DRS — Privacy Policy

Last updated: 21 October 2026

This policy covers the DRS app, the DRS NTI test app and the drs.club website. They share one account and one set of servers. DRS is a driving app: offline navigation, live position sharing with other drivers and convoys, and a social side for sharing drives, cars, routes and events. It is run by Cheng-Hua (Damon) Tsai ("we", "us"). This policy explains what we collect, why, how long we keep it, and who sees it.

The short version

• We don't sell your data and there are no ads. The apps contain no analytics or advertising tools. The one exception is our map provider, Mapbox, whose map software sends Mapbox unidentified location and usage data unless you switch it off (see "Maps, search and traffic"). The drs.club website uses an analytics service, PostHog (see "The drs.club website").
• Your live position is not saved. It passes through our relay, encrypted, to the drivers your transponder setting allows. The relay holds it in memory only and never writes it to disk. We keep no history of where you've been.
• Your live position is public by default. The transponder starts in Public mode, so other DRS drivers can see you on their map. Switch to Community, Crew or Stealth whenever you like. Stealth hides you from other drivers and hides them from you.
• Sharing a drive publishes its path. When you tap Share at the end of a drive, the route you drove is posted publicly. Nothing is uploaded unless you tap.
• Favorites stay on your phone. They are never uploaded.
• Encounters remember who, never where, and are deleted after 7 days.
• Alerts reach other drivers anonymously. We keep a private count of how many you've sent, for the community leaderboards.
• What we keep on our servers: your account and profile, what you post and share, routes and places you choose to save, and a record of each drive (distance and times, never the path), plus counts of convoys and alerts for the leaderboards.
• You can delete your account at any time, in the app or on drs.club. It disappears straight away and is erased 7 days later.

The rest of this policy gives the detail.

Your live position (the transponder)

While the app is open, or running in the background during a drive, it reads your phone's GPS and broadcasts your position so other drivers can see you on their map.

• What is sent: your position, speed and direction, your nickname and car color, whether you've arrived, and lookup tokens for your profile and the car you're driving (for a car card you've made public, also its make, model and nickname). The tokens let other drivers open your card; our server checks your privacy settings before showing it. Everything is encrypted before it leaves your phone, and travels over an encrypted connection (TLS).
• Who receives it depends on your transponder setting:
  • Public (the default): every DRS driver who is online, in either app, wherever they are.
  • Community: members of the communities you belong to, wherever they are.
  • Crew: only the people in your crew, wherever they are.
  • Stealth: your phone stops sending your position, and other drivers' positions are hidden from you too. You still receive SOS requests from your convoy and road alerts. Stealth hides you, but it doesn't make you invisible: our relay can still tell that your app is connected.
  • Convoys: when you're in a convoy, your position and convoy activity (route, roll call, checkpoints, fuel/break/SOS requests) also go to that convoy's members, at any distance.
  • Open convoys: if you lead an Open convoy, its announcement (including your position as the meeting point) is broadcast like a Public position; other drivers' apps show it only within about 300 yards.
• The relay. Positions go through a relay we run on Cloudflare. The relay keeps each driver's most recent position in memory, so someone who joins can see you straight away. It stops replaying a position after about 30 seconds and drops it when you disconnect. Alerts are held in memory for about 20 minutes, and convoy details until they expire or the convoy ends. Nothing is written to disk, and the relay keeps no logs of positions.
• What the relay can see. The relay cannot read your position, speed, nickname or car color. To deliver messages to the right people it does see some identifiers: your device number, your account ID (it checks your sign-in token), the community and crew IDs you broadcast to, and the convoy ID. Like any internet service, it also sees your IP address.
• About the encryption. Positions are encrypted with a key that is built into the app and is the same for every copy of it. That keeps your position unreadable to the relay and to anyone else on the network, but it is not end-to-end encryption and the key is not a personal secret: any copy of the app can decrypt what is broadcast to it, which is how other drivers see you on the map. Choose your transponder setting with that in mind.
• Your device number is a short number (16 bits, so many phones share each value) that tells drivers' dots apart. On iPhone it is random. On Android it is derived from the Android ID, an identifier the system gives the app.
• Off-grid radio. If you pair the app with your own LoRa radio node (Meshtastic), your position, speed, direction, device number and nickname, and the destination of the route you're driving, are also broadcast over that radio to nearby nodes. DRS adds no encryption of its own to this radio traffic: it is protected only by your node's channel settings, and on a default channel anyone nearby with a compatible radio can read it. Bluetooth is used only to talk to your own node.

