Draft, not yet in effect. This text is a draft that is still being reviewed by our lawyers. It doesn't apply to anyone yet, and it will change before it takes effect. Parts in [brackets] are not decided yet.

DaddyGPS Privacy Policy

Last updated: [Month year] · Effective: [Effective date]
Who we are: Gold Star Labs LLC, a Utah limited liability company, 7533 S Center View Ct, Ste R, West Jordan, UT 84084, United States ("we", "us").
Privacy contact: info@goldstarlabs.app
Earlier versions: [Earlier versions page: published with the first change] · En español: [Spanish version: not published yet]
Washington residents: our separate Consumer Health Data Privacy Policy is at https://goldstarlabs.app/daddygps/health-data/.

The short version

DaddyGPS has no accounts, no ads, no analytics, no tracking and no crash-reporting service of its own.
To give you directions and search results, your phone sends your location, your destination and what you type in search to our own server. The server answers, and is configured to keep no logs of those requests. No map company (Google, Apple, Mapbox or others) is involved.
"No logs" is a setting we maintain, not a technical impossibility. A court can order us to start recording specific information going forward and can forbid us from telling you (§10). The limits are explained below.
Voice packs you record stay on your phone until you send one yourself.
Driving remarks (speeding, smooth driving, "phone down") are worked out on your phone and never recorded or sent.
Live location sharing is off unless you, the driver, turn it on. It works only while you navigate and is end-to-end encrypted: our server passes it on without being able to read it.
We don't sell your personal data, don't use it for targeted advertising, and don't use it to train AI models.
DaddyGPS is for adults (18+) only.

1. What this policy covers

This policy covers the DaddyGPS apps for iPhone and Android (including their Apple CarPlay and Android Auto screens), the server they talk to, and this website (goldstarlabs.app). It doesn't cover the App Store or Google Play, your phone's operating system, your car's system, or apps you use to send a voice pack or pairing file (for example AirDrop, Messages or email). Those have their own privacy policies.

What your phone sends, and why. All of this goes only to our server, over an encrypted (HTTPS) connection that ends on our own server. Neither our hosting provider nor anyone else in between can read it.

What	When	What it contains	Precision
Route request	When you start a route, and each time the route is recalculated	Your current position, heading and GPS accuracy, your destination and any stops, route options, roads you asked to avoid, and the app's language and units. Your phone doesn't send the time	Exact: a route has to start where you are
Search	As you type in "Where to?" (after 3 characters)	What you type, and your location so nearby results come first	Location rounded to about 100 m
Category buttons (Coffee, Gas, EV charging, …)	When you tap one (while navigating, also a few points along the road ahead, rounded the same way)	The category, and your location rounded as above	About 100 m
Place label	When you long-press the map	The point you pressed	Exact point
Map tiles and map style	Whenever the map is shown and the area isn't downloaded	Which map squares to draw. This reveals roughly which area you're looking at	Area on screen
Offline region downloads	When you download a region, and automatically in the background (on Wi-Fi unless you change it) for the area around you and along routes you preview or drive	Which region, or which square of about 100 km, to download. No position and no identifier. The order of downloads reveals which state you're in, roughly which 100 km square, and, when the app downloads along a route you preview or drive, roughly which squares that route passes through	State or 100 km squares
Data & licences screen	When you open it	Nothing about you (it asks for the date of our map data)	n/a

What you search for, and where you go, may include health-related places such as clinics, pharmacies or sexual-wellness stores. Our server handles those requests exactly like any other: it uses them only to answer you and keeps none of it.

What our server does with it. It answers the request and forgets it. Our routing, search and map components are configured to write no request data (no IP address, coordinates, search text or timestamps) to any log or file. Our automated tests fail if search text or route coordinates show up in any log. The routing and search components run on an internal network with no way to reach the internet, so they can't pass your request to anyone. Before a request reaches them, our server removes browser-style identifiers (User-Agent, cookies, Referer, forwarded-for headers). (Your phone's language setting is passed on so results come in your language.)

What the server briefly holds in memory. To stop abuse, our server counts requests per IP address. Those counters exist only in memory, for a one-minute window, and are never written to disk. Your connection details also sit briefly in the server's operating-system tables, for minutes.

Offline regions. Once a region is on your phone, its maps, searches and routes are answered on your phone and those requests aren't sent at all. To pick what to download, the phone remembers the region it's in, its current and previous 100 km square, which regions are nearby, and the day each region was last used, never a position, and none of that leaves the phone except as the download requests above.

