Dale!
Privacy Policy
In short. Dale! is a navigation app. It needs your location to guide you, and it keeps what it needs to sync your places and zones, remember your usual routes unless you switch that off, run your convoys and keep them civil, and fix bugs. We do not sell your data, we show no ads, and we never store your live position on our servers, except the single point of each road hazard you report or answer about, kept 30 days (3.9), the latest one also with your reporting record (3.8). You can delete your account and everything attached to it from inside the app, at any time.
Contents
- Who is responsible
- What this policy covers
- The data we process, why, and for how long
- Your location, in detail
- Convoys (Caravana)
- The assistant and your voice
- Phone permissions
- Who else sees data
- Where data lives
- What we do not do
- Your rights
- Deleting your account
- Security
- Children
- Automated decisions
- Changes to this policy
- Contact
1. Who is responsible
Dale! (the app, the website dalenav.com and the services behind them, together "Dale!") is operated by Laurel Daigneault, an independent developer based in Lima, Peru ("we", "us"). For the purposes of Peru's Personal Data Protection Law (Law No. 29733) and its Regulation, and of the EU/UK General Data Protection Regulation where it applies, we are the controller of the personal data described here. You can reach us at soporte@dalenav.com.
2. What this policy covers
This policy covers the Dale! mobile app, the dalenav.com website and invite pages, and the servers that serve them. It does not cover the practices of Apple, Google, or any other company whose services you reach through Dale! — their own policies apply to what they do (section 8 lists them).
3. The data we process, why, and for how long
Everything below is the complete list. "Account life" means the data is deleted when you delete your account (section 12). Legal bases are given for readers in jurisdictions that require them: contract (needed to provide the service you asked for), consent (you chose to send it, and can withdraw it), your choice (a switch that is on unless you switch it off, offered to you in the app's first-launch tour, which you may skip, and always in Settings, where you can switch it off at any time — where the law asks for one of its own terms, this is our legitimate interest in better routes and traffic for you and every rider, and switching it off is an objection we honour at once), legitimate interest (keeping the service working and safe, in ways you would reasonably expect).
3.1 Account
| What | Why | Kept | Basis |
|---|---|---|---|
| The sign-in provider you chose (Apple or Google), the anonymous subject identifier that provider gives us for you, and the display name the provider shares. We do not receive or store your password, and we do not store your email address. | To recognise your account across devices and reinstalls. | Account life | Contract |
| A session token, stored in your phone's secure storage, valid for 90 days. | To keep you signed in. | 90 days, or until you sign out | Contract |
3.2 Your content
| What | Why | Kept | Basis |
|---|---|---|---|
| Saved places (name, icon, coordinates), no-go zones (the polygon you drew, its name, its schedule), custom map themes, your garage choices (vehicle, paint, wheels, finish), and your app preferences (units, fuel type, marker, what the map shows). | They are yours; storing them on our servers is what lets them sync and survive a reinstall. | Account life | Contract |
| The 3D vehicle model files you upload to your garage (converted on your phone to one standard format first), with their name and orientation. They are stored on our servers, in our file storage, under a fingerprint of the file's own contents, so the same model uploaded twice is stored once. | So your garage survives a reinstall and follows you to another phone. | Until you remove the car from your garage or delete your account; the file itself is deleted once no account still refers to it | Contract |
| In a convoy, the other riders never receive your model: they receive a small image sheet of your car, rendered on your phone (section 5). | So other riders in your convoy see your car. | While in a live convoy, then 30 days | Contract |
| Ideas and bug reports you send from Settings, with the text you wrote. | To improve the app. | Account life | Consent |
3.3 Trips and your driving record
The first two rows are recorded only while "Learn my routes" is on. It is on unless you switch it off: the app's first-launch tour offers you the switch (you may skip the tour), and you can switch it off there or at any time in Settings → Navigation. Switched off, no trip is recorded and no usual route is learned from then on; what was recorded before stays until it expires (below) or you delete your account.
