Privacy Policy

1. What RouteRooster does

RouteRooster is a delivery-driver assistant that coordinates job routing, analytics, and earnings tracking. It operates as an intelligence layer on top of your existing delivery app accounts. It does not log in to, control, tap, or automate any other application.

2. What data we collect and why

2.1 Account information

Data	How collected	Purpose
Firebase Auth UID	Firebase Authentication	Account identity and session management
Email address hash (SHA-256)	Derived at registration — raw email not stored in Firestore	Linking your account without storing personally-identifiable email in operational data
First name and last name (text)	Stored in your account profile under users/{uid}	Used for in-app personalisation and to generate community contribution initials. Not shared with third parties or other drivers.

Raw email addresses and phone numbers are never stored in the RouteRooster operational database (Firestore). First name and last name strings are stored in your account profile — see the row above. Firebase Authentication itself holds your credentials in its own system for sign-in purposes; this is governed by the Firebase / Google Privacy Policy.

2.2 Delivery job data (Android and iOS)

Data	How collected	Purpose	Stored?
Job pickup and dropoff locations	From accepted notification signals or manual entry	Route planning	Yes — in your Firestore document
Earnings per job	From notification or manual entry	Analytics and income tracking	Yes
Job state and lifecycle events	App state machine transitions	Job history and analytics	Yes
Source platform	Derived from notification package name	Analytics categorisation	Yes

Job data is written directly to your Firestore document path and is owned by your UID. No other user can read your job data. Firestore rules reject cross-user reads and writes.

2.3 Notification content (Android only)

RouteRooster requests notification access on Android to read delivery offer and lifecycle notifications from supported apps.

Data	Retention	Stored?
Notification title and body (raw snippet)	User-configurable window: 0 to 72 hours maximum	Boolean flag only — raw text is redacted before any storage
Parsed job signals (earnings, location, state change)	Until job completes or history window expires	Yes, as structured job fields

Notification content is redacted on-device before any write to Firestore. The raw text of a notification is never stored as a string in the database. Only the derived structured signals (earnings amount, job state, estimated location) are persisted.

If you set the raw snippet retention window to 0 hours, no snippet record is kept at all. The maximum window is 72 hours, enforced at the Firestore rules level — no client setting can extend beyond this limit.

2.4 OCR fallback (Android only)

When the notification content is insufficient and the Android Accessibility tree is unavailable, RouteRooster may perform on-device OCR analysis on the current screen image.

• No screenshots or images are ever saved to disk or Firestore.
• OCR frame data is held in memory only for the duration of a single parsing attempt.
• Frame data is discarded immediately after use.
• This behaviour is disclosed during onboarding (Accessibility capture step).

2.5 Accessibility capture (Android only — optional)

RouteRooster includes an optional Accessibility Service that can read delivery app UI content.

• This feature is never requested automatically. It must be enabled by you in Settings.
• Sessions are read-only — RouteRooster does not perform taps, gestures, or form filling.
• Sessions are time-bounded to 90 seconds per active capture window.
• Capture is restricted to declared supported delivery app packages — no other apps.
• Accessibility payload data is held in memory for the duration of a session and is not persisted to Firestore.
• You can disable this feature at any time in the Settings tab.

2.6 Analytics (Android and iOS)

RouteRooster computes daily and monthly analytics rollups from your job history.

Data	Retention	Who writes
Daily job metrics (count, earnings, distance)	User-configurable 30–365 day window	Server-side Firebase Function
Monthly aggregates	Same window	Server-side Firebase Function

Analytics rollup documents are written by server-side functions only — clients cannot write to these paths. Your analytics data is only accessible to your own account (Firestore rules enforce owner-only read access).

Analytics data is not shared with third parties, advertisers, or used for ad targeting.

2.7 Community signals (Android and iOS)

Community features allow you to contribute anonymised delivery signals: trust scores for community insights, demand scores for hot-zone windows, and restaurant wait time estimates.

Community signal documents are stored in your Firestore path (users/{uid}/communityInsights/, etc.) and are readable only by your account. Aggregation of community trend data occurs at the server layer — individual users' raw submissions are not exposed to other users.

Signal values are bounded by Firestore rules (trust score 0–100, demand score 0–100, wait time 0–180 minutes). No personal job details, earnings, or location data are included in community signals.

