Privacy Policy

Document ID

privacy

Version

1.6.0 · Revision: 8

Effective

2026-09-05

Status

Final — counsel reviewed 2026-08-21; entity, jurisdiction and contact supplied by the owner 2026-08-22. §§ 3.2, 7A and 7B (community star ratings and weigh-station status) added 2026-08-27, the Supabase history store added to §§ 3.4 and 11 on 2026-08-28, the device tag behind the included Basic routes added as § 4.1 (with §§ 3.1, 3.4 and 12) on 2026-08-29, Weather Ahead — severe-weather alerts from the National Weather Service — added as § 5.5 (with §§ 2, 5.3, 11, 12 and 15) on 2026-08-30, and the website beta-signup form added as § 3.5 (with §§ 1, 3.4, 7.2, 11, 12 and 15) on 2026-09-05 — none of the five yet reviewed.

This policy describes what LastWagon actually does, verified against the source code of the release it ships with. Where a section says information stays on your device, that means there is no code path that sends it anywhere.

Controller: LastWagon, a subsidiary of Hobo Express Cartage LLC, Tennessee, United States. Contact: through the LastWagon project page, https://github.com/jackofall1232/lastwagon (open an issue; the tracker is public, so do not post personal information there — say that you need a private channel and we will arrange one). Support: <support@lastwagon.app> — the official support address, and the one to use for anything that involves your own information rather than a public bug report.

1. The short version

• LastWagon has no advertising, no analytics service, no crash-reporting service, and no third-party tracking SDK. There is nothing in the app that reports how you use it.
• Almost everything you create in LastWagon — your inspections, your CDL progress, your Driver Ledger, your truck profile — never leaves your phone.
• Routing is one exception, and it has to be: to get you a route, the coordinates of where you are and where you are going must be sent to a routing service.
• Receipt double-checking is the other, and only if you ask for it. Photographing a receipt and reading it are done entirely on your phone, for everyone, offline — that never leaves the device. If you hold Premium and tap to have a reading double-checked, that one receipt's photograph and the text read from it are sent to the LastWagon proxy and on to an AI provider, which returns corrections. It is never automatic, it is never done to a receipt you did not tap, and declining it costs you nothing but the second opinion. See §"Receipts" below.
• Community reports carry a place and one small fact — a truck stop and a colour, a truck stop and a number of stars, or a weigh station and open-or-closed. Not your location, and not your identity.
• LastWagon has no user accounts for ordinary use. There are exactly two places an email address is handled: a Premium subscription uses an email-and-password sign-in (§ 10), and the beta-signup form on the LastWagon website asks for a first name and an email address so we can contact you about beta access (§ 3.5). The second is a form you fill in on lastwagon.app, never something the app sends — nothing in LastWagon on your phone submits a signup, and nothing in it knows whether you made one.

2. Information that stays on your device

None of the following is transmitted to LastWagon or to anyone else. It lives in the app's private storage on your phone, and uninstalling LastWagon deletes all of it.

Android backup

Android's own backup and device-transfer features may copy some app data to your Google account, under Google's terms, not ours. LastWagon excludes the following from backup and device transfer, because a copy of them on another phone would be wrong or unsafe: your openrouteservice key, your installation token, your Premium sign-in token, your Premium usage counters, and the Premium trip cache.

Everything else, including your Driver Ledger, is included in Android backup if you have Android backup switched on. You can turn Android backup off for LastWagon in your device's system settings. See § 15 for the open item on this.

3. Information sent to LastWagon's own servers

LastWagon operates one small server: a request proxy hosted on Vercel, with a key-value store provided by Upstash. It exists for two reasons — to keep the shared routing credential off your phone, and to carry the community reports: parking, star ratings, and weigh-station status. It is not an account platform and it stores no profile of you.

Every request the app makes to it carries an installation token (§ 4) and, inherently, your IP address, because that is how internet requests work.