The third row, your driving record, is kept for every account, whatever that switch says: it is what the odometer and the Hall of Fame count, and it holds no route and no position.
| What | Why | Kept | Basis |
|---|---|---|---|
| When a navigated trip actually ends at its destination (you arrived, parked, or ended the navigation close to it): its origin and destination, the times, the kind of ending, whether you took a detour, and the road you actually drove. | The weekly visit counters on your places, and your route habits. | 90 days | Your choice |
| Your route habits: for origin–destination pairs you drive repeatedly, the path you usually take and how long it usually takes. | So the route you prefer is offered first. | 60 days after you last drive it | Your choice |
| Your driving record: the distance credited per country and per day (beside the length of the routes you asked for that day, which is how the server checks the distance is plausible), trip and night-trip counts, the stamps you have collected (which of our curated places you drove through, and when first), and the medals those unlock. To credit distance, the app sends the distance and time driven every 5 km and at the end of a trip, with one point rounded to about a kilometre that the server uses only to name the country and district, then drops. To award stamps, it sends a few seconds of positions at a time, which are checked against the stamps' outlines and dropped. Neither is ever stored. | The odometer, the Hall of Fame, stamps and medals. | Account life | Contract |
3.4 Anonymous road speeds ("Share road speeds")
While you navigate, the app can measure how long each street takes and share those per-street travel times so Dale! learns real traffic. This is designed so that it cannot be traced back to you: each trip's measurements travel under a random identifier that changes every trip and carries no account id; a daily code, derived from your account with a random key that changes every day and is deleted after two days (after which nobody, including us, can recompute it), exists only so a street's average knows how many different drivers covered it; the first and last 300 metres of every trip are never included; only aggregates are used once several trips cover a street; and the raw measurements are deleted after 90 days. Because these rows cannot be linked to an account, they are not affected by an account deletion. It is on unless you switch it off: the app's first-launch tour offers you the switch (you may skip the tour), and you can switch it off there or at any time in Settings → Navigation → "Share road speeds". Basis: your choice.
3.5 Diagnostics
| What | Why | Kept | Basis |
|---|---|---|---|
| Route requests are journaled to diagnose routing quality: the rounded start and end (to about half a kilometre), the distance, the timings, and which path the engine took. No account id. | Routing quality. | 30 days | Legitimate interest |
| The corridor of a route request — the shape of the candidate routes, a line of coordinates from where you are to where you are going — sent to HERE for the live traffic along it (8.3). No account id, no identity, nothing but the line. | To time each route with today's traffic and pick the fastest. | Not kept: the answer is used once for that request and discarded; nothing from it is stored | Legitimate interest |
| Client errors (message and stack trace) and map performance samples (frame timings, zoom level), tied to your account id so a bug you report can be matched to what your app saw. | Finding and fixing bugs. | 30 days | Legitimate interest |
| A bug report you send carries a diagnostic bundle: app, update and native versions, device model and OS version, your settings, the state of the app, a random analytics id, and the last few errors and slow frames. It never carries coordinates, addresses or place names. | Fixing the bug you reported. | Account life | Consent |
| Usage analytics (section 8.5): which features are used and how often, app and OS versions, device model, crashes. Never coordinates, addresses or place names; IP addresses are discarded since September 23, 2026 (8.5). No screen recording. | Understanding what works. | Per the provider's retention, at most 12 months | Legitimate interest |
3.6 Purchases
| What | Why | Kept | Basis |
|---|---|---|---|
| Your Dale! TURBO subscription, the only thing Dale! sells: the store it was bought in (Apple or Google), its status and expiry, and the reference the store gives the purchase (Apple's original transaction identifier, or a one-way fingerprint of Google's purchase token). Content a medal unlocks is recorded beside it, with the medal that unlocked it. | To unlock what you paid for or earned, and to validate the purchase with the store. Payment itself is handled by Apple or Google; we never see card details. | Account life | Contract |
3.7 Developer test accounts
A handful of accounts operated by the developer for engineering record their exact driven routes and comparison trips for up to 30 days. This never applies to ordinary accounts.
