Privacy Policy

Last updated: October 15, 2026  ·  Version 2026-10-15  ·  Data controller: TruckerProfit Inc. (Delaware, USA)  ·  Versión en español

1. Who we are and what this covers

Iron Route GPS ("Iron Route", "the app") is made and operated by TruckerProfit Inc., a Delaware corporation, which is the controller of the personal data described here. This policy covers the Iron Route app for iPhone, iPad and Android, the web app at ironroutegps.com/app, and the website ironroutegps.com.

It is written for drivers, not lawyers. Where something is a legal obligation, we say so.

2. What we collect, and why

2.1 Navigation

To navigate, the app reads your phone's precise location (GPS) while you use it. Your position is used on the device to follow the route. To calculate a route, search an address or show what is ahead, the app sends coordinates (origin, destination, the route line or the map area on screen) together with your truck profile to the providers in Section 6, through our server or, for map images, directly from your device. No name, email or account ID goes with those requests. We do not store your navigation positions on our server.

The location permission is asked by your operating system ("While Using the App" is enough) and you can change it at any time in your phone's Settings or your browser's site settings. Without it the app cannot navigate.

2.2 Live tracking for fleets (only if you turn it on)

Live tracking is off by default and needs an account. It exists so the fleet you drive for can see where its truck is. You join a fleet with the invitation code its owner gives you; the app then shows what will be shared and with whom, and sharing starts only when you tap “Accept and share”. While sharing is on, the app sends to our server, as often as every 15 seconds while you are moving and less often while you are stopped:

• your precise position (latitude and longitude), speed, heading and GPS accuracy;
• your status (for example on route, loading, available).

Who sees it: only the owner of each fleet you share with, on that fleet’s board: the name you entered when you joined, your status and your latest position with how old it is. No shipper, broker or member of the public sees it, and there are no public tracking links. Our server checks who is asking before it sends anything.

How long: our server keeps only your latest position, not a history of where you drove. It is deleted about 24 hours after the last update, and at once when you stop sharing with every fleet. If you lose signal, the phone holds the positions for up to a day and sends them when coverage returns; only the newest one is kept. We keep a log of when you joined or left a fleet and turned sharing on or off — without positions — for 90 days.

How to turn it off: switch it off at any time from the app's menu (Live tracking). Revoking the location permission also stops it. While it runs with the app in the background, Android shows a permanent notification and iPhone shows the location indicator in the status bar.

2.3 Community reports (the shared map)

You can report what you see on the road — police, an accident, a closed lane, a low bridge, a weight limit, a truck entrance, a weigh station. A report contains only: the type, chosen from a fixed list; the place where you reported it (your position at that moment, or the point you marked); the time; and, for a low bridge or a weight limit, the number on the sign. Reports carry no free text, and no name, email or account. Other drivers see them on the map until they expire (hours for traffic alerts, months for permanent restrictions) or until drivers vote them off with "Gone" or "Report this alert".

To stop someone from flooding the map, we store a salted hash of the IP address of whoever reported or voted — never the IP address itself. A report is deleted 30 days after it stops being shown, together with those hashes.

If you drive under a load link from your dispatcher, the app can also send a restriction report with a short note to your dispatcher (your company), not to the shared map.

2.3b Reporting a route (only if you send it)

With "Something wrong with this route? Report it" you can tell us a route was too long, sent you where a truck cannot go, that the voice was wrong or something else from a fixed list, with an optional short note. It is only sent if you tap "Send the report", and the sheet tells you first what it carries: from where to where, approximately (rounded to ~1 km), the path of that route without its first and last half kilometer, the truck measurements (height, width, length, weight, axles, trailers, hazmat), the app version, the language and, if there was one, the comparison with the second map (section 2.7). Never the plate or the transponder, nor your name or email; from your account we only note whether one was signed in, not which. It is not published on any map: only the Iron Route team reads it, to fix routes. It is kept for one year.

2.4 Your account (optional)

The app works without an account. If you create one, we keep:

• Email address — to sign in and for service messages. With email sign-in we send you a 6-digit code and a link; we store only a keyed hash of them, and they are deleted when used or after 15 minutes.
• Sign in with Apple — Apple gives us a stable user ID and the email you choose to share (it can be a private relay address). We do not receive your Apple password. So that we can revoke Iron Route's access when you delete your account, we may keep an Apple sign-in token, encrypted.
• Sign in with Google — Google confirms your email address and a Google user ID. We check that Google has verified the email. We do not receive your Google password and request no access to Gmail, Drive, contacts or calendar.
• Password — only if you create one, stored as a bcrypt hash, never in plain text.
• Name and truck profile, if you choose to save them to your account, and your plan (free or Pro).
• Security records — counters of sign-in attempts per email and per IP address, stored as keyed hashes for at most one hour, to block password and code guessing.