3.1 Basic routing and address search

When you use Basic routing without your own key (§ 9), these go to the LastWagon proxy, which forwards them to openrouteservice:

• The coordinates of your origin, destination and any waypoints
• Your truck profile — the height, width, length, gross weight, axle load, axle count and hazardous-material class you entered, because that is what makes the route a truck route rather than a car route
• Text you type into an address field, and the coordinates of a "near me" search
• Coordinates you ask to be turned into an address label

The proxy does not keep a copy of any of this. It rebuilds each request from a fixed list of permitted fields, forwards it, and returns the answer. There is no route history and no routing database.

What the proxy *does* keep is a count. Basic routes on LastWagon's key are counted against the five included with the app (§ 9), against the device tag described in § 4.1 — the route request itself carries no such value, and nothing about where you were going is kept alongside the number. A recalculation while you are already driving a reviewed route is never counted, an address search is never counted, and neither is the Driver Ledger's state-by-state mileage estimate, which asks for geometry rather than for a route you are driving.

3.2 Community reports: parking, star ratings, weigh stations

Three community features, one shape. In every one of them, your coordinates are not sent, and no timestamp from your phone is trusted — the server stamps the time itself.

• Submitting a parking report sends a LastWagon truck-stop identifier and one of GREEN, YELLOW or RED. That is the entire message.
• Submitting a star rating sends a LastWagon truck-stop identifier and a number of stars, one to five. Rating the same stop again replaces your earlier vote — see § 7A for what makes that possible and what it costs.
• Submitting a weigh-station status sends a LastWagon station identifier and one of OPEN or CLOSED. There is no third value to submit: "no recent report" is what the app shows when nobody has said anything lately, not something anyone sends. See § 7B.
• Reading statuses — parking colours, rating averages, weigh-station status — sends a list of up to 300 identifiers, the ones on your screen, and gets back their current values.

3.3 Premium sign-in

Signing in to Premium sends your email address and your password to the proxy, over HTTPS. The password is checked against a stored one-way hash and is never written to storage or to a log. See § 10.

3.4 What is stored on the server, and for how long

Address searches travel in the request path for the geocoding endpoints, which means the text you typed can appear in the proxy's platform request logs. See § 15.

One row in that table is not like the others. Every other thing the store holds is keyed on a derived value and contains no way to reach a person. The beta-signup record contains an email address, because contacting you is the entire point of it. It is the single exception, it comes from a website form rather than from the app, and § 3.5 is the whole of it.

3.5 Website beta signup

The LastWagon website has a page at https://lastwagon.app/beta where a driver can ask to join the beta programme. This is the only part of this policy that describes something the app never does: nothing on your phone submits a signup, nothing on your phone knows whether you made one, and if you never open that page nothing in this section happens at all.

When it is collected. Only when you fill in the form and press submit. There is no other trigger.

What the form asks for. Required: your first name, your email address, and a checkbox acknowledging that this is beta software. Optional, and blank is a perfectly good answer to every one of them: your US state, your driver type (company driver, owner-operator, lease operator, team driver, or other), your typical operation (OTR, regional, local, or mixed), the Android phone or tablet you would test on, and a free-text note.

What it is for. To contact you about beta access, and to run the beta programme — sending install instructions and saying which builds we would like tested. That is the whole purpose. It is not a marketing list, it is not shared with anyone, and it is not sold.

Where it goes, and how it is keyed. The form posts to the LastWagon proxy, which stores the signup in Upstash — the same key-value store that holds community reports. The storage key is a one-way hash of your address, lowercased, and never the address itself. The record under that key holds the fields you submitted, the server's own timestamp, and which of the two allowed website origins (lastwagon.app or www.lastwagon.app) served the form to you.

What the record deliberately does not hold: no IP address, no user agent, no device identifier, no installation token, and nothing derived from the app on your phone.

