Privacy Policy

Effective 10 October 2026 · Tail End Charlie is operated by Holt Racing Limited ("we", "us")

In short: Tail End Charlie shares your live location with your own ride group while a ride is active, so the group can stay together. If you explicitly create a time-limited personal safety link, one trusted contact can also see your last-known position and status. A group leader can instead create a whole-group watcher link after confirming the group has been told; it shows the current roster, each rider's last-known position and freshness, and the planned-route outline. Both links are read-only, revocable and automatically expire. That data is encrypted at rest, kept only briefly, and deleted automatically. The app has no analytics, no advertising, no trackers, and does not sell data. Your emergency contact details stay on your phone unless you choose to share them, or opt in to auto-sharing with the ride leader during an emergency-stop alert — both described below. The website ride planner keeps your draft route and preferences in your browser so it is there when you return. If you choose Create app code, an encrypted shared copy is stored for 30 days so the code or emailed link can reopen it. It uses no cookies or tracking storage. You can read the full detail below, or jump straight to your rights or how to delete your data.

Beta notice: Tail End Charlie is in an open beta and in active development. As we add and change features, what data we collect and how we handle it may change too, so this policy should be treated as preliminary and is likely to be updated frequently during this stage. We'll keep it accurate as the app evolves.

Who we are

Tail End Charlie is a group-riding app for motorcyclists, developed and operated by Holt Racing Limited, a company registered in England and Wales (company number 12633258, registered office Hockford Cottage, Ash Road, Pirbright, Woking, Surrey, England, GU24 0DE). For the purposes of UK data protection law, Holt Racing Limited is the data controller for the personal data described in this policy.

Information we collect

Location data

While you have an active ride open, the app uses your device's GPS to show your position to the rest of your ride group, provide turn-by-turn navigation, and detect and warn about route deviations. Location sharing only happens while a ride screen is open and only with the group you are riding with — you can pause or stop it at any time from within the app. A ride that nobody ends does not keep sharing for ever: if you have been away from the group, and not on an unfinished route, for about half an hour, the app asks whether you are still riding. If you do not answer, it stops sharing your location 15 minutes after you were asked or last moved, whichever is later, and keeps it stopped until you choose to resume. Sending an alert, such as an emergency-stop alert, switches sharing back on so that you can be found. A dot on the ride menu always shows whether you are sharing, and a message on the ride screen says so while you are being asked or sharing is off.

Ride and group data

To keep a ride group coordinated, the app synchronises a small set of ride events between group members: your chosen display name and marker colour, your live position, hazard reports and route-deviation alerts, an emergency-stop alert if you trigger one, and, if a ride leader records one, the reference route for the ride. This data is only visible to people in the same ride (joined using that ride's six-digit code) and, where the app is online, passes through our relay server described below.

Optional personal and group watcher links

If you explicitly create a personal safety link, anyone you give that private link to can use a read-only web page to see your single last-known position, when it was recorded, update freshness, whether the ride is waiting, active, paused or ended, and whether you most recently sent a help or emergency-stop status.

If you are the group leader, you can instead create a whole-group watcher link after confirming you have told the group. It shows the current rider display names, roles and colours, each rider's last-known position and freshness, ride status, and a bounded outline of the planned route. It does not show location trails, ride or join codes, rider identifiers, speed or heading, phone or ICE information, medical notes, quick-message history, rejoin routes, or any participant control. The watcher does not join the ride or appear in its roster.

You choose a duration of up to 24 hours and can revoke either kind of link from the app. An old or missing update is not proof that anybody is safe.

Emergency contact (ICE) sharing

Your in-case-of-emergency contact name, phone number, and any medical notes stay on your device by default and are not included in the ride and group data above. They only reach anyone else in the ride if:

you explicitly choose to share them with the whole group, from the ride menu; or
you have switched on the optional setting to share them automatically with whoever currently holds the ride-leader role, which then happens whenever you send an emergency-stop alert.

When shared, the recipient's app tells your app once they've opened it, so you can see it was seen. A copy a leader (or other recipient) receives is deleted automatically when the ride ends, unless they've called or texted the contact from within the app, in which case it's kept so they can follow up.