Police and hazard alerts

• Alerts you send. A police or hazard alert carries its location, direction and speed, and goes to DRS drivers through the relay, whatever your transponder setting, with no name or ID attached. Separately, our server records that your account sent an alert, its kind and the time (no location), for the "Spotter" leaderboard.
• Alerts from other sources. Some alerts on the map come from third-party sources rather than from DRS drivers. On Android, if you have installed the separate SABRE plugin app (not made by us), DRS asks it every few seconds for alerts within about 15 km of you. That means passing your current position to the plugin, on your phone; the plugin's own terms and privacy policy apply to what it does with it. DRS then shares the police and hazard alerts it gets back with other DRS drivers through the relay, with no DRS name or ID attached.

What we store on our servers

Our servers store the following, attached to your account. They are hosted by Supabase (database, sign-in and file storage) and Vercel.

• Account information. Signing in is required. You can use an email address and password, Sign in with Google, or, on iPhone, Sign in with Apple. Your email identifies your account and is not shown to other users. Passwords are handled by our sign-in provider (Supabase) and are never stored in readable form.
  • With Google, we receive your email address, name and profile picture, and nothing else from your Google account.
  • With Apple, we receive your email address and, the first time only, your name. If you choose Apple's Hide My Email, we only get an Apple relay address, and emails we send reach you through Apple.
  • We also record which version of our terms you accepted and when, and when you last signed in.
• Profile and social content. Your display name, username, bio, avatar and banner, and optionally your city, state and country; your garage (cars and car photos); posts, comments, likes, ratings and reviews; your crew (friends), communities and community chat messages, events (including an event's meeting place), RSVPs and event photos; and the notifications you receive. Your profile, including any city, state or country on it and whether you're a Premium member, is public. Everything else is shown according to the audience you choose. (Some older accounts may have had a city filled in automatically from the sign-up connection; you can change or remove it on your profile.)
• Photos. Only photos you pick are uploaded. The app re-encodes them on your phone first, which removes embedded details such as where the photo was taken. Uploaded photos are stored at web addresses that don't require signing in to open: anyone who has a photo's link can view it, even if the post it belongs to has a restricted audience.
• Routes and DRS Places. Routes you create or import, and places you save as DRS Places, are stored on our servers with the visibility you pick (private, or shared with others). Places saved as Favorites are different: they never leave your phone.
• Sharing a drive. When you arrive, the arrival card offers Share. Only if you tap it, the path of the drive you just finished is uploaded, saved as a route in your library, and posted to your profile with its name, distance, time and average speed. Both the route and the post are public. The path starts and ends where your drive did, which may be close to your home, so check before you share. Nothing is uploaded unless you tap.
• Drive records. When a drive of more than 100 m ends (navigating to a destination or just driving), the app records its distance, start and end time, whether you arrived, the saved route you were following (if any) and the car you had selected. It does not record where you drove. These records power the mileage on your garage cards and the community leaderboards ("Voyager" for miles, "Journeyed" for routes completed).
• Convoy participation. For each convoy you lead or join, we record the convoy ID, your role and the time. This powers the "Wingman" leaderboard.
• Encounters. When you pass another DRS driver (within about 500 yards) whose car card you're allowed to see, and you're broadcasting yourself, the app records that you crossed paths. We store who (your account and theirs), which car card, when you first and last saw each other, and whether either of you waved or gave props. We never store where. Encounters are deleted 7 days after you last saw each other. A wave or props also sends the other driver a notification, and props leave a post on their profile that only they can see unless they choose to make it public.
• Premium. If you have Premium (for example as an early tester), we keep a record of it: what kind it is, when it started and ends, and, for one we granted, who granted it and a short note. Other users can see that you're a Premium member.
• Premium trial and device check. You can start one free 7-day Premium trial per account and per phone. To check the phone, the app asks Apple (DeviceCheck) or Google (Play Integrity) for a one-time token, and our server uses it to ask Apple or Google whether this phone has already had a trial, and then to mark that it has. That mark is a single flag that Apple or Google keeps for the phone; we never receive or store an identifier for your phone, and we don't keep the token. The flag stays with the phone even if you delete the app or your account. If you bought your phone second-hand and can't start a trial, email us at feedback@drs.club and we can reset it for your account. On Android, Play Integrity also tells us whether the app was installed from Google Play and whether the app and phone pass Google's integrity checks; we use that answer to decide on the trial and don't keep it. We keep a record of the trial itself (when it started and ends) like any other Premium record.
• Push notification token. When you sign in, the app registers a delivery token for your phone so we can send you notifications (follows, comments, waves, convoy invites and similar). It is deleted when you sign out.
• Feedback. If you send feedback from the app, your message, its category and subject, your display name and your account email (so we can reply) are emailed to us through our email provider, Resend. Nothing else is attached: no logs, screenshots, device details or location. It is kept in our mailbox, not in our database.
• Reports and blocks. If you report a post, comment, photo, route, event, community or profile, we keep the report: who sent it, the reason, any note you add and a copy of the reported text, so our team can review it. Each new report is emailed to our team through Resend. The person you report is never told who reported them. If you block someone, we keep a record that you blocked them; they aren't told.
• Automatic content checks. Text you post for others to see (posts, comments, captions, reviews, your name, username and bio, your car details, and the names and descriptions of routes, places, events and communities) is checked automatically when you save it:
  • sexual or explicit wording isn't posted. You're asked to reword it, and nothing is kept;
  • strong swearing is posted, and a copy is kept for our team to review;
  • slurs, hate speech and threats aren't posted. The attempt, including what you typed, is kept for our team to review and counts as a strike on your account.
• Strikes and posting pauses. A report our team upholds also counts as a strike. We keep a record of each strike (when and why). Repeated strikes within a short time automatically pause posting and commenting for a while (by default, a third strike within 30 days pauses them for 7 days), and our team is emailed. Driving, navigation, live sharing and convoys are never affected. Our team may suspend an account for serious or repeated violations; that is always a person's decision, never an automatic one.

