Privacy Policy
How CarrierCaddy handles information: what stays on your phone, what our service receives and keeps, which other companies are involved, and the choices you have.
Who we are
CarrierCaddy is made by Function Desk LLC, a Florida limited liability company (“we”, “us”, “our”). This policy covers the CarrierCaddy apps for Android and iPhone, the CarrierCaddy service those apps use for address lookups, road paths and Plus, and the website carriercaddy.com. The apps are offered only in the United States, and the service and the records it keeps are in the United States.
Questions about privacy go to privacy@carriercaddy.com.
The short version
- There is no account. The app makes an anonymous identity for your phone; we never ask for your name, email address or phone number.
- Your routes, customer names, notes and photos are kept on your phone. They are not synced to us.
- A lookup sends our service only the address or position it needs, never a name, note or photo.
- What our service keeps holds no address text, and it is deleted on a schedule.
- The apps have no advertising, tracking or analytics, and we never sell or share personal information. The website counts visits with Google Analytics.
- Delete my data, in the app, removes what our service holds about your phone.
What stays on your phone
CarrierCaddy keeps your work on your phone: route addresses, their order and positions; stop instructions such as notes, holds and forwards, with their dates and the names they cover; do-not-deliver and accepted-name lists; packages and scans; photos you take with the label scanner; sorting-rack layouts; day records such as start and end times, breaks and odometer readings; and your settings. To avoid looking up the same address twice, the apps also remember, by address, positions from the free Census lookup and positions you set yourself or that were learned at the stop; this memory stays on the phone and is left out of backups. Which of these exist depends on the features you use. None of it is sent to us, and there is no automatic route sync.
Both apps keep your routes in the app's private storage on your phone, protected by the phone's own encryption, which works only when the phone has a screen lock; both apps remind you once if it has none. Android also encrypts its route database with SQLCipher, under a key held in the phone's secure hardware; its photos, and GPS fix logs if you turn them on, are ordinary files protected by the phone's encryption. The iPhone relies on iOS file protection, which allows background access after the phone has been unlocked once following a restart; encrypting the iPhone's database as well is planned for a later version. Every backup is encrypted. None of this prevents someone with access to an unlocked phone or a shared file from reading information.
The apps keep their working data out of the phone's own cloud backup. Settings → Backup & restore makes encrypted backup files that you keep where you choose. We cannot recover a backup's password.
Location
The apps use your phone's location on the phone: to follow your progress along the route, to give spoken reminders as a stop comes up, to record when you leave and return to your starting point, and to show where you are on the map. On Android, while On Route is running, location continues in the background and Android shows a notification; on iPhone, iOS shows when the app is using your location. You can change location access at any time in your phone's settings; the features that depend on it then stop.
Your location history is not sent to us. A position leaves your phone only when you ask for something that needs it: looking up the address where you are standing sends those coordinates to our service, and a road path sends the positions of the stops on it. Positions you set yourself travel with a route only when you share it. On Android, a log of GPS fixes for troubleshooting is kept on the phone only if you turn it on.
Camera, scanning and photos
Reading labels, barcodes and printed lists happens on your phone. On Android this uses Google's ML Kit, including, on supported phones, Google's on-device AI model; on iPhone it uses Apple's VisionKit. The images, and the text read from them, are not sent to us. ML Kit may send Google information about how its features perform and are used, under Google's terms; it does not send the images.
Photos you keep, such as label photos in the backup scanner, stay on the phone. They are removed once the item is re-scanned or after 14 days.
Voice dictation and third-party keyboards may send what you say or type to their providers. Check your phone's settings, or type without them, when entering sensitive information.
