Privacy policy

Effective October 13, 2026
Route Control, operated by Recovery Agent Support
Contact: support@routecontrol.app

What this policy covers

This policy covers the Route Control website, Lead Collector browser extension, and Route Control mobile apps for iOS and Android, including test builds. Features and notification availability can differ by platform and build. Clearplan, Target Density Map (TDM), and Recovery Manager Pro are independent services with their own policies. You must have authorized access to the information you collect from those services.

Information we handle

• Accounts: name, email address, business membership, role, invitations, and authentication information needed to sign in and control access.
• Leads and routes: available vehicle year, make, model, license plate, VIN suffix, address or coordinates, source identifiers, job names, assigned routes, stop results, notes, and related timestamps.
• Extension storage: your connected business and account information, an authentication token, draft selections, queued submissions, and recent activity. This is stored in your browser profile.
• Technical and support information: IP addresses and request metadata processed by hosting services, operational logs, and information you choose to include when contacting support.

The extension reads supported vehicle-detail views to display collection controls. You choose which leads to add and submit. It does not request general browsing-history, microphone, camera, or device-geolocation permissions. Vehicle coordinates come from lead information; the extension does not continuously track your device.

Mobile apps: device storage, maps and notifications

Sign-in and offline use. The native apps keep sign-in tokens in the operating system's secure storage. Account details, downloaded routes, vehicle details, notes, pending stop results and notification bindings are kept in app-local storage so you can use downloaded routes during connection loss. Offline route caches are separate from secure credential storage. Route acceptance, stop results, notes, shift clock-in and clock-out status and related timestamps are sent to your business. Pending updates sync when the app is open and connected. Do not clear app data or uninstall while results are waiting to sync. Successful sign-out clears the app's account-scoped offline cache and session and attempts to unregister this installation's route alerts. Sign-out is blocked while updates remain pending.

Location and navigation. The current mobile apps use addresses and coordinates supplied with assigned stops. On builds with assignment history enabled, and after you enable recording and grant permission, Route Control periodically records device GPS coordinates, capture timestamps and accuracy while you are clocked in with an accepted assignment, including in the background. Recording stops when you clock out, have no remaining accepted stops, sign out, switch business, or turn recording off. After 24 hours on the same shift, the app reminds the driver to confirm they are still working or clock out. Shift age alone does not stop recording during an active accepted assignment. Offline samples are saved on your phone and sent when connectivity and operating-system background execution allow, or when you reopen the app. After you enable the updated location-sharing disclosure, authorized business administrators and dispatchers may see your latest uploaded location during active assignments and stationary observations lasting 30 minutes or longer. Positions include capture timestamps and may be delayed; this is not continuous real-time tracking. Completed journeys are also available for review. Samples are retained for up to 90 days; expired local copies are removed when the app next runs. Removing location permission or closing the app can create gaps. Device readings are not proof of presence. Camera access is optional and requested only when you choose Add photo for a located unit. Captured unit photos are saved on your device while awaiting upload and stored privately with the stop record for authorized members of your business to review. Photos remain with the assignment record until removed through business data deletion. The apps do not request microphone, contacts or photo-library access for this feature. Embedded maps send map requests involving stop locations to Google Maps. Choosing Navigate passes the destination address or coordinates to Google Maps in an external app or browser. That service may request your location under its own permissions and privacy policy; Route Control does not receive that navigation location.

Optional route alerts. On builds with notifications configured, enabling route alerts requests your device's notification permission and registers an Expo push token linked to your Route Control user and business. Delivery uses Expo, Apple Push Notification service (iOS), and Firebase Cloud Messaging (Android). These services process device/app delivery identifiers and notification payloads. Our assignment alerts contain a generic assignment message and business, route and event identifiers used to open the assignment; they do not include vehicle plates, stop addresses or notes in the notification payload. Your operating system may display alerts on the lock screen. Turn alerts off in the app or device settings and control lock-screen previews through your device settings. Offline saving does not require notification permission.

Device copies and deletion. Signing out or uninstalling does not delete records already submitted to your business. App-local data and operating-system backup or credential copies can be handled differently by iOS and Android; we do not promise that uninstalling erases every device or backup copy. Request account or server-record deletion through the contact below. The current mobile apps do not include advertising or behavioral-analytics features.

How we use information

We use information for account setup and recovery, lead collection, saving drafts, submitting jobs, planning and dispatching routes, recording stop results, showing recent submissions, and related support and security. Queued transfers can retry after submission. The extension checks version information to show update notices. If you enable web route alerts, we store a push subscription and send assigned-route notifications through your browser's push service.

We do not sell user data, use it for personalized advertising, transfer it to data brokers, or use it to determine creditworthiness or make lending decisions. Extension data is used only for the collection, dispatch, and related operations described here. Our use and transfer of extension user data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Who receives information

Submitted leads go to the Route Control business you selected. Authorized users of that business can access records according to their roles; drivers receive their assigned routes. Business administrators control membership and dispatch. Check the selected business before sending a job.

Service providers process information to operate the service:

• Vercel: website and API hosting, requests, and operational logs.
• Supabase: authentication and database storage.
• Google Maps Platform: map display, address lookup, and routing requests involving locations.
• Resend: recipients and message contents for invitations and password-recovery emails.
• HostGator: email correspondence sent to our support mailbox.
• Expo, Apple and Google/Firebase: mobile push-token registration and notification delivery through Expo Push Service, Apple Push Notification service and Firebase Cloud Messaging when enabled in the installed build. Firebase is used for Android notification delivery, not as Route Control's account or business-record database.
• Browser push providers: delivery of notifications when you enable web route alerts.

Information may be processed in the United States and other locations where these providers operate. We may disclose information when required by law. Source websites remain responsible for their own data handling; installing Route Control does not grant access to their accounts.

Storage and deletion

Draft selections and pending transfers remain in your browser until removed or processed. Recent-activity indicators use a 12-hour window and older entries are pruned during normal processing. That window does not delete submitted jobs or route history from the server.

Submitted business records are retained to provide workspace and route-history functions until removed through supported controls or a verified deletion request. Closing a business currently disables access but does not automatically erase its stored records. Contact support@routecontrol.app to request deletion. Automated deletion 30 days after closure is not currently active.

Operational logs follow the relevant provider's retention settings. This policy does not promise a fixed deletion deadline for logs or backup copies. Exports, offline copies, and data held by other authorized recipients are separate from server records. Removing a draft, signing out, or uninstalling the extension does not erase jobs already submitted. Uninstalling removes the extension's local browser storage.

Your choices and requests

You can remove draft selections, disconnect the collector, revoke its site permissions, uninstall it, or disable route alerts. Some features need the corresponding permissions to work. Contact your business administrator about workspace access and records. To request deletion of your Route Control account and associated personal data, or to make a privacy, access or correction request, email support@routecontrol.app. We may need to verify your identity and authority before acting. Some business records may involve other users or records the business is entitled or required to retain; we will explain applicable limits when responding. Rights and applicable exceptions depend on your location.

Security

We use HTTPS and access controls to restrict business data. No system is completely secure. Protect your account and browser profile, and do not share passwords or private invitation and recovery links.

Policy updates

We publish the current policy at app.routecontrol.app/privacy and update its effective date when it changes.