Privacy Policy

Document ID

privacy

Version

1.7.0 · Revision: 9

Effective

2026-09-20

Status

Final — counsel reviewed 2026-08-21; entity, jurisdiction and contact supplied by the owner 2026-08-22. §§ 3.2, 7A and 7B (community star ratings and weigh-station status) added 2026-08-27, the Supabase history store added to §§ 3.4 and 11 on 2026-08-28, the device tag behind the included Basic routes added as § 4.1 (with §§ 3.1, 3.4 and 12) on 2026-08-29, Weather Ahead — severe-weather alerts from the National Weather Service — added as § 5.5 (with §§ 2, 5.3, 11, 12 and 15) on 2026-08-30, and the website beta-signup form added as § 3.5 (with §§ 1, 3.4, 7.2, 11, 12 and 15) on 2026-09-05 — none of the six yet reviewed. Revision 9 (2026-09-20) discloses three features that were already live and that revision 8 did not describe: the CB-19 channel (§§ 3.6 and 7C), Weekly Smart Insights (its own section, after Receipts), and Firebase Cloud Messaging (§ 4.2) — with §§ 1, 2, 11, 12 and 15 updated to match. Nothing in the app changed; the policy caught up with it.

This policy describes what LastWagon actually does, verified against the source code of the release it ships with. Where a section says information stays on your device, that means there is no code path that sends it anywhere.

Controller: LastWagon, a subsidiary of Hobo Express Cartage LLC, Tennessee, United States. Contact: through the LastWagon project page, https://github.com/jackofall1232/lastwagon (open an issue; the tracker is public, so do not post personal information there — say that you need a private channel and we will arrange one). Support: <support@lastwagon.app> — the official support address, and the one to use for anything that involves your own information rather than a public bug report.

1. The short version

• LastWagon has no advertising, no analytics service, no crash-reporting service, and no advertising identifier. There is nothing in the app that reports how you use it. The one third-party SDK that talks to its own vendor is Google's Firebase Cloud Messaging, which delivers the optional CB-19 activity notification and nothing else — no Firebase Analytics, no Advertising ID, no behavioural profile. It is described in § 4.2 rather than left to be inferred.
• Almost everything you create in LastWagon — your inspections, your CDL progress, your Driver Ledger, your truck profile — stays on your phone unless you personally ask for a feature that needs a server. Keeping the Driver Ledger, photographing receipts and reading them do not upload anything, ever. Two Premium features you tap for yourself are the exceptions, and each says so where it lives: having a receipt double-checked (§"Receipts") and Weekly Smart Insights (§"Weekly Smart Insights").
• Routing is one exception, and it has to be: to get you a route, the coordinates of where you are and where you are going must be sent to a routing service.
• Receipt double-checking is the other, and only if you ask for it. Photographing a receipt and reading it are done entirely on your phone, for everyone, offline — that never leaves the device. If you hold Premium and tap to have a reading double-checked, that one receipt's photograph and the text read from it are sent to the LastWagon proxy and on to an AI provider, which returns corrections. It is never automatic, it is never done to a receipt you did not tap, and declining it costs you nothing but the second opinion. See §"Receipts" below.
• Weekly Smart Insights is the third, Premium and per-tap. It sends a set of *weekly totals* from your Driver Ledger — miles, revenue, costs, fuel, and which state-to-state lanes you ran — to be read by an AI provider, which returns a few sentences of commentary. No load numbers, no broker names, no customer names, no notes you typed, no individual entries. If you never open it, none of it is sent. See §"Weekly Smart Insights".
• CB-19 is a chat channel, and chat is public by nature. It is optional, you pick the name you talk under, and it is *pseudonymous, not anonymous*: every message carries a short tag derived from your installation so the room can tell two drivers apart. What you type goes to LastWagon's servers and is shown to every other driver on the channel. See §§ 3.6 and 7C.
• Community reports carry a place and one small fact — a truck stop and a colour, a truck stop and a number of stars, or a weigh station and open-or-closed. Not your location, and not your identity.
• LastWagon has no user accounts for ordinary use. There are exactly two places an email address is handled: a Premium subscription uses an email-and-password sign-in (§ 10), and the beta-signup form on the LastWagon website asks for a first name and an email address so we can contact you about beta access (§ 3.5). The second is a form you fill in on lastwagon.app, never something the app sends — nothing in LastWagon on your phone submits a signup, and nothing in it knows whether you made one.

2. Information that stays on your device

None of the following is transmitted to LastWagon or to anyone else by the act of creating or keeping it. It lives in the app's private storage on your phone, and uninstalling LastWagon deletes all of it.

Two Premium features can send a narrow extract of the Driver Ledger, and only when you tap them yourself: having one receipt double-checked (§"Receipts") and Weekly Smart Insights (§"Weekly Smart Insights"). Neither runs on its own, neither uploads the ledger, and using the Driver Ledger without touching them transmits nothing at all.

Android backup

Android's own backup and device-transfer features may copy some app data to your Google account, under Google's terms, not ours. LastWagon excludes the following from backup and device transfer, because a copy of them on another phone would be wrong or unsafe: your openrouteservice key, your installation token, your Premium sign-in token, your Premium usage counters, and the Premium trip cache.

Everything else, including your Driver Ledger, is included in Android backup if you have Android backup switched on. You can turn Android backup off for LastWagon in your device's system settings. See § 15 for the open item on this.

3. Information sent to LastWagon's own servers

LastWagon operates one small server: a request proxy hosted on Vercel, with a key-value store provided by Upstash. It exists for two reasons — to keep the shared routing credential off your phone, and to carry the community reports: parking, star ratings, and weigh-station status. It is not an account platform and it stores no profile of you.