3.8 Reports and suspensions
| What | Why | Kept | Basis |
|---|---|---|---|
| A report you make from a convoy about a message or a rider (section 5): your account and your role in the convoy, the convoy and its name, whether it is about a message or a rider, the reported rider's account id and name, the sign-in provider and the anonymous identifier it gives for the reported rider's account (so a suspension still reaches them if they delete it), the reason you give if any, and — for a message — its text as our server holds it, never text supplied by the reporting phone. That text stays with the report even after the message is removed from the convoy or its chat is deleted. | Reviewing it, and acting on abuse. | While we review it; once handled, deleted when it is 90 days old. Deleted with the reporting account in any case | Legitimate interest |
| If we suspend an account: the sign-in provider (Apple or Google), the anonymous identifier that provider gives for it, the account id, the reason and the date. | So a suspended account cannot sign in, and cannot sign up again with the same Apple or Google account. | Until the suspension is lifted, including after the account is deleted | Legitimate interest |
| A reporting reputation for your account: a score, with what it gained today and when it last lost points; how many road hazard reports you made and how many were confirmed or denied; how many reports and answers you sent this hour and today; the time and rounded position of your last one; and, if the score falls too low or we suspend your reporting after reviewing it, a reporting suspension with its end date, and how many there have been. Never shown to other riders. | So that false reports lose their voice, and to bound how much one account can report. | Account life; deleted with the account | Legitimate interest |
Muting a rider happens on your phone: the list of riders you muted is kept on that phone for your account, cleared when you sign out, and never sent to us. Our usage analytics (8.5) count that you muted or unmuted somebody, never whom.
3.9 Road hazard reports
| What | Why | Kept | Basis |
|---|---|---|---|
| A road hazard you report (police, speed camera, crash, hazard, closure, roadworks) and your answers to "still there?": your account id, the kind and type, the time, your position on the road at that moment rounded to about 11 metres, your heading, speed and GPS accuracy, the road segment you were on, the hazard it belongs to, the weight your voice had, and what became of it. Beyond the trip records of 3.3, these single points are the only positions of an ordinary account stored with its account id: one per report or answer, never a route. | To check that a report was made from where the car is, to count the voices behind a hazard, and to review abuse. | 30 days, or until you delete your account | Legitimate interest |
| The hazard other riders see: its type, state, position, heading and road segment, when it was first and last reported, how many reports and answers it has, from how many accounts, and when it expires. It carries no account id, and riders are never shown who reported it; only the report records above tie it to an account, for their 30 days. | Warning other riders. | Until it expires, other riders deny it or we remove it (it expires at most 30 minutes to 6 hours after the last sighting, by type; a permanent speed camera stays until riders stop confirming it), then 30 days more for review | Legitimate interest |
A permanent speed camera nobody reported: the position of a highway=speed_camera node from OpenStreetMap's public map data (© OpenStreetMap contributors, ODbL), refreshed monthly, kept as a hazard "to be verified" with no report and no account behind it. Riders passing are asked once whether it is still there. | Warning other riders, and letting riders correct the map. | Until riders deny it three times or we retire it; never for lack of traffic. A retired one is kept, without any report, so it is not seeded again | Legitimate interest |
4. Your location, in detail
- On the map. Your position is read by your phone and drawn on the map on your phone. Loading map tiles tells our servers which area you are looking at, as any map does, together with your IP address; this is not kept beyond ordinary server logs.
- Routing. When you ask for a route, we send your current position, the destination, any via points, your course, your no-go zones and your preferences to our routing engine, which computes the route and returns it. The request is journaled as described in 3.5, without your account id and with the endpoints rounded.
- Traffic. Live traffic is fetched for the area of your route from TomTom (section 8) and drawn on your phone only; it is never stored. For each route you ask for, our server also sends the corridor of the candidate routes to HERE and uses the live speeds it answers with, once, to time those routes and pick the fastest (8.3); the same answer may colour the traffic on those routes on your screen (then no TomTom tile is fetched for them) and, when it reports a jam on them, have our routing engine look once more for a way around it. Nothing from that answer is stored, and nothing it changed is kept: the next route you ask for starts from a clean engine.
- Trips. Only while "Learn my routes" is on (it is, unless you switch it off), and only when a trip ends, as described in 3.3.
- Odometer and stamps. While you navigate, whatever "Learn my routes" says: the distance you drove, with one point rounded to about a kilometre, and short batches of positions to check for stamps. The server keeps the distance, the country and the stamps, and drops the points (3.3).
