Privacy Policy

This policy explains what JoltMile does with your personal data, why, and what rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who is responsible for your data

JoltMile is run by Reeksac, a business based in the United Kingdom, trading as JoltMile. A postal address for the service of documents is available on request from support@joltmile.com. Reeksac is the data controller for the personal data described here, which means we decide what data is collected and why.

For any privacy question, or to exercise any of the rights below, email support@joltmile.com.

What we collect

You give us this directly:

• Account details - your email address, an encrypted form of your password, and a display name if you set one.
• Your records - shifts (dates, times, odometer readings, mileage, earnings and tips, notes), any shift you save as a draft to finish later, expenses and any receipt images you attach, saved postcodes, and your settings.
• Other income you choose to add - money you earn outside the driving, if you enter it: what you called the source and what kind it is, then each payment with its date and amount. For a job, that is the pay before tax plus the tax already deducted from it, which is what lets the tax estimate credit the tax your employer has already paid. Any invoice or receipt you attach is stored the same way as an expense receipt. None of it is required, and leaving it out only means the tax estimate assumes the driving is all you earn.
• Account security events - a record of when a change to your email address was requested, approved, completed or cancelled, with the addresses involved and the IP address it came from. This is what lets us tell you if someone tries to move your account to an address they control.
• Account setup answers - vehicle, fuel and insurance details, and a small number of tax-status questions used only to decide which deadline reminders apply to you.
• Messages you send us - anything you write on the contact form.

Location, in the phone app only. Your location is used only between Start shift and End shift, to measure your business miles and to find the postcode where the shift started and finished. The miles and those two postcodes are kept with the shift. The positions themselves stay on your phone: they are turned into postcodes on the phone, using a postcode directory built into the app, and deleted once that is done. The one exception is a Northern Ireland postcode, which the built-in directory does not cover: then the position is sent to our own server to find the nearest postcode, and it is not stored or logged there. If you allow location Always on an iPhone, it is used for the same thing and nothing more: it lets the app carry on measuring if your phone closes JoltMile during a shift. We never keep a record of where you went, and the app does not use your location when no shift is running. The website does not use your location at all. There are no advertising cookies and no cross-site trackers.

About postcodes. A shift can carry a start, end and return postcode, and you can save postcodes you use often. These are stored with the shift for as long as your account exists, shown in your shift log, and included when you export your data. They are also sent to a lookup service when you ask for a driving distance. They are postcodes only, never a full address and never a live location.

Postcode data. The postcode directory built into the phone app contains OS data © Crown copyright and database right 2026, Royal Mail data © Royal Mail copyright and database right 2026, and data from the Office for National Statistics licensed under the Open Government Licence v3.0.

Cookies and browser storage

JoltMile sets no cookies at all, and there is no consent banner because there is nothing to consent to. Under UK law consent is needed to store or read information on your device beyond what the service you asked for requires - and everything below is exactly that. Our analytics store nothing on your device, so they do not need consent either; they are still described above, because being told about them is a separate right. There is a fuller explanation on the cookie policy page.

What the app keeps on your device (on the website, in your browser's own storage):

• Your sign-in session, so you stay logged in between visits.
• An offline cache of your own shifts, expenses and settings, so the app works without a connection and syncs when you reconnect.
• Small device preferences, such as when you last exported a backup.
• Nothing from the in-app assistant. Its conversations are not stored, here or anywhere else. Close the panel and the conversation is gone.

Deleting the app, or clearing your browser storage, removes all of this. Your account and records on the server are unaffected.

Why we are allowed to use it (lawful basis)

• Performance of a contract - holding your account and records so the app can do what you signed up for.
• Legitimate interests - keeping the service secure, preventing abuse, and fixing faults. We only rely on this where it does not override your rights.
• Legal obligation - keeping records of payments for the period tax law requires.
• Legitimate interests, for analytics - counting page views and page load times so we can tell which parts of the site are slow or unused. This needs no consent because nothing is stored on your device and nothing identifies you or follows you between sites.

We do not sell your data, share it with advertisers, or use it to train any AI model.