Every request the app makes to it carries an installation token (§ 4) and, inherently, your IP address, because that is how internet requests work.

3.1 Basic routing and address search

When you use Basic routing without your own key (§ 9), these go to the LastWagon proxy, which forwards them to openrouteservice:

• The coordinates of your origin, destination and any waypoints
• Your truck profile — the height, width, length, gross weight, axle load, axle count and hazardous-material class you entered, because that is what makes the route a truck route rather than a car route
• Text you type into an address field, and the coordinates of a "near me" search
• Coordinates you ask to be turned into an address label

The proxy does not keep a copy of any of this. It rebuilds each request from a fixed list of permitted fields, forwards it, and returns the answer. There is no route history and no routing database.

What the proxy *does* keep is a count. Basic routes on LastWagon's key are counted against the five included with the app (§ 9), against the device tag described in § 4.1 — the route request itself carries no such value, and nothing about where you were going is kept alongside the number. A recalculation while you are already driving a reviewed route is never counted, an address search is never counted, and neither is the Driver Ledger's state-by-state mileage estimate, which asks for geometry rather than for a route you are driving.

3.2 Community reports: parking, star ratings, weigh stations

Three community features, one shape. In every one of them, your coordinates are not sent, and no timestamp from your phone is trusted — the server stamps the time itself.

• Submitting a parking report sends a LastWagon truck-stop identifier and one of GREEN, YELLOW or RED. That is the entire message.
• Submitting a star rating sends a LastWagon truck-stop identifier and a number of stars, one to five. Rating the same stop again replaces your earlier vote — see § 7A for what makes that possible and what it costs.
• Submitting a weigh-station status sends a LastWagon station identifier and one of OPEN or CLOSED. There is no third value to submit: "no recent report" is what the app shows when nobody has said anything lately, not something anyone sends. See § 7B.
• Reading statuses — parking colours, rating averages, weigh-station status — sends a list of up to 300 identifiers, the ones on your screen, and gets back their current values.

3.3 Premium sign-in

Signing in to Premium sends your email address and your password to the proxy, over HTTPS. The password is checked against a stored one-way hash and is never written to storage or to a log. See § 10.

3.4 What is stored on the server, and for how long

Address searches travel in the request path for the geocoding endpoints, which means the text you typed can appear in the proxy's platform request logs. See § 15.

One row in that table is not like the others. Every other thing the store holds is keyed on a derived value and contains no way to reach a person. The beta-signup record contains an email address, because contacting you is the entire point of it. It is the single exception, it comes from a website form rather than from the app, and § 3.5 is the whole of it.

3.5 Website beta signup

The LastWagon website has a page at https://lastwagon.app/beta where a driver can ask to join the beta programme. This is the only part of this policy that describes something the app never does: nothing on your phone submits a signup, nothing on your phone knows whether you made one, and if you never open that page nothing in this section happens at all.

When it is collected. Only when you fill in the form and press submit. There is no other trigger.

What the form asks for. Required: your first name, your email address, and a checkbox acknowledging that this is beta software. Optional, and blank is a perfectly good answer to every one of them: your US state, your driver type (company driver, owner-operator, lease operator, team driver, or other), your typical operation (OTR, regional, local, or mixed), the Android phone or tablet you would test on, and a free-text note.

What it is for. To contact you about beta access, and to run the beta programme — sending install instructions and saying which builds we would like tested. That is the whole purpose. It is not a marketing list, it is not shared with anyone, and it is not sold.

Where it goes, and how it is keyed. The form posts to the LastWagon proxy, which stores the signup in Upstash — the same key-value store that holds community reports. The storage key is a one-way hash of your address, lowercased, and never the address itself. The record under that key holds the fields you submitted, the server's own timestamp, and which of the two allowed website origins (lastwagon.app or www.lastwagon.app) served the form to you.

What the record deliberately does not hold: no IP address, no user agent, no device identifier, no installation token, and nothing derived from the app on your phone.

Signing up twice changes nothing. A second submission with the same address is refused by the store itself, and the original record is kept exactly as it was — same timestamp, same answers. The page answers a repeat signup the same way it answers a first one, so nobody can use the form to test whether an address is on the list.

Abuse limits, and the honeypot. Two short-lived counters keep the form from being flooded: one per IP address per hour, one across everybody per day. Both are keyed on a derived IP value — the same derivation as every other counter in § 7.2, never a raw address — and both expire on their own, after 1 hour and 24 hours. The form also carries a honeypot: a hidden field no person ever sees. A submission that fills it is answered as though it were accepted, and nothing is stored.

What is logged. The proxy writes one word per submission — whether it was stored, was a duplicate, tripped the honeypot, or hit a named rate limit. Never your address, and never your note. Vercel's platform logs still record the request's IP address and path, as they do for every request to any website.

How long it is kept. For the duration of the beta programme. A record is deleted when the programme ends, or when you ask for it to be deleted, whichever comes first. There is no automatic expiry in the code, and we would rather say that than describe a timer that does not exist.

Removing it. Email <support@lastwagon.app> from the address you signed up with. We can look a signup up by address and delete it — the hashed key is exactly what makes that a single lookup rather than a search. This is the one thing in this policy you *can* have deleted on request; community reports cannot be (§ 12).