Other information that stays on your device

The following is stored only in the app's local storage on your phone and is not sent to our relay server, to other riders, or anywhere else unless you explicitly share or create an app code:

Your distance-unit and display preferences.
Imported or recorded GPX route files you haven't shared.
Places you have chosen in the app's destination search, so the search can show them again: the last ten, newest first, which you can clear from the search. And any places you save as Home, Work or under a name of your own, with the address or coordinates they point to, which you can rename, move or delete from the search. They are not part of a ride, so no other rider and no relay sees them, and they are not written to the diagnostics log or included in an exported ride. Typing in the search narrows this list on your phone and sends nothing; a search is sent to the search provider only when you submit it. When you choose one of these places as a start, stop or destination it is used like any other place, so its coordinates go to the routing service to calculate the route, as described under Who we share information with.
The record of alerts raised during a ride (the one-tap Report button, or a speed-camera or police report), kept with the completed ride in your Ride Library with the time, the place and who raised each one. It appears on the ride review. If you export or share a ride, the alerts are included in the GPX, CSV or summary you choose to send.
If your build offers the Record ride diagnostics setting, which is off by default: a text log of each turn instruction and when it was spoken, every alert, and this phone's own route. In a group ride it also counts how updates from other riders reached your phone, by phone signal or by Bluetooth. It records no other rider's position and no rider's name (other phones appear as “phone A”, “phone B”). Nothing is sent anywhere until you choose a recipient when you share the log.

Personal and global ride heatmaps

The optional Personal rides map layer is calculated entirely on your phone from travelled tracks in your Ride Library. It is on by default and does not send those tracks to us. Deleting a ride removes it from that local layer.

The separate Global rides layer displays a public, thresholded aggregate. Viewing it is off by default and never opts you into contribution. Contribution of completed rides is opt-in and off until you choose. First setup asks, with no option pre-selected, and skipping it means Never. A phone that installed the app before that question existed, and never stored a choice, is asked once on the home map and shares nothing until you answer. Settings lets you choose Never, Ask after each ride, or Always after a ride, and hide 0, 500 m, 1 km (the default), or 2 km at both ends. Settings can share existing saved ride coverage in one bulk action.

If you consent, your phone uses only the travelled recording, removes the chosen distance from both ends, converts what remains into an unordered, deduplicated set of roughly 170–210 m map cells, and sends those cells using a separate random heatmap credential. It does not send a GPX track, ordered route, ride or join code, ride name, display name, installation identifier, speed, direction, timestamps, or live-ride credential. The cells can still describe places you visit and are not described as anonymous.

A bulk share applies the same endpoint removal separately to every eligible saved ride, then combines and deduplicates their cells into one unordered upload. It does not connect separate rides or send the boundaries between them.

We merge cells by opaque contributor and calendar month and retain them for up to 24 complete calendar months. The public map publishes only daily snapshots and only where at least three distinct opaque contributors covered a cell; it exposes broad contributor and intensity bands, never identities or exact counts. That threshold reduces sparse disclosure but does not prove three different people and does not stop long-term comparison of public snapshots.

Stop contributing and remove my data deletes the contributor credential, monthly cells and retry receipts from the relay; the next daily public snapshot excludes them. The local ride remains in your library. The removal credential is kept in your phone's protected storage: after a lost phone or unrestored upgrade we may need the opaque handle or other information you retained to help with an exceptional deletion request. Contact [email protected].

Personal and shared arrival estimates

Personal arrival-time learning uses suitable completed rides on your phone, excluding long breaks and uncertain recordings. You can disable or reset it in Settings. It does not upload your ride history.

Contribute to motorcycle estimates is a separate, optional setting, off by default. It sends up to three rounded timing ratios for broad road types, using a separate random credential. No route, trip date, duration, distance, absolute speed, account identity or heatmap credential is included. The relay stores a hash of that credential, the coarse ratios and a 90-day expiry date. Normal network request handling still applies as described below.

Public trends require at least 20 contributor profiles per road type and contain no individual profiles or exact contributor counts. Switching sharing off removes your profile; if offline, the phone keeps the deletion credential and retries when connected. Resetting personal learning also replaces the shared profile when sharing is enabled. Expired profiles are excluded and removed by regular cleanup. Other phones can retain previously downloaded public trends for up to seven days. Your original ride records stay on your phone.

Website ride planner

To provide the save-and-return feature you request by using the planner, the browser stores your ride name, stops, route shape, routing preferences, café-layer preference, and most recently generated route in first-party local storage on your device. The draft is ignored after 180 days and removed the next time you open the planner; you can remove it sooner with Clear local data. Place-search results are cached in the same browser storage for up to seven days to avoid repeating the same search and to respect the search provider's usage limits. The website sets no cookies and uses this storage only for the planner features described here, not for analytics, advertising, or tracking.