Signing up twice changes nothing. A second submission with the same address is refused by the store itself, and the original record is kept exactly as it was — same timestamp, same answers. The page answers a repeat signup the same way it answers a first one, so nobody can use the form to test whether an address is on the list.

Abuse limits, and the honeypot. Two short-lived counters keep the form from being flooded: one per IP address per hour, one across everybody per day. Both are keyed on a derived IP value — the same derivation as every other counter in § 7.2, never a raw address — and both expire on their own, after 1 hour and 24 hours. The form also carries a honeypot: a hidden field no person ever sees. A submission that fills it is answered as though it were accepted, and nothing is stored.

What is logged. The proxy writes one word per submission — whether it was stored, was a duplicate, tripped the honeypot, or hit a named rate limit. Never your address, and never your note. Vercel's platform logs still record the request's IP address and path, as they do for every request to any website.

How long it is kept. For the duration of the beta programme. A record is deleted when the programme ends, or when you ask for it to be deleted, whichever comes first. There is no automatic expiry in the code, and we would rather say that than describe a timer that does not exist.

Removing it. Email <support@lastwagon.app> from the address you signed up with. We can look a signup up by address and delete it — the hashed key is exactly what makes that a single lookup rather than a search. This is the one thing in this policy you *can* have deleted on request; community reports cannot be (§ 12).

It is switched off until this revision is published. The endpoint that stores signups is held closed by a server switch, so that no signup can reach the server under a policy that never mentioned it. It is opened only after this revision is published and accepted. Until then the form on the website offers you the same signup as an email you send yourself, from your own mail app, to support@lastwagon.app — and an email you send us is handled like any other support email, not stored in the signup store described above.

4. Your installation token

On first launch the app asks the server for an installation token. The server generates a random identifier, signs it, and returns it. The app stores it and sends it with every request.

• The identifier inside it is not an advertising ID, a phone number, or anything that names you as a person. It is a random number the server invented.
• It exists so that abuse can be rate-limited and, if necessary, blocked, without knowing who anyone is.
• It is pseudonymous, not anonymous. It is stable across your requests, so requests from one installation can be recognised as coming from the same installation.
• Reinstalling LastWagon, or clearing its data, produces a new token and breaks the link to the old one for everything in this policy except one count — the included Basic routes you have used, which is the whole subject of § 4.1 below.

4.1 The device tag, and the one thing it counts

Basic routing includes five routes on LastWagon's openrouteservice key before you need your own free key (§ 9). Those five are counted per device, and this is the only place in LastWagon where anything derived from your hardware is used at all. It is described in its own section rather than folded into the token above, because it is a different kind of value and deserves to be read as one.

• What the app reads. Settings.Secure.ANDROID_ID — a value Android gives to apps, which since Android 8 is a *different* value for every app publisher on the same phone, so it is not a number other apps see. It survives uninstalling and reinstalling LastWagon, and it changes on a factory reset.
• What leaves your phone is never that value. The app sends a SHA-256 hash of it under a fixed LastWagon label. The server hashes that result again under a secret only the server holds, and only that second result is kept, inside your own signed token. The hash your phone sent is never stored and never logged; it exists in memory for the length of one registration call.
• It is used for exactly one thing: counting the five included Basic routes. It keys no other counter, it is attached to no community report, it is sent to no third party, and it is never used to recognise you across apps or to build any kind of profile.
• It is sent when the app registers, and when its token is renewed. It does not travel with your routes, your searches or your reports.
• What it honestly does, and does not do. It closes the casual reset — clear app data, get five more routes — and nothing beyond that. It is not device attestation and not a device fingerprint, and this policy will not describe it as either. A modified copy of the app can simply decline to send it and be counted per installation instead, and a factory reset changes the underlying value for real.
• If Android returns nothing usable — no value, a blank one, or one of the known manufacturing-batch constants that identifies a production run rather than a phone — the app sends nothing at all, and your included routes are counted per installation exactly as they were before this existed.

In Google Play's Data safety vocabulary a value derived this way is a device or other ID, and it is named as one here rather than being described as something milder.