Who else processes it

We use a small number of service providers, each of which only ever acts on our instructions:

• Supabase - hosts the database and handles authentication.
• Vercel - hosts and serves the application.
• Google Maps - calculates the driving distance between two postcodes, for example your commute at the end of a shift. Only the postcodes are sent, never your identity or your records.
• postcodes.io - looks up the location of a postcode when the Google Maps route is unavailable, so a distance estimate can still be given. Only the postcode is sent, never your identity or your records. For a Northern Ireland shift in the phone app, our server also sends it the position where the shift started or ended, with nothing else attached, to find the nearest postcode.
• Google Gemini - answers the questions you type into the in-app assistant. What is sent is your question, up to the last two messages of the same conversation, and the Knowledge Centre extracts we picked to answer it. Your name, your email address, your shift records, your earnings and your tax figures are never sent. Questions about your own figures are worked out inside the app and never reach Google at all. We use the paid tier, under which Google does not use what is sent to train its models. Nothing you ask is stored by us.
• Cloudflare - checks that a question to the assistant came from a browser rather than a script, which is what stops the feature being abused. Cloudflare sees your IP address for that check. It runs invisibly and there is nothing for you to click.
• Brevo - delivers the emails we send you: sign-up confirmation, password reset links, email-change approvals and contact-form messages. Brevo sees your email address and the contents of those messages.
• Hostinger - provides the joltmile.com mailbox that support replies come from and go to.
• Apple and Google - take subscription payments made in the app, through the App Store and Google Play, and offer Sign in with Apple and Sign in with Google if you choose them. They handle card details directly; we never see or store your card number.
• RevenueCat - confirms with Apple and Google which app subscriptions are active, so your account is unlocked on every device. It receives an anonymous account identifier and the subscription details, not your name, email address or records.
• Sentry - receives a report when the app crashes, so faults get fixed rather than going unnoticed. Reports are stripped before they are sent: no user identity, no cookies, and none of the figures or postcodes you have entered. Session replay, performance tracing and profiling are all switched off.
• Vercel Analytics and Speed Insights - count page views and measure how quickly pages load. They store nothing on your device, set no cookies, and do not follow you between sites; what they record is the page, the referrer, and coarse device and country information, with no identifier that ties visits together into a profile.

Where your data is held

Your database is hosted in London, United Kingdom (eu-west-2), so your records stay in the United Kingdom.

Some of the providers above operate internationally and may process limited data (such as an email address or a postcode) outside the UK. Where that happens it is covered by the UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

How long we keep it

• While your account is open - your records are kept until you delete them or delete your account.
• After you delete your account - your records are removed immediately and disappear from routine backups within 30 days. Deleting your account does not cancel a subscription: cancel that in your App Store or Google Play account.
• Payment records - kept for six years after the relevant tax year, as UK tax law requires. Apple and Google keep the records of payments made through them, whether or not you delete your JoltMile account. Brevo also keeps a delivery log of emails already sent to you.
• Account security events - the IP address recorded against one is removed after 12 months, and the event itself is kept without it. Finished and cancelled email-change requests, including the old and new addresses, are deleted after 12 months. Long enough to look into somebody trying to take an account over, and no longer.
• Contact messages - kept for up to 12 months so we can follow up on an issue.

Your rights

Under UK GDPR you have the right to:

• Access your data - Settings → Data has a "Download all my data" button that gives you every record held under your account, including your account email address, as a JSON file. If you would rather we sent it to you, email us and we will.
• Correct anything inaccurate - every record in the app is editable.
• Erase your data - delete your account from Settings, which removes your records and your login.
• Restrict or object to how we process it.
• Portability - the backup file in the same place is a machine-readable copy of your driving records that you can take elsewhere, or restore into JoltMile again.
• Withdraw consent where we relied on it.

Email support@joltmile.com to exercise any of these. We will respond within one month.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk.

Security

Data is encrypted in transit. Every record is tied to your account and protected by database-level row security, so one user cannot read another's records even if the app had a bug. Passwords are stored only as a salted hash and are never visible to us.

Children

JoltMile is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you by email. The current subscription price is £7.99 per month, including VAT.