If you select Create app code, the route name, stops and GPX route shape are sent to our relay and encrypted at rest. The shared copy is deleted automatically after 30 days. Anyone with its short code can load that route in the app or reopen its editable web copy, so treat the code and link as private. Email route opens your own email application with the link and code filled in; the website does not send or receive the email.

If you draft a motorcycle discovery-layer suggestion, the browser also keeps its name, category, reason, evidence link and selected map geometry in first-party local storage. It is not sent automatically when your connection returns: you must confirm submission. Once sent, the relay keeps it in a private moderation queue. Approved suggestions and their audit provenance are retained with the public catalogue; rejected or superseded suggestions are deleted after 90 days. The public map never exposes an unreviewed submission or submitter network information. You can ask us to review an urgent closure or takedown at the contact address below.

The mobile app follows the same confirmation rule. A suggestion is stored as an offline draft in the app's local preferences and remains there until you open the discovery-layer controls and choose to send queued suggestions. A failed send leaves the draft on the device.

The built-in biker café catalogue and its map locations are stored in the website and matched locally in your browser. When a search does not match that catalogue, the search text is sent to the public Nominatim service. When you add two or more route points, their coordinates are sent to the public OSRM routing service so it can calculate a road-following route. Sorting cafés by road time also sends the start point and café coordinates to OSRM. If you select motorway, major-road, toll, or ferry avoidance, route coordinates are instead sent to the public Valhalla motorcycle routing service operated by FOSSGIS/OpenStreetMap.de. Loading the map also connects your browser to OpenFreeMap to retrieve map styles and tiles. As with ordinary web requests, these providers receive your IP address and standard connection information.

The mobile app's Show mapped speed limit setting is on by default and can be turned off. While it is on and you use the map in Great Britain or the Isle of Man, the app periodically sends your current and a recent prior foreground location point, current GPS accuracy, and sampled points up to one kilometre ahead on your active route to a configured Valhalla road-matching service. If there is no active route, those look-ahead points are projected along your current heading. The points are used to identify the current and upcoming roads. Development and alpha builds use the public FOSSGIS/OpenStreetMap.de Valhalla service. This is used only to identify OpenStreetMap roads with explicitly mapped speed limits. Tail End Charlie keeps prefetched answers only in app memory during the ride and does not store the lookup requests. The provider receives your IP address and standard connection information. Mapped limits are not live and can be incomplete or out of date, so roadside signs always apply.

The mobile app draws fuel stations and chargers from a map layer bundled with the app, and Navigate to fuel ranks them on your phone; neither sends anything. Where the Tail End Charlie relay offers fuel prices, the app asks it for the prices inside the part of the map you are viewing, as boxes on a fixed grid of about 55 by 50 kilometres. The request carries the app's version and platform but no rider, ride or device identifier, and the relay does not store it. The relay collects prices itself from the UK Government's Fuel Finder scheme and, where enabled, France's prix-carburants open data; neither receives anything from your phone.

Device identifier

The app generates a random identifier on your device to distinguish participants within a ride's event stream. It is not your name, email address, phone number, or an Apple or Google account identifier — the app does not have user accounts or sign-in at all.

Push notifications

If you allow notifications, your phone registers with Apple's push service (iOS) or Google's Firebase Cloud Messaging (Android) so the relay can send an alert hint to riders in your ride. The registration token is encrypted on the relay, tied to your random device identifier for one ride, and revoked when you leave or the ride ends. Notification text contains no name, position or emergency-contact details. Apple and Google process the token under their own privacy policies. You can refuse notifications and still use the app.

Technical and security information

Our relay server processes your connection's IP address transiently, to apply rate limits and prevent abuse. It is not written to the database alongside ride data. Standard web-server logs (e.g. connection timestamps) may be kept briefly for security and operational purposes.

How we use your information

To share your position and status with your own ride group.
If you explicitly opt in, to show your last-known progress to the trusted safety contact who has your private, time-limited link.
To provide navigation and route-deviation warnings.
To relay hazard reports, alerts, and emergency-stop signals between riders in the same ride.
To operate destination search and road routing (see Third parties, below).
To store and retrieve a planned route when you explicitly create or use a route code.
To secure the relay service against abuse and misuse.

We do not use your information for advertising, profiling, or analytics, and we do not sell or rent it to anyone.

