Legal
Privacy Policy
We respect your privacy and are committed to being transparent about the data we hold and how we use it. This policy explains what information we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.
1. Who We Are
RoadworksTrackr is operated by JTG Digital ("we", "us", "our"). We are the controller of the personal data you provide to us or that we collect through your use of the RoadworksTrackr mobile application and website (collectively, the "Service").
If you have any questions about this policy or wish to exercise your rights, please contact us at: support@roadworkstrackr.co.uk
2. Data We Collect and Why
We collect only the minimum data necessary to provide and improve the Service.
2.1 Account Data
When you create an account you provide:
- Display name and email address — used to identify your account, send you alerts, and respond to support requests.
- Password (hashed) — we store a bcrypt hash; we never store your password in plain text.
- User type (e.g. member of the public, highway authority, utility company) — used to personalise features and communications.
- Profile picture (optional) — stored as a URL if you choose to upload one.
Lawful basis: Contract performance (Article 6(1)(b) UK GDPR) — account data is necessary to provide the Service you have signed up for.
2.2 Location Data
If you grant location permission, the app uses your device's GPS coordinates to:
- Centre the roadworks map on your current position;
- Search for roadworks near you;
- Monitor saved routes for disruption alerts.
Location data is processed on-device and in-memory for map rendering. When you save a route or location, the coordinates are stored against your account so we can deliver email and push alerts. We do not build profiles of your movement history.
Lawful basis: Consent (Article 6(1)(a) UK GDPR) — you grant or deny location permission in your device settings at any time.
2.3 Usage Analytics and Event Data
We log anonymised in-app events (e.g. "searched roadworks", "viewed route", "opened alert") to monitor app performance, diagnose issues, and improve the Service for all users. These events are linked to an internal account identifier, not to your name or email address. We also collect aggregate usage metrics via the admin portal (such as daily active sessions, feature usage frequencies, and error rates) to inform product decisions. This data is retained for up to 12 months in aggregated form and is then deleted.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — monitoring and improving the Service is a legitimate interest that does not override your fundamental rights, given that the data is pseudonymous, aggregated, and never used for advertising or profiling.
2.4 Highway Authority Reporting and Aggregated Data Sharing
The Service includes a reporting suite (accessible to highway authority and local authority partners, for example at pathways such as /kcc) that produces aggregated, statistical summaries of roadworks interaction patterns — for example, which road corridors attract the most user queries, or how frequently certain permit categories are viewed. These statistics are derived from the usage event data described in section 2.3 above.
This reporting data is fully anonymised and aggregated: it does not contain names, email addresses, account identifiers, precise GPS coordinates, or any other information that could identify an individual user. It is not personal data within the meaning of UK GDPR.
Aggregated reporting statistics may be shared with highway authorities, local authorities, and road planning partners for the purpose of informing road planning, traffic management, and infrastructure decision-making. Partners receive statistical outputs only — they receive no information about individual users and cannot re-identify any person from the reports.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — sharing anonymised, aggregated intelligence with road planning authorities is a legitimate public interest activity consistent with the purpose for which the underlying data was collected, and does not materially affect your privacy.
2.5 Technical and Device Data
When you use the Service, our server infrastructure automatically receives standard technical data including IP address, device type, operating system version, app version, and timestamps. This data is used to maintain security, diagnose technical issues, and enforce fair use. IP addresses are stored in server logs for up to 30 days and then deleted.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR).
2.6 Payment and Subscription Data
In-app purchases and subscriptions are handled entirely by Apple (via App Store) or Google (via Google Play) and managed by RevenueCat. We do not receive or store your payment card details. We receive a subscription status token from RevenueCat to unlock premium features in the app. See Section 5 for more on third-party processors.
2.7 Enterprise Enquiry Data
If you submit a contact or enterprise enquiry form on our website, we collect your name, email, organisation, phone number, and message. This data is used solely to respond to your enquiry.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR).
