Draft for the owner's review. Not yet the published policy.
Privacy
Vetta is built so that how you drive stays yours. Most of what the app knows never leaves your phone. This page lists everything that does, where it goes, and how to remove it.
On your phone only
- Your drives: position, speed, g-forces, banking, bumps and roughness every 5 m. Saved in the app's storage on the phone. They are never uploaded unless you share one yourself.
- Privacy zones (home zones) you set (home, work). Inside one, nothing is recorded or shared and convoys don't see you. They stay on the phone, except while you show yourself on the map to friends or crews: then a copy goes to our server so it can refuse a position inside one too. When you add or change a zone, the position it held is deleted. The copy is deleted when you choose Nobody.
- Spots you save, until you share one. A photo you add to a spot is redrawn without its location, time and camera details and never leaves the phone, even when you share the spot.
- Recent destinations. Never uploaded.
- Your notes from a recce drive and the calls you changed. Never uploaded.
- Crash check contact: the name and number you enter. Used only to open a text to them, which you send, after a hard impact. Never uploaded.
- Voice: notes are spoken by a voice model that runs on the phone. No audio is recorded or sent.
- Settings and your route history.
If you make an account
Signing in is optional. The cockpit, routing, recording and the Log all work without an account.
- From Google sign-in: your Google account id, email address and display name. Your display name is shown only to you and to friends you accept; everyone else sees your handle.
- What you add: your handle, friends, blocks, crews, garage cars, shared spots and ratings, messages you write in a crew's chat (seen by that crew's members; what was written while a crew was private stays with those who were in it then, never shown to someone who joins after it goes public; deleted after 30 days), your position on the friends map only if you choose who sees you (your friends, or your private crews, never a public crew's members; sent while you drive, held back by the delay you pick, snapped to a one-mile grid unless you choose Exact, kept no longer than the delay needs and deleted when you choose Nobody), a build thread for a car (its steps, parts, photos and the Vetta Score of a drive you pick for a step; seen by whoever sees that car) and replies you write on others', photos you add (a profile photo, your cars' photos; redrawn on the phone before upload, which drops where and when they were taken and the camera details, and checked again on our server; seen only by members who can see what it belongs to (a car's photos by those who see the car, a crew's by its members; a profile photo by any signed-in member), and a report hides one from you at once, and from everyone while it's looked at; removing one deletes it), roadbooks (the roads you put in them, as shapes you planned, never drives; a public one shows your handle; that you have driven one of a roadbook's roads is worked out on your phone from your Log and stored without your account id), results you share (each friend and each private crew you're in sees your Scores and times unless you switch it off for them (since 11 November 2026, friends and crews you already had too), which you can for each one; a public crew sees nothing until you say yes when joining, and when a private crew you're in is made public, what you shared with it (Scores, times, planned routes, stages and the rough area you drive from) stops being shared with it until you say yes again; on a stage: your best Vetta Score and the date of each day you drove it, so friends can see who drove it most this month; times only if you share times; to a crew you share Scores with, each drive's Vetta Score and its date, never where or how fast, added up on the crew's Score board and deleted when you stop sharing, leave the crew or close your account), duels you send or accept with a friend (the stage, how many days and whether it was accepted; it compares only the Vetta Scores each of you already shares with the other, and your time there only if you share times with them (a time duel is decided by it), and is deleted 60 days after it ends), and reports you file. Kudos you give (a tap, no text) are seen by the person who drove; kudos are kept 90 days. An accepted friend can open your profile, which shows only what you already share with them: your name, cars you show friends, crews you share, and stages whose scores you share with them.
- Saved routes and pinned places (Home, Work and places you name), so they are on every phone you sign in on: with the account's switch Saved routes and places on my account on (it starts on), each one you save, pin or remove on a phone is copied to your account, and your other phones take it from there. Only you see them, never friends or crews. Switching it off deletes the account's copy and keeps the phone's; a removed one is kept as a removal for 60 days so your other phones learn it went, then deleted. Signed out, they stay on the phone only.
- Sign-in sessions, which expire after 30 days without use.