On your phone. Your settings, recent destinations and downloaded regions are stored on your phone only and are excluded from cloud backup. You can delete recent destinations one by one or all at once in Settings. The map keeps a cache of map squares you've viewed (map pictures, not a record of your trips).

How your phone finds its location. On Android, DaddyGPS uses GPS only, not Google's "fused" location service (which can send nearby Wi-Fi and cell-tower information to Google). On iPhone, DaddyGPS uses Apple's Location Services, which Apple runs under its own privacy policy.

No live traffic. We don't collect speeds or positions from users to estimate traffic. Your arrival time is corrected on your phone from your own progress.

Precise location is "sensitive data" under some state laws. Before DaddyGPS uses your location, it asks on a screen of its own. Only after you tap Allow does your phone show its own location prompt. By allowing, you agree that we use your precise location, and what you search for and where you go (including health-related places), only to provide the directions, map and search you ask for.

You can withdraw that consent at any time, as easily as you gave it: Settings › Privacy › Stop using my location in the app stops all use of your location at once, and you can also turn off DaddyGPS's location permission in your phone's settings. Navigation needs location, so without it the app can't give directions.

4. The voice: persona, vanilla mode, voice packs and the recorder

Persona voice. The DaddyGPS voice is a set of recordings that ship inside the app and play on your phone. It is AI-generated: it was made before release with a text-to-speech AI service, and it isn't a recording of a real person and isn't modelled on anyone's voice. Nothing you say, type or do is sent to the service that made the voice or to any other AI service.

Vanilla mode uses your phone's built-in text-to-speech voice, on the phone. On Android, the app uses only a voice that works offline.

Voice packs.

A pack is a file, recorded, checked and built on the phone that records it. The recorder has no network code.
We never receive voice packs. There's no upload, no server and no catalog. You send a pack yourself through your phone's share sheet (for example AirDrop or Messages) or save it to Files. The app you pick handles it under its own policy. The app reminds you that email isn't end-to-end encrypted.
An exported pack contains the recordings, the line text (including lines you wrote yourself), the pack's name, the "recorded by" name its author typed, any pet names and special days (birthday or anniversary, as month and day, never a year) the author added, an optional greeting and note, and a random pack number that stays the same across versions of that pack. It contains no device model, location, recording date or recipient name.
Installed packs and recorder drafts live in the app's private storage, excluded from cloud backup. Deleting a pack removes it at once.

Microphone. The recorder uses the microphone only while you're recording a line or checking the sound level before recording. Nothing from the sound check is saved. Your phone's microphone indicator always matches what the app shows.

Speech check. The recorder can check that each direction says the right word (for example "left" in a left-turn line). It uses your phone's own on-device speech recognizer, which is part of your phone's system software, not of DaddyGPS. On iPhone, the app requires Apple's on-device mode, which Apple says keeps the audio on the phone. On Android, the app uses only the phone's on-device recognizer, which is run by Google or your phone's maker under their own policies, and the app tells you so before the first check. On both, the app asks once before the first check whether to use the recognizer, and you can always check by ear instead. The words it hears are kept in memory for the review screen and never saved. DaddyGPS doesn't identify or recognize who is speaking, and creates no voiceprint.

5. Driving remarks: speed, smooth driving, "phone down"

Speed remarks. The persona may remark when you go over the speed limit by more than the margin you choose (or never, if you turn them off). Your phone compares its own GPS speed with the speed limit included in the route.
Smooth-driving remarks and the optional "phone down" nudge use your phone's motion sensors, only while guidance runs in persona mode. "Phone down" is off unless you turn it on.
All of this happens on your phone. Sensor readings and speeds are never stored, logged or sent. There's no driving score, no trip history and no crash detection.
These remarks are for fun. They aren't a safety system and don't tell you what's legal.

6. Car screens (Apple CarPlay and Android Auto)

When you use DaddyGPS on a car screen, the app draws the map and directions through Apple's CarPlay or Google's Android Auto, which pass them to your car's display. That runs under Apple's, Google's and your car maker's own policies. DaddyGPS sends nothing extra to anyone for the car screen, and live sharing can only be started from the phone.

What it is. You can share your drive live with someone you've paired with, who sees it in their DaddyGPS app.

You decide, every time.

Sharing works only while you're navigating, and only after you, the driver, turn it on for that drive, or turn on "Always share my drives" for a person (which needs your phone's screen lock and is re-confirmed every 14 days). There's no background tracking and no "find my partner".
The person you share with can't turn your sharing on, ask for it, or change your settings.
While sharing is on, the navigation screen and your phone's notification (or Live Activity on iPhone) always say so, with a Stop button. Stop, vanilla mode, ending the route or arriving all end sharing at once, and nothing restarts it by itself.
Either of you can remove the pairing at any time, in one step.

