Veloce Track Privacy Policy
Effective date: 9 October 2026
Last updated: 9 October 2026
This Privacy Policy explains how Ranga Rathnayake ("we", "us", "our"), the developer of Veloce Track, collects, uses, shares and protects information when you use the Veloce Track mobile app for iOS and Android, the Veloce Track web app, and the related backend services (together, the "Service").
Veloce Track helps you manage your vehicles: record fuel and other expenses, follow maintenance, and see the live location and trip history of vehicles fitted with a GPS tracking device that you link to your account.
If you do not agree with this Privacy Policy, please do not use the Service.
1. Summary
- We do not use your phone's location. The app does not ask for location permission. Vehicle locations come from the GPS tracking device installed in your vehicle that you link to your account.
- We collect only what the Service needs: your account details, the vehicle information and expenses you enter, and the location data sent by your linked GPS device.
- We do not sell your personal data, do not show ads, and do not track you across other companies' apps or websites.
- We do not use third-party analytics or advertising SDKs.
- You can delete your account and all associated data at any time (see Section 9).
2. Information we collect
2.1 Information you provide
| Data | Details | Purpose |
|---|---|---|
| Account information | Full name, email address, phone number (optional), password | Create and secure your account, sign you in, contact you about your account |
| Profile preferences | Preferred currency, language | Show the app the way you prefer |
| Vehicle information | Nickname, make, model, year, vehicle type, fuel type, tank capacity, colour, odometer readings, registration (plate) number, chassis number (optional), GPS device ID (optional), notes | Identify and manage your vehicles and link them to a GPS tracking device |
| Expense and maintenance records | Date, category, amount, odometer, fuel litres and price, fuel station, notes, replaced parts, receipt link or file (optional) | Expense tracking, fuel-efficiency and cost analytics, maintenance reminders |
| Security (parking guard) settings | Whether the guard is armed, the parked position and the alert radius | Alert you if your parked vehicle moves |
Fields marked optional can be left empty. Please do not enter information in free-text "notes" fields that you do not want stored.
2.2 Information from your vehicle's GPS tracking device
When you link a GPS tracking device to one of your vehicles, that device sends us:
- device identifier (for example the tracker's IMEI/ID number);
- precise location (latitude/longitude), time, speed and heading;
- device status such as ignition on/off, where the device reports it.
We use this to show the vehicle's live position, build trip history and trip replays, record stops, calculate distance travelled, and send parking-guard and movement alerts. This is the location of the vehicle, not of your phone.
2.3 Information collected automatically from the app
| Data | Details | Purpose |
|---|---|---|
| Push notification token | Token issued by Firebase Cloud Messaging / Apple Push Notification service | Deliver alerts you have enabled |
| Device information | A device identifier (Android ID or iOS identifier for vendor), platform, device name and model, OS version, app version | Send notifications to the right device and manage your signed-in devices |
| Sign-in session data | Secure session (refresh) tokens, stored only in hashed form | Keep you signed in safely |
| Local app storage | Your session, settings and a cache of place names, stored on your device | Faster loading and offline display |
2.4 Information we do NOT collect
We do not access your phone's GPS location, contacts, photos library, camera, microphone, health data, or payment card details. We do not use advertising identifiers (IDFA / Advertising ID). The app plays its own alert sound but never records audio.
3. How we use information
We use information only to:
- provide and operate the Service and its features;
- create and manage your account and authenticate you;
- show live vehicle location, trips, stops, analytics and maintenance status;
- send notifications you have enabled (e.g. vehicle-moved alerts, trip and security alerts);
- respond to support requests;
- keep the Service secure, prevent misuse and fix problems;
- comply with legal obligations.
We do not use your data for advertising, sell it, or use it for automated decisions that produce legal or similarly significant effects on you.
4. Legal bases (where GDPR / UK GDPR applies)
Contract — to provide the Service you signed up for. Consent — for push notifications, which you can withdraw at any time in your device settings. Legitimate interests — to keep the Service secure and reliable. Legal obligation — where the law requires us to keep or disclose information.