What our service receives
| When | What it receives | Why |
|---|---|---|
| The first time the app uses the service | A random identifier the app makes, your phone's public key, the platform, the app version and the language. Like any server, it also sees the network address the request comes from. | To check that later requests come from your phone, and to limit how many new identities one network can create. |
| Every request | The identifier, a signature made with a key that never leaves your phone, and the time. | To know the request is genuine and count it against the right allowance. |
| Locating stops | The addresses to locate, with their postal codes and country. Never the names, notes or photos stored with them. | To find where each stop is. |
| The address where you stand | Your coordinates at that moment. | To find the address for that spot. |
| A road path (Plus) | The positions of the stops on the route, in order. | To draw the road path on the map. |
| Plus and codes | A request to check your subscription, or a code you type. | To know whether Plus is active. |
| Delete my data | The request to delete. | To remove what we hold about your phone. |
For US addresses, the service asks the US Census Bureau's public geocoder first, and Google Maps Platform when the Census Bureau has no match or the address is outside the US. Finding the address for a position, and road paths, use Google. Google and the Census Bureau receive the addresses or coordinates from our service, not your identifier.
Do not type customer names, access codes or private delivery instructions into address fields: anything in an address is sent to look it up.
What our service keeps, and for how long
| Record | What it holds | How long |
|---|---|---|
| Your phone's identity | The random identifier, its public key, the platform, the app version and language, and when it was registered. | Until you use Delete my data. |
| Your plan | Free or Plus, where Plus came from (the store, a code or a grant from us) and when it ends. | Until you use Delete my data. |
| Allowance counts | How many lookups and road paths your phone used each day. | 90 days. |
| Request records | For each request: the operation, its time, whether it was answered from the cache, and its estimated cost. Never the address, position or stops it carried. | 90 days; after that, monthly totals for 13 months. |
| Shared cache | Positions and road paths, so the same request costs nothing twice. Each entry is encrypted with a key made from the request it answers and a secret we hold, so the stored cache cannot be read without both. No address text is kept. | 30 days, the most Google's terms allow. |
| New-identity counter | A scrambled form of the network address that created identities in the last hour, and how many. | Deleted after the hour. |
| Promotional codes | A one-way hash of each code, its months, and which identifier redeemed it. | Until we retire the code; Delete my data removes the link to your phone. |
| Service logs | Method, status and error codes. No address, identifier or network address. | 14 days. |
| Database restore points | Copies of the records above, kept to recover from mistakes or failures. | 35 days. |
Road paths are also kept on your phone for at most 30 days. A persistent identifier is not a guarantee of anonymity: anyone who can link it to you could connect it to your phone's usage.
Other companies involved
We use these service providers. Each receives only what it needs, and handles it under its own privacy policy.
- Amazon Web Services runs our service and stores its records, encrypted, in the United States.
- Google provides address lookups and road paths through our service, and the map in the app. The map is drawn by Google's Maps SDK, which contacts Google directly from your phone, so Google sees your phone's network address and the area of the map on screen, and receives the SDK's own usage and diagnostic data. On Android, Google's ML Kit provides the on-device scanning.
- The US Census Bureau answers most US address lookups, from our service.
- RevenueCat manages Plus subscriptions. The app and our service give it your anonymous identifier, and the App Store or Google Play gives it your purchase receipt.
- Apple and Google run the app stores, take payment for Plus and keep their own purchase records. If you allow it in your phone's settings, they also share crash and performance reports with us.
- Fastmail hosts our email, including messages you send to support.
- Google Analytics measures visits to the website, as “The website” below describes. It is not in the apps.
Google Privacy Policy (opens in a new tab)https://policies.google.com/privacy
RevenueCat Privacy Policy (opens in a new tab)https://www.revenuecat.com/privacy/
Plus purchases and codes
CarrierCaddy Plus is bought through the App Store or Google Play. The store takes payment and keeps your billing details; we never see them. The store's receipt goes to RevenueCat, which records it against your anonymous identifier. Our service asks RevenueCat whether Plus is active and keeps only the plan, where it came from and when it ends.
Promotional codes are stored only as a one-way hash. Redeeming a code links that hash to your anonymous identifier.
What we don't do
- We don't require an account, an email address or a phone number.