5. Location

Location gets its own section because it is the most sensitive thing this app touches.

5.1 When LastWagon asks for it

LastWagon requests location permission only when you use a feature that needs it, and never at first launch:

• pressing the "my location" control on a map
• searching for truck stops near you
• starting turn-by-turn guidance

If you refuse, maps still work, the directory still works, and you can still plan a route by typing addresses. You lose the position dot and "near me".

LastWagon requests foreground location only. It does not request ACCESS_BACKGROUND_LOCATION, and it never asks for the always-on location grant.

5.2 During active guidance

When you start guidance, LastWagon runs a foreground service — the one that puts a persistent notification in your status bar — so that the trip keeps running when you switch apps or your screen goes off. That service is why guidance survives a phone call.

This is still foreground location in Android's sense, tied to a trip you started and visible in your notification shade the whole time. It stops when the trip stops.

5.3 Where your coordinates go

5.4 Whether location is stored

• On your phone: yes, in a limited way. The origin and destination of your last route are saved so the planner reads as you left it; an interrupted trip stores its destination for up to 12 hours (§ 6); the Premium trip cache holds one trip for up to 48 hours (§ 8). You can delete all of it — see § 12.
• On LastWagon's server: no. No location is stored server-side. Parking reports contain no coordinates.
• At openrouteservice and HERE: governed by their own privacy policies (§ 11).

5.5 Weather Ahead

Weather Ahead shows severe-weather alerts that are in force on the road ahead of you. It sits in the location section because it touches your route, and it is worth being exact about how small a thing it is — "weather" and "location" in the same sentence usually mean something much larger than this.

• Alerts only. There is no forecast in LastWagon. The app asks what warnings, watches and advisories the National Weather Service has issued right now. It does not ask what the weather will be, and nothing in the app predicts weather.
• It runs only when there is a route. The check begins when you calculate or drive a route and stops when that route ends. With no route on the screen, nothing is requested and the National Weather Service is never contacted at all.
• It asks for no new permission, and it does not follow you. Weather Ahead reads the planned route — the line you asked the app to draw — not a history of where your phone has been. It adds nothing to the location use described in § 5.1, and it does not need the position dot to work.
• What actually leaves your phone, and nothing else: the two-letter codes of the states your route crosses, and one coordinate about every 20 miles of that route, rounded to four decimal places — roughly 100 feet — used only to look up which forecast zone that stretch of road is in. A state code is not a location. A point every 20 miles, rounded to a hundred feet, is a corridor rather than a trip. Neither is a fix from your GPS: both are read off the planned line.
• The narrowing happens on your phone. LastWagon asks for every alert in force in those states and works out on the device which ones are actually on your road. The National Weather Service is never told which highway, which exit, or how far along it you are.
• No LastWagon server is involved. These requests go from your phone straight to api.weather.gov, run by NOAA's National Weather Service. LastWagon's proxy is not in the path and holds no record that you asked. The National Weather Service sees your device's IP address, as any service you contact does, and no identifier of any kind travels with the request — no installation token, no device tag, no account, not even your phone's model.
• The zone cache, and why this shrinks the more you use it. Which forecast zone covers a given point almost never changes, so the answer is kept on your phone for 90 days. A lane you run every week is looked up once and then not again. The cache is one small file in the app's private storage; it holds zone identifiers for points on roads, not a record of trips, and it is emptied by Android's "Clear storage" and by uninstalling LastWagon (§ 12).

What this feature is not able to do — where its coverage ends and how late an alert can be — is in § 15, with the rest of the things this policy would rather state than round away.

6. Interrupted trips

If a trip is interrupted — a reboot, a crash, the app being killed — LastWagon leaves a small record so it can offer to continue: the destination's label and coordinates, the provider, and how far was left. It contains no route geometry and nothing from any provider's SDK.

It is deleted automatically after 12 hours, and immediately when the trip ends normally or you decline the offer.

