability

Driveable is intended for people aged 18 and over. It is not directed to children and does not intentionally request children's personal information. If you believe a child has created an account or provided personal information, contact the Privacy Officer so we can assess and address it. A store content rating is separate from the age required to enter our service agreement.

Driveable is offered in New Zealand only. If another country's mandatory privacy law nevertheless applies to information we handle, nothing in this policy removes the rights it gives you. Contact the Privacy Officer to exercise them. Any future expansion into other countries or material change to the audience requires a fresh privacy and legal assessment and an updated policy.

18 Changes and complaints

We may update this policy to reflect changes in the service, providers or law. We will show the effective date and explain material changes through an appropriate in-app or account notice before a new material use begins, where practicable. We will obtain fresh consent where required. An updated notice does not authorise us to retroactively use data for an incompatible purpose without a valid basis.

Contact the Privacy Officer first if you have a concern; we will investigate and respond. You may also complain to the Office of the New Zealand Privacy Commissioner at https://www.privacy.org.nz/your-rights/making-a-complaint/ or use other rights available under applicable law. You do not need our permission to contact a regulator.