Privacy Policy

The two apps do the same job in the same way, and most of this policy applies to both. Where the platforms differ — how purchases are checked, which permissions exist, what the now-playing card can see — the paragraph says which app it is talking about.

1. Who we are

Speed Comp is developed and published by Express Development Group LLC, the data controller for the processing described here. You can reach us at [email protected].

The app raises your media volume as your vehicle speeds up and lowers it back toward your chosen baseline as you slow down. Everything in this policy follows from that one job.

2. Data that stays on your device

The following is processed entirely on your phone. It is not transmitted to Express Development Group LLC, and it is not transmitted to any third party.

Location and speed

While compensation is running, the app receives location updates from the phone's location service — Core Location on iPhone, Google Play services on Android — including latitude, longitude, speed and accuracy. Only the speed value is used: it is normalised against the minimum and maximum speeds you configured and converted into a volume level.

Location updates are handed directly to the running app and then discarded. The app writes no location data to storage — no coordinates, no speed readings, no trip history, no timestamps of where you have been — and includes no code that transmits location off the device. On iPhone the coordinates are not even passed from the location callback to the rest of the app; only the speed and the accuracy figure are. Location updates stop when you stop compensation, when the free session limit ends the run, or (on Android) when the foreground service ends. One figure derived from the readings does leave: the highest speed seen in a session, sent with the analytics event that closes it (section 3).

The speed, the current volume and the amount of compensation are also shown on the run-status card — a Live Activity on the iPhone Lock Screen, an ongoing notification on Android. That card is drawn by the phone from values the app hands it; it involves no push service and nothing about it leaves the device.

Media playback information

On iPhone, if you grant access to Media & Apple Music, the app reads what Apple Music is currently playing — the track title, the artist, the playback state and the album artwork — in order to show it on the home screen and offer play, pause and skip controls. That is the only player iOS lets an app inspect, so the card shows Apple Music and nothing else. The app reads nothing else from your library, keeps no record of what was playing, and transmits none of it.

On Android, if you grant notification access, the app reads the currently active media sessions on your device in order to display what is playing and offer transport controls. This can include the track title, the artist, author or show name, the playback state, and album artwork. This information is shown to you inside the app and is not transmitted anywhere.

The Android app does not read the content of your notifications. Notification access is requested only because it is the permission Android requires before an app may enumerate active media sessions. Separately, when a media app opens or closes an audio session on your device, the Android app stores that app's package name, the audio session identifier, and which of the two happened — so your setup is remembered between launches. That record is a list of apps and session identifiers; it holds no track titles and no history of what you played. The iPhone app keeps no equivalent record.

Your settings

Speed units, minimum and maximum speeds, update rate, saved vehicle profiles, simulation settings, display toggles, whether you have completed the tutorial, and a small number of counters and timestamps used to decide when to offer you a review prompt (and, on Android, an update prompt). All of this lives in the app's own private storage on your device.

The app also caches the answer to "is there a subscription?" — two yes/no flags, the product bought, any pending change, and the time of the last check — so that a store outage does not switch your features off. On iPhone this lives in the iOS Keychain; on Android in encrypted preferences. See section 8.

3. Data that leaves your device

Subscription verification on iPhone: nothing is sent to us

On iPhone, Speed Comp is sold as a subscription through the App Store, and the app has no server of its own. When you buy, Apple processes the payment and issues a signed transaction record to your phone; the app checks that record on the device using Apple's StoreKit framework and keeps a simple entitlement flag. Nothing about the purchase is sent to Express Development Group LLC. Restoring purchases, upgrading or cancelling are conversations between your phone and Apple.

We do not receive your name, email address, Apple Account or payment details. Apple reports sales to us only in aggregate, through App Store Connect, without identifying purchasers.

Subscription verification on Android

On Android, Speed Comp is sold as a subscription through Google Play. To confirm that a subscription is genuine and current, the app sends the purchase details to a verification service that we operate, which then asks Google's Play Developer API whether the purchase is valid. Verification is not trusted to the app alone, because a check that runs only on the device can be bypassed.

