Legal

Data & retention

Last updated: August 5, 2026

This is the plain-language version of how Formation handles the data from a drive. The short version: live data is a temporary room, not a permanent trail. Here is exactly what that means.

Live location is never stored

While a convoy is active, your position is relayed between the members of that convoy in encrypted form so the crew can see each other on the map. It is not written to a database and there is no table of where you have driven. When the convoy ends, that live stream stops and nothing about your live position remains.

Convoy chat and the live route are wiped automatically

Convoy chat and the live route payload are ephemeral. Rather than living forever, they are removed from live systems automatically on a short, recurring cycle. You do not have to do anything for this to happen. The cleanup runs on its own.

Saved routes are the one thing you keep on purpose

A saved route is different from live location. If a host chooses to save a route, Formation stores the plannedroute, meaning the waypoints the host set, not anyone’s live GPS trail. It is opt-in and user-initiated, so it intentionally outlives the convoy cleanup, and it can be deleted at any time. Saving a route is a deliberate action, not automatic tracking.

Stats are totals, not a trip log

Formation shows totals like miles driven in convoys and meets attended or hosted. These are computed on your device and stored as running totals only. There is no per-trip, per-route, or position history behind them.

Diagnostics expire after 30 days

Formation keeps limited crash and error diagnostics for up to 30 days so we can identify and fix broken app versions. Reports use a pseudonymous device identifier and may be associated with your account when you are signed in. Common personal information and secret values are redacted before the report is sent, and the reports are not readable by other users.

Voice instructions may be reused

When cloud voice guidance is available, a short instruction or convoy callout is converted into audio and may be cached for reuse. The cached phrase is not labeled with your account or device identifier and does not contain your live GPS coordinates, although an instruction may include a street name. On-device speech is used when cloud voice is unavailable.

Legal and moderation holds

There is one important exception to the wipe. If content is reported for moderation, or if we are legally required to preserve it, that specific content is held so it can be reviewed or so we can meet a legal obligation. In other words, a hold always beats deletion. When content is removed, it is removed from live systems. A hold does not shred evidence that we are required to keep, and deletion never lets someone erase content that is under review.

Deleting your account

You can delete your account at any time in the App at Settings, Privacy & safety, Delete account. This removes your account and its associated data from live systems, subject to the limited holds described above.

If you have already uninstalled the App or cannot sign in, you can request account deletion here.

For the full picture of what we collect and who we share it with, see the Privacy Policy.