Home / Privacy Policy

Privacy Policy

How Milepost handles your business's and your team's location and account information.

Who we are

Milepost is a product of Civil Digital, a Bedford-based UK digital consultancy. Milepost provides live GPS location tracking software for small businesses — couriers, farms, trades and field-service teams — with a mobile app for the people being tracked (Track) and a live map and team management for the business (Hub). This policy explains what personal and location data we collect, why, and how we look after it.

Information we collect

  • Account details — names, email addresses and roles of Hub (admin) and Track (tracked team member) users.
  • Location data — GPS coordinates, accuracy, speed, heading and timestamps uploaded by each Track device while tracking is switched on, plus stored route history for the organisation's configured retention period.
  • Device information — device battery level, app version and last-seen time, used to show device status to Hub users; and a random identifier the Milepost app creates for its installation on your phone, used to keep each account signed in on one phone at a time. It is not your phone's advertising identifier, serial number or IMEI, and Milepost never reads any of those.
  • GPS signal details — when your phone cannot get a usable GPS position, how many satellites it can see, how many it is using and how strong their signal is, so Hub users can tell "indoors" from "app not working". These are cleared as soon as the signal is good again. If your phone reports that a position came from a "mock location" app (one that can fake where a phone is), that fact is recorded with the position and shown to Hub users. Tracking is not stopped because of it.
  • Organisation data — organisation name, group names, member roster and subscription/billing status.
  • Technical data — basic usage and diagnostic information needed to run and secure the service.
  • Zone (geofence) data — the places your organisation marks on the map, and a record of when each device entered or left one. Zones are created and seen only by Hub users; Track users cannot view the list of places their organisation has marked.
  • Messages and files — messages, photos, videos and documents sent between members of your organisation in Milepost, and a record of who downloaded a file and when, which your organisation's Hub users can see.
  • Trips — when a Hub user posts that someone is going to a place: the destination, an optional name for it, who posted it, when it ends, and whether the person arrived, was stopped short or ran out of time.
  • Notes — notes you write in Milepost. Only you can see your notes; not your organisation's Hub users, and not us in the normal running of the service.
  • Daily summaries — each night we add up each person's previous day of tracking for their organisation's reports: how long tracking was on, how far they travelled, when their first and last positions were, and how long they spent in each zone. No speeds are included. The person can see their own summary in the app.
  • Lone-worker data — only for organisations that use lone-worker awareness, and only for the people they enrol: check-in sessions (start time, check-in time and an optional note), alerts (when and how each was raised, location during the alert, who was alerted, when it reached their phone, who responded and how it ended), any voice recordings made during an alert, optional medical notes and a record of who has read them, and whether each person's phone is set up to send and receive alerts. PINs are never stored, only a one-way scrambled form of them that cannot be turned back into the PIN.
  • Work phone number — optional, added by you or your organisation's Hub users, so the people dealing with a lone-worker alert can ring you. Every change records who made it and when.
  • Acknowledgements — when a message asks to be acknowledged, a record of who it was sent to and when each person acknowledged it. The record does not include the message itself.
  • Passkeys — optional. If you choose to sign in with a passkey (your fingerprint, face or screen lock), we store only the passkey's public key, the name you give it, and when it was added and last used. Your fingerprint or face never leaves your device and is never sent to us. The same is true of the optional fingerprint or face lock on the app. Your passkeys are deleted with your account.
  • Billing contact details for organisations that pay by invoice — the name, address, email and purchase-order number to put on the invoice.

How we use your information

  • To provide and operate the Milepost service for your business, including the live map and route history.
  • To manage organisation membership, seats and groups.
  • To keep the service secure and to prevent misuse, including keeping each organisation's data isolated from every other organisation's, and keeping each account signed in on one phone at a time.
  • To process subscription payments via Google Play Billing or Stripe, and to contact you about your account.
  • To notify Hub users when a device arrives at or leaves a place the organisation has marked (a "zone"), where the organisation has set zones up.
  • To show Hub users where someone has been sent and whether they have arrived, where the organisation posts trips.
  • To produce your organisation's usage reports from the daily summaries.
  • To run lone-worker awareness for organisations that use it: to record check-in sessions, and to send alerts to the people the organisation has chosen as contacts.