The request contains:

The service replies with the subscription record Google holds for that purchase — state, expiry, renewal setting, base plan, region code and acknowledgement status — which the app uses to decide whether to unlock premium features. The app caches only a simple entitlement flag from that reply.

This request is not sent unless you have a purchase to verify, and entitlement is re-checked at most once per day. The request does not include your location, your speed, what you were listening to, your device identifiers, or your settings.

We do not receive your name, email address or payment details. Google Play handles payment; we only ever see the purchase token and the subscription record Google returns for it.

Crash and error reports

When either app crashes or handles an unexpected error, a report is sent to Google Firebase Crashlytics. A report typically contains the stack trace, the app version, your device model and the iOS or Android version, the state of the device at the time (such as available memory), and a randomly generated Crashlytics installation identifier. Reports are used to diagnose and fix defects. They do not contain your location, your media, your settings, or (on Android) your purchase token.

Product analytics

Both apps send usage events to Google Analytics for Firebase, so we can see which parts of the app are used, where people give up in the tutorial or on the subscription screen, and whether purchases fail. The same events are sent from the iPhone and the Android app. An event names what happened and carries a handful of values about it:

• Which screen was opened (home, settings, profiles, the subscription screen, the tutorial, the permission screens).
• The tutorial: that it was started, and whether it was finished or skipped, on which step, and which of the permissions it asks for were granted by the end.
• Compensation sessions: that one started and stopped, why it stopped (a button, the free-tier limit, the run-status card, the simulation ending, the app closing), how long it ran, the highest speed it saw, the start and top speeds you configured, whether the Loudness Enhancer was on, and whether it was the built-in simulation rather than a vehicle. Milestones at 30 and 60 minutes, and the free-tier limit being reached.
• The subscription funnel: that the subscription screen was viewed and from which button, which plan was tapped, and that a purchase was started, completed, cancelled or failed — with the plan's product ID, its price and currency, and, for a completed purchase, the store's transaction ID so that the same purchase is not counted twice. Also that a subscription was restored or expired. Never a receipt, a purchase token or your Apple or Google account.
• A saved speed profile being created, and how many there are.
• Two properties that describe the install rather than an event: the subscription tier (free, Plus or Pro) and the speed unit you chose (mph or km/h).

Every event is tied to a random app-instance id that Google Analytics generates for the install. It is not linked to an advertising identifier: the Android app removes the advertising-id permission and turns advertising-id collection off, and the iPhone app uses the version of the analytics library that cannot read the advertising identifier, turns collection of the identifier for vendors (IDFV) off, and never shows Apple's tracking prompt. Events contain no location and no speed history — the only speeds in them are the two you configured and the single highest speed of a session — no media details and nothing you typed. Google Analytics also derives a coarse location (country or city) from the IP address of the connection, as described in its own policy.

4. Permissions and why they exist

On iPhone

The iPhone app asks for no notification permission — a Live Activity does not need one — and no permission is involved in changing the volume: the app moves the same system volume the side buttons do, through the standard system volume control. You can withdraw location or media access at any time in iOS Settings under Privacy & Security. Withdrawing location stops speed compensation; withdrawing media access simply empties the now-playing card.

On Android

You can withdraw any of these at any time in Android's Settings. Withdrawing location permission stops speed compensation; withdrawing notification access simply removes the now-playing display.

5. What we do not do

• We do not sell or rent your personal information, and we do not share it with data brokers.
• We do not display advertising, and neither app contains an advertising SDK.
• We do not read or use an advertising identifier to profile or track you across apps or sites. The iPhone app never shows Apple's tracking prompt, because it never tracks.
• We do not use analytics to profile you. The events in section 3 are aggregate usage measurements under a random app-instance id; they do not record how far you travel or where, and they are never joined to an advertising identifier, an account, or a purchase receipt. The one piece of attribution data we receive — on Android only — is Google Play's install referrer, which says which store link an install came from and is sent only alongside a purchase; it is described in section 3 rather than hidden behind this bullet.
• We do not store or transmit your location, and we keep no record of where you have been.
• We do not require an account, and we do not ask for your name, email address, phone number or contacts.
• We do not access your microphone, camera, photos, files, or the contents of your notifications.
• We do not use your data to train machine learning models.

