Effective date: 2026-10-04 Document version: 1.8 Controller: DriveBy - support@driveby.dev
This Privacy Policy explains what data the DriveBy Android application ("App") processes, why, and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR").
DriveBy is a personal profit calculator for couriers working with food-delivery platforms. The App is not affiliated with, endorsed by, or connected to Glovo, Uber Eats, Bolt Food, Wolt, DoorDash, Deliveroo, Stuart, or any other delivery platform.
DriveBy is designed around the principle of data minimisation. We do not collect, store, transmit, or sell:
The App contains no network calls to any delivery platform's API.
The App stores the following on your phone (and never transmits it to any server):
This data lives in the App's private storage (Room database). The App itself never sends it to our servers; we have no access to it.
Backup to your own Google account (Android Auto Backup). If you have Android's "Back up to Google" feature enabled (Settings → Google → Backup), Android automatically includes the above on-device data - your vehicle profiles, calculation history and app preferences - in your own Google account backup, so you can recover it after reinstalling the App or setting up a new phone. This backup belongs to you and is governed by Google's terms; we never see, receive or store it. Screen content from delivery apps is never backed up - it is never written to disk in the first place. Subscription/billing state and per-device settings are excluded from the backup. You can turn this off at any time in your Android backup settings (or disable backup for DriveBy specifically). Uninstalling the App deletes the on-device copy.
Manual backup to a file you control. From Settings you can also export a full backup of your on-device data (vehicle profiles, calculation history, work sessions and your tax/fee settings) to a single JSON file that you save wherever you choose through the Android system file picker (your own storage, Google Drive, etc.), and import it back later or on another phone. This file is created by you, stays entirely under your control, and is never sent to us. As with the automatic backup, it contains no screen content and no individual order data from delivery apps - that is never stored in the first place.
This telemetry is off by default. We collect it only if you opt in - through the one-time prompt in the App or the checkbox on the sign-in screen, which is never pre-ticked; until then nothing is sent. You can withdraw consent any time in Settings (see 3.7).
When telemetry is enabled, after the App detects an order on screen and calculates a result it sends a small bucketed event to Firebase Analytics:
glovo, wolt)3-5km) - never the exact value4-5eur) - never the exact valueBucketing is deliberate: we measure platform-level distributions and parser accuracy without ever observing the financial details of any individual courier or order. This data is pseudonymised (tied to a random Firebase installation identifier, not to your identity), not fully anonymous - so we treat it as personal data and process it on the basis of your consent.
Also off by default and covered by the same consent as the telemetry above (3.2, 3.7). When enabled and the App crashes, Firebase Crashlytics records the stack trace, Android version, device model, a random installation identifier, and the App's build type. This helps us fix bugs that affect your earnings during a shift.
Your trial and subscription are sold and managed by our Reseller acting as Merchant of Record (see Sub-processors). Our licence server confirms only an entitlement signal (active trial / active subscription / inactive) tied to your purchase e-mail - no payment details whatsoever (card number, billing address, etc.) pass through the App or our servers; those are held by the Reseller.
Because DriveBy is not distributed through an app store, we verify your subscription by e-mail instead of a store account:
The one-time codes (and any waitlist notifications) are sent through our e-mail provider, and the entitlement check runs on our licence server; both are listed under Sub-processors. On our servers we store at most your e-mail address, current entitlement status (active / inactive) and the list of devices signed in to your subscription: for each, a random per-installation identifier (not a hardware serial) and the dates of its first and last licence check. The list exists only to enforce a reasonable limit (a subscription may be used on up to three devices) and to stop one purchase being shared across many phones. A device unused for 60 days is removed from it automatically, and when you sign in on a new phone with the limit reached you can sign out the device that was used longest ago yourself. We never store the financial details of any order.
To protect sign-in against abuse we briefly keep (from a few minutes to 24 hours) attempt counters and one-time codes. They are stored under a cryptographic hash of the e-mail or IP address, never the address itself, and delete themselves automatically.
