Privacy policy

Who is responsible

Convoy is operated by Korzen LLC, established in the State of Florida, United States, which decides what is collected and why and is who to ask about any of it. Reach them at the support address on the app’s store listing. If you are in the EEA or the UK, Korzen LLC is the data controller.

The account itself

Your name, username, @handle and password. No email address is required and none is collected unless you add one yourself in Settings so that a password can be reset. If you do, it is verified with a code, used only to send you those codes, and never shown to anybody. A short friend code is generated so people can find you. Passwords are stored hashed and nobody, including the operator, can read yours.

What you put in

Your cars and their photos, the routes you draw, the runs you schedule and record, posts, comments, challenge votes, and messages. Your crews and your friends list, including requests you have sent and received, and anybody you have blocked. A summary of each run — distance, duration, top speed, who was in it — which is what the achievements are counted from. If you report a post, comment, person or message, the report keeps who filed it, why, and a copy of what was reported, so the moderator can read it; the person reported is not told who reported them.

Location

While a convoy is running, your position is shared with the other people on that run so the map works, and it is used for the distance and speed summary at the end. Positions are kept while the run is live and are not used to build a history of where you go. Background location runs ONLY while a convoy is live and stops when it ends — you can leave the run to stop it at any moment.

Separately, and whether or not a run is on: the app reads where the phone is to centre the map, to work out what is nearby at your chosen 50 or 100 miles, and to place a police report you send. That reading stays on the phone unless you do something that shares it.

Route waypoints are coordinates you chose and are shared with whoever you share the route with. Sharing your position on a run can be turned off in Settings, and location permission can be withdrawn in the phone's own settings, which stops all of it.

Voice

Push-to-talk audio goes directly between the phones on a run wherever the network allows it, and through LiveKit when the convoy is too large for that. It is not recorded and not stored, by Convoy or by LiveKit.

Photos and the camera

Photos you attach to a car or a post are uploaded and stored so they can be shown. The app asks for camera and photo-library access only when you use one, and takes only the picture you pick.

Notifications

If you allow notifications, your phone gives the app a push token, which is stored so a message can be sent to that device. It identifies the install, not you, and it is deleted with your account. What you are notified about is four switches in Settings, and turning all four off stops them.

Police reports

A report records the coordinates you sent, the time, the run it was sent to, and that it was you who sent it — the people on that run see your name on it. Published police open data is separate, comes from public government portals, and is about incidents rather than about anybody using the app.

Diagnostics

Log sharing is OFF unless you turn it on in Settings. With it on, the app sends error and usage logs so faults can be found, and the developer can read them — and those logs can include coordinates, because most of what goes wrong here is about location. They are deleted after seven days, and turning the switch off stops any more being sent. If you report an issue from Settings, the developer receives what you wrote, which version of the app and which phone you were using, and — unless you switch it off on that screen — the most recent lines of this phone's log. Separately, when the app crashes it sends a crash report to Sentry: the error, the phone model and system version, the app version and your account's id — not your name, messages, location or anything you wrote.

What other people can see

Your profile, @handle, cars, achievements and public posts are visible to anybody with an account. A run is visible according to who you said could join it. Your friends list is shown to your friends. When you were last in the app, and your top speed, are shown only to your friends and the people in your crews. Your app preferences — units, theme, notification switches, nearby distance — are stored against your account so they follow you to a new phone, and are readable only by you. Your messages are visible only to the people in the conversation. Blocking somebody is never disclosed to them.

Who else it is handed to

Supabase stores the data. Expo delivers app updates and carries push notifications through Apple's and Google's push services. LiveKit carries voice for larger convoys, and Metered relays voice between phones that cannot reach each other directly. Sentry receives crash reports. Resend delivers the codes emailed to a recovery address. A tip is paid to Apple or Google through their store, and Convoy never sees your card or payment details. Route lines are calculated by the OSRM public routing service and place searches are answered by OpenStreetMap's Nominatim, which means the coordinates of a route you draw and the words of a place search are sent to those services. Nothing is sold, and nothing is given to advertisers or data brokers.

Where it is kept

On servers that may be outside the country you live in, including the United States. Where the law requires a safeguard for that, the standard contractual clauses are what the providers above rely on.

How long it is kept

Your account and what you put in it are kept until the account is closed. Diagnostic logs are deleted after seven days, and Sentry keeps crash reports for ninety. Reports of content are kept while the account that filed them exists. Police reports and the published area picture age out within days. Finished runs and their positions are kept so your history and achievements stay correct.

Your rights

You can see and correct most of what is held about you inside the app — the profile, garage, routes, posts and settings screens are the data. For a copy of the rest, for correction of anything you cannot reach, or to have it deleted, write to the support address on the app’s store listing. If you are in the EEA or the UK you also have the right to object, to restrict processing, and to complain to your data protection authority.

Closing your account

Settings → Account → Delete Account. It removes your profile, your garage and its photos, your recorded runs, your posts and comments, your achievements, and the messages you sent — those go from the other person's copy of the conversation too. Any run you HOSTED is deleted for everybody who was on it. Routes you drew are KEPT, with your name removed, so that other people's runs still have a line to follow. It cannot be undone, and there is no waiting period. If the control will not work for you, write to the support address on the app’s store listing.

Children

Convoy is not for anybody under 13, and not for anybody under 16 in the EEA or the UK. Nothing is knowingly collected from them. If you believe a child has an account, write to the support address on the app’s store listing and it will be removed.

Security

Traffic is encrypted in transit. Access to your rows is enforced by the database itself rather than by the app asking nicely, so a bug in a screen cannot hand somebody else's data out. No system is perfect, and you will be told if something happens that affects you.

Changes

The version date at the top changes when this does, and the app asks you to read it again when the change matters.

Getting in touch

Questions about any of this go to the support address on the app’s store listing.