7. Community parking, in detail

7.1 What a report contains

A truck-stop identifier and a colour. Nothing else leaves your phone.

The server adds, on arrival:

• its own timestamp — your phone's clock is never trusted or stored for this purpose
• a pseudonymous reporter identifier (below)

7.2 The reporter identifier — per stop, per period

The server does not store your installation token with your report. It stores a keyed hash — and that hash is deliberately scoped to the single truck stop you reported on, and to the period you reported in:

`` reporter id = HMAC-SHA256(server secret, installation + truck stop + time period) ``

Two consequences, and they are the whole point:

• Reports you make at different truck stops are not linkable to each other. The identifier at one stop is unrelated to the identifier at another. Nobody reading the stored history can assemble your stops into a route.
• Reports you make at the same truck stop in different periods are not linkable either. The identifier rotates on a schedule — currently every seven days — so last month's reports and this month's do not connect.

What stays linkable is exactly what the feature needs to work: the reports one installation made about one truck stop inside one period. That is what lets the app say "3 drivers said" without one driver reporting three times looking like three drivers.

This is still pseudonymous, not anonymous, and we will keep saying so. Within one stop and one period, repeat reports from one installation are recognisable as coming from the same installation. What has been removed is the ability to follow that installation anywhere else.

What limits it further: the identifier is never shown to any other user or returned by any API; the raw installation token is never stored; the hash cannot be reversed without the server's secret; and reinstalling the app breaks every chain permanently.

The honest cost. We can no longer look back through the stored history and group one installation's reports across many truck stops. That was a genuine abuse-detection capability and it is gone, because it is the same capability that would have tracked you. The abuse limits that replace it work in real time instead, at the moment a report arrives, and are described in § 13.

One rough edge, stated rather than hidden. If you report the same truck stop twice within a few hours and the rotation happens between the two, those two reports count as two different reporters. It is rare, the error is at most one, and we would rather tell you than round it away.

Counter keys. The short-lived counters that enforce the limits in § 13 are keyed on derived values too — never on your raw installation token, your IP address, or an email address. Nothing in the store holds a raw identifier next to the permanent report log. The one deliberate exception is the beta-signup record of § 3.5 — a record that exists precisely so that we can contact you, and so it contains the address you gave us. It lives in its own key family, beta:v1:*, written only by the website form; it carries no reporter identifier, no installation token and nothing derived from either, so there is nothing in it or beside it that connects a signup to a report.

7.3 Retention

The report history — truck stop, colour, server timestamp, reporter identifier — is append-only and kept indefinitely. Nothing overwrites or deletes an entry.

This is deliberate and we would rather say so than bury it. It is what makes it possible to one day tell you "this lot usually fills around 8:30pm on weeknights", which cannot be recovered from a status that was overwritten. The trade is that a report you send today is still in the history years from now.

The serving copies — a truck stop's recent window and its current colour — expire on their own within hours.

7.4 What other drivers see

A colour, how long ago it was reported, and how many distinct reporters said it. Never an identifier, never a device, never a person.

7A. Community star ratings, in detail

7A.1 What a rating contains

A truck-stop identifier and a number of stars, one to five. Nothing else leaves your phone. The server adds its own timestamp and a pseudonymous reporter identifier — the same kind of keyed hash as § 7.2, scoped to the one truck stop you rated:

`` reporter id = HMAC-SHA256(server secret, installation + truck stop) ``

7A.2 The one honest difference from parking

This identifier does not rotate, and we would rather explain that than hide it. A parking report is an observation — it goes stale and can be forgotten, so its identifier can rotate away. A rating is your standing vote, and you can change it: rate a stop three stars today and four next year, and the four replaces the three rather than counting twice. The only way the server can find the vote to replace is for your identifier at that stop to stay the same.