Leaderboards

Communities show leaderboards (top three per award). If you're among the top three in a community you belong to, your name, username, avatar and total (for example, miles driven, alerts sent or convoys joined) appear there, with the date of your most recent qualifying activity. Leaderboards are visible to anyone by default, including people who aren't signed in; a community's admins can make theirs members-only.

AI features

Some optional features use Google's Gemini AI service. We send it only what the feature needs, and never your name, email or account ID:

• Car card AI (nickname, story, stats, generated car image): your car's year, make, model, trim and color, any hint you type, and the card's existing text. Enhance photo sends the car photo you chose.
• AI event cover: the event name and the image description you type.
• Review summaries: when you rate a route, sector or place, your star rating and review text (with profanity masked), together with other users' reviews, are sent to Gemini to write the short summary shown on that route or place.

AI features that cost credits keep a record of the credits you've used (which feature, the AI model and its usage count) on your account.

Maps, search and traffic

• Maps and offline routing. The map (on your phone, Android Auto and CarPlay) is drawn by Mapbox's map software, which downloads map tiles and the live-traffic layer from Mapbox, including map areas along your route so it keeps working offline. Event map previews are drawn by Mapbox from the event's meeting place. Turn-by-turn routing runs on your phone and works offline. Offline data packs are downloaded from our storage on Cloudflare.
• Mapbox telemetry. Mapbox's map software, built into the app, sends Mapbox unidentified location and usage data by default, along with a random session ID, so Mapbox can bill us and improve its maps and traffic data. This comes from Mapbox's software, not from DRS: it carries no name, nickname or DRS account ID, and Mapbox handles it under its own privacy policy. You can opt out with the (i) button in the corner of the map.
• Traffic-aware routing and place search. When you use traffic-aware routing or place search, the route points (including your starting position), or the text you typed together with your current map position, are sent through our own server to our data provider, TomTom. Your sign-in token goes to our server with each request, so it can check that you're signed in and apply fair-use limits; it is not passed on, and no name, nickname, account or device ID is sent to TomTom. We don't store these requests. For the daily fair-use limits, the server keeps a count of how many routes and searches your account has used each day (only the counts, kept for a few days). The live-traffic layer on the map comes from Mapbox.
• Event meeting places. When you search for a meeting place while creating an event, the text you type, and optionally the area you're searching near, are sent through our server to Google Places.
• Shared map links. If you share or paste a Google Maps link into DRS, our servers ask Google where that link points.
• Work-zone alerts (optional, off by default). If you turn on Washington State work-zone alerts, your phone asks WSDOT's public data service for work zones in an area about 130 km across, centred on your position.
• Voice search. The microphone is used only while you're speaking a destination. The app uses your phone's built-in speech recognition, on the phone itself wherever your phone supports that. If it doesn't, your phone's own speech service (Google on Android, Apple on iPhone) may process the audio under its own privacy terms. We never receive or store your voice; the recognized words are used for the search like typed text. Spoken directions use your phone's built-in text-to-speech voice.