Road data (only if you turn it on)
With Road data switched on, the app helps map how roads feel. What is sent is the map's road id, the direction, a 5 m section number on that road, and four road measurements for it (roughness, banking, crest and bumps), plus that road's own line and kind (a highway, a back road) as drawn on the public map (OpenStreetMap), so the coverage map can show which roads are measured. With each 5 m section also go how steadily you drove it (a ratio worked out on the phone: 1 for an even pace, 0 for stop-start; it holds no speed) and whether you braked hard there with no corner ahead, so routes can favour roads members drive smoothly; and whether the phone felt a sharp bump there (yes or no), so a pothole that several members felt can be called out ahead on a planned route (each person counted once per spot, never who); and whether it came from a drive you recorded with Start, so a road members come back to on a second recorded drive can count as loved (each person counted once per road, never who). Never your position, your path, speeds or times. (Busy times of day per road would need the hour of each drive; that stays off unless the owner decides otherwise, and this page will say so first.) A random 0.5 to 1.5 km at each end of every trip is never sent, nor anything inside a privacy zone, nor residential and service roads. Where there is no signal, the sections not yet sent wait on the phone (the part of the trip between those private ends, for at most 13 days) and go when signal is back, only if Road data is still on; Erase everything removes them, and so do signing out, deleting your account and switching Road data off. Once merged into a road's averages, road data is anonymous and is not deleted with your account. A through road's averages (highways, main and secondary roads, and long back roads) are shown to other members from the first drive, marked as less sure; any other road only once at least two different people have driven it that way, so a lane nobody else drives never shows yours. Members see how sure a road's numbers are, never how many people or drives measured it. Your account keeps how many km of road data you shared each month, and how many you were first to map, for your challenges; your crews see only the total of all their members. It is deleted with your account.
Fair meeting points (a crew switch, off by default)
On a crew's page, Share my rough area for fair meeting points sends that crew's server the square about 11 km across (a tenth of a degree) that your Home pin is in, or, with no Home pinned, the square the phone is in when you switch it on, worked out on the phone; never Home or the position itself, which stay on the phone. When someone plans a crew drive, Fair for the crew gets the squares of the members who switched it on, without names, and only once two members other than the one planning have (your own square never counts toward the two), and picks the place with the shortest longest drive for everyone, using the public routing server with the squares' centres. Switching it off or leaving the crew deletes it.
Your car, your time, and who's aboard (route planning)
- Fuel and range you add to a car in the Garage are kept with your car, never shown to friends, and used to plan fuel stops on long stretches.
- Chargers for an electric car are looked up through our server, which asks the US Department of Energy's station list for the squares (about 25 km) your route passes through, never the route; our server keeps no record of the request.
- My free time (the app only): when you tap it, iOS asks you for calendar access; the app then reads only when your next event starts, to size a loop that gets you back before it. Never its title, place, notes or who's invited, and nothing leaves the phone.
- This album (the app only): when you tap it, iOS asks you for media library access; the app reads how long the album you're playing has left. Nothing leaves the phone.
- For this drive (Passenger aboard, Lit roads at night, Cyclist courtesy, Tunnels) and how technical a route to offer, from your own drives' Score, stay on the phone. Lighting, tunnels, cycle routes and fuel stations come from OpenStreetMap (Overpass) for map squares, the way cameras do.
Convoys
In a convoy you joined, the other cars see your live position, heading and handle while the convoy runs. Positions are kept in memory only and are gone when the convoy ends. A convoy ends after two hours unless its leader keeps it going (an hour at a time, six hours at most); everyone in it is told when that happens, and you can leave at any time. Nothing is sent from inside a privacy zone.
Shared arrival times
When you share your ETA, anyone with the link sees your handle and when you'll arrive, refreshed about once a minute while you drive. Never where you are, your route or where you're going. It ends when you arrive or stop it, or after 4 hours, and is deleted a day later.
Crew drives
When you plan a drive for a crew, its name, time, meeting point and notes are seen by that crew's members, with who planned it and who's going (by handle). A public crew can list a drive as a meet: then members within about 80 km also see its name, time, meeting point and how many are going, never who. When you start or join a drive's convoy from its card, or say you were there afterwards, the crew's members see that you came (by handle, never where you were), and the drive shows the Vetta Scores crew-mates who came had already shared with the crew that day: the best one, and a results sheet with each one's best Score on each stage, and their time on it if they share times with the crew. It is all deleted a week after the drive starts, or with your account.