The consequence, stated plainly: your ratings of one truck stop over time are linkable to each other. That is the mechanism that makes your vote replaceable, not a side effect. What is *not* linkable is everything else — the identifier at one stop is unrelated to the identifier at any other, so nobody reading the store can assemble your ratings into a route, and it is never linkable to your parking or weigh-station identifiers, which are derived under different labels. Reinstalling the app breaks the chain permanently; your old vote simply remains as one anonymous-to-you vote in the tally.

7A.3 Retention, and what other drivers see

The rating history is append-only and kept indefinitely, like parking's (§ 7.3): each change of vote is a new entry, and the entry it replaces stays in the history. The tally a stop serves — sum, count, your current vote — is kept until a newer vote changes it.

Other drivers see an average and a count: ★ 4.2 (187 ratings). Never who, never when you individually rated, never an identifier.

7B. Weigh-station status, in detail

7B.1 What a report contains

A weigh-station identifier and one of OPEN or CLOSED. Nothing else leaves your phone. The server adds its own timestamp and a pseudonymous reporter identifier built exactly like parking's (§ 7.2) — scoped to the one station, and rotating on the same schedule, currently every seven days. Everything § 7.2 says about linkability, its limits, and its honest cost applies here unchanged.

7B.2 Freshness — why 90 minutes, not 6 hours

A parking lot fills over an evening; a weigh station opens and closes on a shift change. So a station's serving status expires after 90 minutes, not parking's 6 hours, and the app dims a status as it ages well before that. When no report is recent enough, the app shows no recent report — which nobody submitted and nobody is blamed for. During navigation the app may ask you, once per station as you pass: *"Weigh station ahead — is it open?"* If you ignore or dismiss the prompt, nothing is recorded at all — not an answer, not the dismissal, nothing.

7B.3 Retention, and what other drivers see

The report history is append-only and kept indefinitely, like parking's (§ 7.3), and for the same reason: it is what could one day say "this station is usually open on weekday mornings". The serving copies expire on their own within the 90-minute window.

Other drivers see a status, how long ago it was reported, and how many recent reports agree. Never an identifier, never a device, never a person.

What a status is not. A community CLOSED is a driver's claim, not a fact, and it is never permission to pass a weigh station — the law at the roadside applies to you regardless of anything this app shows. That warning lives in community-reports.md, which is part of the Terms.

Receipts

Taking and reading a receipt never leaves your phone. The camera writes into LastWagon's own private storage, the text recognition runs on a model built into the app, and the reading is offered to you as suggestions you can edit or ignore. No account, no network, no Premium. A receipt you photograph and save is a file on your device and nothing else.

Double-checking a receipt is a separate thing you ask for. It appears only if you hold Premium, and only when you tap it, on the receipt in front of you. When you do:

• what is sent: that receipt's photograph, the text your phone read from it, and the fields your phone parsed out of it;
• where it goes: the LastWagon proxy, and from there to an AI provider that reads the image and returns corrected fields;
• what comes back: field values only, which are shown to you as suggestions. You edit them, or ignore them, before anything is saved;
• what is kept: nothing. The proxy holds the image only for the length of the request and writes it nowhere; the request tells the provider not to retain it; and the image, the recognised text, the fields and the model's answer are never written to a log.

If you never tap it, none of that happens. Receipt capture and reading work exactly the same without it, and a receipt saved without a double-check has never been transmitted anywhere.

8. Premium: information sent to HERE

Premium routing is powered by HERE Global B.V. and its affiliates. When you use Premium, the HERE SDK inside the app talks to HERE directly from your phone — not through LastWagon's server. HERE therefore receives your device's IP address.

What goes to HERE when you use Premium:

• The coordinates of your origin, destination and waypoints
• Your truck profile — dimensions, weights, axle count, hazardous-material class — because that is what produces a truck-legal route
• Map viewport requests as you pan and zoom
• Text and categories you search for, and the area you search in
• Your device location, while the map is showing your position or guidance is running

HERE's collection and use of this information is governed by HERE's own privacy policy and by the HERE End User Terms, which apply between you and HERE directly. LastWagon asks you to read and accept them before Premium first uses HERE, and they are linked from Legal & Attribution inside the app.