It is switched off until this revision is published. The endpoint that stores signups is held closed by a server switch, so that no signup can reach the server under a policy that never mentioned it. It is opened only after this revision is published and accepted. Until then the form on the website offers you the same signup as an email you send yourself, from your own mail app, to support@lastwagon.app — and an email you send us is handled like any other support email, not stored in the signup store described above.

3.6 CB-19, the chat channel

CB-19 is an optional national chat channel inside the app — one room, open to every driver running LastWagon. It is off to one side of the app: you reach it deliberately, and if you never open it nothing in this section happens.

Chat is the one feature here whose whole purpose is to show what you wrote to other people, so the plain facts first:

• What you type is transmitted to LastWagon's servers and shown to every driver on the channel. There is no private message, no direct message, and no way to un-send.
• You choose the name you talk under. It is display flair, not identity — it does not have to be your real name, nothing checks it, it is not unique, and two drivers may pick the same one. LastWagon never asks for a legal name and has no way to learn one.
• It is pseudonymous, not anonymous. Beside your name the room shows a four-character tag derived from your installation — a keyed one-way hash of your installation identity, not the token itself and not anything about your hardware. It is what tells two drivers with the same handle apart, and it is stable for as long as that installation lasts, so messages you send *are* linkable to each other by anyone reading the channel. We say pseudonymous rather than anonymous deliberately: a stable tag is exactly what anonymity is not.
• No location is attached to a message. Not coordinates, not a state, not a truck stop.
• What LastWagon does not learn. Your name, your phone number, your employer, your truck, or where you were when you typed. Nothing in a message ties to a Premium account either — the channel runs on the installation identity, not on a sign-in.

Retention, exactly as the code does it:

Moderation, and where an AI provider comes in. Every message passes a deterministic screen on LastWagon's server first. That screen looks at behaviour, not vocabulary — ordinary profanity is not prohibited and is not moderated, because swearing about a pothole is normal traffic on this channel. What it looks for is a target: threats, slurs, doxxing, and sexual content involving minors.

• Most messages never reach an AI provider at all. Clean traffic posts with no model call, and the most serious category is refused without one either.
• A message the screen cannot settle is sent to an AI provider — OpenAI, falling back to Anthropic — which returns a structured decision, never text a driver reads. When that happens the provider receives the message, the handle and tag beside it, and a short window of the room's recent messages as context, which means other drivers' messages can travel as context to somebody else's borderline line. Nothing else goes with it: no account, no installation token, no location.
• What the identifiers are for. Running the channel, moderating it, preventing abuse, and enforcing a mute — and nothing else. The tag keys no advertising, no profile, and no analytics.
• Automatic enforcement stops at a 24-hour mute. A permanent ban is a human action.
• A message that reads as someone in distress is not treated as misconduct: it posts, and the channel answers with a crisis resource.

4. Your installation token

On first launch the app asks the server for an installation token. The server generates a random identifier, signs it, and returns it. The app stores it and sends it with every request.

• The identifier inside it is not an advertising ID, a phone number, or anything that names you as a person. It is a random number the server invented.
• It exists so that abuse can be rate-limited and, if necessary, blocked, without knowing who anyone is.
• It is pseudonymous, not anonymous. It is stable across your requests, so requests from one installation can be recognised as coming from the same installation.
• Reinstalling LastWagon, or clearing its data, produces a new token and breaks the link to the old one for everything in this policy except one count — the included Basic routes you have used, which is the whole subject of § 4.1 below.

4.1 The device tag, and the one thing it counts

Basic routing includes five routes on LastWagon's openrouteservice key before you need your own free key (§ 9). Those five are counted per device, and this is the only place in LastWagon where anything derived from your hardware is used at all. It is described in its own section rather than folded into the token above, because it is a different kind of value and deserves to be read as one.

• What the app reads. Settings.Secure.ANDROID_ID — a value Android gives to apps, which since Android 8 is a *different* value for every app publisher on the same phone, so it is not a number other apps see. It survives uninstalling and reinstalling LastWagon, and it changes on a factory reset.
• What leaves your phone is never that value. The app sends a SHA-256 hash of it under a fixed LastWagon label. The server hashes that result again under a secret only the server holds, and only that second result is kept, inside your own signed token. The hash your phone sent is never stored and never logged; it exists in memory for the length of one registration call.
• It is used for exactly one thing: counting the five included Basic routes. It keys no other counter, it is attached to no community report, it is sent to no third party, and it is never used to recognise you across apps or to build any kind of profile.
• It is sent when the app registers, and when its token is renewed. It does not travel with your routes, your searches or your reports.
• What it honestly does, and does not do. It closes the casual reset — clear app data, get five more routes — and nothing beyond that. It is not device attestation and not a device fingerprint, and this policy will not describe it as either. A modified copy of the app can simply decline to send it and be counted per installation instead, and a factory reset changes the underlying value for real.
• If Android returns nothing usable — no value, a blank one, or one of the known manufacturing-batch constants that identifies a production run rather than a phone — the app sends nothing at all, and your included routes are counted per installation exactly as they were before this existed.

In Google Play's Data safety vocabulary a value derived this way is a device or other ID, and it is named as one here rather than being described as something milder.

4.2 Firebase Cloud Messaging, and the identifiers Google issues

LastWagon can send you one kind of push notification: a single nudge when a quiet CB-19 channel comes alive. Delivering a push at all requires a push service, and LastWagon uses Google's Firebase Cloud Messaging (FCM).