3. How We Use Your Data
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing and personalising the Service | Account data, location data | Contract performance |
| Sending roadworks alerts and digests | Email, saved locations/routes | Contract performance |
| Managing your subscription | RevenueCat subscription token | Contract performance |
| Improving the Service | Anonymised usage events | Legitimate interests |
| Sharing aggregated, anonymised statistics with highway authority partners for road planning | Aggregated, anonymised usage statistics (no personal data) | Legitimate interests |
| Security and abuse prevention | Technical / device data, IP | Legitimate interests |
| Responding to enquiries | Enquiry form data | Legitimate interests |
| Legal compliance | Any relevant data | Legal obligation |
4. Data Retention
- Account data — retained for as long as your account is active. If you delete your account, your personal data is deleted within 30 days, except where we are required to retain it for legal or tax purposes.
- Usage events — retained for up to 12 months in aggregated form, then deleted.
- Server access logs (including IP addresses) — retained for 30 days, then deleted.
- Email logs — metadata (type, timestamp, success/fail) retained for 6 months.
- Enterprise enquiries — retained for 2 years or until you request deletion.
5. Third-Party Processors
We share data with the following trusted third parties only as necessary to operate the Service:
5.1 RevenueCat
We use RevenueCat, Inc. to manage in-app subscriptions and entitlements. RevenueCat receives a device identifier and subscription event data from Apple or Google and provides us with a subscription status. RevenueCat processes data in the United States under Standard Contractual Clauses. See RevenueCat's Privacy Policy.
5.2 Apple Inc.
If you use an iOS device, Apple processes your App Store purchases, Sign in with Apple authentication, and push notification tokens. Apple's processing is governed by Apple's Privacy Policy.
5.3 Google LLC
If you use an Android device, Google processes your Google Play purchases and may process device identifiers in connection with push notifications. Google's processing is governed by Google's Privacy Policy.
5.4 Cloud Infrastructure
The Service is hosted on cloud infrastructure (including Replit and associated hosting providers). These providers act as data processors and operate under appropriate data processing agreements. Data may be stored or processed in the United States or European Economic Area. Where transfers outside the UK occur, we rely on Standard Contractual Clauses or an adequacy decision.
5.5 Sentry
We use Sentry, Inc. for crash and error monitoring in both the mobile app and the backend service. When an error or crash occurs, Sentry receives diagnostic information including stack traces, device type, operating system version, and a session identifier. This information is used solely to identify and fix bugs. Sentry processes data in the United States under Standard Contractual Clauses and Sentry's Data Processing Agreement. See Sentry's Privacy Policy.
5.6 Email Delivery
We use a third-party email delivery provider to send transactional emails and roadworks digests. Your email address is shared with this provider for the sole purpose of delivery.
We do not sell your personal data to any third party, and we do not share it for advertising purposes.
6. Data Sources — Public Sector Open Data
The roadworks data displayed in the Service is sourced from publicly available government datasets, including the Department for Transport Street Manager service, National Highways, Traffic Scotland, and Transport for London. This data is used under the Open Government Licence v3.0. It is not personal data, and it does not originate from you.
7. Cookies and Local Storage
The RoadworksTrackr mobile app does not use cookies. The marketing website (roadworkstrackr.com) uses only essential functional cookies required to maintain your session and preferences. We do not use third-party tracking or advertising cookies.
The mobile app uses local device storage (AsyncStorage) to cache map settings and authentication tokens on your device. This data never leaves your device without your action.
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you may request a copy of the personal data we hold about you.
- Right to rectification — you may ask us to correct inaccurate data.
- Right to erasure — you may ask us to delete your data ("right to be forgotten"). You can also delete your account directly in the app under Settings > Account > Delete Account.
- Right to restriction — you may ask us to restrict processing in certain circumstances.
- Right to data portability — you may request your data in a structured, commonly used, machine-readable format.
- Right to object — you may object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. location), you may withdraw it at any time via your device settings without affecting the lawfulness of prior processing.
To exercise any of these rights, please email us at support@roadworkstrackr.co.uk. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.
9. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
10. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or in-app notice. Continued use of the Service after an update constitutes acceptance of the revised policy.
12. How to Raise a Complaint
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's data protection supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would, however, appreciate the chance to address your concerns before you contact the ICO, so please reach out to us first at support@roadworkstrackr.co.uk.
13. Contact Us
JTG Digital — RoadworksTrackr
Email: support@roadworkstrackr.co.uk
Website: roadworkstrackr.com