Privacy Policy

Introduction

the long way is operated by Broken Branch Studios (“we,” “our,” or “us”). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our mobile application and website (collectively, the “Service”).

Information We Collect

Location Data

the long way uses your device's location to tell you stories about the places you are actually passing. We collect:

• Current GPS coordinates while a drive is running
• Your destination, if you set one
• Route information for narrative generation

When we collect your location: only while a drive is running in the app. A drive keeps running even when your screen is off or you are using other apps — that is how the crew can keep talking while your phone is in your pocket. While a drive is running, Android shows a notification saying the app is active, and you can see it in Android's own list of running apps.

Closing or swiping the app away does not end a drive. To stop collecting your location, end the drive in the app.

When no drive is running, we do not collect your location. The app does not hold Android's background-location permission, so it cannot access your location outside a running drive.

The drive also ends on its own when it should. If the app crashes, is stopped by the system, or your phone restarts, tracking shuts itself down instead of lingering. And if you forget to end a drive: parked about fifteen minutes with the app in the background, the crew checks in; at about twenty they say the goodbye themselves and the drive — and location collection with it — ends.

Audio

The crew talks; you are never recorded. the long way has no voice assistant, no push-to-talk, and no ambient listening — the app never records audio. If that ever changes, it will be a visible, hold-a-button feature, and this policy will change first.

Now Playing (optional, off by default)

If you turn on now-playing access in Settings, Android lets the app see the title of what you are currently playing — Spotify, YouTube Music, podcasts — so the crew can react like a friend in the passenger seat. It is read-only, it is processed on your phone, and track names never leave your device. The same access lets the app see whether Google Maps is navigating, so the crew can look further down your road; your route stays on your phone.

Diagnostics (on in beta builds, off in store builds)

Beta builds keep the Diagnostic Beacon on unless you turn it off in Settings; store builds ship with it off and you opt in. Either way your choice in Settings wins. While it is on, the app sends technical health snapshots while a drive is running — GPS pulse rate, audio state, network status — to help us fix the weird stuff. Coordinates in these snapshots are rounded to roughly a 1 km grid before they leave your phone, and no place names, emails, or other personal identifiers are included. Our server-side logs use a random per-session trace ID and strip personal fields before storage.

Account Information

If you create an account or subscribe to premium features, we may collect:

• Email address
• Display name (optional)
• Subscription status and payment information (processed securely by Stripe; we never store your card details)

Trip History

Your trips — where you went and what the crew said — are stored under your account so your logbook and atlas persist. It is a journal the raccoons kept, and it is yours: you can delete all of it at any time (see Retention below).

Breadcrumbs

Every drive leaves a trail of GPS breadcrumbs — the points the car actually passed, thinned to roughly one every 25 metres. They draw your atlas and your logbook. By default they live only on your device and leave with you when you sign out or uninstall. If you turn on “Keep my trails” in Settings, they are stored under your account (Supabase, US region) so the map follows you to a new phone; turn it off and no more are synced. Deleting your account deletes them.

Usage Data

We collect limited usage data to keep the app reliable and affordable to run:

• Trip statistics (distance, duration)
• Character preferences and settings
• Aggregate service metering (which backend services were called, cache hit rates) — used for reliability and cost control, never for advertising

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract: Processing necessary to provide the Service you requested (account creation, trip features, subscription management)
• Consent: Location collection during drives (granted via device settings), optional now-playing access, and the optional Diagnostic Beacon
• Legitimate Interest: Anonymous usage analytics to improve app quality and prevent abuse

How We Use Your Information

We use collected information to:

• Generate personalized narratives about points of interest
• Run drives and keep your trip journal
• Process payments and manage subscriptions
• Improve our app and develop new features
• Send important updates about your account or the service

Third-Party Services

the long way integrates with the following third-party services, each of which processes data according to their own privacy policies:

• Google Maps / Places — Routing, place discovery, and snack stop recommendations
• Stripe — Payment processing (we never store your card details)
• Anthropic / OpenAI / Google AI — AI narrative generation (place names and coordinates only; no personal identifiers)
• ElevenLabs / OpenAI — Turning the crew's lines into voice (the text being voiced may include place names from your route; never your name or contact details)
• Wikipedia (Wikimedia Foundation) — A free lookup of articles near your position, so a place with a story ranks higher (coordinates only; no identifiers)
• Supabase — Secure cloud database and authentication
• Vercel — Web hosting, serverless functions, and privacy-friendly web analytics
• Resend — The emails we send (waitlist welcome, account and service updates)
• Sentry — Crash and error reporting, scrubbed of personal data before it is sent

Data Storage, Security, and Retention

Your data is stored securely using industry-standard encryption. Trip history is stored under your account in our database hosted by Supabase (AWS infrastructure, US region); some preferences live only on your device.

We retain your data according to the following schedule:

• Account data: Retained while your account is active. Delete your account yourself at thelongway.ai/account/delete: it happens immediately — no request queue, no waiting period. Everything under the account (drives, breadcrumb trails, what the crew remembered) goes with it.
• Trip history and breadcrumb trails: Retained while your account is active and deleted with it. Trails kept only on your device are yours to clear by signing out or uninstalling.
• Payment records: Retained for at least 7 years as required by tax and accounting regulations.
• Anonymous analytics: Retained indefinitely in aggregated, non-identifiable form.
• Website analytics: We record page views, video plays, and how quickly each page loaded and responded for you (standard browser performance timings such as load time and layout shift) on this website without cookies. No IP address, no device fingerprint, and no account is stored with them, and the identifier that groups one visit together lives only in your browser tab and is discarded when you close it — so these records cannot be linked to you or followed between visits. Referrers are stored as the site name only (for example example.com), never the full address you arrived from.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (“right to be forgotten”)
• Portability: Export your trip history in a machine-readable format
• Opt-out: Opt out of non-essential data collection
• Withdraw Consent: Withdraw previously given consent at any time

To exercise any of these rights, contact us at ben@brokenbranch.dev. We will respond within 30 days (or 45 days for complex requests, with notice).

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• You have the right to know what personal information we collect, use, and disclose
• You have the right to request deletion of your personal information
• You have the right to opt out of the sale of your personal information

We do not sell your personal information. We do not share your personal information with third parties for their direct marketing purposes.

International Data Transfers

Our servers are located in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

Children's Privacy

the long way is designed for family use but requires users to be at least 13 years of age (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete that information.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable law. Notification will be sent via the email address associated with your account.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Your continued use of the long way after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

Broken Branch Studios
Email: ben@brokenbranch.dev