Privacy Policy
Last updated: 2026-10-22. This policy covers the website leadwolf.app and the Leadwolf app for iPhone and Apple Watch. The German version is legally binding.
Controller
Fabian Faraz Farid, Richard-Wagner-Straße 137, 41065 Mönchengladbach, Germany, [email protected].
In short
- The website sets no cookies and uses no analytics or advertising services.
- The app has no ads, no tracking and no analytics tools.
- Locations, routes, messages and voice messages in your pack are end-to-end encrypted. My server can't read them and doesn't store them.
Website: hosting and server logs
The website runs on a server of Contabo GmbH (Germany) and is delivered through Cloudflare, Inc., which protects the connection and caches content. When you visit, these services process technically necessary data such as IP address, time, requested address and browser identifier to deliver the page and fend off attacks (Art. 6(1)(f) GDPR). Data processing agreements are in place with both providers. Cloudflare may transfer data to the USA, safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. Server logs are deleted after a short time. Your language choice is only remembered in your browser (local storage), not on the server.
App: account via Sign in with Apple
Leadwolf uses Sign in with Apple. Apple provides an anonymous identifier unique to Leadwolf and, at first sign-in and if you choose, your first name. I don't ask for an email address. My server stores the identifier, the creation date and the time of the last sign-in to run your account (Art. 6(1)(b) GDPR). Your first name stays on your iPhone.
App: location
Leadwolf uses your location to show you on the map, guide you and share your position with the cars in your pack. Only while you're in a pack does the app send your position, heading, speed and estimated arrival time about every three seconds, encrypted with a key only your pack's devices know. With “Always” permission this also happens while your iPhone is locked, and iOS shows that it does (Art. 6(1)(b) GDPR). You can change the permission in your iPhone settings at any time.
App: pack, routes and messages
Your display name, avatar, planned routes and quick messages only reach your pack's devices, encrypted. The connection runs through my server (Contabo GmbH, Germany). It relays the encrypted packets in real time and doesn't store them. It sees technically necessary data such as your device's IP address and a random pack identifier, which are deleted from the logs after a short time (Art. 6(1)(f) GDPR). The pack keys are kept in your iPhone's keychain. If you save a permanent pack, all members also receive the invitation link's key, encrypted, so any member can admit new cars after comparing the PIN.
App: walkie-talkie
While you hold the walkie-talkie button (in motorcycle mode: from one tap until you tap again to send), Leadwolf records from the microphone for up to 15 seconds. The recording is encrypted on your iPhone, relayed to your pack's devices, played there and not stored. Leadwolf never uses the microphone unless you hold the button (Art. 6(1)(b) GDPR).
App: camera, contacts, voice guidance
Leadwolf uses the camera only to scan the QR code; the image is neither stored nor transmitted. If you pick an address from your contacts, Leadwolf reads only that one address. Voice guidance is generated by iOS on your iPhone.
App: maps, search and routes by Apple
Maps, place search and routes come from Apple (MapKit). For this, your iPhone sends search terms, map areas, start and destination of a route and your approximate location to Apple, which processes them as an independent controller under Apple's Privacy Policy. Recent destinations are stored only on your iPhone.
App: trip log, Live Activity, Apple Watch and Siri
For fuel prices the app sends an approximate position (rounded to about 1 km) and your chosen fuel to my server. It fetches prices in Germany from the Market Transparency Unit for Fuels via Tankerkönig (licence CC BY 4.0) and in Austria from E-Control. These sources only see my server, not you. None of it is stored.
For the speed limit display the app requests map tiles of about 1 km from my server while you drive, never your exact position. The server loads the roads of that tile from OpenStreetMap (© OpenStreetMap contributors, licence ODbL) and keeps them for up to 14 days, without any link to you or your device. Matching to your road happens only on the iPhone. You can turn the display off in settings.
The trip log stores routes, times and the names of fellow drivers only on your iPhone. You can turn it off and delete trips. Live Activity, the Apple Watch app and Siri only show and send data between your own devices.
App: Music for the Pack
When you start music for the pack, the identifier of the chosen Apple Music playlist, the current song and the position in it only reach your pack's devices, encrypted. Playback runs through Apple Music with each iPhone's own subscription, and iOS asks for permission once. Apple processes search and playback as an independent controller under Apple's privacy policy (Art. 6(1)(b) GDPR).
App: Photos, calendar and Apple Intelligence
If you turn on “Show Trip Photos”, Leadwolf reads the capture time, location and a preview of the photos taken during a trip from your library and shows them in the recap and the video. The photos only leave your iPhone if you share the video yourself. If you plan a trip from your calendar, Leadwolf reads the title, time and location of your events for the next 14 days on the iPhone only. Destination and departure of the chosen event reach your pack encrypted like any route, and the app writes nothing to your calendar. Break suggestions and trip log summaries are created by Apple Intelligence on your iPhone, without a server. You can withdraw all three permissions in the iPhone settings at any time.
Live link
You can create a link that lets others see your convoy in a browser for up to 12 hours: names, avatars, positions, arrival times and destination. The key is only in the part of the link after “#”, which browsers never send to servers. My server only relays encrypted data. The live page's map is loaded by the viewer's browser from OpenStreetMap (OpenStreetMap Foundation, United Kingdom, EU adequacy decision), which receives the viewer's IP address (Art. 6(1)(f) GDPR).
TestFlight
During the beta you install Leadwolf through Apple's TestFlight. Apple provides me with your name and email address (if invited by email), installation data, crash reports and the feedback you send. I use this only to improve the app (Art. 6(1)(f) GDPR).
If you write to me, I process your details to answer (Art. 6(1)(b) or (f) GDPR) and delete them once they're no longer needed. Emails to leadwolf.app addresses are received and stored for me by Resend (Resend, Inc., San Francisco, USA) on servers in Ireland. I have a data processing agreement with Resend; possible access from the US is covered by the EU Commission's Standard Contractual Clauses.
Retention and deletion
Your account exists until you delete it: in the app under Settings, “Delete account”, or by email to [email protected]. When you delete it in the app, you briefly confirm with Apple. My server exchanges this confirmation with Apple once and uses it to revoke “Sign in with Apple” for Leadwolf. Nothing is stored in the process. When you leave a pack, the app deletes its key, except for a permanent pack: its key stays in the keychain until you remove it under “Your Packs”. Removing the app removes all its data from your iPhone.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.