Privacy policy
Last updated: 9 October 2026
Mappex is a rally preparation and race-day app for co-drivers, drivers, their teams and the people who follow them. This policy says what personal data Mappex handles, why, where it goes and what you can do about it. It covers the Mappex app for iPhone, Apple Watch and Android, and the website at mappex.app.
The data controller is Mappex, established in the United Kingdom. Write to contact@mappex.app for anything in this policy.
What we collect
Your account. An email address and a password, or the name and email Apple or Google send when you sign in with them. Your name, the language you read Mappex in, whether you use it as a crew member or as a follower, and — if you choose — a date of birth, a profile photo and a link to your public rally results profile.
What you put into your rallies. Itineraries, programmes, stages, entry lists, fuel plans, service books, setups, tyre pressures, driver notes, pacenotes, documents, timecard photographs and the photos and stories you make. Documents you keep in your crew kit, such as a licence or a medical card, are stored for you and shown only to you and to the people you give a role on your car.
Location. With your permission, the phone's position while Mappex is open, to show where you are on the stage map and the road book. With the "always" permission, also while the screen is off or the phone is in your pocket, so the tripmeter keeps counting and the people following your car keep seeing it. Mappex also records the car's track, speed and motion on a stage you have asked it to record, for your own analysis afterwards. Position sharing only happens while a rally of yours is running, and only to the people you have shared the car with.
Motion. The phone's motion sensors, for the tripmeter and stage recordings.
Camera and photos. The camera to scan a follow code or a tyre barcode and to photograph a timecard, a licence or a stage story; your photo library when you pick a picture from it.
Bluetooth. To find and control a GoPro camera on the car, and to read what it reports: temperature, battery and card space. Nothing else on the Bluetooth radio is read.
Livestream. If you stream from the car, the video goes through Amazon Web Services to your followers and team, and a recording is kept with the rally.
Notifications. A device token so the server can send you a warning before a time control, a new document on the organiser's board or a message from your team.
Purchases. Subscriptions — Mappex Basic and Mappex Plus — are sold through the App Store or Google Play and managed by RevenueCat. We receive which plan you hold and when it renews or ends, never your card details.
Support and the help assistant. The questions you ask the assistant, and the screen you were on, so it can answer and so we can make the help better. Emails you send to contact@mappex.app.
Technical. The time of your sign-ins, the kind of device you use and the version of Mappex it runs, so updates reach it and faults can be found. Mappex contains no advertising and no analytics or tracking kit.
Why we use it
- To run the service you signed up for: your rallies, prepared on the web and carried on the phone, offline, and shared with your team and followers. This is the performance of our contract with you.
- To keep your account secure and to answer your messages.
- With your consent, which you give through the phone's permission prompts and can withdraw there: location, motion, camera, photos, Bluetooth and notifications.
- For our legitimate interest in keeping Mappex working: finding faults, preventing abuse and improving the help.
- To meet legal obligations, such as keeping records of purchases.
Who sees your data
The people you choose. The members of your team see what their role allows — an engineer the setups and tyres, a team manager the itinerary and the car's position, media the stories. The people who follow your car see its position during the rally, the itinerary and the results. You decide who they are, and you can remove any of them.
Our processors, who handle data on our behalf and under contract, and may not use it for anything else:
- Supabase — the database, file storage and sign-in. Hosted by Amazon Web Services in Ireland (EU).
- PowerSync — relays the rally data between the phone and the database so Mappex works offline.
- Vercel — hosts the website.
- Expo (EAS) — delivers app updates and relays push notifications to Apple and Google.
- Apple and Google — sign-in with Apple or Google, push notifications, and the stores themselves.
- Mapbox — draws the maps and works out the roads between stages. Map requests carry the area you are looking at.
- Amazon Web Services (Interactive Video Service) — the livestream and its recordings.
- RevenueCat — which subscription you hold, and its renewals.
- Anthropic — the AI behind the itinerary import, the help assistant and the race engineer. It is sent the document you import, the question you ask, or the car's make, model, setup, times and crew feedback. It is never sent your name, email or location, and the data is not used to train its models.
- Open-Meteo — the weather forecast for each stage, from the stage's coordinates only.
Public results services. Stage times and entry lists come from the organisers' timing providers and from public results sites. If you link your public rally profile, Mappex reads it; it writes nothing to those sites.
Mappex staff. A member of the Mappex team can open your account to help you with a problem, and every such access is recorded with who did it and when.
We do not sell personal data, and we share it with nobody else unless the law requires it.
Where it is kept
Your data is stored in the European Union (Ireland), which the United Kingdom recognises as giving adequate protection. Some processors above operate from the United States; where data reaches them it is under the United Kingdom's international data transfer rules: the Addendum to the standard contractual clauses, or adequacy regulations.
How long
For as long as you have an account. A rally you delete is gone. Deleting your account — from the Account screen in the app or at mappex.app/account/delete — removes your profile, your rallies and everything in them, your photos and documents, and your recordings, in one step. Backups of the database are kept for up to 7 days and then overwritten. Records of purchases are kept for as long as tax law requires.
Anonymous followers, who follow a car without an account, keep nothing on our side beyond the car they follow and, if they turn notifications on, a device token. Both go when they stop following.
Your rights
Under the UK General Data Protection Regulation and the Data Protection Act 2018 — and the GDPR if you are in the European Union — you can ask to see the data we hold about you, to correct it, to have it deleted, to receive it in a portable form, to restrict or object to how we use it, and to withdraw a consent at any time. Most of this you can do yourself on the Account screen; for the rest, write to contact@mappex.app and we answer within a month. You can also complain to the data protection authority where you live; in the United Kingdom that is the Information Commissioner's Office (ICO).
Children
Mappex is not meant for anybody under 16, and we do not knowingly keep data about them.
Changes
When this policy changes we update the date at the top and, for a change that matters to you, tell you in the app or by email before it takes effect.
Contact
Mappex, United Kingdom. contact@mappex.app.