- We don't show advertising, use advertising identifiers, or track you across other companies' apps and websites.
- We don't sell or share personal information, and we don't use it for targeted advertising or profiling.
- We don't put analytics in the app. The counts our service keeps exist to enforce allowances and control costs.
- We don't receive your routes, customer names, notes or photos.
Your choices and rights
Delete my data, in Settings → About CarrierCaddy on iPhone or Settings → About, privacy & licenses on Android, removes what our service holds about your phone: its identifier and key, its plan, its allowance counts, request records and monthly totals, its link to any code it redeemed, and its customer record at RevenueCat. Copies in our database restore points leave within 35 days. It does not delete routes on your phone, cancel a store subscription, or remove the store's own purchase history.
If you can no longer open the app, email privacy@carriercaddy.com with your device identifier, shown on that About screen, and we will delete those records. You can also ask what we hold about your phone, or ask us to correct it. We answer within 45 days, and may ask you to show the identifier in the app so we can be sure the request is yours. These choices are open to everyone, whatever state you live in.
Location, camera and notification access are controlled in your phone's settings. Uninstalling the app deletes its data from the phone: make an encrypted backup first if you want to keep it.
Security
Every request is signed with a key that never leaves your phone, and travels over an encrypted connection. Our service's records are encrypted with a key of our own, the cache is sealed as described above, and only Function Desk LLC can reach the service's administration. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.
On the phone, keep your phone updated and protected by a screen lock.
Deleting on your phone
Deleted routes stay in Recently deleted until you restore them or erase them for good. On both phones, some details also clear themselves each time the app starts: a forward's names a week after the forward ends; names removed from a do-not-deliver or accepted-names list, from the route's change history after 90 days (on Android you can choose 30, 90 or 180); label photos once re-scanned or after 14 days; and package lists after seven days.
Deleting something on your phone does not recall files you shared, prints, or copies other people hold. Deleting the app may remove your only copy of your routes, and a route transfer omits some settings and work records, so it is not a full backup.
The website
carriercaddy.com uses Google Analytics to count visits and see which pages are read, so we can improve the site. It is on the website only; the apps have no analytics.
When it runs, Google Analytics sets two cookies of the site’s own (_ga, and one starting with _ga_) that last up to two years, and your browser sends Google the pages you visit, the page that sent you, your browser, device type and screen size, and your approximate location, which Google works out from your network address and does not store. We have turned off Google signals and ad personalization, so the data is not used for advertising or connected to a Google account, and the record of each visit is deleted after two months.
It does not run if your browser sends Global Privacy Control or Do Not Track. You can also block it in your browser’s settings or with Google’s opt-out add-on. The site works the same without it.
Google Analytics opt-out add-on (opens in a new tab)https://tools.google.com/dlpage/gaoptout
The site is served by Amazon Web Services, and we keep no access logs for it.
If you email us, your message and our reply are kept in our email at Fastmail for as long as they are useful to support you. Please use made-up examples rather than real customer details.
Workplace use and driving
Only store and share information you are authorized to use. Your employer's rules, customer contracts and local law may still apply even when a transfer is encrypted. CarrierCaddy is an independent tool, not an employer system or a promise of regulatory compliance.
Do not use the app while driving, and keep your eyes on the road. Set up routes, edit records, scan documents and share files while safely parked. Spoken reminders are intended to reduce screen interaction, not to guarantee safer driving or replace your judgment. Spoken names and instructions can be overheard; choose alert settings and volume to suit. Do not interact with the screen while the vehicle is moving.
Children
CarrierCaddy is a tool for adults who work routes. It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has used it, contact us and we will delete what our service holds.
Changes to this policy
We will post any change here with a new date. If a change is material, we will say so in the app or on this site before it takes effect.
Contact
Function Desk LLC, 11100 SW 93rd Crt Rd, Ste 10-228, Ocala, FL 34481-5188 — privacy@carriercaddy.com