Privacy Policy

Last updated: September 2026

What we collect

• Location. Your GPS position while the app is open, and — only while you are recording a drive, are in an active convoy, or are following the arrow to a destination — while the app is in the background. Recording a drive saves the full route you drove.
• Your profile. Email address and your name — from your Google account or the name you sign up with, shown as your display name unless you change it — plus vehicle make and model, profile photo, and an optional Instagram handle.
• Your activity in the app. Spots you claim, including the position you claimed from, drives you record, saved waypoints (position and optional photo), spots you suggest (position and photos), points and badges you earn, friends and convoys, and articles you read.
• Technical data. Crash reports and usage events (which screens are opened, which features are used).
• If you leave your name and WhatsApp number for a course, we use them only to message you about the course. We keep them, and your email if you add one, until you ask us to delete them (hello@offroadpal.app).
• If you add your email and tick the box, we'll also email you about courses and offers. Unsubscribe anytime.

We do not collect your contacts, your calendar, or any health data.

How we use it

• To show you on the map and, if you join a convoy, to share your live position with the other members of that convoy — and with nobody else.
• To save your drives so you can view, re-live and share them.
• To run the app's features: claiming spots, points, leaderboards, friends.
• To help you when you are stuck. The app walks you through getting yourself out, then opens WhatsApp with your GPS position ready to send to a volunteer rescue team. You decide whether to send it, and it travels through WhatsApp under WhatsApp's own policy. People in your convoy already see your live position.
• To fix crashes and improve the app, using technical data.

We never sell your data, and we never use your location for advertising.

Where it's stored, and for how long

Your data is stored with Supabase, on servers in the European Union. We are based in the UAE, so your information is transferred outside the UAE for storage — we rely on the contractual protections in our agreement with Supabase to keep it safe.

• Your current position is a single record. Each update overwrites the last, so there is no history of where you have been. It is deleted automatically 30 minutes after the last update, by a job that runs every minute.
• If you host a convoy, it keeps your last position from while you hosted it, also after it ends, and people who were in that convoy can still see it.
• Spot claims, including the position you claimed from, are kept until you delete your account.
• SOS alerts you raised (time and position) are kept until you delete your account.
• Recorded drives are kept until you delete them or delete your account.
• Profile and activity data are kept until you delete your account.
• Crash and usage data are kept for up to 12 months.

Sharing

• Other users see your display name, profile photo, vehicle, points and tier, your Instagram handle if you add one, and — inside a convoy — your live position. If you make a recorded drive public, everyone on OffroadPal can see its route on the map and on your profile, and anyone with its link can see it with your display name and profile photo, without signing in. Drives are private until you do. Blocking hides you from each other in search, profiles, friend requests and kudos; leaderboards still show both of you, and in a shared convoy you still see each other's position.
• Service providers who process data on our behalf: Supabase (accounts, database, files), Mapbox (maps — to draw map images, such as the route picture on your drive summary and share card, it receives that route's coordinates; it may also collect anonymised telemetry under its own policy), Sentry (crash reports), PostHog (usage analytics), Expo (delivers push notifications to Apple and Google). Usage analytics are linked to your account id, never your name or email; PostHog works out an approximate city from your connection, and you can turn it off in Settings → Share usage counts. Crash reports are linked to your account id too, and can include your display name and your recent position.
• Our website is hosted and delivered by Cloudflare, which processes your IP address and basic request data to serve the page and protect it from attacks. We also use Cloudflare Web Analytics to count visits to our website. It does not use cookies or track you across other sites.
• Push notifications are delivered through Apple and Google. The notification itself never contains anyone's coordinates — the position is read inside the app after you open it.
• Legal requests where we are required by UAE law to comply.

Your choices and your rights

Under the UAE Personal Data Protection Law you can access, correct, or delete your data, object to how we use it, and withdraw consent at any time.

• Delete your account: Profile → Delete account. This permanently erases your account, profile and photo, drives, claims, points, badges, friends, saved waypoints and their photos, SOS alerts and your current position. It cannot be undone. It does not yet remove: spots you suggested and the photos you added to them; kudos you gave and reports you filed; your notifications, and friend-request notifications about you in other people's inboxes; your records of accepted safety notices and consents; your offline-map and course records; security logs (kept 180 days); or the position a convoy you hosted keeps. Write to hello@offroadpal.app to have those removed.
• Turn off location: in your device Settings. The app keeps working; live convoy sharing and drive recording stop.
• Turn off notifications: Settings → News from OffroadPal, or in your device Settings.
• Ask us anything: hello@offroadpal.app — we reply within 30 days.

If you are in the EU

OffroadPal is available in EU app stores, and some of our users live in the EU. We use your GPS location only to run a feature you turned on — the map, a convoy, a recorded drive, navigation — or to answer your own request for help. Never for advertising or profiling. Your live position is deleted after 30 minutes by an automated job, not by a promise. The exceptions are the position a convoy you hosted keeps and crash reports, which can include your recent position — both described above. You can access, correct or delete your data and object to how we use it: delete your account in the app (Profile → Delete account), or write to hello@offroadpal.app. We do not sell personal data, and we use no ad networks or location brokers.

Children

OffroadPal is not intended for anyone under 16 and we do not knowingly collect their data.

Safety

OffroadPal helps you plan and record off-road driving. It is not a substitute for your own judgement, local rules, or proper preparation. The app shows emergency numbers for the UAE, Oman, Saudi Arabia and Qatar — it does not contact them for you.

Changes

If we change this policy we will update the date above and, for significant changes, tell you in the app.

Contact

hello@offroadpal.app · OffroadPal, Dubai, United Arab Emirates