That means Google is involved, and this section says how rather than leaving it to be found:

• Firebase generates a Firebase Installation ID (FID) for this app on your device, and an FCM registration token, and sends them to Google along with basic device and app information — the sort of thing a push service needs to reach a handset. This is Google's own SDK doing Google's own housekeeping; the values are created by it, not by us.
• This happens when the app starts, before and regardless of whether you turn CB-19 alerts on. Firebase initialises with the app. We would rather state that plainly than imply the notification toggle gates it, because it does not.
• LastWagon never receives your FCM token or your FID. The app subscribes to a *topic* — a named channel anyone can join — and the server publishes to that topic. There is no list of device tokens on LastWagon's side, because the design never needed one, and therefore no way for us to single out a device to push to.
• Nothing a driver typed ever rides a push. The notification's words are compiled into the app; the payload only says which kind of nudge it is.
• LastWagon does not use Firebase Analytics, Google Analytics, or Crashlytics — none of them is in the app. LastWagon does not use the Android Advertising ID, and the app does not request the AD_ID permission. Nothing here is used for advertising, behavioural analytics, or building a profile of you.
• Once these identifiers are with Google they are held under Google's terms, not ours.

If you would rather not have it, turn CB-19 activity alerts off, or deny the notification permission — the channel itself still works, you simply check it yourself. What that does not do is undo the Firebase initialisation described above.

In Google Play's Data safety vocabulary the FID and the FCM token are device or other IDs, and they are declared as such.

5. Location

Location gets its own section because it is the most sensitive thing this app touches.

5.1 When LastWagon asks for it

LastWagon requests location permission only when you use a feature that needs it, and never at first launch:

• pressing the "my location" control on a map
• searching for truck stops near you
• starting turn-by-turn guidance

If you refuse, maps still work, the directory still works, and you can still plan a route by typing addresses. You lose the position dot and "near me".

LastWagon requests foreground location only. It does not request ACCESS_BACKGROUND_LOCATION, and it never asks for the always-on location grant.

5.2 During active guidance

When you start guidance, LastWagon runs a foreground service — the one that puts a persistent notification in your status bar — so that the trip keeps running when you switch apps or your screen goes off. That service is why guidance survives a phone call.

This is still foreground location in Android's sense, tied to a trip you started and visible in your notification shade the whole time. It stops when the trip stops.

5.3 Where your coordinates go

5.4 Whether location is stored

• On your phone: yes, in a limited way. The origin and destination of your last route are saved so the planner reads as you left it; an interrupted trip stores its destination for up to 12 hours (§ 6); the Premium trip cache holds one trip for up to 48 hours (§ 8). You can delete all of it — see § 12.
• On LastWagon's server: no. No location is stored server-side. Parking reports contain no coordinates.
• At openrouteservice and HERE: governed by their own privacy policies (§ 11).

5.5 Weather Ahead

Weather Ahead shows severe-weather alerts that are in force on the road ahead of you. It sits in the location section because it touches your route, and it is worth being exact about how small a thing it is — "weather" and "location" in the same sentence usually mean something much larger than this.

• Alerts only. There is no forecast in LastWagon. The app asks what warnings, watches and advisories the National Weather Service has issued right now. It does not ask what the weather will be, and nothing in the app predicts weather.
• It runs only when there is a route. The check begins when you calculate or drive a route and stops when that route ends. With no route on the screen, nothing is requested and the National Weather Service is never contacted at all.
• It asks for no new permission, and it does not follow you. Weather Ahead reads the planned route — the line you asked the app to draw — not a history of where your phone has been. It adds nothing to the location use described in § 5.1, and it does not need the position dot to work.
• What actually leaves your phone, and nothing else: the two-letter codes of the states your route crosses, and one coordinate about every 20 miles of that route, rounded to four decimal places — roughly 100 feet — used only to look up which forecast zone that stretch of road is in. A state code is not a location. A point every 20 miles, rounded to a hundred feet, is a corridor rather than a trip. Neither is a fix from your GPS: both are read off the planned line.
• The narrowing happens on your phone. LastWagon asks for every alert in force in those states and works out on the device which ones are actually on your road. The National Weather Service is never told which highway, which exit, or how far along it you are.
• No LastWagon server is involved. These requests go from your phone straight to api.weather.gov, run by NOAA's National Weather Service. LastWagon's proxy is not in the path and holds no record that you asked. The National Weather Service sees your device's IP address, as any service you contact does, and no identifier of any kind travels with the request — no installation token, no device tag, no account, not even your phone's model.
• The zone cache, and why this shrinks the more you use it. Which forecast zone covers a given point almost never changes, so the answer is kept on your phone for 90 days. A lane you run every week is looked up once and then not again. The cache is one small file in the app's private storage; it holds zone identifiers for points on roads, not a record of trips, and it is emptied by Android's "Clear storage" and by uninstalling LastWagon (§ 12).

What this feature is not able to do — where its coverage ends and how late an alert can be — is in § 15, with the rest of the things this policy would rather state than round away.

6. Interrupted trips

If a trip is interrupted — a reboot, a crash, the app being killed — LastWagon leaves a small record so it can offer to continue: the destination's label and coordinates, the provider, and how far was left. It contains no route geometry and nothing from any provider's SDK.

It is deleted automatically after 12 hours, and immediately when the trip ends normally or you decline the offer.

7. Community parking, in detail

7.1 What a report contains

A truck-stop identifier and a colour. Nothing else leaves your phone.