Zones and workplace monitoring

An organisation can mark places on the map — a depot, a yard, a customer address — and be notified when a tracked device arrives at or leaves one. We call these zones.

If you are a Track user, you should know that this happens: while your tracking is switched on, your organisation may be notified of your arrivals at and departures from the places they have marked. The Milepost app tells you this on the tracking screen. Only the person tracking a device can switch that tracking on or off — Milepost gives no one a remote switch over someone else’s device.

Zone monitoring is a feature we provide to employers, and employers are responsible for using it lawfully — which in the UK generally means telling staff what is monitored and why. If you are an employee with questions about how your employer uses it, please ask them first; they control the settings, not us.

Trips

A Hub user can post that someone is going to a place: they drop a pin on the map, and Hub users then see a dashed line from that person's live position to the pin until they arrive, the trip is ended, or it runs out of time (between 2 and 24 hours). We work out when the person has arrived from the positions their phone already sends; trips add no extra tracking.

A trip is shown only to the people who can already see the person's position on the map: the organisation's Hub users, and managers and viewers of the person's team. It is not shown to other Track users, to administrator accounts, or in the app of the person who is travelling. Because of that, if you are a Track user your organisation is responsible for telling you when it posts trips for you, in the same way as for zones.

Hub users can be notified when someone arrives or a trip ends without them arriving. A notification on a phone's lock screen does not name the person or the place; the details are shown only inside Milepost.

Lone-worker awareness

Some organisations use Milepost's lone-worker awareness. It gives an organisation better awareness of staff who work alone: a person starts a timed check-in session, and if they raise an alert or do not check in, their own colleagues are told. It is self-monitored by your organisation, not a monitored alarm service. In an emergency, call 999. If your organisation uses it, here is what happens.

If you are enrolled as a lone worker

  • Only the organisation's owner can enrol you, and only if you already have a Track seat.
  • During a session your location is sent regularly. During an alert it is sent every 5 seconds until the alert is closed. You can always stop tracking yourself; nobody else can.
  • Your phone tells Milepost whether its Location setting is switched on, as a yes or no only. While it is off you are shown as not ready, because an alert would not include where you are.
  • A note you add to a session is seen only by you, unless an alert is raised during that session. Then the people dealing with the alert can see it.
  • When you start a session you can also say where you are going, by dropping a pin on a map that shows only your own position. Like the note, it is seen only by you unless an alert is raised; then the people dealing with the alert see it, with a line from where you are, and it is kept with the alert record.
  • When an alert is raised, your organisation's chosen contacts, and the Hub users on cover, see your name, your location during the alert, your note, and what happens next.
  • You choose a cancel PIN and a duress PIN. If you are made to cancel an alert, the duress PIN makes your phone look as if the alert was cancelled while your contacts are still told. For this reason your phone does not show whether an alert really stopped.
  • Medical notes are optional. If you add them, your organisation's owner, its Hub users and your team manager can read them at any time, so they can take them into account when planning your work, and the people dealing with an alert can read them during it. Every time someone reads them is recorded, and the app shows you who and when (a reading during an alert is shown once the alert is closed). Your notes are deleted when you delete them or stop being a lone worker.
  • Your work phone number, if one is stored, can be used by the people dealing with an alert to ring you, except after a duress PIN or three wrong PINs. Each call is recorded on the alert.
  • The positions recorded during an alert are kept with the alert record, so the route can be seen for as long as the record is kept.
  • When you raise an SOS, your phone records 30 seconds of sound, and you can record short voice notes while an alert is open. The app always shows when it is recording; it never records secretly, and never outside an alert.
  • If your organisation switches on person-down detection, your phone uses its own movement sensors during a session to notice a fall or a long time without moving, and asks “Are you OK?” for 60 seconds before alerting anyone. The sensor readings stay on your phone; a short note of each countdown (when, and whether you answered) is kept for 7 days.

