Privacy policy: BroomBroom

Draft for the owner to reviewThis policy is a working draft written from the product plan. It has not been checked by a lawyer and describes the service as planned for launch. It must be checked against the finished app, the hosting set-up and the data protection impact assessment before the app is released.

BroomBroom is a mileage tracker. To do its job it has to know where you drive, which is personal information, so we have tried to say plainly what we keep, why, and what you can do about it.

Who we are

BroomBroom is run by 12 Hobbies Studio Limited ("we", "us"), a company registered in England and Wales, company number 16488194, with its registered office at 89 Portland Street, Barnsley, S70 3QT. We are the controller of the personal data described here. You can contact us at [email protected].

What we collect

When you create an account

Your email address, or the identifier that Apple or Google gives us when you use "Sign in with Apple" or "Sign in with Google" (this can include your name and an Apple private relay address if you choose one).

When you use the app

Your drives: the start and end time, the start and end locations (coordinates), the address of each, the distance, whether the drive is business or personal, the vehicle, any passengers, and any note you add. We do not keep a second-by-second trail of where you went.
Saved places and rules you create, such as "Home" and "Office", with their locations.
Vehicles you add: name, type, fuel type, ownership, and the registration if you choose to enter it.
Fuel, charging and odometer entries, and any receipt photos you attach.
Your settings, such as whether you are an employee or self-employed, and your chosen mileage rate.

When you subscribe

Apple or Google handles the payment. We receive confirmation of whether you have Pro and when it renews. We do not receive your card or bank details.

Technical and support information

Your IP address, the app version and phone type, in our server logs, to run and secure the service.
Emails you send us.

Your location

BroomBroom uses your phone's location and movement sensors, including in the background when the app is closed, only to notice when you start and stop driving. You can turn location access off in your phone settings at any time, but automatic drive detection will then stop working.

Location is used to build your drive records. It is not used for advertising, and it is not sold or shared for marketing.
Drives are stored on your phone first. They are sent to our server when you are online so that your data is backed up and your reports can be made.

Addresses and geocoding

To turn coordinates into an address, the app asks Apple (on iPhone) or Google (on Android) to look the place up, using the feature built into your phone's system. This means the coordinates of the start and end of a drive are sent to Apple or Google, under their privacy policies. The address that comes back is saved with the drive, so it does not need to be looked up again.

We plan to add a lookup service of our own on the server at a later stage. If we do, the coordinates of your drives will be sent to that provider, and we will name it here and update this policy before it starts. Where map data from OpenStreetMap is used, it is credited as "© OpenStreetMap contributors".

Calendar

If we add calendar-based sorting, it will work on your phone, and your calendar will stay there unless you choose to switch on something that sends it to us. We will update this policy before that is released.

Why we use your data, and our legal basis

What we do	Lawful basis under UK GDPR
Provide the app: record, store, sync and report on your drives	Performance of a contract with you (Article 6(1)(b))
Use your location in the background to detect drives	Your consent, given through your phone's location permission and our in-app explanation (Article 6(1)(a)). You can withdraw it at any time in your phone settings.
Check that you have Pro, and handle billing questions	Performance of a contract (Article 6(1)(b))
Keep the service secure, prevent abuse and fix faults	Our legitimate interests in running a safe service (Article 6(1)(f))
Answer your emails	Legitimate interests, and the contract where it is about your account
Meet legal, tax and accounting duties	Legal obligation (Article 6(1)(c))

Where your data is stored

Our servers are in the European Union, hosted by Hetzner Online GmbH. Backups are encrypted. The UK treats the EU as providing an adequate level of data protection, so no extra safeguards are needed for this storage.

Apple and Google process some data (geocoding, sign-in and payments) under their own terms, and may do so outside the UK and the EU.

Who we share it with

Our hosting provider (Hetzner), who store the data for us and may not use it for their own purposes.
Apple and Google, for sign-in, geocoding on your phone and subscription payments.
An email delivery service, only to send the reports you ask us to email, and messages about your account. We will name the provider here before the apps are released.
Anyone you choose, for example when you email a report to your accountant.
Authorities, only where the law requires it.

We do not sell your data, we do not show adverts, and we do not use tracking or advertising software in the app or on this website.

How long we keep it

Your account data, drives and logs are kept while your account is open, so you have your history for tax purposes.
When you delete your account we remove them within 30 days. Encrypted backups are replaced within a further 35 days. See delete your account.
Server logs are kept for a short period, up to 30 days, then deleted.
Emails to support are kept for as long as needed to deal with your request, and then for up to 2 years in case of follow-up.
Anything we must keep by law is kept for as long as the law requires.

Keeping it safe

Data is encrypted in transit and backups are encrypted. Each account can see only its own data. We test the service for security before each release. No system is perfectly secure, and if a breach put your rights at risk we would tell you and the Information Commissioner's Office as the law requires.

Your rights

Under UK GDPR you can ask us to:

give you a copy of your data (you can also export it from the app)
correct anything that is wrong
delete your data (you can do this in the app, see delete your account)
restrict or object to how we use it
move your data to another service
withdraw your consent, for example to location access, at any time

Email [email protected]. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, although we would like the chance to put things right first.

Children

BroomBroom is for adults who drive. It is not meant for anyone under 18, and we do not knowingly collect their data.

This website

This website does not use cookies or analytics. See cookies. Our hosting records your IP address in standard server logs for security.

Changes to this policy

If we change this policy in a way that matters, we will change the date at the top and tell you in the app before it takes effect.