Drive posts
When you post a drive (Post, on the card after a drive), your friends, or the one crew you post it to, see its name, the day, its length, its Vetta Score, the roads it used, what you wrote, and a line of its shape. The line never shows where the drive started or ended: anything inside your privacy zones is cut from both ends on your phone, then 500 m more, and the server cuts 500 m again. Never a time along it or your speed. A photo or clip you add goes with it to the same people: a photo is redrawn on your phone first, which drops where it was taken. They can give it kudos and comment; you can delete your post, and any comment on it. Posts, kudos and comments are deleted with your account.
Notifications
If you turn on Notifications (Garage, Settings), your phone gives Vetta a token Apple uses to deliver them, and we keep it while you are signed in: it goes when you turn them off, sign out or delete your account. A notification says who did what (a friend request, kudos, a comment on your drive, a duel, a crew drive), never what a comment says, a place or a time, and none come while you drive.
Scores and times with friends and crews
With an account, your friends and the private crews you start or join see your Vetta Scores and your times on the stages you drive, by your handle. This is on from the start: switch it off, or keep Scores and drop times, for any friend or crew in Who sees what. A public crew sees them only if you say yes when you join, and a crew that goes public stops seeing them until you say yes again. Never the drive itself: not where you went, your route or your speed. They are deleted with your account.
Weekly time attack
Where to? shows your area's time attack loop this week, which Vetta picks from the area's best roads. To find your area the app sends only the middle of the quarter-degree square you are in (about 28 by 22 km), never where you are. If you put one of your stages up, members can see its name, its line and your handle. If you enter a week, the stage is copied into your Stages and your quickest time on it that week, with that run's Vetta Score and its date, is seen by every member by your handle (never by people you blocked or who blocked you). Take my time off removes it. Times are deleted after eight weeks, or with your account.
Shared routes
When you share a planned route, its shape (without the first 400 m) and name go to the friends and crews you pick, for 30 days or until you delete it. Never a recorded drive.
Road links
Send the road (on a drive's page in the Log) makes a link to the road you drove: a few points along it, about a metre apart at best, and its name when a road named it. Never the drive itself: not its first or last 800 m (usually home and work), its date or time, speeds, Score, or who drove it. The road is written into the link, so nothing is stored on our server to make it, and on the website it sits after the # of the address, which browsers don't send to any server. Whoever opens it sees the road as a route; routing it asks the route server named below, as any route does.
Hazard reports
When you report a hazard (pothole, gravel, police…), its kind, the spot where you were and the direction you were travelling are shown to other members nearby until it expires (30 minutes to 7 days by kind). They never see who reported it. "Still there?" answers are counted the same way.
Hazards, meets and crews near you
To show reported hazards while you drive, meets near you and crews near you, the app asks our server about the area you're in: a square about 11 km across (a tenth of a degree), never your position. It works out which are nearest on the phone. Nothing is asked from inside a privacy zone, nor in the first km of a drive. When a drive starts on a planned route, or you save a route for offline or open a saved one with signal, the app also asks about the squares the route runs through, so reports are still known where there is no signal (a saved route keeps them on your phone with the route, and drops them when you remove it); never the squares where the route starts or ends, nor one with a privacy zone in it. The server keeps no record of what was asked, and its request logs don't keep the address of a request.
App health counts (switch in Garage → Settings → Your data)
Once a day the app sends yesterday's totals of a few events, such as routes found or failed, road uploads that failed and how long the phone mount took to set, so problems get fixed. No account, phone, position or time of day is in them, and no session is sent with them. Totals are kept 90 days. Turn it off and nothing is counted or sent.
The app also asks the server, a few times a day, which of its features are switched on. With that it sends the app's version and a random number this phone made up, used only to pick a share of phones when a feature is tried out on some first. The server doesn't keep either.
Feedback (Garage → Settings → Feedback)
What you write is sent to the person who makes Vetta, with, if you leave the box ticked, the app's version, the kind of device, screen size, language and how many errors the app saw since you opened it. Never your position, drives or contacts. Your handle is sent only if you are signed in and ask for a reply. Feedback is kept 180 days.