If you are a contact or a Hub user on cover

  • Your phone reports whether it can receive alerts: whether notifications and full-screen alerts are allowed, and which Do Not Disturb mode it is in. This is how the app tells you and your organisation whether alerts can reach you. It is not used for anything else.
  • When an alert is sent to you, we record when it reached your phone and what you did. The notification itself carries no name or details; your phone fetches them securely when it arrives.

Who decides

Your organisation decides whether to use lone-worker awareness, who is enrolled, and who the contacts are. They are responsible for using it lawfully and for telling you about it. Nobody at Civil Digital watches for or answers alerts.

Your rights

You can ask your organisation for a copy of any alert record about you; they can download it from Milepost. You can also contact us using the details below.

Where your data is processed

Milepost's database and backend run on Google Firebase/Google Cloud infrastructure. Authentication (sign-in) runs on Google's global infrastructure and is not region-pinned.

Sharing your information

We do not sell your personal or location data. We only share it with trusted service providers who help us run Milepost (for example, Google Firebase for hosting and data storage, and Google Play or Stripe for payment processing), or where we are required to by law. Your organisation's data is kept within your organisation and is not shared with other Milepost customers.

Data retention

We keep each kind of data only as long as it is needed, and delete it automatically:

  • Live location is overwritten on every update.
  • Route history is kept for 30 days; older points are deleted automatically.
  • Zone alerts are kept for 30 days, or until you dismiss them.
  • Messages are deleted automatically 24 hours after they are sent, or sooner if the sender deletes them. After that they cannot be recovered from Milepost by anyone, including Civil Digital. Copies can remain in our encrypted database backups for up to 7 days before those are erased too.
  • Photos, videos and documents sent in messages are deleted with their message. They are not kept in any backup, so once deleted they cannot be recovered by anyone, including Civil Digital.
  • The download record (who downloaded a file from a message, and when) is kept for 12 months.
  • Trips are kept for 30 days after they end, then deleted. A person's trips are deleted with their account.
  • Notes are kept until you delete them or your account is deleted.
  • Acknowledgement records are kept for 12 months, then deleted. The record of changes to a work phone number is kept for 12 months.
  • Daily usage summaries are kept for 12 months, then deleted. They hold no route, only the totals described above.
  • Lone-worker records (organisations that use lone-worker awareness): alert records, with any voice recordings and the route during the alert, are kept for 12 months; sessions without an alert for 30 days; the record of who read someone's medical notes for 12 months.
  • Unused invitations expire after 48 hours, or 7 days if they were sent by email.
  • The app installation identifier is replaced when you sign in on another phone, and deleted with your account.
  • Account and organisation data is kept for as long as your organisation remains active, or as required by law. When you delete your account, or an owner deletes the organisation, we delete the related data straight away.
  • Backups: our database is backed up so it can be restored after a fault. Backups are kept for 7 days, so anything deleted from Milepost is gone from the backups within 7 days.

Payment records are held by Stripe or Google Play under their own policies.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to certain processing. To make a request, contact us using the details below. UK users may also complain to the Information Commissioner's Office (ICO).

Security

We take reasonable technical and organisational measures to protect your information against loss, misuse and unauthorised access, including access controls enforced in our database's own security rules that keep every organisation's data separate from every other organisation's. Further technical detail is available on request.

Changes to this policy

We may update this policy as Milepost develops. When we do, we'll change the "last updated" date below and, where appropriate, let you know directly.

Contact us

Questions about this policy or your data? Get in touch:

Last updated: 8 October 2026