Diagnostic data

To keep an eye on the cost and reliability of our relay and traffic servers, they record a small amount of data with our infrastructure provider, Cloudflare:

• Traffic and search server: an approximate area (a grid cell about 39 km across, never your precise location), whether it was a route or a search, a count (route points, or search length), and whether the sign-in check and fair-use limits passed.
• Relay: connection and message counts and sizes, the app's platform and version, and whether the sign-in check passed. No location and no channel or convoy names.

None of it carries a name, nickname, account or device ID, and it is not used for advertising or tracking. Cloudflare keeps it for about three months. Like any online service, our providers also process technical information such as IP addresses to deliver and protect the service.

The drs.club website

The website uses the same account as the apps. On the website you can sign in with an email address and password or with Google.

• Analytics. We use PostHog (servers in the United States) to understand how the website is used: pages you visit, clicks and similar interactions, how long you stay, and your browser, device type and approximate location as worked out from your IP address. When you're signed in, this is linked to your DRS account ID and username. PostHog may also record sessions (what was on screen and how you moved through the site), with anything you type into forms masked. Our own server separately records which pages and features you use, and for how long, linked to your account when you're signed in.
• Cookies and browser storage. The website keeps you signed in, remembers the last page you were on and your display preferences, and stores PostHog's cookie. It uses no advertising cookies.
• Other services the website loads. Fonts come from Google Fonts and jsDelivr, maps from Mapbox, and, where an event page includes one, videos from YouTube. Each of them receives your IP address and browser details when the page loads.
• Joining the beta. If you join the beta on drs.club, we store your email address and whether you use iPhone or Android, add them to our mailing list at Resend, and email our team about your signup. We use them only to invite you to test DRS and tell you about its launch. To be taken off the list, email us.

On your phone

• Favorites (Home, Work and your other saved spots), your recent destinations and your settings are stored only on your phone and never uploaded. Your nickname, car color and device number are also kept on your phone; they travel with your live position as described above, but we don't store them on our servers.
• Trip logs and crash logs. If you turn on recording, the app keeps a session log of your drive (positions and events). It always keeps a small diagnostic and crash record as files on your phone. Both stay on your phone unless you choose to export and share them. The apps contain no crash-reporting service.
• The app also keeps your last known position on the phone, so the map opens where you are.
• Phone backups. Your phone's own backup (Google's backup on Android, iCloud or a computer backup on iPhone) may include the app's files, such as your favorites, recent destinations, last position and logs, if you have backup turned on. That backup is controlled by your phone and its backup provider, not by us.
• Uninstalling the app removes everything it stored on your phone. Deleting your account from the app also clears the account's data and your favorites from that phone.