Your session is a signed token kept in your phone's secure storage (Keychain or Keystore) or, on the web, in a secure cookie.

2.5 Purchases

Iron Route Pro is sold through the Apple App Store, Google Play and, on the web, Stripe. The store or Stripe handles the payment; we never see your card number. To turn Pro on for your account and keep it in step with renewals, cancellations and refunds, we receive and keep the purchase record from the store or Stripe: product, transaction ID, purchase environment, status and expiry date, linked to your account (and, for Stripe, the Stripe customer ID).

2.6 Voice dictation

Only when you tap the microphone, your phone's own speech recognition service converts what you say into text: Apple on iPhone and iPad, Google on Android, or your browser's on the web. Depending on your device and settings, that service may process the audio on the device or on Apple's or Google's servers, under their privacy policies. We receive only the resulting text, which is used as a search; no audio reaches our servers. Spoken turn-by-turn directions are generated on your device.

2.7 The web app (ironroutegps.com/app)

• Search history and saved trips — if you are signed in, the places you search (name, coordinates, type, whether you starred them; the last 200) and the trips you save (origin, destination, route line, distance, times and truck profile) are stored with your account so you can return to them. Trips saved without signing in are stored without your name or email.
• Device information — only if you choose Allow measurement in the cookie notice: browser and platform, language, screen size, touch support and connection type (linked to your account if you are signed in). Kept up to 12 months.
• Usage analytics (first-party) — only if you choose Allow measurement (or turn on Settings › Data & maintenance › “Anonymous usage statistics”, which is the same choice): which screens and features are used, the version, language, operating system, country (from the IP address), the referring site, campaign tags and the role you picked in the welcome (driver, fleet owner…). To know whether someone comes back, this browser keeps a random install number that is not your account or your name; clearing the browser's data deletes it, and on our server it is stored hashed. Never your location or what you search for. Measured on our own server, not by Google Analytics or any third party. The IP address is removed after 30 days and the records are deleted after one year.
• Error reports — when the web app or the phone app fails, it sends the error message, the file and line, the app version, the browser family or the operating system. These reports carry no identifier, no location and no account. They are on by default and you can turn them off in Settings › Data & maintenance › “Send crash reports”; they are kept as monthly log files on our server.
• Comparison with a second map — when you calculate a truck route, we ask HERE (section 6) for its truck route for the same origin, destination and measurements, and check whether the two agree. We keep a summary with nobody's location and no identifier: the miles of each, whether they agree, the truck class (straight, trailer or 53′) and its height, and which bridges, crossings or parkways the two disagree on (with the position of the bridge or crossing, which is public infrastructure). It is used to find errors in the maps. It follows the same “Send crash reports” switch; the summary is deleted after 180 days.

The native apps for iPhone, iPad and Android send the error reports and second-map comparisons described above, the route reports you choose to send (section 2.3b) and, from version 2.6.16, anonymous usage statistics: which screens and features are used and for how long, the version, language, system, country, the role from the welcome and a random number for that install that is not your account or a device identifier (uninstalling the app deletes it; on our server it is stored hashed). We do not store the IP address from the app: it is used to know the country and discarded. Never your location, your routes, what you search for or your name. The statistics are on by default and you can turn them off in Settings › Data & maintenance › “Anonymous usage statistics”; when off, nothing is sent and anything waiting is discarded. They tell us what fails, what is used and what to improve.

2.8 Loads posted by brokers

Anyone with an account can post a load. A post contains what you enter — company name, equipment, origin and destination city and state, pickup and delivery dates, and, if you choose, weight, rate, miles, a description and a contact phone or email — and is linked to your account. Iron Route Pro users see it on the map near the origin city. Any user can report a post as spam, false or offensive, or block a broker; a post reported by three different accounts is hidden. Posts expire within 15 days and are deleted 30 days after they expire or are withdrawn, or when you delete your account.

2.9 What stays on your phone

Your fuel log, hours-of-service clock, IFTA miles by state, saved routes and places in the native app, offline map regions, your E-ZPass or transponder state and your license plate stay on your device. We do not receive them. You can export or erase them from the app (Settings → Data and maintenance), and they are removed when you uninstall the app.

2.10 What we do not collect

• No advertising identifiers (IDFA or Android advertising ID). Iron Route shows no ads.
• No contacts, photos, calendar, call logs or text messages. We do not send text messages and do not ask for your phone number; "Share by SMS" opens your phone's own messaging app and we never see the number.
• No tracking of you across other companies' apps and websites, as defined by Apple's App Tracking Transparency.