- Road hazard reports. When you report a hazard or answer "still there?", that one position is sent with your account and kept rounded, as 3.9 describes. The hazard key exists only while you navigate. To show the hazards ahead of you, the app also asks our servers, every half minute to a minute, for those in the squares of about one kilometre around you and along your route. The request carries your session and names those squares, never your exact position, and is not kept beyond ordinary server logs.
- Convoys. Only while a convoy you joined is active, as described in section 5.
- When the app is closed or in the background, your location is not collected — except during an active convoy if you granted "Always" location, so your car keeps moving on the other riders' maps.
5. Convoys (Caravana)
A convoy is a group drive you create or join with an invite link. While a convoy is active:
- Your live position (with heading and speed) is sent to the convoy's room on our servers every few seconds and relayed to the other members in real time. It is kept only in memory: your latest position is held until you leave or the convoy ends, and positions are never written to storage.
- The other members see your display name, your car (the rendered image sheet), where you are now, your chat messages, your radio clips if they are within about 200 metres of you, and any police report you send. Anyone who has the invite link (and the PIN, if the leader set one) can join while the convoy is live: share the link with care.
- Chat messages are stored so late joiners can read them; they are deleted 30 days after the convoy ends. Radio clips (up to 15 seconds of audio, recorded on your phone when you hold the key) are stored for one hour and then deleted. Police reports (a position and your display name) live in the room's memory and are gone when the convoy ends. The same press of the police key also makes an ordinary road hazard report to every rider near it, as 3.9 describes: the convoy's copy carries your name to your convoy and nothing to us; the shared one carries your account to us for 30 days and your name to nobody.
- The convoy itself (its name, its destinations — the stops the leader planned, with their labels — its schedule, who was in it and in what role, and whether the leader removed anyone) is deleted 90 days after it ends.
- A PIN, if set, is stored only as a salted hash; failed attempts are counted per member so it cannot be guessed.
- Background sharing uses the "Always" location permission on your phone; on Android a persistent notification shows while it runs. You can decline it and share only while the app is open.
- Chat messages, convoy and stop names, and riders' names as the convoy shows them pass through an automatic filter on our servers that masks a list of slurs and insults (in Spanish and English) before they are stored or shown to anyone. It is a floor, not a guarantee.
- Reporting. Hold a chat message to report it, or report a rider from the convoy's rider list. The report reaches the developer with what 3.8 lists; nothing tells the rider you reported that you did. We may remove content and suspend an account that breaks the Terms: a suspended account cannot sign in, and because we keep its sign-in identifier (3.8), deleting it and signing up again with the same Apple or Google account does not lift the suspension.
- Muting. You can mute a rider: their messages are hidden and their radio clips are not played to you, in every convoy. Who you mute is kept on your phone and never sent to us; our analytics count only that a mute happened (3.8).
- Leaving a convoy stops your sharing immediately; deleting your account removes you from every convoy you are in and ends the ones you lead.
6. The assistant and your voice
- Speech recognition. When you dictate a convoy chat message, or speak to the assistant where it is available, the app hands your voice to your phone's own recogniser, Apple's or Google's. Depending on the phone and its settings, that recogniser works on the phone or sends the audio to Apple's or Google's servers, under their terms. We never receive that audio, only the text you then send.
- Chat read-aloud uses your phone's text-to-speech; nothing leaves the phone.
- Radio clips in a convoy are real audio; see section 5.
- The assistant is not available in every version of the app. Where it is, what you asked — the text (at most 400 characters), the recogniser's alternative readings of the same sentence, the names of your saved places, and, on a follow-up, the previous question and its options — is sent to Anthropic's API, which interprets it into a destination and routing preferences. Anthropic processes it as our service provider under its commercial terms and does not use it to train its models. We keep only token counts for cost accounting, never the request.