Who we share it with

• Other drivers, as described above: your live position, nickname and car color, according to your transponder setting; alerts you send, anonymously; and, over your own LoRa radio if you use one, your position, nickname and destination.
• Other users: your profile and whatever you post or share, with the audience you choose; drives you share, publicly; your name and totals on community leaderboards; whether you're a Premium member; and, to drivers you wave at or give props to, your name.
• Service providers who process data to run DRS for us:
  • Supabase (accounts, database and photo storage) and Vercel (our website and servers);
  • Cloudflare (relay, traffic server, offline data packs and the diagnostics above);
  • Mapbox (maps, live traffic, and elevation profiles for saved routes);
  • TomTom (traffic-aware routing and place search);
  • Google (Gemini for the AI features, Places for event meeting places, Sign in with Google, and looking up Google Maps links);
  • Apple (Sign in with Apple; when you delete an account that uses it, we tell Apple to revoke DRS's access);
  • Apple DeviceCheck and Google Play Integrity (checking a phone hasn't already had a Premium trial);
  • Resend (sign-in and password emails, feedback, the beta mailing list, and moderation emails to our team);
  • PostHog (website analytics);
  • Expo together with Google and Apple (push notification delivery).
• Mapbox telemetry, which Mapbox's map software sends to Mapbox for Mapbox's own use unless you opt out (see "Maps, search and traffic").
• The SABRE plugin app, if you've installed it on Android: your current position, on your phone (see "Police and hazard alerts").
• Your phone's speech service (Google or Apple), only if voice search can't run on the phone.
• Public services you choose to use: WSDOT, if you turn on work-zone alerts.
• When the law requires it, for example to respond to a valid legal request.

We do not sell your information or share it with advertisers or data brokers.

How long we keep it

Deleting your account

• How: in the app, open your profile, then Settings → Danger Zone → Delete account, and type DELETE. On the web, use drs.club/delete-account while signed in. If you can't sign in, email feedback@drs.club from the account's email address. (If you used Apple's Hide My Email, write from any address and include your @username.) If your account uses Sign in with Apple, the app asks Apple to confirm once more, so we can revoke DRS's access with Apple too.
• Straight away: your account is hidden from everyone, you are signed out, your notification tokens are removed and the account can no longer sign in.
• 7 days later we permanently erase your profile, garage and car photos, routes, sectors and places, posts, comments and reactions, crew, encounters, community memberships and messages, RSVPs and event photos, drive history, leaderboard stats, badges and DRS tokens, your notifications, your blocks, your strikes and posting pauses, reports about you, your beta signup and your sign-in itself. We also delete your website analytics profile and its history in PostHog, and your contact on our beta mailing list at Resend. Events you organised are cancelled. Communities you own pass to their longest-standing moderator or member, or are closed if you are the only member.
• What stays, without your name: an empty record of the account (an internal number and dates, so links to it don't break), token-spend accounting, group-drive counts (so the drivers you convoyed with keep their credit), sign-in statistics, website page-use counts, our Premium records, and reports you filed about someone else's content (the reason stays; your name and note are removed).
• Changed your mind? Email us from the account's address within the 7 days.
• If you ever buy a subscription through the App Store or Google Play, deleting your account won't cancel it; cancel it in your store account.

Your choices

• Switch your transponder to Community, Crew or Stealth at any time.
• Location, camera, microphone, photos and notifications are all permissions you can refuse or turn off in your phone's settings. Navigation works without the camera, microphone or photo access.
• Opt out of Mapbox telemetry with the (i) button on the map.
• Edit your profile, and delete posts, comments, cars, routes and places, in the app or on drs.club. Deleted content disappears from the app and website straight away, but for now we keep a copy in our database until your account is deleted. Deleting a post doesn't remove its photo file: anyone who already has that photo's link can still open it. If you need a photo or other content removed for good, email us and we will.
• Ask us for a copy of the data we hold about you, or to correct or delete it, at feedback@drs.club.

Permissions

• Location (including background): to show your position, navigate, and keep sharing your position during a drive while the screen is off.
• Bluetooth / nearby devices: only to connect to your own LoRa radio node. It is not used to find your location.
• Camera: only to scan convoy invite QR codes. The app does not take or upload pictures.
• Microphone and speech recognition: only for voice destination search, while you're speaking. Audio is never sent to us (see "Voice search" above).
• Photos: read-only, to let you pick photos for your profile, garage, posts, communities and events. Only the photos you pick are uploaded.
• Notifications: for the ongoing notification shown while the app runs in the background during a drive, and for social and convoy notifications.
• Motion (iPhone): the app does not use motion or activity data.

Children

DRS is for adults. You must be 18 or older to use it, and we do not knowingly collect data from children.

Security and where data is stored

Everything the apps and website send travels over encrypted connections (TLS). Our providers store data mainly in the United States. No system is perfectly secure, so please use a strong, unique password.

Changes to this policy

We may update this policy as DRS changes. We will change the "last updated" date above, and tell you in the app or by email about significant changes.

Contact

Questions about this policy, or requests about your data: feedback@drs.club