CoDriver
Support Download

Legal

CoDriver Privacy Policy

Effective date: October 9, 2026 · Version 1.0

CoDriver is operated by Navid Ehsani Azad in British Columbia, Canada ("CoDriver", "we", "us"). This policy explains what personal information the CoDriver iOS app and the services behind it collect, why, who sees it, how long we keep it, and the choices you have. It is written to meet the Personal Information Protection and Electronic Documents Act (Canada) and the Personal Information Protection Act (British Columbia).

CoDriver is a convoy driving app: live voice between the cars in a convoy, live positions on a shared map, turn-by-turn navigation, and a history of the drives you record. Location and voice are the heart of the product, so this policy says plainly what happens to each.

1. What We Collect and Why

1.1 Account

Your email address, a password (stored only as a salted hash; we never see it in readable form), and the one-time codes we email you to verify your address at sign-up, to sign in on a new device, to reset your password, and, if you turn it on, as a second factor at every sign-in. We use these only to create and secure your account and to send you notices about the service. We do not collect your phone number or your Apple ID.

When you choose a password, our server checks whether it appears in a known data breach. Only the first five characters of a one-way hash of the password leave our server; the password itself cannot be recovered from them and the request does not identify you.

1.2 Profile

A handle, a display name, and an avatar colour. Your handle and display name are visible to the people you share a convoy, crew, or friendship with and to anyone who searches for your handle. We do not collect photos or video.

1.3 Precise Location

Location is used in three ways, and each has its own control.

  • Live position in a convoy. While you are in a convoy and have not turned on Hide Location, your GPS position, speed, and heading are sent to the other members of that convoy about once a second so everyone can see where everyone is. These live positions are relayed and not written to our database; our server logs are configured to discard coordinates entirely.
  • Friend map (optional, off by default). If you turn on location sharing in your profile, your position is sent to our server at a coarse interval and shown live to your accepted friends while your status is online or busy. It is held in memory only and never written to our database: there is no history, and turning sharing off, setting your status to invisible, or going offline removes it from friends' maps and from our server immediately.
  • Drive history. While a drive is recording, in a convoy or on your own, the app sends position samples to our server in periodic batches. Raw samples are deleted after approximately seven days. Each drive is condensed into a simplified route line (the time axis is discarded) and summary statistics: distance, moving time, time present, time leading, and time with location hidden. These are kept for your own account until you delete the drive or your account.

Hide Location pauses both your live position and your route recording for that convoy; nobody sees you move and nothing is recorded while it is on. Leaving a convoy stops sharing your position with its members. The friend map is a separate control and is unaffected by either.

Navigation search and directions are provided by Apple Maps. When you search for a place or request a route, the query and the coordinates it needs go to Apple under Apple's privacy policy. Saved places and the routes you draw and keep are stored on your device, not on our server.

1.4 Voice (Transmitted, Never Stored)

Convoy voice is transmitted in real time through a media server we run on our own hardware in Canada. It is never recorded, buffered for later use, or stored in any form, on your device or on our servers, and nobody outside the convoy can hear it. The microphone is active only while you are in a convoy and unmuted. A speech detector on your device transmits speech and replaces everything else with silence; noise suppression and speech detection both run on your device and send nothing anywhere.

1.5 Friends, Crews, and Social Graph

Your friend requests and accepted friendships, the crews you belong to, convoy invites, and the users you have blocked are stored on our server so we can enforce your choices. Your availability status (online, busy, invisible) is visible to your accepted friends. Your drive statistics appear in a leaderboard visible to you and your accepted friends, together with statistics about the people you have driven with.

1.6 Content You Share

Routes you share are stored as a name and the coordinates and names of their checkpoints, with a thinned outline for the recipient's preview card; drives you share are stored as a reference to the drive with its summary card. Shares are delivered to the recipient's Activity page and are readable by our server (content is encrypted in transit but is not end-to-end encrypted). The recipient keeps access until they dismiss the share or you delete the drive.

1.7 Device and Diagnostics

For each device signed in to your account: a randomly generated installation identifier, hardware model, iOS version, app version and build, push-notification, incoming-call (VoIP), and Live Activity push tokens, notification-permission state, and last-seen time. These keep your devices signed in and reachable.

The app sends us Apple MetricKit reports: daily aggregate performance and battery metrics, and crash and hang diagnostics. They contain device model, OS and app versions, and technical traces; they contain no location, voice, or account content. The app embeds no third-party analytics or advertising SDK.

1.8 Bug Reports

Only when you submit a bug report: your description, app and OS versions, device model, the current convoy identifier, thermal state and audio route, and the app's recent log messages. If you drove recently, the report also includes the app's per-drive logs, which contain position, speed, and heading samples and the route being navigated. Drive logs leave your device only with a report you choose to send.