The server adds, on arrival:

• its own timestamp — your phone's clock is never trusted or stored for this purpose
• a pseudonymous reporter identifier (below)

7.2 The reporter identifier — per stop, per period

The server does not store your installation token with your report. It stores a keyed hash — and that hash is deliberately scoped to the single truck stop you reported on, and to the period you reported in:

`` reporter id = HMAC-SHA256(server secret, installation + truck stop + time period) ``

Two consequences, and they are the whole point:

• Reports you make at different truck stops are not linkable to each other. The identifier at one stop is unrelated to the identifier at another. Nobody reading the stored history can assemble your stops into a route.
• Reports you make at the same truck stop in different periods are not linkable either. The identifier rotates on a schedule — currently every seven days — so last month's reports and this month's do not connect.

What stays linkable is exactly what the feature needs to work: the reports one installation made about one truck stop inside one period. That is what lets the app say "3 drivers said" without one driver reporting three times looking like three drivers.

This is still pseudonymous, not anonymous, and we will keep saying so. Within one stop and one period, repeat reports from one installation are recognisable as coming from the same installation. What has been removed is the ability to follow that installation anywhere else.

What limits it further: the identifier is never shown to any other user or returned by any API; the raw installation token is never stored; the hash cannot be reversed without the server's secret; and reinstalling the app breaks every chain permanently.

The honest cost. We can no longer look back through the stored history and group one installation's reports across many truck stops. That was a genuine abuse-detection capability and it is gone, because it is the same capability that would have tracked you. The abuse limits that replace it work in real time instead, at the moment a report arrives, and are described in § 13.

One rough edge, stated rather than hidden. If you report the same truck stop twice within a few hours and the rotation happens between the two, those two reports count as two different reporters. It is rare, the error is at most one, and we would rather tell you than round it away.

Counter keys. The short-lived counters that enforce the limits in § 13 are keyed on derived values too — never on your raw installation token, your IP address, or an email address. Nothing in the store holds a raw identifier next to the permanent report log. The one deliberate exception is the beta-signup record of § 3.5 — a record that exists precisely so that we can contact you, and so it contains the address you gave us. It lives in its own key family, beta:v1:*, written only by the website form; it carries no reporter identifier, no installation token and nothing derived from either, so there is nothing in it or beside it that connects a signup to a report.

7.3 Retention

The report history — truck stop, colour, server timestamp, reporter identifier — is append-only and kept indefinitely. Nothing overwrites or deletes an entry.

This is deliberate and we would rather say so than bury it. It is what makes it possible to one day tell you "this lot usually fills around 8:30pm on weeknights", which cannot be recovered from a status that was overwritten. The trade is that a report you send today is still in the history years from now.

The serving copies — a truck stop's recent window and its current colour — expire on their own within hours.

7.4 What other drivers see

A colour, how long ago it was reported, and how many distinct reporters said it. Never an identifier, never a device, never a person.

7A. Community star ratings, in detail

7A.1 What a rating contains

A truck-stop identifier and a number of stars, one to five. Nothing else leaves your phone. The server adds its own timestamp and a pseudonymous reporter identifier — the same kind of keyed hash as § 7.2, scoped to the one truck stop you rated:

`` reporter id = HMAC-SHA256(server secret, installation + truck stop) ``

7A.2 The one honest difference from parking

This identifier does not rotate, and we would rather explain that than hide it. A parking report is an observation — it goes stale and can be forgotten, so its identifier can rotate away. A rating is your standing vote, and you can change it: rate a stop three stars today and four next year, and the four replaces the three rather than counting twice. The only way the server can find the vote to replace is for your identifier at that stop to stay the same.

The consequence, stated plainly: your ratings of one truck stop over time are linkable to each other. That is the mechanism that makes your vote replaceable, not a side effect. What is *not* linkable is everything else — the identifier at one stop is unrelated to the identifier at any other, so nobody reading the store can assemble your ratings into a route, and it is never linkable to your parking or weigh-station identifiers, which are derived under different labels. Reinstalling the app breaks the chain permanently; your old vote simply remains as one anonymous-to-you vote in the tally.

7A.3 Retention, and what other drivers see

The rating history is append-only and kept indefinitely, like parking's (§ 7.3): each change of vote is a new entry, and the entry it replaces stays in the history. The tally a stop serves — sum, count, your current vote — is kept until a newer vote changes it.

Other drivers see an average and a count: ★ 4.2 (187 ratings). Never who, never when you individually rated, never an identifier.

7B. Weigh-station status, in detail

7B.1 What a report contains

A weigh-station identifier and one of OPEN or CLOSED. Nothing else leaves your phone. The server adds its own timestamp and a pseudonymous reporter identifier built exactly like parking's (§ 7.2) — scoped to the one station, and rotating on the same schedule, currently every seven days. Everything § 7.2 says about linkability, its limits, and its honest cost applies here unchanged.

7B.2 Freshness — why 90 minutes, not 6 hours

A parking lot fills over an evening; a weigh station opens and closes on a shift change. So a station's serving status expires after 90 minutes, not parking's 6 hours, and the app dims a status as it ages well before that. When no report is recent enough, the app shows no recent report — which nobody submitted and nobody is blamed for. During navigation the app may ask you, once per station as you pass: *"Weigh station ahead — is it open?"* If you ignore or dismiss the prompt, nothing is recorded at all — not an answer, not the dismissal, nothing.

7B.3 Retention, and what other drivers see

The report history is append-only and kept indefinitely, like parking's (§ 7.3), and for the same reason: it is what could one day say "this station is usually open on weekday mornings". The serving copies expire on their own within the 90-minute window.

Other drivers see a status, how long ago it was reported, and how many recent reports agree. Never an identifier, never a device, never a person.

What a status is not. A community CLOSED is a driver's claim, not a fact, and it is never permission to pass a weigh station — the law at the roadside applies to you regardless of anything this app shows. That warning lives in community-reports.md, which is part of the Terms.