What LastWagon keeps from HERE, and for how long. HERE results are held only in a disposable, trip-scoped cache in a separate database file, for no more than 48 hours, after which they are deleted. That cache is excluded from Android backup and device transfer. It exists so that returning to a screen does not re-run a paid route calculation. HERE data is never added to LastWagon's permanent truck-stop directory — see data-sources.md and third-party/here.md for how that separation is enforced.

If you never turn on Premium, no information is sent to HERE at all.

9. Your own openrouteservice key

You may obtain your own free API key from HeiGIT and enter it in Settings. If you do:

• It is stored in a private preferences file on your device only.
• It is excluded from Android backup and device transfer.
• It is never sent to LastWagon's servers, and it is never written to a log.
• Requests then go directly from your phone to HeiGIT, bypassing LastWagon's proxy entirely — which means HeiGIT sees your device's IP address rather than our server's.
• The key belongs to you and your use of it is governed by HeiGIT's terms.

Clearing the field deletes the key.

10. Premium accounts

LastWagon has no accounts for ordinary use — Basic routing, the directory, inspections, CDL practice and the Driver Ledger all work with no sign-in.

Premium is currently unlocked by an email-and-password sign-in for accounts provisioned by LastWagon. There is no self-service sign-up in the app today.

• Your email and password are sent over HTTPS to the LastWagon proxy at sign-in.
• The password is verified against a one-way scrypt hash held in server configuration. The plaintext is never stored and never logged.
• On success the server returns a signed entitlement token containing your account identifier, your tier, and expiry times. The app stores it on your device, excluded from backup.
• Failed sign-in attempts are rate-limited per IP address and per account. Both counters are keyed on a derived value, so neither your IP address nor the email address you typed is stored as a key. (This matters more than it looks: what gets counted is what someone *typed*, which may be the address of a person who has no account here at all.)
• There is no accounts database, no session table, and no password reset flow yet.

When subscriptions and billing arrive, this section and the Terms will be revised, and the revision will require your acceptance again. See § 15.

11. Service providers and third parties

LastWagon does not sell your information, does not share it for advertising, and has no advertising partners.

12. Deleting your information

On your device. Uninstalling LastWagon deletes everything in § 2. Individually: Settings resets progress; the route planner clears a saved route; clearing the API key field deletes the key; signing out of Premium deletes the entitlement token; Android's "Clear storage" removes everything including your installation token and the Weather Ahead zone cache (§ 5.5), which simply refills itself from the National Weather Service as you drive.

The count of included Basic routes is the one thing a reinstall does not clear. It is kept against the device tag of § 4.1, which is exactly why it survives — uninstalling LastWagon or clearing its storage leaves that count where it is, and this is the intended behaviour rather than a leftover. A factory reset changes the Android value underneath it and ends the link. The count is a single number; it is not a record of the routes themselves, which are never stored.

Community reports — parking, ratings, weigh stations. A report carries no identifier you can present to us, which is the direct consequence of not storing who sent it. That means we cannot locate your past reports to delete them, and neither can anyone else. A star rating is the partial exception: from the same installation you can *change* your vote at a stop, which supersedes it in the tally — but the superseded entry stays in the history, and after a reinstall even you cannot reach it (§ 7A). Requests to delete community history are addressed in § 15 and in the Play checklist.

Beta signup. Email <support@lastwagon.app> from the address you signed up with and ask for your signup to be removed. We look it up by address — the storage key is a one-way hash of it — and delete the record. This one we *can* delete on request, because unlike a community report it was stored so that we could reach you (§ 3.5).

Premium account. Contact us through the LastWagon project page (see Contact above), or email <support@lastwagon.app>, to have a Premium account and its entitlement revoked.

