TachoClear — privacy policy

Last updated: 2 October 2026

The short version

TachoClear keeps your driver record on your phone. It has no account or adverts. Product analytics, ad attribution and crash reports are on by default and can each be switched off in Settings; switching any of them off never limits an app feature or purchase. They never include your activity log, hours, dates, rules, compliance results, GPS location used by Drive Detection, motion activity, notes or exports. Measurement providers receive product interaction, purchase and technical diagnostic data. Nobody — including us — can see your hours. If you choose to send feedback, the message goes anonymously to TachoClear's shared feedback database. No email or account is required, and that system has no individual reply channel.

Versions covered

Version 1.1.0 build 9 has no third-party measurement SDKs or measurement switches. It sends no product analytics, crash reports or advertising-measurement events. Pro product, purchase, verification and restore requests still connect to Apple's StoreKit. The provider collection and switch behaviour described below starts with version 1.1.1.

The current App Store version is 1.1.4. It records the explicit product milestones described below, starts crash reporting after verifying an App Store installation and uses AppsFlyer for advertising measurement.

Version 1.1.5 is the next update and is not yet the current App Store version. It adds the automatic product events described below, starts crash reporting earlier on physical devices (including TestFlight) and removes AppsFlyer from the app. Ad attribution then uses only Apple's built-in SKAdNetwork and AdAttributionKit. It asks no new questions and adds no popup. These changes apply only once that version is installed.

What TachoClear stores, and where

Everything you enter stays in the app's own storage on your device:

• your activity log — driving, other work, availability, breaks and rest, with the times
• your settings, including which rules you drive under
• weeks you have told the app about but not logged
• your own notes about Driver CPC training and your card's expiry date

Apple may include app data in your iPhone's normal encrypted backups if you use them, whether to iCloud or to a computer. TachoClear has not independently verified a cross-device restore, so export PDF or CSV before replacing or erasing a phone. Those backups are covered by Apple's terms, not ours, and we have no access to them.

What TachoClear sends

TachoClear sends none of your activity log, settings, GPS location used by Drive Detection, motion activity, driver notes or exports to us. There is no account or driver-record sync.

The app uses Apple's StoreKit framework to ask the App Store for TachoClear Pro product information and to purchase, verify or restore Pro access. Apple processes those App Store requests under Apple's terms and privacy policy. They contain the App Store transaction information Apple needs, not your driver record. This does not prevent the shift tracker, saved records or rules guide from working without a signal.

From version 1.1.1, TachoClear also uses:

• PostHog for pseudonymous product usage: setup, completed shifts, paywall views, purchase outcomes and export format. The current App Store version sends these milestones explicitly. Version 1.1.5 also records app opens and backgrounding, named screens and interactions with supported controls using PostHog's official iOS SDK. It includes ordinary technical context such as app version, device model, operating-system version, language, time zone, screen size and a session identifier. Control text and selected values are excluded from automatic capture; screens and control identifiers describe the product, not the contents of your driver record. There are no screen recordings, person profiles, surveys or PostHog crash reports. PostHog is instructed not to derive GeoIP location from the network address. An anonymous installation identifier groups product journeys while analytics is enabled. This makes events pseudonymously linked to the installation under Apple's App Privacy definition. TachoClear supplies no name, contact detail or account identity. We use these events to understand and improve the product, not to make decisions about individual drivers or share their journeys with advertising partners.
• Firebase Crashlytics for crash reports and technical diagnostics needed to find stability problems. Firebase associates reports with app-installation identifiers; TachoClear does not add your name, contact details, account identity or your own text to them. From version 1.1.5, reporting starts before the driver record is opened on physical devices, including TestFlight installations. It can include fixed product screen/action names and generic failure categories for storage, export, purchase or feedback errors, without the original error description or private content. Debug, simulator and automated UI-test sessions do not send these reports.
• Apple's ad attribution (version 1.1.5 onwards). If you installed TachoClear after tapping an advert, Apple's SKAdNetwork and AdAttributionKit let that advertiser (for example Meta or TikTok) learn how its campaign performed. TachoClear tells iOS a small number from 0 to 63 that summarises which milestones the installation has reached: setup finished, a shift started, the first and a later shift completed, the Pro screen viewed and Pro bought. Apple, not TachoClear, decides when to send this, delays it, and sends it without any identifier for you or your device. Apple withholds detail when too few people share a campaign. Copies of these Apple reports also go to AppsFlyer, which turns them into campaign reports for us. No AppsFlyer, Meta or TikTok code runs in the app, no installation identifier is created for advertising, and nothing about your driving is included. If no advert led to your install, nothing is reported.
• AppsFlyer (version 1.1.4 and earlier, from 1.1.1). These versions include AppsFlyer's SDK to measure which campaigns lead to an install, first completed shift, paywall view or Pro purchase. It generates an identifier for the app installation, although TachoClear disables Apple's IDFA and IDFV, keeps probabilistic modelling off and masks IP addresses. A purchase event contains the product identifier, value and currency, never an App Store transaction identifier or receipt. Meta and TikTok receive only anonymous aggregate reports through AppsFlyer. Updating to 1.1.5 removes the SDK. Data already sent remains subject to AppsFlyer's retention and deletion rules.