Because DriveBy is installed from our website rather than an app store, the App checks https://driveby.dev every few hours for a small version manifest. When a newer version is available, the App downloads it in the background (over Wi-Fi, unless the update is required for the App to keep working), using your sign-in token to prove you are entitled to it, and verifies the file before offering it: its SHA-256 checksum and that it is signed with the same key as the installed App. Installing it needs your confirmation; only on devices where Android lets an app update itself without a prompt may the update be applied automatically, while the phone is idle. Like any request to a website, these requests involve your device's IP address and are handled by our hosting provider (Cloudflare, see Sub-processors); we do not use them to build a profile of you or link them to your identity.
Early access and staged releases. If you switch on "Early access" in Settings, the App is offered new versions before they are released to everyone. New versions may also reach users gradually; whether this device is offered one early is decided locally from a random identifier that is stored only on the device and never sent to us.
Technical diagnostics and crash reporting (3.2-3.3) are opt-in: the App asks for your consent with an explicit choice ("I agree" / "Not now"), and you can also give it by ticking the checkbox on the sign-in screen, which is never pre-ticked. Collection stays fully off unless you agree in one of these ways; leaving the checkbox unticked is not a refusal, so the App may still ask you once, later. You can withdraw consent at any time with the toggle in Settings → "Diagnostics and statistics"; withdrawal is as easy as giving consent and immediately disables both mechanisms (GDPR Art. 7(3)). We never make use of the App conditional on this consent - declining blocks nothing.
The website does not use advertising or tracking cookies, so it shows no cookie banner. In your own browser it stores only what the features you use need:
These never leave your browser and are strictly necessary for the features you ask for, so they need no consent (ePrivacy Directive, Art. 5(3)). For visit statistics we use Cloudflare Web Analytics, which sets no cookies and stores nothing on your device; it gives us aggregate figures only (for example page views, country, browser type). As our hosting provider, Cloudflare may also process your IP address and set a strictly necessary security cookie to protect the site from automated abuse. If we ever add marketing tools to the website (for example advertising pixels), we will ask for your consent first.
| Purpose | Legal basis (GDPR) |
|---|---|
| Calculating profit on your device | Performance of the service you requested (Art. 6(1)(b)) |
| Verifying entitlement and sending your sign-in code (your email) | Performance of the service you requested (Art. 6(1)(b)) |
| Waitlist, beta invitation and sign-up notification (your e-mail, approximate location) | Steps taken at your request before entering into a contract (Art. 6(1)(b)); you can unsubscribe at any time |
| Bucketed diagnostic telemetry | Your consent (Art. 6(1)(a)) - off by default, opt-in, withdrawable at any time |
| Crash diagnostics | Your consent (Art. 6(1)(a)) - off by default, opt-in, withdrawable at any time |
| Downloading and verifying app updates | Performance of the service you requested (Art. 6(1)(b)) |
| Aggregate website visit statistics (no cookies) | Our legitimate interest in knowing which content is useful (Art. 6(1)(f)) |
We collect telemetry and crash diagnostics only after you have given consent and only within the scope of that consent; withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We do not engage in profiling under Art. 22 GDPR, and we do not make automated decisions that produce legal effects concerning you.
We use the following processors. Each is bound by a data-processing agreement and, for any transfer outside the EU/EEA, the Standard Contractual Clauses. We remain the Controller.
europe-west1 region (Frankfurt, Germany; Remote Config is a one-way pull of parsing patterns, not telemetry). Google also provides Android Auto Backup to your own Google account (see 3.1). Governed by the Google Cloud EU Data Processing Addendum.We do not sell your data or use it for advertising.
You have the right to:
To exercise these rights, e-mail: support@driveby.dev. We respond within 30 days as required by GDPR.
DriveBy is intended for couriers, who must be at least 18 years old in most jurisdictions to work for a delivery platform. We do not knowingly collect any data from anyone under 18.
We may update this Privacy Policy as the App evolves. The current version is always linked from the App's "About" screen and at:
https://driveby.dev/legal/privacy-policy
Material changes will be announced in-app at least 14 days before they take effect.
DriveBy (Controller) e-mail: support@driveby.dev Country of registration: Poland (EU)
Polish version: Polityka prywatności (PL). In case of any conflict, the English version prevails for legal purposes; the Polish translation is provided for the convenience of Polish-speaking users - except where Polish mandatory consumer-protection law requires otherwise.