What is shared, and with whom. While a shared drive is running, about once a second: your position, its accuracy, speed and direction, your arrival time and remaining distance, the next turn and the street name on the banner, and your phone's battery level (in steps of 5 %). At the start and after each recalculation: your route and any stops still ahead. If you turned it on, a code for the greeting line your partner's app plays. Only the people you share that drive with (at most four) can read it. When sharing ends, the last message carries no position.

From the person watching: while your drive is on their screen, their app tells yours so (you see "{name} has your drive open"), and, if you allowed it for them, it can ask your phone to play one of a few praise recordings already on your phone. Neither carries text, audio or location.

Pairing is done in person (two QR codes) or by exchanging pairing files through your share sheet. The names you give each other stay on your two phones and are never sent to our server. Each pairing has its own encryption keys, stored in your phone's secure key storage, excluded from backups and never synced. The camera is used only to scan a pairing code, on the phone.

What our server can and can't see. Shared drives pass through a relay on our server. It keeps only the newest encrypted update and the newest encrypted route of each drive, in memory, and deletes them about 60 seconds after the last update or after the drive ends. It writes nothing to disk and can't read the location, route, names or arrival time.

That doesn't mean we, as the operator, could never work out where a shared drive is. The relay sees, without decrypting anything, the IP addresses and timing of each phone's requests: that a drive is being shared, for how long, roughly when the driver stopped moving, that a route was recalculated, and how many people have it open. Your phone also sends route and map requests to the same server. Matching up the IP addresses and timing of all these could reveal a driver's approximate position and destination, and who is watching the drive, without breaking any encryption, and could link a pair's shared drives together. Our server keeps no logs, and that's what prevents this. It's a configuration we maintain, not a cryptographic guarantee. We don't claim that your shared drives can't be linked to each other.

What the relay keeps for longer (in memory only, lost whenever the relay restarts):

Alert registrations of people who turned on alerts: which service delivers them (Apple or Google), the device's push token, and which alerts they want, under a random ID. Kept up to 14 days, renewed each time the viewer opens the app, and deleted when alerts are turned off or the pairing is removed. A push token identifies one app on one device. We can't tell from it who you are, but Apple or Google can (see §10).
A "removed the pairing" message, encrypted, for up to 30 days.
Abuse counters keyed by a salted hash of the IP address, for the short window they apply to.

On the viewer's phone, the driver's newest position and route are kept in memory only, never on disk, and are cleared when sharing stops.

A safety note. Someone who has your unlocked phone and its passcode could set up "Always share". We make that visible (the indicator on every shared drive, the 14-day re-check, a list of every pairing in Settings › Sharing), but we can't make it impossible. If you're worried, open Settings › Sharing › "Worried someone is tracking you?". The partner screen isn't evidence of where someone was. If the person whose drives you can see asks you to stop, remove the pairing: in some states, Utah included, continuing to track someone after they withdraw permission is a crime.

8. Shared-drive alerts (push notifications)

Alerts are off unless the person you share with turns them on, per pairing. The driver can switch alerts off for any pairing, and then nothing about their drives reaches Apple or Google.

When a shared drive starts or ends, the driver's app sends an encrypted notice to our relay. The relay forwards it once to Apple's (APNs) or Google's (Firebase Cloud Messaging) push service and keeps no copy. The viewer's phone decrypts it and writes the alert text itself.

What Apple or Google learn: that our server sent an alert to that device at that time, with a fixed generic text on iPhone ("DaddyGPS / Shared drive update") and no text on Android. So they learn when the driver's shared drives start and end, tied to the viewer's device and account. They don't see names or locations. Apple or Google may hold an alert for up to 10 minutes if the phone is offline.

On Android, viewers choose between checking in the background (no Google involved), "Open drive" (no Google involved), and instant alerts through Google (optional). Only the last uses Google's Firebase Cloud Messaging library. The library stays switched off, with no contact with Google, until you turn instant alerts on. It then creates a Firebase installation ID and a push token. Turning instant alerts off deletes both and switches the library off again; Google says it removes deleted installation IDs from its systems within 180 days. We use no other Firebase or Google service. On iPhone, alerts use Apple's push service, like any iPhone app's notifications.

