Tarmac Privacy Policy

Last updated: March 2026

This Privacy Policy describes how Tarmac ("we", "us", or "our") collects, uses, and shares information when you use the Tarmac mobile application (the "App"). By using the App, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

When you create an account, we collect:

• Email address
• Username and display name
• Profile photo (optional)
• Password (stored in hashed form; we never see your plaintext password)

When you use the App, we collect:

• Drive content you publish: route data, photos, descriptions, and captions
• Comments you post on other users' drives
• Interactions: drives you like, save, follow, or report

1.2 Location Data

Tarmac collects precise GPS location data while you are actively recording a drive. Specifically:

• Foreground location is used to show drives near you in the feed.
• Background location is collected when you start a drive recording. Your device's GPS records your route continuously — even when the app is not visible on screen or the screen is locked — until you stop the drive. This is the core function of the App. We do not collect location data at any other time.

We store your recorded GPS route (as a series of coordinates) and the locations of any stops you make during the drive. This data is associated with your account and visible to other users when you publish a drive.

You can prevent location collection at any time by revoking location permissions in your device Settings. Note that background GPS is required for drive recording to function.

1.3 Automatically Collected Information

When you use the App, we may automatically collect:

• Device type and operating system version
• App version
• Error and crash logs (for debugging purposes only)
• Timestamps of drive recordings and account activity

We do not use third-party analytics SDKs (e.g. Firebase, Mixpanel) in the App. Diagnostic data is processed by our backend infrastructure provider (see Section 3).

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Record, store, and display your drives to you and, when published, to other users
• Operate the social features of the App (feed, followers, likes, comments)
• Send push notifications about activity on your account (likes, comments, new followers) — only if you grant notification permission
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Respond to your support requests
• Improve the App (using aggregated, anonymised usage patterns — not individual tracking)

We do not sell your personal information to third parties. We do not use your location data for advertising purposes.

3. Third-Party Service Providers

We share your information with the following service providers who process it on our behalf:

Supabase, Inc. (supabase.com)

• Role: Database, authentication, file storage, and backend infrastructure
• Data shared: All account data, drive data, photos, and GPS coordinates
• Location: United States (data stored on AWS infrastructure)
• Privacy policy: supabase.com/privacy

Apple, Inc.

• Role: Push notification delivery via Apple Push Notification service (APNs)
• Data shared: Device push token (anonymous; not linked to your identity by Apple)
• Privacy policy: apple.com/legal/privacy

RevenueCat, Inc. (revenuecat.com)

• Role: In-app subscription management and purchase validation
• Data shared: Anonymous user identifier (Supabase UID), device info, purchase receipts
• Privacy policy: revenuecat.com/privacy

No other third parties receive your personal data. We do not use advertising networks, data brokers, or behavioural analytics services.

4. Public Content

When you publish a drive, the following information is visible to all users of the App:

• Your username and profile photo
• The drive route (GPS path on a map), distance, and duration
• Any photos and description you attach to the drive
• Your drive's location (city/region level shown in feed)
• Likes and comments on your drive

Drives you do not publish remain private — they are visible only to you.

If you do not want location data associated with your account to be visible to others, do not publish drives.

5. Data Retention

• Account data is retained for as long as your account is active.
• Drive data and photos are retained until you delete the individual drive or delete your account.
• Account deletion permanently removes all of your data — including your profile, all drives, all photos, all comments, all likes, and your authentication record — within 30 days of your deletion request. The in-app deletion process initiates this immediately.
• Backup copies may persist for up to 30 days in Supabase's automated backups before being overwritten.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the data we hold about you.
• Correction: Update your username, display name, and profile photo at any time within the App.
• Deletion: Delete your account and all associated data at any time using the "Delete Account" option in your Profile settings. This is permanent and cannot be undone.
• Location permissions: Revoke location access at any time via iOS Settings → Privacy & Security → Location Services → Tarmac.
• Notification permissions: Revoke push notification permission at any time via iOS Settings → Notifications → Tarmac.

To exercise any right not available in-app (e.g. data access request), contact us at: tarmacapp@outlook.com

Residents of the EU/EEA (GDPR): Our lawful basis for processing your data is the performance of a contract (providing the service you signed up for) and legitimate interests (preventing abuse and improving the service). You have the right to lodge a complaint with your local data protection authority.

Residents of California (CCPA): We do not sell your personal information. You have the right to know what data we collect and to request deletion.

Residents of Australia (Privacy Act 1988): You have the right to access and correct personal information we hold about you, and to make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe your privacy rights have been breached.

Residents of South Africa (POPIA): You have the right to access, correct, and request deletion of your personal information. You may lodge a complaint with the Information Regulator at justice.gov.za/inforeg.

7. Children's Privacy

The App is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it immediately. If you believe a child under 13 has created an account, contact us at tarmacapp@outlook.com.

8. Security

We implement industry-standard security measures to protect your information:

• All data is transmitted over HTTPS/TLS
• Passwords are hashed using bcrypt via Supabase Auth; we never store or see plaintext passwords
• Database access is controlled via Row Level Security (RLS) policies — users can only access data they are authorised to see
• Photos are stored in a private Supabase Storage bucket with access controls

No method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take it seriously.

9. International Data Transfers

Your data is stored and processed in the United States via Supabase's infrastructure (AWS us-east-1). By using the App, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this document and, where appropriate, by sending a notification through the App. Your continued use of the App after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: tarmacapp@outlook.com

We aim to respond to all privacy enquiries within 14 business days.