7C. CB-19, in detail

§ 3.6 is the summary. This is the rest of it, in the same shape as the community-report sections above — because CB-19 differs from them in one way that matters, and the difference should be easy to find rather than buried.

7C.1 How it differs from a community report

A parking, rating or weigh-station report carries a place and one small fact, and no identifier travels with it (§§ 7.2, 7A.2, 7B.1). CB-19 cannot work that way. A conversation needs to show who said what, or it is not a conversation — so a message carries a stable four-character tag and whatever handle you chose, and both are shown to the whole room.

That is a real difference in kind, and it is the reason this section exists:

• Your messages are linkable to each other. Anyone reading the channel can see that the same tag posted at 09:00 and at 14:00. Over a stretch of messages that is a thread someone could follow — which is exactly what makes a conversation legible, and exactly what a community report deliberately avoids.
• The tag does not rotate. The parking reporter identifier changes per stop and per period on purpose (§ 7.2). CB-19's does not, because a name that changed mid-conversation would make the channel unusable.
• It does not reach across features. The CB-19 tag is derived under its own label and its own server-held secret. It cannot be matched to a parking report's identifier, to a rating, to a weigh-station report, or to a Premium account — the derivations are separate by design, so one cannot be used to look up another (§ 13).
• It is tied to the installation, not to you. Clearing the app's storage or reinstalling ends that identity and starts a new one; the old messages keep the old tag, and nothing connects them. A new phone is a new tag. Your handle, if you keep it, travels — the tag beside it does not.

7C.2 What you should assume before you type

Treat CB-19 as a public channel, because it is one. Anything you type is shown to every other driver running LastWagon, and for as long as it is in the window anyone can read it. Do not post your phone number, your home address, your truck number, your load details, or anything about another person you would not say to their face on an open radio. The moderation screen catches doxxing aimed at someone else; it cannot protect you from what you volunteer about yourself.

7C.3 Retention, and what cannot be undone

The retention table in § 3.6 is the whole of it: a rolling 200-message / 7-day window for traffic, 90 days for a handle that has gone quiet, 90 days for the moderation log's record of blocked messages.

There is no un-send, and no self-service deletion of what you posted. A message is in front of other drivers the moment it lands. It ages out of the window on its own, and that is the mechanism — we cannot pull one line out of a room for you before then, and nor can anyone else. If a message needs to come down for a reason that matters — you posted something about yourself you should not have, or somebody posted something about you — email <support@lastwagon.app> and say so. That is a human asking a human, not a feature, and § 12 says the same thing in the deletion section.

Receipts

Taking and reading a receipt never leaves your phone. The camera writes into LastWagon's own private storage, the text recognition runs on a model built into the app, and the reading is offered to you as suggestions you can edit or ignore. No account, no network, no Premium. A receipt you photograph and save is a file on your device and nothing else.

Double-checking a receipt is a separate thing you ask for. It appears only if you hold Premium, and only when you tap it, on the receipt in front of you. When you do:

• what is sent: that receipt's photograph, the text your phone read from it, and the fields your phone parsed out of it;
• where it goes: the LastWagon proxy, and from there to OpenAI, which reads the image and returns corrected fields;
• what comes back: field values only, which are shown to you as suggestions. You edit them, or ignore them, before anything is saved;
• what is kept: nothing. The proxy holds the image only for the length of the request and writes it nowhere; the request carries the provider's "do not retain" flag (store: false); and the image, the recognised text, the fields and the model's answer are never written to a log.

If you never tap it, none of that happens. Receipt capture and reading work exactly the same without it, and a receipt saved without a double-check has never been transmitted anywhere.

Weekly Smart Insights

Weekly Smart Insights is a Premium feature on the Driver Ledger's weekly review. You tap it, for one week, and a few sentences of plain commentary come back — where the money went, what changed since last week. Keeping a Driver Ledger does not upload it. This is the only thing in the ledger that sends anything anywhere, and it runs only when you tap it, once per week you ask about.

What is sent is a set of *totals for that week*, computed on your phone before anything leaves it:

• how many loads, and total / loaded / deadhead miles;
• revenue — gross, linehaul, fuel surcharge, accessorial, and per-mile figures;
• costs — fuel spend, other expenses, operating cost per mile;
• net, and net per mile;
• fuel — gallons, average MPG, average price per gallon;
• the fuel and freight-market benchmarks the app compares you against;
• your top lanes as state pairs (for example TX-CA) and top regions, each with a count of loads, miles and gross.

What is not sent, and cannot be: load numbers, broker or customer names, addresses, your notes, individual expenses or fuel purchases, receipts, dates of specific trips, or anything identifying who you hauled for. The payload is built from a fixed list of aggregates — there is no field in it for free text you typed.

Where it goes: the LastWagon proxy, and from there to OpenAI, falling back to Anthropic if OpenAI cannot answer. The proxy sends no account, no email and no installation token with it.

What is kept — stated exactly, including the part that is not zero:

• LastWagon stores nothing and logs nothing from it. Not the totals, not the sentences that come back. The insight you read is written to your own phone, in your ledger, and to no server.
• LastWagon does keep two counters, and neither holds content: a monthly tally of how many calls the feature made and how many tokens they cost (no account attached to it at all), and a per-week count of how many times *this account* has generated insights, keyed on a one-way hash of the account address so the address itself is never stored. It exists to cap the feature at three generations a week.
• The AI provider's own retention applies, and we do not suppress it. Unlike the receipt double-check above, this request does not carry a "do not retain" flag. What OpenAI or Anthropic keeps, and for how long, is governed by their terms — not by this policy. We would rather say so than claim a zero we have not implemented. It is recorded as an open item in § 15.