9. Who else is involved

We don't sell personal data, don't share it for targeted advertising, and no other company collects information about your activity over time and across other apps or sites through DaddyGPS. The parties involved are:

Who	Role	What they can see
[Hosting provider]	Runs the computer our server is on, under a data processing agreement with us	Encrypted traffic only: your IP address, timing and data volume. Encryption ends on our server, so it can't read your requests
[Email provider]	Hosts our email, under a data processing agreement with us	Emails you send us, including privacy requests
Apple (APNs) and Google (FCM)	Deliver shared-drive alerts, if the viewer turned them on	When an alert is sent, to which device; a generic text on iPhone, no text on Android
Apple and Google (app stores)	Sell and deliver the app, take payments, and answer the app's age check (§13)	Under their own policies
Apple CarPlay, Google Android Auto	Show the app on your car's screen	Under their own policies (§6)
The speech recognizer and voice on your phone	Recorder speech check; vanilla-mode voice	On your phone, under your phone maker's or Google's policies (§4)
Apps you choose in the share sheet	Carry voice packs and pairing files you send	Whatever you send
Apple (App Attest) and Google (Play Integrity)	Confirm that the app is a genuine copy of DaddyGPS (planned, §14)	Apple: when the app makes a new key, about every 90 days. Google: that the app asked, about once a day. Nothing about your routes, searches or partners
Google Play (subscription check)	Confirms that an Android subscriber who covers a partner still has an active subscription (planned, §14)	That we asked about that subscription's purchase token, about once a week

Our server downloads map and address data each week from public sources. Those downloads contain no information about you. Map data © OpenStreetMap contributors and the other sources listed in the app under Data & licences.

10. Legal requests, and the limits of "no logs"

We can only hand over what we have. What we hold that a legal order could reach is listed in §11. We keep no logs, no location history and no search history.

Our server is configured not to log the requests your phone sends or the shared drives our relay passes on. A court order can legally require a service provider to record specific information about specific users going forward, and may forbid us from saying so. If that happens, we would record only what the order requires, for the users and the period it names. We may challenge an order we believe goes beyond what the law allows.

One item we hold can identify a person with someone else's help: the push token of a viewer who turned on alerts (§7). Given that token, Apple or Google can identify the account behind the phone.

We'll publish each legal request we receive, with personal details removed, once we're legally allowed to, at [Legal requests page address].

Other honest limits. Anyone with administrator access to our server could change its configuration to start logging, or watch its traffic. Our hosting provider sees encrypted traffic (IP addresses, timing and volume). Map and download requests reveal roughly which area or state you're in, which is why they go only to our own server. Our web address is listed in public certificate logs, as every website's is.

11. How long we keep things

Data	Where	How long
Route, search, place-label, map and download requests	Our server's memory	Only while answering the request
Abuse counters by IP	Our server's memory	About one minute
Shared-drive updates (encrypted)	Relay memory	Newest update only; deleted about 60 s after the last update or the end of the drive; 24 h at most
Alert registrations (push tokens)	Relay memory	Up to 14 days, renewed when the viewer opens the app; deleted when alerts are turned off or the pairing removed
"Removed the pairing" message (encrypted)	Relay memory	Up to 30 days
Firebase installation ID (Android instant alerts only)	Google	Until you turn alerts off; then up to 180 days in Google's systems
Coverage notes (encrypted; planned, §14)	Relay memory	Newest one per pairing and direction; up to 30 days after the last one
Google Play purchase token (Android subscribers who cover a partner; planned, §14)	Our server's memory	Only while asking Google; nothing is kept
App check counter (iPhone; a salted hash of the app's key; planned, §14)	Our server's memory	Until the end of the day; the salt is replaced daily and never written down
Emails you send us, including privacy requests	Our mailbox	24 months after we close the matter
Settings (including pet name and birthday), consent choice, recent destinations, saved places, downloaded regions, cars you've connected (as a scrambled code), voice packs, recorder drafts, pairing keys	Your phone only	Until you delete them or uninstall the app

Everything the relay holds is also lost whenever it restarts.

12. Your rights and choices

In the app. You can delete recent destinations, voice packs and downloaded regions; stop sharing, turn off "Always share", switch off alerts or remove a pairing; turn off instant alerts on Android (which deletes the Google token and installation ID); stop the app using your location (§3); and turn off location, microphone, camera and notifications in your phone's settings. Uninstalling DaddyGPS deletes all its data from your phone; none of it is in your cloud backup.

Your rights. Wherever you live, you can ask us to:

confirm whether we process personal data about you, and get access to it and a portable copy;
correct it;
delete it;
opt out of targeted advertising, sale, and profiling (we do none of these);
withdraw any consent you gave.