2.8 Subscription and billing

Data	Stored	Notes
Subscription tier (FREE or PRO)	Yes — server-managed Firestore document	Determines feature limits
Subscription status	Yes	ACTIVE, GRACE, EXPIRED, REVOKED
Purchase token hash (Android)	Yes — SHA-256 hash only	Raw Play purchase token is never stored
Transaction ID hash (iOS)	Yes — SHA-256 hash only	Raw App Store transaction ID is never stored

Raw purchase tokens and transaction IDs are hashed on the client before transmission. Only the SHA-256 hash is retained in the backend.

2.9 Diagnostics

If you enable diagnostics upload in Settings, redacted diagnostic records may be written to your Firestore path. Diagnostic payloads are capped at 512 characters and contain no raw notification text, screenshots, or personal data.

2.10 Vehicle configuration and efficiency data

Data	How collected	Purpose	Stored?
Vehicle category and fuel type	Entered by you during onboarding or Settings	Used to calculate estimated running costs, CO₂ emissions, and to determine platform vehicle eligibility warnings. Optional — defaults to not set.	Yes — in users/{uid}/meta/settings
Fuel efficiency (km per litre or kWh per 100 km)	Entered by you during onboarding or Settings	Used to calculate estimated running costs per delivery	Yes — in users/{uid}/meta/settings
Energy cost (fuel price per litre or electricity cost per kWh, AUD)	Entered by you during onboarding or Settings	Used to calculate estimated running costs per delivery	Yes — in users/{uid}/meta/settings

All vehicle fields are optional. If not set, running cost and emissions estimates are not displayed. No vehicle data is shared with your delivery platforms or third parties.

2.11 Estimated CO₂ emissions

Data	How derived	Purpose	Stored?
Estimated CO₂ emissions per job (kg CO₂-e)	Derived from your declared vehicle category, fuel type, efficiency data, and job distance using DCCEEW National Greenhouse Accounts Factors 2024	Displayed in your analytics dashboard	Yes — in users/{uid}/analyticsDaily/{date} and users/{uid}/analyticsMonthly/{month}
Estimated CO₂ emissions per day and per month	Aggregated from per-job estimates	Analytics display and operator fleet summaries	Yes — analytics paths above

Emissions data is not shared with third parties, delivery platforms, or other drivers.

2.12 Shift and fatigue awareness

Data	How derived	Purpose	Stored?
Shift duration (hours, per day)	Calculated from your shift start and shift end events	Displayed as a fatigue awareness indicator on the Pool screen	Derived client-side from shift events already stored in your Firestore path
On-shift hours today	Running total derived from shift events	Fatigue awareness banner threshold	Not stored separately — computed at display time

Shift duration data is used only for your in-app awareness display. It is not shared with third parties, delivery platforms, or government agencies.

Note on heavy vehicles: If you set your vehicle type to Heavy Truck or Light Truck, the app displays a factual note that HVNL work/rest rules may apply. RouteRooster does not make any statutory compliance determination for any driver type.

3. What data we do NOT collect

The following data is never collected by RouteRooster:

• Raw email addresses in the operational database (email is processed by Firebase Auth only; see section 2.1)
• Raw notification text beyond the redacted structure
• Screenshots or images from OCR
• Raw Accessibility tree payloads
• Raw purchase tokens or transaction IDs
• Personal messages, photos, or contacts from your device
• Location data beyond what is used for active map display (Android) or route display (iOS)
• Any data from apps not on the supported platform allowlist

4. Platform capabilities

RouteRooster is available on Android and iOS. The following capabilities are Android-only and are not present on the iOS app:

Capability	Android	iOS
Notification listener / ingest	✓	✗
HUD overlay	✓	✗
Optional Accessibility capture	✓	✗
OCR fallback (memory-only)	✓	✗
WorkManager background scheduling	✓	✗

The iOS app supports: manual job entry, route view, earnings dashboard, settings, and subscription management.

5. Data sharing

RouteRooster does not share your data with:

• Third-party advertisers
• Data brokers
• Other RouteRooster users (individual signal data)
• Your delivery platform employers

Data is stored in Google Firebase (Firestore and Firebase Authentication). Access to Firebase infrastructure is governed by the Google Cloud and Firebase privacy policies, which RouteRooster is bound by as a Firebase customer.