Crash reports
If the app hits an error, it sends the error message and where in the app it happened, with numbers, emails and links removed. Nothing in it identifies you. When a Fun, Long way or loop route can't be planned, it sends only why (for example "off the map" or "map didn't load"), never where. If the iPhone app itself crashes or freezes, iOS hands it a report on a later launch and it sends what kind of crash it was, the app's build and where in the app's code it stopped. Never a position, a name or a drive. Daily counts are kept for 30 days.
Services the app talks to
To draw maps and plan routes the app asks these services directly. They see your phone's internet address and what is asked of them:
- Map tiles: OpenFreeMap (map area on screen). Terrain: Amazon Web Services public terrain tiles.
- Routing and map matching: the public Valhalla server (openstreetmap.de) and OSRM. They receive the start, end and stops of a route you plan, the route lines they planned for it (to read those roads' speed limits, signals and kind of road; good roads nearby that the map suggests, which are the same for everyone, are asked through our server, which keeps the answer a few days with nothing about you), and, when the Log matches a drive to roads, that drive's track with its first and last km removed.
- Search: Photon (komoot) and Nominatim (OpenStreetMap) for what you type in Where to?. To name the town on the map, and a map area you save for offline, Nominatim receives that place rounded to about 1 km.
- Road names and features: Overpass (OpenStreetMap; the public servers, including VK Maps' maps.mail.ru). To rank a route you plan, they receive the map squares (about 5 km across) its candidate routes cross, never the route itself, and return the roads, signals, signs, limits and fuel stations in them; which of those your route uses is worked out on the phone. To weigh members' road data into a route, the app asks our server for the measured roads in the squares about 11 km across (a tenth of a degree) the routes cross, never the route or its roads.
- Car lookup: NHTSA's vehicle database (US Department of Transportation), only when you look a car up in the Garage. It receives the VIN or the make and year you typed.
- Weather: Open-Meteo, for the forecast along a route you plan. It receives six points along the route, and, to weigh routes against each other, the centres of the 5 km squares they pass through. For the weather word on the map (Rain, Wet roads, Dry), Open-Meteo and the US National Weather Service (api.weather.gov) receive where you are rounded to about 1 km, at most every 20 minutes; nothing else, and no account.
- Conditions around a route you plan: to weigh fog, flooding, road works, game traffic and scenery, the app asks public services about the area around the routes it compares, never your position or the route itself: NOAA and the U.S. Geological Survey (river gauges in the route's bounding box), Indiana DOT and Ohio DOT (work zones; their whole feeds), MLB (the day's game schedules), SeatGeek (events within a radius of the area's centre), Wikimedia Commons and Mapillary (photo and traffic-sign positions in squares of about 2 to 5 km along the way), and Overpass (schools and places of worship in 25 km squares). Kentucky's work zones come through our server, which receives only 50 km squares and keeps nothing. Road closures, lane closures, roadwork, slow traffic and crashes on the map and in the car come from Indiana DOT, the Kentucky Transportation Cabinet and Ohio DOT through our server, which asks for each state's whole list and is asked for the whole region: it never receives your position. If you turn on Road cameras, the list of Ohio DOT's cameras comes the same way, and tapping a camera loads its picture from Ohio DOT's image server, which sees only that request. Deer hours, school hours, church hours, harvest and fall colour are worked out on the phone.
- Route context (traffic counts, land cover, noise, crashes, flood zones and similar public data) is read on the phone from files that ship with the app or come from our server. Our server learns only which roughly 150 km square a planned route passes through, never the route.
- Our server runs on Cloudflare, which processes requests to it. Cloudflare's per-request logs are turned off for it, so the address and questions of a request aren't kept.
Vetta has no advertising, no tracking across apps or websites, and sells no data.
Keeping and deleting
- Download my data (Account) gives you everything the server holds about you as a file.
- Delete account (Account) erases your account, friends, crews you own, shared results and spots, and removes you from what other people hold. Server backups are kept for up to 8 weeks, so a deleted account can remain in a backup copy until then.
- Deleting the app removes everything stored on the phone.
Children
Vetta is for licensed drivers and is not directed at children under 13.
Contact
Questions or requests: see the contact address on Vetta's App Store page.