Your location stays on your phone. Period.

What never leaves your phone

GPS coordinates. Route waypoints. City names. None of it syncs. Ever. Waypoints are held in memory during an active session for distance calculation, then cleared the moment you stop. They're never written to disk. They're never sent anywhere.

Nothing that could be used to locate, track, or identify a teen driver leaves the device. That's not a toggle you can turn off. It's how the app works.

What does sync

If you sign in and enable cloud backup, Moda syncs: session duration, time category (day or night), weather condition, supervisor name, and distance in miles. That's it. Distance reveals nothing about where you drove—just how far.

Encryption on device

Sessions save to encrypted files using NSFileProtectionComplete. That means the files are unreadable unless the device is unlocked. Keychain backup adds a second layer—hardware-level encryption that persists even if you delete and reinstall the app.

No accounts required

Core features work without signing in. No email, no password, no account creation screen blocking you on first launch. If you want cloud backup, Sign in with Apple keeps it simple—no email/password to manage or leak.

The device ID Moda uses is anonymous, generated from Keychain. It's not tied to your Apple ID, your phone number, or anything else.

No ads. No tracking. No data sales.

Moda has no ad SDK. No analytics trackers. No third-party data partnerships. We don't know where your teen drives. We don't want to. The app makes money from a one-time purchase, not from selling information about minors.

This isn't a privacy policy buried in legal text. It's an engineering decision. The data physically can't leak because it's never collected.