6. Third-party services

The apps rely on services from Apple and Google, and the Android verification service is hosted on Microsoft Azure. Their handling of data is governed by their own policies.

Our verification service runs in the United States. If you are outside the United States and use the Android app, purchase verification data is transferred there for processing. The iPhone app sends us nothing, so there is nothing of yours for us to transfer.

7. How long data is kept

• Location and speed: not retained. Each reading is used and discarded.
• Settings, profiles and (on Android) media session details: kept on your device until you change them, clear the app's data, or delete the app.
• Cached subscription state: kept on your device and overwritten by each check; see section 10 for what deleting the app does to it on each platform.
• Purchase verification records (Android): retained by our service for as long as needed to verify your entitlement and to keep a record of the transaction, including for tax, accounting and fraud-prevention purposes. The iPhone app creates no such records with us; Apple keeps its own transaction records under its policy.
• Crash reports: retained by Firebase Crashlytics according to Google's retention schedule, which is up to 90 days for detailed reports.
• Analytics events: retained by Google Analytics at event level for up to 14 months, its longest available setting; the aggregate reports built from them contain no per-install data.

8. Security

On iPhone, the cached subscription state is stored in the iOS Keychain, marked as accessible only after the phone has been unlocked once since boot and as belonging to this device only, so it is never migrated to another phone. The app has no server of its own to talk to; its only outbound traffic is Apple's StoreKit talking to the App Store, the analytics events to Google, and, when a crash occurs, the Crashlytics report, all over HTTPS.

On Android, purchase, entitlement and install-referrer values are stored using Android's encrypted preferences, with the encryption key held in the Android keystore rather than in the app's own files — backed by dedicated hardware on devices that provide it. All communication with our verification service uses HTTPS.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify affected users and the relevant authorities where the law requires it.

9. Backups

On iPhone, your settings and profiles are part of your phone's normal iCloud or computer backup, held in your own Apple Account under Apple's terms and not accessible to us. The cached subscription state is marked device-only and does not move to a new phone; on a new phone the app simply asks the App Store again (Restore Purchases). You control backups in iOS Settings.

On Android, the app participates in Android's standard backup and device-transfer system, so your settings and profiles can be restored when you set up a new device. That backup is held in your own Google account, under Google's terms, and is not accessible to us. You can turn it off in your device's backup settings.

10. Your choices and rights

• Stop location processing: stop compensation in the app, or revoke location access — in iOS Settings under Privacy & Security › Location Services, or in Android Settings.
• Turn off the now-playing display: switch the card off in the app's Settings; or revoke Media & Apple Music access in iOS Settings, or notification access in Android Settings.
• Turn off the Lock Screen card: on iPhone, switch off "Allow Notification" in the app or Live Activities for Speed Comp in iOS Settings; on Android, revoke the notification permission.
• Delete everything held on your device: on iPhone, delete the app — this removes your settings and profiles. iOS keeps Keychain items when an app is deleted, so the cached subscription flags (two yes/no values, a product identifier and a timestamp, none of which identify you) can outlive the app until a reinstall overwrites them or the phone is erased. On Android, clear the app's storage in Android Settings, or uninstall the app; this removes your settings, profiles and cached entitlement.
• Manage or cancel your subscription: on iPhone, in iOS Settings under your Apple Account › Subscriptions, or from the Manage Subscription link in the app; refunds are requested from Apple at reportaproblem.apple.com under Apple's refund policy. On Android, in your Google Play account under Subscriptions; refunds are handled by Google under Play's refund policy.
• Crash reporting: we will be straight with you — there is currently no switch to turn this off, in either app or anywhere else. What limits it is what the reports contain: no location, no media, no purchase token, as set out in section 3. Deleting the app stops them entirely. If a toggle matters to you, say so and we will weigh it.
• Access, correct or delete server-side records: email [email protected]. This applies to the Android app's purchase verification records; because there is no account, please include the Google Play order ID from your purchase receipt so we can locate the record. We may need to retain transaction records where the law requires it. The iPhone app creates no server-side records with us, so there is nothing for us to look up; your transaction history is held by Apple.

We respond to requests within 30 days, and we will not treat you differently for making one.