PostHog retains its anonymous installation identifier. PostHog and Crashlytics, and AppsFlyer in versions before 1.1.5, can therefore associate their respective events or reports with an app installation over time while that measurement is enabled. This is installation-level linkage, not a claim that a provider knows the driver's real-world identity. Each provider can receive the network/IP information involved in a request; they can also receive ordinary technical information needed to provide their services, such as app version, device model, operating-system version and event time. PostHog is configured to discard IP addresses and not to derive location. Purchase events may include the product, price/value and currency. TachoClear does not request Apple's permission to track you across other companies' apps or websites and does not access the advertising identifier.

Product analytics, ad attribution (advertising measurement in earlier versions) and crash reports have separate switches in Settings and all start on. An existing switch-off is kept when you update, and a full data wipe keeps these choices. On a cold launch with Product analytics off, TachoClear does not initialise PostHog. If analytics is turned off during an enabled session, it stops new collection and queued sending. It does not delete data already sent or file-backed events captured while analytics was previously on: if you later re-enable analytics, PostHog may send those offline events. A request already in progress cannot be recalled. From version 1.1.5, a cold launch with Crash reports off does not initialise Firebase. Turning Crash reports off during an enabled session stops TachoClear's added context and non-fatal reports immediately; Firebase's automatic crash collection is fully disabled on the next app launch. The app requests deletion of pending reports on a best-effort basis, but cannot recall reports already uploading or remove a crash handler already registered in that session. With Ad attribution off, version 1.1.5 never gives iOS a conversion value, so Apple's attribution window never starts and no report about your install is produced. Data sent before a switch is turned off remains subject to the relevant provider's retention and deletion rules. PostHog, Google and AppsFlyer act as service providers for these purposes under their own privacy and security terms.

Optional feedback

Today and Settings include an optional way to share an idea, feature request, suggestion or problem. Nothing is sent merely because the invitation or form appears. When you tap Send, TachoClear sends:

• the message and whether you labelled it as an idea, problem or other feedback
• the place in the app where you opened the form
• the app version and build, platform, operating-system version and locale
• a random submission UUID used to acknowledge the exact message and make a retry duplicate-safe

The shared feedback service uses Neon Auth to issue a short-lived anonymous token and Neon to process and store the submission. The feedback tables store no name, email, account ID, advertising or device identifier, or IP address. Neon necessarily receives network information while processing the request, but TachoClear does not put it into the feedback record. There is no individual reply channel, so do not include personal information or anything that needs a response.

An unfinished draft stays in TachoClear's own storage on your iPhone. Closing the form keeps the draft so you can return to it; Discard draft removes it. A successful send clears the local draft only after the service acknowledges the matching UUID. Failed sends keep the draft and offer a retry. Submitted feedback is kept until Tom deletes it from the shared feedback database. Provider backups may retain deleted records within their restore window.

This feedback transport is separate from product analytics. It remains available if Product analytics is switched off. TachoClear may record content-free events such as opening the form or whether a send succeeded while Product analytics is enabled, but it never puts the message, submission UUID, token or error detail into PostHog.

Location and motion

Drive Detection is off by default. While it is off, the app never asks the system for your location or your motion activity.

If you turn it on:

• it reads high-confidence motion activity as the required automatic-switch signal and may use location speed as corroborating evidence while the app is open
• both are processed on your device, in the moment, to decide whether to log a switch between driving and other work
• neither is stored as a track, a route or a history. The only thing that survives is the activity entry it created, which is the same entry you would have made by tapping
• no GPS location or motion data used by Drive Detection is transmitted by TachoClear or included in StoreKit requests
• you can turn it off at any time in Settings, or revoke the permission in iOS Settings, and the app remains fully usable by tapping to switch

Exports and sharing

When you create a PDF or a CSV, the file is written to your device and handed to the iOS share sheet. Where it goes after that is your choice. TachoClear does not upload it, keep a copy, or see where you send it.

Notifications

Break, finish and other reminders are scheduled locally by your phone from times the app has worked out. No notification goes through a server, and nothing about them leaves the device.

Analytics provided by Apple

Apple gives every developer aggregate, anonymised statistics about downloads and crashes through App Store Connect. That is Apple's measurement of the App Store, not ours of you, and it contains nothing about your hours. This is separate from the measurement described above.

Children

TachoClear is a tool for professional drivers. It is not directed at children.

Your rights

Your driver record is yours: export it whenever you like, and delete it from Settings → Your data, where a full wipe asks you to type a confirmation first and offers an export before it happens. Because TachoClear has no account and provider metrics use pseudonymous installation identifiers rather than your name or contact details, we generally cannot connect a particular provider-side event to you from a support request alone. You can stop future collection at any time in Settings. Contact us with a privacy request or question and we will explain what can be actioned directly and what requires the relevant provider.

Changes

If a future version of TachoClear ever needs to transmit your app data, this policy will say so before that version ships, and the App Store privacy answers will change with it.

Contact

Tom Murton — support@weevolve.app

TachoClear is a planning aid, not the legal record — your tachograph is. Not legal advice.

Contains public sector information licensed under the Open Government Licence v3.0.