1.9 Reports You File

When you report another user, we record who reported whom, both handles as they were at the time, the reason you chose, and any description you give.

1.10 Communications

Messages you send to [email protected], and our replies.

1.11 Server Logs

Operational logs record connection metadata: account, installation, and convoy identifiers and message types, never message contents or coordinates. IP addresses appear only as irreversible fingerprints. An append-only audit ledger records account and convoy events by identifier (for example "convoy created", "account deleted") without content or coordinates.

1.12 Acceptance Records

When you accept the Terms of Service, we record your account identifier and handle, the terms version, a cryptographic hash of the exact text shown to you, the app build, and the time. This is our proof of what you agreed to.

2. Legal Basis and Consent

We collect and use personal information with your consent, for the purposes a reasonable person would consider appropriate in the circumstances. Creating an account and ticking the acceptance box is your consent to the processing this policy describes. Location, microphone, and notification access are granted separately through iOS and can be changed at any time in Settings. Location sharing with friends and drive history are controlled in the app. You may withdraw consent at any time (Section 6); some features cannot work without the data they depend on.

3. Who Sees Your Information

  • Convoy members see your handle, display name, avatar colour, live position, speed, heading, and mute state while you are in the convoy, and hear your voice while you are unmuted.
  • Accepted friends see your status, your drive statistics, and, if you turn it on, your live position. Everything you choose to share with friends is visible to all of your accepted friends.
  • Recipients of a shared route or drive see what you sent them.
  • Service providers that process data on our behalf: Cloudflare (edge network, tunnel, and firewall carrying the app's connections to our servers); Resend (delivers our transactional email from [email protected]); Apple (push notifications, which can include the display names of the friends and crews they concern; Maps search and directions; App Store distribution); and Have I Been Pwned (receives the five-character hash prefix described in Section 1.1, never a password or anything identifying you). Our voice and control servers are self-hosted; the media software we run is not a party that receives your data. Every third party that handles personal information for us is required to protect it at least as well as this policy states.
  • Legal requirements. We may disclose information when required by law or a valid order, or to protect the safety of a person.

We do not sell personal information, we do not use it for advertising, and we do not track you across other apps or websites.

4. International Transfers

Our servers and your data are in Canada. Cloudflare's edge network routes connections through the data centre nearest you, which may be outside Canada; Resend processes email in the United States; Apple processes push notifications and Maps queries under its own policy. Information outside Canada is subject to the laws of the country where it is held.

5. Retention

  • Drive history (route lines and statistics): until you delete the drive or your account. Raw position samples: approximately seven days.
  • Live and friend-map positions: not stored.
  • Voice: not stored.
  • Bug reports, drive logs, and MetricKit reports: 30 days, then deleted. Deleting your account deletes them immediately.
  • Server logs: approximately 30 days.
  • Audit ledger and deletion ledger: for the life of the service; they hold identifiers and event summaries only, and ensure a deletion survives any restore from backup.
  • Backups: encrypted; deletions are replayed after any restore so deleted data stays deleted.
  • Acceptance records: two years after your account is deleted, then destroyed.
  • Reports about users: for moderation and to defend legal claims; a report is destroyed two years after either account it names is deleted. Any attached evidence is removed 30 days after the report is resolved.

6. Your Rights and Choices

  • Access and correction. You can view and change your profile, email, password, two-factor setting, status, and location sharing in the app. For anything else, write to us.
  • Deletion. Delete your account in the app (Profile → Delete account). Deletion is immediate and permanent. It removes your account, devices, profile, friendships, blocks in both directions, crew memberships, invites, drive history including every copy of your route geometry (also from drives you shared), and your bug reports and diagnostics. Routes and drive cards you shared remain with the people you sent them to, attributed to "Deleted user" and without your route geometry. Reports filed about you or by you, and your acceptance records, are kept for the periods in Section 5. Convoys and crews you own that still have other participants pass to one of them.
  • Withdraw consent. Turn off location sharing, set your status to invisible, mute, enable Hide Location, leave a convoy, change iOS permissions, or delete your account.
  • Complaints. Contact us first at [email protected]. You also have the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

We respond to requests within 30 days and will not charge for them except where the law allows.

7. Children

CoDriver is for drivers and passengers aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, write to us and we will delete it.

8. Security

Connections are encrypted in transit. Passwords are salted and hashed. Voice and control infrastructure is self-hosted and reachable only through an authenticated edge. Logs are redacted of secrets and coordinates. Access to production systems is limited to the operator. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.

9. Changes to This Policy

We will post any new version at https://trycodriver.com/privacy with a new effective date and version number. Because this policy forms part of the Terms of Service, a material change is published as a new version of the Terms, which the app asks you to review and accept before you continue using it.

10. Contact

Navid Ehsani Azad, British Columbia, Canada
[email protected]