If you never tap it, none of this happens — and the weekly review itself, with every figure in it, is computed on your phone and works exactly the same without it.

8. Premium: information sent to HERE

Premium routing is powered by HERE Global B.V. and its affiliates. When you use Premium, the HERE SDK inside the app talks to HERE directly from your phone — not through LastWagon's server. HERE therefore receives your device's IP address.

What goes to HERE when you use Premium:

• The coordinates of your origin, destination and waypoints
• Your truck profile — dimensions, weights, axle count, hazardous-material class — because that is what produces a truck-legal route
• Map viewport requests as you pan and zoom
• Text and categories you search for, and the area you search in
• Your device location, while the map is showing your position or guidance is running

HERE's collection and use of this information is governed by HERE's own privacy policy and by the HERE End User Terms, which apply between you and HERE directly. LastWagon asks you to read and accept them before Premium first uses HERE, and they are linked from Legal & Attribution inside the app.

What LastWagon keeps from HERE, and for how long. HERE results are held only in a disposable, trip-scoped cache in a separate database file, for no more than 48 hours, after which they are deleted. That cache is excluded from Android backup and device transfer. It exists so that returning to a screen does not re-run a paid route calculation. HERE data is never added to LastWagon's permanent truck-stop directory — see data-sources.md and third-party/here.md for how that separation is enforced.

If you never turn on Premium, no information is sent to HERE at all.

9. Your own openrouteservice key

You may obtain your own free API key from HeiGIT and enter it in Settings. If you do:

• It is stored in a private preferences file on your device only.
• It is excluded from Android backup and device transfer.
• It is never sent to LastWagon's servers, and it is never written to a log.
• Requests then go directly from your phone to HeiGIT, bypassing LastWagon's proxy entirely — which means HeiGIT sees your device's IP address rather than our server's.
• The key belongs to you and your use of it is governed by HeiGIT's terms.

Clearing the field deletes the key.

10. Premium accounts

LastWagon has no accounts for ordinary use — Basic routing, the directory, inspections, CDL practice and the Driver Ledger all work with no sign-in.

Premium is currently unlocked by an email-and-password sign-in for accounts provisioned by LastWagon. There is no self-service sign-up in the app today.

• Your email and password are sent over HTTPS to the LastWagon proxy at sign-in.
• The password is verified against a one-way scrypt hash held in server configuration. The plaintext is never stored and never logged.
• On success the server returns a signed entitlement token containing your account identifier, your tier, and expiry times. The app stores it on your device, excluded from backup.
• Failed sign-in attempts are rate-limited per IP address and per account. Both counters are keyed on a derived value, so neither your IP address nor the email address you typed is stored as a key. (This matters more than it looks: what gets counted is what someone *typed*, which may be the address of a person who has no account here at all.)
• There is no accounts database, no session table, and no password reset flow yet.

When subscriptions and billing arrive, this section and the Terms will be revised, and the revision will require your acceptance again. See § 15.

11. Service providers and third parties

Two upstream sources are deliberately not in this table, because nothing about you reaches them. The Road Reports feed (Hammer Down) and the freight-market benchmark (Freight Data Watch) are fetched by LastWagon's server on a timer, cached, and served to every app from that cache. Your phone never contacts either one; they see LastWagon asking, not you asking, and they receive no identifier, no location and no request of yours. They are credited in attribution.md and data-sources.md, which is where a source belongs when it is a source rather than a recipient.

LastWagon does not sell your information, does not share it for advertising, and has no advertising partners. No AI provider in this table is used for advertising, profiling or analytics, and none of them receives your ledger, your inspections, your CDL progress, your routes or your account — only the specific payload named in its row, only when you ask for the feature behind it.

12. Deleting your information

On your device. Uninstalling LastWagon deletes everything in § 2. Individually: Settings resets progress; the route planner clears a saved route; clearing the API key field deletes the key; signing out of Premium deletes the entitlement token; Android's "Clear storage" removes everything including your installation token and the Weather Ahead zone cache (§ 5.5), which simply refills itself from the National Weather Service as you drive.

The count of included Basic routes is the one thing a reinstall does not clear. It is kept against the device tag of § 4.1, which is exactly why it survives — uninstalling LastWagon or clearing its storage leaves that count where it is, and this is the intended behaviour rather than a leftover. A factory reset changes the Android value underneath it and ends the link. The count is a single number; it is not a record of the routes themselves, which are never stored.

Community reports — parking, ratings, weigh stations. A report carries no identifier you can present to us, which is the direct consequence of not storing who sent it. That means we cannot locate your past reports to delete them, and neither can anyone else. A star rating is the partial exception: from the same installation you can *change* your vote at a stop, which supersedes it in the tally — but the superseded entry stays in the history, and after a reinstall even you cannot reach it (§ 7A). Requests to delete community history are addressed in § 15 and in the Play checklist.

Beta signup. Email <support@lastwagon.app> from the address you signed up with and ask for your signup to be removed. We look it up by address — the storage key is a one-way hash of it — and delete the record. This one we *can* delete on request, because unlike a community report it was stored so that we could reach you (§ 3.5).

CB-19 messages. There is no un-send and no self-service deletion (§ 7C.3). Traffic ages out of the rolling 200-message / 7-day window on its own; a quiet handle drops after 90 days; the moderation log's record of a blocked message clears after 90 days. If something needs to come down sooner — you posted something about yourself you should not have, or somebody posted something about you — email <support@lastwagon.app>. Clearing the app's storage or reinstalling ends the tag your past messages were sent under, but does not remove the messages themselves.