7. Phone permissions
| Permission | Used for |
|---|---|
| Location (while using) | Showing your position, navigating, and sharing with a convoy while the app is open. |
| Location (always) | Only convoys: keeping your car moving on the others' maps while the app is in the background. Optional. |
| Microphone | The convoy radio, dictating a convoy chat message and, where it is available, speaking to the assistant. |
| Speech recognition (iOS) | Turning what you dictate into text, with Apple's recogniser (section 6). |
| Files | Choosing a 3D model for your car. Only the file you pick is read; it is converted on your phone and uploaded to your garage (3.2). |
| Notifications (Android) | The persistent notification Android requires while background location runs. |
8. Who else sees data
We share data only with the providers that run the service, only what each needs, and with the other members of a convoy you join. A road hazard you report is shown to the riders near it, without your name or your account (3.9). We never sell data, never share it with advertisers, and never hand it to data brokers.
8.1 Infrastructure
Cloudflare (United States, global network) hosts our servers, database, file storage and the convoy rooms; data at rest is encrypted. Hetzner (Falkenstein, Germany) hosts the routing engine that computes routes from the coordinates in each request; it keeps no account data. Expo (United States) delivers app updates; your phone tells it which app version and platform it runs, never who you are.
8.2 Maps and places
Map tiles are served from our own servers (built from OpenStreetMap and OpenMapTiles). Place search uses our own place index and, when needed, TomTom's geocoding service, which receives the text you searched and the area of the map — under our API key, never your identity. Fuel station data comes from Osinergmin's open data (Peru) and contains no personal data.
8.3 Traffic
TomTom serves live traffic tiles for the area around your route; the request carries the tile coordinates under our key, not your identity. Traffic is displayed on your phone only.
HERE Technologies (Netherlands and Germany) receives, for each route you ask for, the shape of the corridor around the candidate routes — a line of coordinates from where you are to where you are going — under our API key, never your account or identity, and answers with the current traffic speeds along it. The answer is used once, to time that route, colour its traffic on your screen and look once for a way round a jam it reports, and discarded; nothing from it is stored.
8.4 The assistant
Anthropic (United States) receives the text of your request as described in section 6.
When you ask the assistant to avoid a street by name, our server looks up that street's shape on a public Overpass server, a service that answers questions about OpenStreetMap data: overpass-api.de, overpass.kumi.systems or overpass.private.coffee, tried in that order. The request comes from our server and carries the street name and the centre of the square of about 11 km you are in — never your position, your account or your IP address. The answer is kept 30 days, so the same question is not asked twice.
8.5 Analytics and crashes
PostHog (United States) receives usage events and crash reports as described in 3.5, under a random identifier that we link to your account id so a bug report can be matched to the crashes your app sent. Its location lookup from IP addresses is switched off, and since September 23, 2026 PostHog discards the IP address of every event it receives (the project is set to discard client IP data): events received since then carry no IP address. Events received before that date keep the IP address they arrived with until they expire, at most 12 months after they were sent (3.5). We do not use session recording.
8.6 Where you heard about us
If you reached the app through one of our short links (dalenav.com/r/…), we add one to a counter: how many taps that link got, on which day, from which kind of phone and which country. There is no record of you in it — no address, no device, no identifier of any kind — and it cannot be turned back into a list of people.
On Android, Google Play passes the app the campaign name from that link the first time you open it. It is a label like “a creator’s name”, not an identifier, and we keep it alongside your usage events so we know which campaigns bring people who actually drive.
On iOS there is no such label, and the app does not ask your permission to track: it never reads your advertising identifier and never follows you into other apps or websites. We simply do not learn which ad you came from.
8.7 Sign-in and payments
Apple and Google handle sign-in and purchases under their own terms. From sign-in we receive the identifiers in 3.1; from purchases, the receipt or transaction in 3.6.
8.8 Convoy members
Members of a convoy you join see what section 5 describes, for as long as the convoy is active. They are other people, not our providers; be as careful with them as you would be in person.
8.9 Legal
We will disclose data if the law requires it, to a competent authority with a valid request, or to protect the safety of riders or the integrity of the service, and only to the extent required.
9. Where data lives
Our servers run on Cloudflare's global network, with the database in a region Cloudflare selects near our users; routing runs in Germany; analytics and the assistant run in the United States. Where data leaves Peru or the European Economic Area, it does so under contracts with these providers that require them to protect it, including the standard data-protection clauses those jurisdictions recognise.
10. What we do not do
- We do not sell, rent or trade personal data.