5. How we share information
We share information only in these cases:
Service providers that help us run the Service, under their own terms and only to the extent needed:
| Provider | What it receives | Why |
|---|---|---|
| Our hosting / server provider | All Service data stored on our servers | Run the backend, database and GPS server |
| Google Firebase Cloud Messaging and Apple Push Notification service | Push token, notification content | Deliver notifications |
| OpenStreetMap (map tiles and Nominatim place-name lookup) | Map area being viewed; coordinates of a trip point or stop when a place name is looked up; your IP address | Display maps and turn coordinates into street names |
| Google Maps (when you choose the Google or satellite map view) | Coordinates of the displayed vehicle; your IP address | Display the vehicle on Google Maps |
| Esri ArcGIS (satellite imagery in trip replay) | Map area being viewed; your IP address | Display satellite imagery |
| unpkg CDN | Your IP address | Load the open-source map library |
Map providers process data under their own privacy policies, for example the Google Privacy Policy and the OpenStreetMap Foundation Privacy Policy.
People in your account. If an administrator or fleet manager has given you access, or you are part of a business account, users with the appropriate role (for example an Admin or Manager) may see vehicles, trips and expenses they are responsible for.
Legal reasons. If required by law, court order or a valid request from authorities, or to protect the rights, safety and property of users or others.
Business transfer. If the Service is transferred to another owner, your information may transfer with it, subject to this Policy, and we will tell you in advance.
We do not sell personal information and do not share it for cross-context behavioural advertising.
6. Data retention
| Data | How long we keep it |
|---|---|
| Raw GPS positions received from the tracking device | 4 days, then deleted automatically |
| Trips, trip points, stops and security alerts | While the vehicle remains in your account, or until you delete them, the vehicle or your account |
| Account, vehicle, expense and maintenance records | While your account is active |
| Push tokens and device information | Until you sign out of that device, the token becomes invalid, or you delete your account |
| Expired sign-in sessions | Deleted automatically |
When you delete your account we delete your personal data from our active systems within 30 days, except where we must keep limited information to comply with law. Residual copies in backups are overwritten within 90 days.
7. Data security
We protect your data with encryption in transit (HTTPS/TLS), passwords stored only as salted hashes (bcrypt), hashed session tokens, role-based access controls, and restricted access to our servers. No system is completely secure, so we cannot guarantee absolute security. If a data breach is likely to affect you, we will notify you and the relevant authorities as required by law.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data (most of it you can edit directly in the app);
- delete your data and account;
- receive a copy of your data in a portable format;
- object to or restrict certain processing;
- withdraw consent at any time;
- lodge a complaint with a data protection authority.
These include rights under the Sri Lanka Personal Data Protection Act No. 9 of 2022, the EU/UK GDPR, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). To exercise them, contact us (Section 14). We may need to verify your identity first. We will not discriminate against you for exercising your rights.
Notifications: turn them off at any time in your device settings.
GPS tracking: unlink the GPS device from the vehicle in the app, delete the vehicle, or switch the tracking device off.
9. How to delete your account
You can request deletion of your account and all associated data (profile, vehicles, expenses, maintenance records, trips, location history, alerts and push tokens):
- In the app: Settings → Delete Account
- On the web: https://app.veylo360.rangarathnayake.com/delete-account.html
- By email: send a request from your registered email address to the contact address in Section 14 with the subject "Delete my account".
Deletion is permanent and cannot be undone. Any subscription bought through the App Store or Google Play must be cancelled separately in your store account.
10. Tracking other people
Veloce Track is designed to track vehicles you own or are authorised to manage. If someone else drives a tracked vehicle (for example a family member or employee), you are responsible for telling them that the vehicle is tracked and for obtaining their consent where the law requires it. The Service must never be used to secretly monitor a person. See our Terms and Conditions.
11. Children
The Service is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.
12. International transfers
Our servers and service providers may be located outside your country. When we transfer personal data internationally we take steps to protect it as required by applicable law, including the Sri Lanka Personal Data Protection Act and, where relevant, Standard Contractual Clauses.
13. Changes to this Policy
We may update this Privacy Policy from time to time. The latest version will always be available at this address with the "Last updated" date. If changes are significant, we will notify you in the app or by email before they take effect.
14. Contact us
Ranga Rathnayake — Developer of Veloce Track
Sri Lanka
Email: [SUPPORT EMAIL]
Website: https://app.veylo360.rangarathnayake.com