13. Security

Stated as what is done, not as a promise of outcome:

• All network requests use HTTPS.
• The shared openrouteservice credential is held server-side only and is never present in the app. Your own key, if you supply one, stays on your device.
• Credentials and tokens on the device are kept in a separate private preferences file that is excluded from Android cloud backup and device transfer.
• Installation and entitlement tokens are HMAC-signed under separate server secrets, so a device cannot forge either one, and either can be revoked without shipping an app update.
• Community reports — parking, ratings, weigh-station status — are validated and rate-limited per installation, per IP, per place and globally — in real time, as each report arrives, which is what now carries the abuse protection that the old cross-stop identifier used to provide after the fact (§ 7.2).
• No raw identifier is written into the store at all — not the installation token, not an IP address, not an email address. Every stored key is a keyed hash under a server-held secret, and the label each one is derived under differs, so one cannot be used to look up another.
• The proxy rebuilds every upstream request from a fixed list of permitted fields, and never logs or echoes a credential.

No system is perfectly secure, and we do not claim otherwise.

14. Children, and other legal matters

LastWagon is a tool for commercial drivers and is not directed at children. See the Terms for eligibility.

15. Known gaps — recorded rather than papered over

These are real, they are in the project's TODO list, and none of them is described above as though it were already solved.

1. Geocode text appears in server request paths, and therefore in Vercel's platform logs. Moving these endpoints to POST bodies would remove address text from log lines.
2. Community report history has no maximum retention — parking, ratings and weigh-station status alike. §§ 7.3, 7A.3 and 7B.3 say so plainly; whether it should have one is an open decision.
3. There is no self-service deletion path for community report history, by construction (§ 12).
4. The Driver Ledger is included in Android cloud backup. It is your business and financial data. Whether it should be excluded by default, or made a setting, is an open decision.
5. We have not yet verified encryption at rest on the parking store. Our provider documents it as available on request rather than on by default, and a provider's general documentation is not a statement about our database. Nobody has yet opened the console and looked. Until someone has, this policy will not claim it either way. The verification is recorded as an open item and must be answered before the store holds real reports.
6. The driver-supplied API key is stored in a private but unencrypted preferences file. It is protected by the Android application sandbox and file-based encryption, not by the Android Keystore.
7. Weather Ahead covers the United States only, and an alert can be late or missing. The National Weather Service issues alerts for the United States; where it has no coverage the app says so rather than showing an empty panel, and coverage of the territories has not been verified. An alert can also be late or absent — an outage at the service, no signal in the truck, a warning issued a minute after the last check, or a product the app does not recognise. Navigation never depends on any of it: routing, guidance, rerouting and arrival behave exactly the same when no alert ever arrives. Nothing shown here is a substitute for the sky in front of you, for a highway advisory radio, or for your own decision to keep rolling or shut down — and an empty weather panel is not a statement that the road ahead is clear.
8. The beta signup is a website form, not the app, and this policy's on-device guarantees do not describe it. Everything else here is written about code that ships inside LastWagon and can be read in the release it ships with. § 3.5 is not that: it describes a page on lastwagon.app and a server function behind it, running in a browser we do not control, on a website whose ordinary web-request logging (IP address, path) is Vercel's rather than ours. "Never leaves your phone" and "no identifier travels with the request" are statements about the app; they say nothing about a form you filled in in a browser. It is also the one place LastWagon holds a name and an email address you gave us on purpose. Whether the signup store should have a hard retention date rather than "the duration of the beta programme" is an open decision.

Closed since the first draft of this policy: the reporter identifier used to be a single stable pseudonym, identical at every truck stop and never rotating. It was replaced before any real reports existed — see § 7.2, which describes what replaced it and what that cost.

16. Changes to this policy

When this policy changes materially, its revision number goes up, and the app will ask you to read and accept it again before you continue. The current revision is always shown in Legal & Attribution, and the canonical text is published at https://lastwagon.app/legal/privacy.