11. Regional rights (EEA, UK, California)

If you are in the EEA or the UK, our legal bases under the GDPR are: performance of a contract for processing purchase and subscription data on Android, since it is necessary to provide the subscription you bought; consent for location and media access, which you grant through the iOS or Android permission prompts and can withdraw at any time; and legitimate interests for crash reporting and, on Android, install attribution, in keeping the app working and understanding where installs come from. On this website, analytics and advertising cookies are set only with your consent, given on the cookie bar and withdrawable at any time from "Cookie settings" in the footer. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority.

If you are in California, the apps do not sell or share personal information as those terms are defined by the CCPA/CPRA, and have not done so in the preceding twelve months. On this website, if you accept advertising cookies, information about your visit is disclosed to Google to measure whether an ad led to it, which may count as "sharing" under the CPRA; you can decline or withdraw that at any time with "Cookie settings" in the footer, and we honour the Global Privacy Control signal as an opt-out. We do not knowingly sell or share the personal information of anyone under 16. You may request access to or deletion of your personal information using the contact details below.

12. Children

Speed Comp is intended for people operating a boat, motorcycle, ATV, golf cart or similar vehicle, and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. This website

speedcomp.app is a set of static pages hosted on GitHub Pages. It has no login and no contact form. Web fonts are loaded from Google Fonts, which means your browser makes a request to Google's servers; the store badges link to Apple's and Google's sites, which have their own policies. GitHub, as the host, keeps standard server logs, including IP addresses, for security and operational purposes under the GitHub Privacy Statement.

Analytics and advertising measurement, with your consent

We use Google Analytics 4 to count visits, see which pages are read and which store badge is tapped, and Google Ads to learn whether a visit came from one of our advertisements. Neither sets or reads anything on your device until you choose: the first time you visit, a bar at the bottom of the page offers Accept all, Reject all and Manage choices with the same prominence, and the site works the same whichever you pick. Change your mind at any time with "Cookie settings" in the footer. We ask again after six months.

Before you choose, and if you reject, the Google tag runs in Google's Consent Mode with every storage type denied. In that state it sets no cookies and reads none. It does send Google a cookieless signal that a page was viewed, with the page address, the consent state and a random number that is not kept between pages — along with what any web request carries, such as your IP address and browser type — from which Google estimates aggregate figures without identifying you. If you would rather that signal were not sent either, a content blocker that blocks googletagmanager.com stops it entirely and the site is unaffected.

If you accept analytics, Google Analytics sets the cookies in the table below and records these events under a random client identifier: a page being viewed, a page being scrolled to the bottom, a tap on the App Store or Google Play badge, a tap on the Discord or email link, a question being opened on an FAQ page, which sections of a page came into view, and the cookie choice itself. Each event carries the type of page and, on the vehicle pages, which vehicle the page is about. Nothing you type is collected, because there is nowhere to type anything. Google Analytics 4 does not log or store IP addresses; it derives a coarse location from the address and discards it.

If you accept advertising, Google Ads may set its cookies so that a tap on a store badge can be attributed to an ad you clicked. We use this to measure the advertising, not to show you ads elsewhere and not to build a profile of you. If your browser sends a Global Privacy Control signal, advertising storage stays off whatever you tap, and we treat the signal as an opt-out of any sale or sharing of your information.

When you tap the Google Play badge, the link carries a note of which page and which campaign you came from — and a Google click identifier if you arrived from a Google ad. Google Play passes that note to the Android app when it is installed, and the app forwards it with purchase verification as described in section 3. It contains no personal information. The App Store link carries nothing of the kind.

No data from the apps is ever joined to data from this website; the apps' analytics run under a separate, random app-instance identifier and know nothing about your browser.

What this site stores

Rejecting, or withdrawing consent later, deletes the Google cookies this site can reach. Google's own handling of the data is described in How Google uses information from sites that use its services.

14. Changes to this policy

We will update this page when either app's or this website's data handling changes, and we will move the "last updated" date at the top. If a change materially affects how your information is handled, we will give notice in the app before it takes effect.

15. Contact us

Questions, privacy requests, or anything in this policy that does not match what you are seeing in the app:
[email protected]