Weekly Smart Insights. There is nothing on our side to delete: no summary and no generated text is stored or logged (§"Weekly Smart Insights"). The insight itself lives in your ledger on your phone and goes when the app's data goes. The two counters hold numbers, not content, and the per-account one is keyed on a one-way hash. What the AI provider retains under its own terms is not ours to delete, which is why that limitation is stated plainly rather than implied.

Premium account. Contact us through the LastWagon project page (see Contact above), or email <support@lastwagon.app>, to have a Premium account and its entitlement revoked.

13. Security

Stated as what is done, not as a promise of outcome:

• All network requests use HTTPS.
• The shared openrouteservice credential is held server-side only and is never present in the app. Your own key, if you supply one, stays on your device.
• Credentials and tokens on the device are kept in a separate private preferences file that is excluded from Android cloud backup and device transfer.
• Installation and entitlement tokens are HMAC-signed under separate server secrets, so a device cannot forge either one, and either can be revoked without shipping an app update.
• Community reports — parking, ratings, weigh-station status — are validated and rate-limited per installation, per IP, per place and globally — in real time, as each report arrives, which is what now carries the abuse protection that the old cross-stop identifier used to provide after the fact (§ 7.2).
• No raw identifier is written into the store at all — not the installation token, not an IP address, not an email address. Every stored key is a keyed hash under a server-held secret, and the label each one is derived under differs, so one cannot be used to look up another.
• The proxy rebuilds every upstream request from a fixed list of permitted fields, and never logs or echoes a credential.

No system is perfectly secure, and we do not claim otherwise.

14. Children, and other legal matters

LastWagon is a tool for commercial drivers and is not directed at children. See the Terms for eligibility.

15. Known gaps — recorded rather than papered over

These are real, they are in the project's TODO list, and none of them is described above as though it were already solved.

1. Geocode text appears in server request paths, and therefore in Vercel's platform logs. Moving these endpoints to POST bodies would remove address text from log lines.
2. Community report history has no maximum retention — parking, ratings and weigh-station status alike. §§ 7.3, 7A.3 and 7B.3 say so plainly; whether it should have one is an open decision.
3. There is no self-service deletion path for community report history, by construction (§ 12).
4. The Driver Ledger is included in Android cloud backup. It is your business and financial data. Whether it should be excluded by default, or made a setting, is an open decision.
5. We have not yet verified encryption at rest on the parking store. Our provider documents it as available on request rather than on by default, and a provider's general documentation is not a statement about our database. Nobody has yet opened the console and looked. Until someone has, this policy will not claim it either way. The verification is recorded as an open item and must be answered before the store holds real reports.
6. The driver-supplied API key is stored in a private but unencrypted preferences file. It is protected by the Android application sandbox and file-based encryption, not by the Android Keystore.
7. Weather Ahead covers the United States only, and an alert can be late or missing. The National Weather Service issues alerts for the United States; where it has no coverage the app says so rather than showing an empty panel, and coverage of the territories has not been verified. An alert can also be late or absent — an outage at the service, no signal in the truck, a warning issued a minute after the last check, or a product the app does not recognise. Navigation never depends on any of it: routing, guidance, rerouting and arrival behave exactly the same when no alert ever arrives. Nothing shown here is a substitute for the sky in front of you, for a highway advisory radio, or for your own decision to keep rolling or shut down — and an empty weather panel is not a statement that the road ahead is clear.
8. The beta signup is a website form, not the app, and this policy's on-device guarantees do not describe it. Everything else here is written about code that ships inside LastWagon and can be read in the release it ships with. § 3.5 is not that: it describes a page on lastwagon.app and a server function behind it, running in a browser we do not control, on a website whose ordinary web-request logging (IP address, path) is Vercel's rather than ours. "Never leaves your phone" and "no identifier travels with the request" are statements about the app; they say nothing about a form you filled in in a browser. It is also the one place LastWagon holds a name and an email address you gave us on purpose. Whether the signup store should have a hard retention date rather than "the duration of the beta programme" is an open decision.

1. Weekly Smart Insights does not send a "do not retain" flag to the AI provider. The receipt double-check does (store: false); the insights call does not, so the provider's ordinary retention applies to a week of your business totals. Adding the same flag is a one-line server change and is on the list. Until it ships, §"Weekly Smart Insights" says so rather than claiming a zero we have not implemented.
2. CB-19 has no un-send and no self-service deletion (§§ 7C.3, 12), and its sender tag does not rotate the way the parking identifier does (§ 7C.1). Both are consequences of what a chat channel has to do to work, not oversights — but they are the sharpest edges in this policy and are listed here so they are not mistaken for fine print.
3. This policy was behind the app between 0.8.0 and this revision. CB-19, Weekly Smart Insights and Firebase Cloud Messaging were live and running while revision 8 did not describe them. Revision 9 fixes the disclosure; nothing about the features changed. Recording it here rather than quietly correcting it is the point of this section.

Closed since the first draft of this policy: the reporter identifier used to be a single stable pseudonym, identical at every truck stop and never rotating. It was replaced before any real reports existed — see § 7.2, which describes what replaced it and what that cost.

16. Changes to this policy

When this policy changes materially, its revision number goes up, and the app will ask you to read and accept it again before you continue. The current revision is always shown in Legal & Attribution, and the canonical text is published at https://lastwagon.app/legal/privacy.