2.11 Records of your acceptance

Before you create an account or sign in, you tick three separate boxes — the Terms of Service, this Privacy Policy, and that you are 18 or older — and, when you subscribe, you see the auto-renewal terms next to the button. To be able to prove what you agreed to and when, we keep a record of each acceptance: the document and its version, a fingerprint (SHA-256) of the exact text published at that moment, the wording of the box in your language, the date and time, how you signed in (email code, Google, Apple or password), the type of device and the app version, your IP address and your browser or app identifier. For a subscription we also keep the renewal text you saw and the product.

These records cannot be edited. When you delete your account they are unlinked from it and only a fingerprint of your email address is kept with them (not the address itself), so that we can still answer a complaint or a regulator; they are deleted five years after that.

3. Cookies and local storage

• ir_session — keeps you signed in on the web (secure, HTTP-only, 30 days). Only set if you sign in. Strictly necessary.
• A security cookie set by our hosting provider's firewall to tell people apart from automated traffic. Strictly necessary.
• Your choices (language, settings, the answer to the cookie notice) are saved in your browser's local storage and do not leave your device.

There are no advertising, social-media or third-party analytics cookies. The only optional measurement is the first-party analytics and device information in Section 2.7, which run only after you choose Allow measurement. If your browser sends the Global Privacy Control signal, we treat it as "Only what is needed" and the optional measurement stays off. We never record sessions, keystrokes or screen replays. The full list is in our Cookie Policy. You can change your answer at any time with the "Cookie choices" link at the bottom of the home page.

4. How we use data, and the legal bases

• To provide the app — routing, search, tolls, weather, live tracking you turn on, the shared map, your account and Pro (performance of our contract with you).
• To keep it safe — rate limits, abuse prevention and fraud checks (legitimate interest).
• To improve it — aggregated usage counts on the web, only with your consent.
• To comply with the law — tax and accounting records of purchases, and valid legal requests (legal obligation).

We do not use your data to train AI models, and we do not make automated decisions that have legal effects on you.

5. Live tracking is shared with your fleet

When you turn on live tracking, your position goes only to the fleets you joined and chose to share with, in the way described in Section 2.2. The fleet owner uses it under their own relationship with you. If you do not want a fleet to see your position, turn sharing off or leave the fleet: navigation works the same without it.

6. Who we share data with

We share personal data only with the service providers below, only for the purpose stated, and only what each one needs. Every third party that receives personal data from Iron Route must provide the same or equal protection of that data as described in this policy.

We disclose data only when legally compelled by valid process. If TruckerProfit Inc. were merged or acquired, your data would move to the successor under this same policy, and we would tell you before any change.

7. How long we keep it

8. Deleting your account

9. Your rights

California (CCPA / CPRA) and other U.S. states

• Know and access — ask for a copy of what we hold about you. We answer within 45 days.
• Delete — see Section 8.
• Correct — have inaccurate information fixed.
• Opt out of sale or sharing — we do not sell or share personal information; write to us to confirm it.
• Non-discrimination — using these rights never changes your price or your service.

EU / UK (GDPR)

• Rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. We answer within 30 days, extendable to 60 for complex requests.
• You may complain to your national data protection authority.

To use any right, write to privacy@ironroutegps.com. We will confirm that you control the account email before acting, so nobody can get or delete your data by pretending to be you.

10. Security

All traffic uses HTTPS with HSTS, and the session cookie is always marked secure. Passwords are stored as bcrypt hashes; sign-in codes, links and reset tokens are stored only as keyed hashes; sessions can be revoked; sign-in attempts are rate-limited; and third-party API keys stay on our server and are never shipped in the app. If a breach affected your data, we would tell you within 72 hours where GDPR applies, and without unreasonable delay under U.S. state law. No system is perfectly secure, and we do not claim otherwise.

11. Children

Iron Route is a professional tool for adults who drive commercial vehicles. It is not directed to children, and you must be 18 or older to use it. We do not knowingly collect data from anyone under 18; signing up requires confirming you are 18 or older. If you believe a minor — in particular a child under 13 — has given us data, write to privacy@ironroutegps.com and we will delete it and close the account.

12. International transfers

Our servers are in the United States. If you use Iron Route from outside the U.S., your data is transferred to and processed in the U.S. Where GDPR applies, those transfers rely on the European Commission's Standard Contractual Clauses.

13. Changes to this policy

If we make a material change, we will tell you in the app and, if you have an account, by email before it takes effect. The date at the top is the date of the current version.

14. Contact

• Privacy questions and data requests: privacy@ironroutegps.com
• Account deletion without the app: ironroutegps.com/delete-account.html
• Support: ironroutegps.com/support.html · support@ironroutegps.com
• Postal: TruckerProfit Inc., 2028 Madison Ave, New York, NY (registered office)