Our legal bases for processing

Under UK GDPR, we rely on:

Consent — for location sharing, which the operating system asks you to grant and which you can withdraw at any time in your device settings or by pausing sharing in the app; and for sharing your emergency contact details, which only happens if you take an explicit sharing action or switch on the default-share-with-leader setting yourself.
Contract — processing ride events is necessary to provide the group-riding feature you're actively using.
Legitimate interests — for rate-limiting, abuse prevention, and keeping the relay service secure and reliable.

Who we share information with

Maps, destination search and routing. By default, the app and website ride planner send user-requested destination searches to the OpenStreetMap Foundation's public Nominatim service and route coordinates to the public Project OSRM service, or to the public FOSSGIS/OpenStreetMap.de Valhalla service when motorway, major-road, toll, or ferry avoidance is selected. If mapped speed limits are enabled in the mobile app, the current and a recent prior foreground location point, plus sampled points up to one kilometre ahead on the active route or current heading, are also sent to the configured Valhalla service for road matching. The website also loads map styles and tiles from OpenFreeMap. These are independent third-party services. Nominatim is covered by the OpenStreetMap Foundation's privacy policy.

App marketplaces. Apple and Google process installation and device information as part of operating the App Store and Google Play, under their own privacy policies.

Watcher maps. The private observer view does not send a rider's or group's last-known viewport to OpenFreeMap. It requests map assets only from the same Tail End Charlie relay that serves the observer snapshot, or shows coordinates when those private map assets are not configured.

We do not use advertising networks, analytics SDKs, crash-reporting services, or any other third-party trackers in the app, and we do not share ride or location data with data brokers. Location is sent to map and routing providers only for the user-requested and opt-in features described above.

How long we keep information

Ride data is kept only as long as it is useful for the ride it belongs to, and is deleted automatically by the relay server:

Data	Kept for at most
Live location updates	30 minutes
Safety-contact access grant	24 hours, or less if you choose or revoke it
Status messages and route-deviation alerts	2 hours
Hazard reports	24 hours
A shared emergency contact, on the server	2 hours
A ride's remaining records, after the ride is ended	24 hours
A ride record overall (if never explicitly ended)	72 hours after any phone in the ride last synchronised
A planned route shared with an app code	30 days from creation

A cleanup process runs on the server and permanently deletes anything past its expiry — retention limits are enforced automatically, not just promised. Information kept only on your device (see above) is kept until you delete it, uninstall the app, or clear the website's browser storage, as applicable. A planner draft is ignored after 180 days and removed on your next visit; cached searches expire after seven days. A route-code copy is separate from the browser draft and expires after 30 days even if the original draft remains on your device.

How we protect your information

Connections to the relay server are encrypted in transit (TLS).
Ride event content is encrypted at rest on the server using AES-256-GCM. This protects stored data against, for example, theft of a database file or backup; it does not mean the data is end-to-end encrypted between riders, since the relay operator holds the key needed to relay events between group members.
Route-code GPX content is also encrypted at rest. The short code is a bearer secret: anyone who has it can retrieve that shared route until it expires.
Ride join codes are short-lived, rate-limited, and stored as encrypted, hashed records rather than plain codes.
Safety-contact access uses three separate high-entropy credentials for management, publishing and read-only viewing. The relay stores only their hashes, automatically expires them, and cannot use them to join a ride or retrieve the ride event feed. Personal and group grants have distinct server-enforced scopes.

Your rights

Under UK GDPR, you have the right to:

Ask what personal data we hold about you and get a copy of it.
Ask us to correct inaccurate data.
Ask us to delete your data (see below).
Object to or ask us to restrict certain processing.
Ask for your data in a portable format, where applicable.
Withdraw consent at any time, for anything we process based on consent, without affecting processing that already happened.

To exercise any of these rights, contact us using the details below. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Deleting your information

Uninstalling the app immediately removes everything stored on your device, including any ICE details and preferences.
Ride data on the relay server deletes itself automatically on the schedule above — there is nothing you need to do.
To request earlier deletion of a specific ride's data, or ask any other question about your data, email us at the address below.

Children

Tail End Charlie is for riders aged 17 or over. It is not directed at, or intended for use by, anyone under 17.

International transfers

Our relay server is operated from the United Kingdom. Where the app or website contacts third-party services described above (maps, destination search and routing), those requests may be processed on infrastructure outside the UK, governed by that service's own privacy terms.

Changes to this policy

We may update this policy as the app changes. We'll update the effective date above when we do, and material changes will be reflected here before or when they take effect.

Contact us

Holt Racing Limited · [email protected]

Beta support, bug reports and feedback: [email protected]. For data requests use the privacy address above.