You never need an account. Email info@goldstarlabs.app; an authorized agent may ask for you. Because we keep no logs, no accounts and no location or search history, we usually hold nothing that can be connected to you, and we'll tell you so. We won't ask you for more information than we need to answer, and we won't treat you differently for using your rights.

We answer within 45 days. If we need more time, we may extend that once by 45 days, and we'll tell you why within the first 45. If we decline to act on your request, our answer explains why and how to appeal: reply to it within 60 days saying you appeal. We answer appeals in writing within 45 days. If we deny your appeal, you can complain to your state Attorney General, for example Connecticut (https://www.dir.ct.gov/ag/complaint/) or Washington (https://www.atg.wa.gov/file-complaint).

Do Not Track and Global Privacy Control. DaddyGPS doesn't track you over time or across other apps or websites, and doesn't let anyone else do so. There's nothing for a Do Not Track or Global Privacy Control signal to switch off, so we treat everyone as if they had sent one.

AI training. We don't collect, use or sell personal data to train large language models or any other AI model.

13. Adults only, and the app's age check

DaddyGPS is for adults 18 and older. It isn't directed to children, and we don't knowingly collect personal data from anyone under 18. The first time you open it, the app asks you to confirm you're 18 or older; that answer stays on your phone. The app also asks the app store whether the account holder is an adult: on iPhone, Apple (Declared Age Range) where the law requires it; on Android, Google Play (Play Age Signals) at each launch, and Google answers only where a law requires it. We receive only an age range or a "not shared" answer. The app uses it on the phone to allow or block the app, keeps it in memory, and never sends it to us. If the store says this account isn't an adult, the app remembers only that it is blocked, on this phone: one on/off flag, with no age, kept out of backups and removed when a later answer says you're an adult or when you delete the app.

14. Subscriptions

Not in the app yet. Subscriptions, partner coverage and the app check described in this section are planned and aren't in the app yet. This section says how they will work; we'll update it, and the date at the top, before they ship if anything changes.

DaddyGPS will be sold as a subscription through the App Store or Google Play, which handle payment under their own terms and privacy policies. We never receive your name, card or billing address.

Checking that the app is genuine. About once a day the app asks Apple (App Attest) or Google (Play Integrity) to confirm that it is a genuine copy of DaddyGPS, and our server then gives it anonymous passes that let it use our server without saying which phone it is. Apple learns when the app makes a new key (about every 90 days) and Google that the app asked (about daily); neither learns your routes, searches or partners. On iPhone, to limit how many passes one copy of the app can get, our server counts them by a salted hash of the app's key, in memory, until the end of the day.

Covering a partner. If you subscribe on iPhone and cover a partner, your partner's phone receives, end-to-end encrypted, Apple's signed record of your subscription (which includes its product, dates and transaction numbers) so it can check it without us. If you subscribe on Android and cover a partner, about once a week your phone sends our server your Google Play purchase token; our server asks Google whether the subscription is active and answers with a signed note, keeping nothing. Google learns that we asked. The token stays the same for the life of the subscription. Each paired phone posts an encrypted "coverage" note to our relay at least weekly; the relay keeps the newest one for up to 30 days and can't read it.

15. Security and diagnostics

All connections to our server are encrypted (HTTPS). Shared drives are end-to-end encrypted. Pairing keys are kept in the phone's secure key storage (iPhone Keychain, Android Keystore) on that device only. The server runs only the components it needs, with no outside network access for routing and search, and with administrator access limited to us. No system is perfectly secure.

DaddyGPS contains no crash reporter, analytics or telemetry of its own. If you allowed your phone to share diagnostics with app developers, Apple or Google may give us crash reports. The app writes no location, search text, names or shared-drive data into its logs, so those reports don't contain them.

16. Changes to this policy

When we change this policy, we update the date at the top and keep the earlier version at [Earlier versions page address]. If a change matters, for example if we would start keeping data we don't keep today, we'll tell you in the app before it takes effect, and ask for your consent again where the law requires it. Data we already hold won't be used in a materially different way without your consent.

One exception: if a court order requires us to record information about specific users (§10) and forbids us from disclosing it, we can't tell those users, or anyone, in advance or while the order lasts. This promise covers changes we choose to make, not orders we're legally barred from disclosing.

17. Contact

Gold Star Labs LLC, 7533 S Center View Ct, Ste R, West Jordan, UT 84084, United States, info@goldstarlabs.app. This policy is also in the app (Settings › About › Privacy policy) and in Spanish at [Spanish version address].