- We do not show ads and do not share data with advertisers or data brokers.
- We do not store your live position, and we do not build a history of where you have been beyond the trip records of 3.3, which you can switch off, and the single points of the road hazards you chose to report or answer about (3.9).
- We do not record your screen, and we do not read your contacts, photos (beyond the file you pick), messages or calendar.
- We do not store your password or your email address.
- We do not feed traffic data or any third-party location data into your route history.
11. Your rights
Wherever you are, you can ask us to tell you what data we hold about you, to correct it, to delete it, to stop or limit a particular processing, to give you a copy in a usable format, and to withdraw a consent you gave or object to a processing (the switches in Settings do this instantly for trips and road speeds). Write to soporte@dalenav.com from the sign-in you use, or use the in-app controls. We answer within the deadlines the applicable law sets, and we may ask you to confirm you own the account.
Peru. Under Law No. 29733 you hold the rights of information, access, rectification, cancellation and opposition (the "ARCO" rights), and the right not to be subject to decisions based solely on automated processing that produce legal effects. If you believe we have not honoured them, you may complain to the Autoridad Nacional de Protección de Datos Personales of the Ministry of Justice and Human Rights.
European Economic Area and United Kingdom. The GDPR rights of access, rectification, erasure, restriction, portability and objection apply, as does the right to lodge a complaint with your national supervisory authority. Our legal bases are listed in section 3.
California and other US states. You may know what we collect and why (this policy), ask for access or deletion, and you will not be treated differently for doing so. We do not "sell" or "share" personal information as those laws define it.
12. Deleting your account
"Delete account", at the bottom of Settings → About and confirmed twice, erases your account immediately and permanently: your places, zones, themes, preferences and garage (including the 3D models you uploaded), your trips, habits, statistics, stamps and achievements, your ideas, bug reports and the reports you made, your road hazard reports and your reporting reputation, your purchase records, your convoy memberships (the convoys you lead are ended), and your session. You can also ask by email (see Deleting your account). Two things are not touched because they cannot be linked to you: the anonymous road-speed measurements (3.4) and the journaled route requests (3.5). A hazard you reported stays on the map until it expires; it never carried your account. A report another rider made about you belongs to their account: it stays while we review it and, once handled, until it is 90 days old, or until that rider deletes their account (3.8). If the account was suspended, the suspension record (3.8) is kept, so the same sign-in cannot open a new account. Usage analytics tied to your random identifier are deleted from the analytics provider on request.
Backups. The database keeps its own recovery copies for 30 days, and we keep a weekly backup for 8 weeks, both only to recover from a disaster and never read for anything else. Deleted data is not removed from them one by one: it disappears as they age out, within about 8 weeks.
13. Security
All traffic between the app and our servers is encrypted (TLS). Data at rest is encrypted by our hosting provider. Sessions are signed tokens with a 90-day life, kept in your phone's secure storage; we never see a password. Convoy PINs are stored only as salted hashes, and a convoy's positions are never written to storage. Access to production data is limited to the developer, for operating the service. Should a breach affect your personal data, we will notify you and the competent authority as the law requires.
14. Children
Dale! is built for drivers and is not directed at children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect data from anyone younger; if you believe we have, write to us and we will delete it.
15. Automated decisions
Routes, the order of route options, and the traffic estimates are computed automatically from the data in this policy. They are suggestions for you to accept or ignore, and they produce no legal or similarly significant effect on you. A road closure, crash or roadworks that other riders confirmed can move the route you are offered — a closure is avoided, a crash or roadworks is treated as a slow stretch — and you can switch each of the three off under Settings → Navigation. We do not profile you for advertising. Road hazard reports are weighed automatically: a report counts for more once other riders confirm it, and an account whose reports are contradicted again and again can have its reporting suspended for a time. Nothing else in the app is affected.
16. Changes to this policy
When this policy changes in substance, the version and date above change, and we tell you in the app or in the app's update notes in the store. Continuing to use Dale! after the change means you have read the new version. Earlier versions are available on request.
17. Contact
Laurel Daigneault, Lima, Peru · soporte@dalenav.com
Where this policy exists in more than one language, the Spanish version governs for users in Peru and the English version elsewhere.