Privacy
Your ride. Your people. Your privacy.
Ride sharing is temporary. Your own trip History can remain on your iPhone and in your private iCloud storage. Here is how those different parts work.
Last updated: October 11, 2026
What Bread Crumbs may process
During an active outing, Bread Crumbs may process recorded location breadcrumbs, timestamps, device battery and connectivity state, activity and expected duration, ride status, and safety-incident state. Your profile, Guardian connections and retained trip History can remain after the outing ends.
When location is collected
Location access supports recording and sharing during an active outing, including related background operation while the phone is locked or another app is open. Ending the outing stops new tracking. Missing or unreliable location reports remain gaps; the app does not invent a route through them.
People you connect with
Bread Crumbs does not request or upload your Contacts database. Add Guardian uses a QR or Text invitation, and the recipient must accept in Bread Crumbs before connecting. The service uses person and installation identities, display names, invitation and relationship status, notification preferences and delivery tokens to maintain these connections and send alerts. Removing a Guardian ends their current and future ride access when the service confirms removal. An offline removal remains pending; messages or information already received cannot be recalled.
Sign in with Apple and device ownership
When you choose Sign in with Apple, Bread Crumbs verifies Apple’s identity proof and associates your profile with a durable Bread Crumbs person identity. The Guardian service maintains that verified Apple association and separate installation and current-Rider-host authorization records for recovery and device ownership. A display name alone does not establish ownership. Switching accounts does not grant the previous person’s sharing authority or private History. Sign in with Apple and the iPhone’s iCloud account are separate identities; History checks its account binding.
Existing sharing permissions
Previously excluded people do not silently gain ride access after an update. They remain excluded unless intentionally added back and accepted. Existing public accounts retain their established sharing permissions, and a running legacy outing keeps the sharing list set when it started. Automatic Guardian membership and mid-ride inheritance remain restricted to the existing two-person verified pilot; installing an external beta or accepting a public TestFlight invitation does not grant that entitlement. Guardian membership never grants unrelated account information or private History.
Optional Fresh Location
Fresh Location is separately authorized by the Rider. Depending on the account’s available flow, the Rider chooses current-outing Guardians or a saved preference; the actual authority remains limited to an active outing and eligible Guardians. Permission expires with the outing or its grant, can be turned off sooner, and does not permit continuous live tracking. A request asks for one encrypted fix, expires after 90 seconds, and is subject to cooldown and rate limits. The service cannot decrypt the returned coordinates. Expired encrypted results are cleared by scheduled cleanup, and request records are removed after 24 hours. A cleanup outage disables requests and results until cleanup recovers. Fresh Location does not change recorded routes or statistics; browser Safety Links grant no Fresh Location authority.
Optional Emergency SMS backup
Emergency SMS backup is independently authorized for one explicitly chosen phone number. The choice is kept in this iPhone’s protected Keychain; it is not inferred from Guardian membership or uploaded as a Guardian recipient. An eligible background Help or possible-crash incident may reserve one SMS attempt, whose outcome remains with the local incident. The short message contains no coordinates or route. Apple and your carrier process messaging under their own terms. Submission is not proof of delivery. You can turn it off or change the recipient in the app’s safety settings; removing a Guardian does not change this separate choice.
Previously shared browser Safety Links
A browser Safety Link is separate from an in-app Guardian connection. A recipient does not need the app or an account, and anyone holding the link may see its available ride information. Existing valid links keep their original access, revocation and expiry rules. They do not add a Guardian or authorize Fresh Location. Routine Rider screens use Add Guardian for ongoing connections.
Shared rides after End
Ending stops new tracking. An authorized Guardian may reopen the latest shared ride for up to 24 hours from its earliest known end. A newer ride, removed sharing or expiry can end access sooner. An already-shared browser link can temporarily show its frozen final summary under its original expiry and revocation rules. A new connection does not grant private ride History or unrelated earlier outings.
Trip History on this iPhone and in private iCloud storage
Bread Crumbs keeps trip History on your iPhone and can synchronize trip records and recorded location breadcrumbs with your private Apple CloudKit database when a Bread Crumbs profile and iCloud access are available. This supports your own History across compatible installations. The app binds synchronized History to your Bread Crumbs person identity and checks that binding before reading or writing. Private History is separate from Guardian ride sharing; adding a Guardian or sharing a Safety Link does not authorize access to it. Apple processes the data in your private CloudKit database. Local safety-incident records and Emergency SMS outcomes are excluded from the History synchronization payload.
History retention
Ending a ride stops new tracking; it does not erase retained History. The dedicated local trip cache keeps the newest 10 completed trips plus sessions still tracking. That local limit does not automatically delete previously synchronized private CloudKit History. Deleting the app should not be treated as deleting its private CloudKit records. Contact support for help understanding retained data or deletion options.
Beta diagnostics
During the beta, Bread Crumbs records a bounded technical report for each session on the iPhone. It can include precise location evidence needed to investigate tracking problems. Reports remain on-device by default, are excluded from backup, are not automatically sent to the developer, and are not automatically synced to CloudKit. A report leaves the app only after you choose Share Trip Diagnostics, confirm the precise-location warning, and select a destination. Bread Crumbs keeps at most 10 diagnostic sessions and removes reports after 14 days.
Operational monitoring and owner-only analytics
If enabled after security review, Bread Crumbs can use existing Guardian service records to calculate daily totals such as new verified accounts, Guardian connections, backend-shared adventures and notification provider outcomes. These aggregates are stored separately from location and outing data and can be viewed or exported only through a protected owner reporting area. The aggregate reports contain no names, contact information, device identifiers, precise locations or individual trip histories. This does not add advertising tracking or new background location collection. A first adventure observed by the Guardian service may not be the first outing recorded privately on an iPhone.
Service providers and encryption
Apple CloudKit stores shared Guardian telemetry and your separate private History. Sensitive shared Guardian telemetry is encrypted before storage. Private History uses Apple’s private CloudKit storage and account access controls. The Guardian web experience is hosted on Vercel and validates the private link before retrieving and decrypting the available shared ride view. Managed PostgreSQL provided by Neon stores Guardian identity, ownership, connection, invitation and authorization records. Apple, Vercel, Neon, and your wireless carrier process relevant data under their applicable terms and policies.
Advertising and sale of data
The current app includes no advertising, advertising tracking or data-selling feature. This describes the current product architecture and does not replace the privacy practices of Apple, Vercel, Neon, your wireless carrier or services you choose to use.
Your choices
You decide when to start and end an outing, whom to invite or remove, and whether to authorize optional Fresh Location or Emergency SMS backup. You can change Bread Crumbs permissions in iPhone Settings. Turning off connectivity may delay updates and revocation confirmation. Force-quitting affects iOS background behavior until you reopen the app. Bread Crumbs does not replace emergency services or guarantee location, alert or message delivery.
Questions
Email support@breadcrumbsafety.com for privacy questions, or visit Support for help using Bread Crumbs.