6. Data retention

Data type	Default retention	User control	Hard limit
Raw notification snippets	Per user setting	Yes (0–72 hours)	72 hours (Firestore rules)
Structured job data	90 days after completion	Via account deletion (Settings → Account)	90 days (auto-pruned)
Analytics rollups	395 days (global server cutoff)	analyticsHistoryDays setting (30–365 days) controls what the app displays; per-user storage enforcement is a planned enhancement	395 days (enforced by scheduled prune job)
OCR frames	Zero	No setting needed	Never stored
Accessibility payloads	Zero	No setting needed	Never stored
Diagnostics	90 days	Via account deletion	90 days (auto-pruned); 512 chars per record
Community signals	Until signal expires or account deletion	Via account deletion	Signal-specific expiry
Job lifecycle events	395 days	Via account deletion	—
Entitlement audit events	Deleted with account	For post-deletion billing disputes, contact your payment platform	—
Vehicle category and fuel type	Until updated or account deletion	Editable in Settings at any time	Deleted on account deletion
Vehicle efficiency and energy cost values	Until updated or account deletion	Editable in Settings at any time	Deleted on account deletion
Estimated CO₂ emissions (per-job and aggregate)	395 days (stored within analytics rollups)	Via account deletion	395 days (same prune job as analytics rollups)
Shift event records (used to derive shift hours)	395 days (stored within job lifecycle events path)	Via account deletion	395 days

Account deletion permanently removes all data under users/{uid} and all jobs/routePlans owned by the account.

7. Security

• All Firestore writes require authenticated Firebase Auth sessions.
• Firestore security rules enforce strict ownership — your documents cannot be read or written by any other account.
• Server-side paths (entitlements, analytics, job events) are write-protected from clients.
• Billing tokens are hashed before transmission; raw values are never stored.
• Transport is encrypted via HTTPS/TLS.

8. Your rights

• Access your data — Request a data export via Settings → Privacy & Data → "Export my data". A structured bundle including your profile, settings, jobs, analytics, and community signals is returned immediately. For accounts with more than 200 jobs or 500 job events, a full export is available on request via the support address.
• Correct inaccurate data — Update settings and routing preferences in the Settings tab.
• Delete your account — Settings → Account → "Delete account". This permanently deletes all data across all RouteRooster Firestore paths (jobs, analytics, settings, community signals, diagnostics, and entitlement audit records) and your Firebase Authentication record. Deletion is immediate and irreversible. Billing dispute records (purchase history, transaction records) are maintained by your payment platform — Google Play for Android purchases and Apple App Store for iOS purchases — not by RouteRooster. If you need billing history after deleting your account, contact your payment platform directly.
• Withdraw consent — Accessibility capture, analytics upload, and diagnostics upload can be disabled at any time from the Settings tab. Changes take effect immediately.

9. Email communications

RouteRooster sends transactional emails only:

• Email verification (on account creation)
• Password reset (on request)

No marketing emails are sent. Email addresses are processed by Firebase Authentication only.

10. Changes to this policy

Material changes to this privacy policy will increment disclosureVersion in the app. Users who have completed onboarding with a lower disclosureVersion will be prompted to review the updated disclosures on next session.

11. Contact

For privacy enquiries, contact the RouteRooster operator at the support address listed in the app store listing.

---

Appendix A: Firebase Auth template requirement

Before public launch, the Firebase Authentication email templates (verification and password reset) must be configured with RouteRooster branding: custom sender name, custom reply-to address, branded email body, and production action URL domain.

Appendix B: Google Play Data Safety — operator action required

The Google Play Data Safety form must be updated before the next app release to accurately reflect the following data types collected:

Data type	Collected	Shared	Third-party SDKs
Name (first and last)	Yes	No	Not shared with SDKs
Analytics (usage data)	Yes	Yes — Firebase Analytics	Firebase Analytics
Crash logs	Yes	Yes — Firebase Crashlytics	Firebase Crashlytics
Device identifiers	Yes	Yes — FCM, Firebase Installations	FCM, Firebase Installations
Vehicle category and fuel type	Yes	No	Not shared with SDKs
Estimated emissions data	Yes	No	Not shared with SDKs
Shift duration data	Yes (derived)	No	Not shared with SDKs

The operator must update the Play Console Data Safety form to declare "Personal info — Name" as collected, confirm Firebase Analytics, Crashlytics, FCM, and Firebase Installations as declared third-party SDK data sharing, and confirm that no data is sold and no data is used for ad targeting.