Privacy Policy

Last updated: 2 October 2026

Introduction

Cargoway is a route planner for heavy goods vehicles. This policy explains what data we handle, where it is stored, and who else sees it. It is written to be read, not to be skimmed past.

Who is responsible

The controller of your data is Mario Cruz Ávila, who provides Cargoway. His full identification details are in the legal notice. For anything about your data: info@cargoway.app.

Your account

You can install Cargoway, set up your vehicle and search for addresses without an account. Calculating a route requires signing in with Google or Apple. We do this so the daily route allowance means something: an anonymous session can be reset by clearing the app data, and with it any limit tied to it.

  • Account identifier — A unique identifier issued by Firebase Authentication, which is how your data is linked to you.
  • Sign-in details — The email address and display name your Google or Apple account provides. We never see or store your password.
  • Signing in on the web — If you subscribe at cargoway.app you sign in with Google or Apple through Firebase Authentication, and it is the same Cargoway account as in the app. That page loads Firebase from Google’s servers to do it.

What we handle

To plan a route we handle the following:

  • Location — Your current position, only if you grant permission: to set the origin or search nearby while you are using the app and, once you tap Start trip, to keep the map following the truck until you tap End trip or leave the screen. On iPhone this only happens while the app is open. On Android it continues with the app in the background, and a persistent notification is shown the whole time.
  • Route information — Origin, destination and intermediate stops you enter.
  • Vehicle specifications — Height, width, length, weight, axle load and whether you carry dangerous goods (ADR). These determine which roads you can legally use.
  • Route history — The trips you have calculated, so you can repeat them.
  • Preferences — Language, units, theme and whether to avoid tolls or ferries.
  • Daily usage counters — How many routes and route analyses you have used today, to apply the free allowance.
  • Vehicle photos — If you add a photo of your vehicle, it stays on your device. It is never uploaded.
  • Documents — Only if you use the Documents section, and only with a Google or Apple account: the type of each document (driving licence, driver CPC card, roadworthiness test…), its expiry date, your notes and the photos you add. They are stored in your account in Google Cloud Firestore and Cloud Storage, in the European Union, so they follow you to a new phone, and the photos you open are also kept on your device so you can show them without signal. Expiry reminders are calculated and scheduled on your phone. Nobody looks at them, and they are never used for advertising or analytics.
  • Transport documents (DeCA, CMR and each country's document) — Only if you issue or save them, and only with a Google or Apple account: the details of each transport (sender, consignee and carrier with their name, tax ID and address; places, goods, weight, date and number plates), the signatures drawn on screen, the delivery, the codes others give you (AT, SENT, UIT) and the loading and unloading times with the phone's location at that moment, plus the PDF and the photos of documents you receive. They are stored in Google Cloud Firestore and Cloud Storage, in the European Union, and the PDFs also on your device. The PDF can be downloaded, without signing in, by anyone who has its link or scans its QR code, because the law requires inspectors and your customer to be able to do so; the link is random and cannot be guessed. Your customers and carriers are also kept in your address book, which you can edit or delete. When you type an EU VAT number, it is sent to the European Commission's VIES service to check it and fill in the official name and address. We process your customers' details on your behalf, only for this. Each document is kept for 13 months and then deleted; deleting your account deletes everything at once.
  • Subscription — If you buy Cargoway Pro, the store’s transaction identifier and its expiry date, so Pro is unlocked on every device where you sign in. We never see your card or payment details.
  • Web subscription — If you subscribe at cargoway.app: the identifiers of your Stripe customer and subscription, its expiry date, and the date and language in which you asked for it to start immediately, which affects the right of withdrawal. We never see your card details.

Why we process it

Each use of your data has a legal basis:

  • Your account, vehicles, routes, history, route analysis and subscription — to provide the service you ask for (performance of the contract).
  • Location and push notifications — your consent, which you give by granting the permission and can withdraw in your phone settings.
  • Personalised advertising — your consent, asked through Google’s consent platform.
  • Anonymous analytics, crash reports, performance and preventing abuse of the free plan — our legitimate interest in keeping the app working and not being misused.
  • Invoices and payment records from the web — a legal obligation under tax and commercial law.

Where it is stored

Your vehicles, route history and preferences are stored on your device and also backed up to your account in Google Cloud Firestore, so they follow you if you change phone. Calculated routes are cached under your account for up to 30 days, so repeating a familiar trip does not recalculate it. Everything is stored in the European Union.

Who else sees it

Cargoway relies on the following services. Each receives only what it needs:

  • OpenRouteService (HeiGIT, Germany) — Receives your origin, destination, stops and vehicle dimensions to compute the route. Requests are relayed through our own server.
  • Photon (Komoot, Germany) — Receives what you type in the address fields, to suggest places.
  • Anthropic (Claude) — Only if you open the route analysis. It receives the route summary, its steps and your vehicle dimensions, and returns an explanation. It is not used to train models.
  • Google Maps (Google) — Draws the map on the route preview. Google receives the map requests for the area on screen.
  • Google Maps or Apple Maps — Only when you choose to open the route in one of them. The coordinates go to the app you pick.
  • Firebase (Google) — Authentication, database, anonymous analytics, crash reports, performance and push notifications.
  • Google AdMob — Advertising in the free tier. See the section below.
  • Apple App Store and Google Play — Process the payment if you subscribe to Pro, and tell our server whether the subscription is active.
  • Stripe (Stripe Payments Europe, Ireland) — Only if you subscribe on the web. It processes the payment and receives your email, name, billing address, card details and, if you give it, your VAT number; it calculates the VAT and tells our server whether the subscription is active. It acts on our behalf to charge you and, for fraud prevention and its own legal obligations, as an independent controller.

Transfers outside the EU

Some of the providers listed above, such as Google, Anthropic or Apple, may process data in the United States or other countries outside the European Economic Area. They do so under the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

Advertising and consent

The free plan shows ads. If you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before any ad is requested, through Google’s consent platform. You can change your choice at any time in My profile → Privacy → Ad options. On iOS we also ask, separately, whether you allow tracking; declining means you still see ads, just less relevant ones. Cargoway Pro has no ads.

Keeping and deleting your data

Cached routes are deleted automatically after 30 days and usage counters after three days. Everything else is kept while your account exists. You can delete your account from the app, in My profile → Account options → Delete my account: this erases your account, your vehicles, your history, your documents and their photos, and your cached routes, on our servers and on your device, and it cannot be undone. If you signed in with Apple, we also revoke Cargoway’s access to your Apple ID.

If you subscribed on the web, the payment records and invoices are kept by Stripe and by us for six years, as Spanish commercial law requires, even after you delete your account. Deleting your account cancels the web subscription.

Your rights

If you are in the European Union you may access, correct, export or erase your data, object to its processing, or lodge a complaint with your data protection authority. Deleting your account from the app covers erasure immediately; for anything else, write to us.

Children

Cargoway is a professional tool for goods transport and is not directed at anyone under 18. We do not knowingly collect data from minors.

Changes to this policy

If we change how we handle your data we will update this page and its date. Substantial changes will also be announced inside the app.

Contact

Questions about this policy, or about your data: info@cargoway.app