Privacy Policy

This is a translation for your convenience. Only the German version is legally binding: Deutsche Fassung

Version: October 2026

1. Controller

Serhii Novytskyi, SnailGo (sole proprietorship), Hardenbergstr. 20, 47799 Krefeld, Germany
Phone: +49 171 9960427 · E-mail: support@snailgo.eu

2. Overview

SnailGo consists of an Android app for truck and van drivers (tachograph aid, truck navigation, messenger with internet calls, orders with CMR photos, hazard reports) with a free car mode for all drivers, and a web portal for dispatchers and company owners at app.snailgo.eu. We process personal data only as far as necessary to provide these functions. We do not sell data and do not show advertising.

3. Website hosting

The websites snailgo.eu and app.snailgo.eu are hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit them, technically necessary data is processed (IP address, date and time, page requested, browser type) and stored briefly in server log files. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation). A data processing agreement is in place with the host.

In addition, we keep visitor statistics on snailgo.eu without cookies and without storing any information on your device. We record the page viewed, the domain of the referring page, a campaign identifier (utm_source), the browser language, the time zone and clicks on the Google Play link. To count unique visitors, a daily-changing, non-reversible hash is created from the IP address and browser identifier and deleted after 3 days at the latest; the IP address itself is not stored. Results are stored as daily totals in Google Firebase (Google Ireland Limited). Legal basis is Art. 6(1)(f) GDPR (audience measurement and improving our service).

4. Sign-in and user account

For sign-in we use Firebase Authentication by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your phone number, the confirmation code sent by SMS and a technical user ID are processed. Optionally you can set a password to sign in later without SMS; the password is stored at Google only in encrypted (hashed) form. To protect against misuse, Google uses Google reCAPTCHA in the web portal and the Play Integrity API in the app.

The legal basis is Art. 6(1)(b) GDPR (use of the service).

5. Data stored in the cloud

The following data is stored in Google Firebase (Cloud Firestore and Cloud Storage):

• Feedback: if you write to us via “Report a problem or idea”: your text, name, phone number, app version, device model, Android version, language and mode (no location or messages) and — only if you attach them yourself — up to 5 screenshots and one video (up to 30 seconds). Photos and videos are visible only to us and are deleted after 90 days; the other data once handled, at the latest after 12 months;
• Profile: name, phone number, driver ID, language, selected mode (truck or car);
• Vehicle profile: height, width, length, weight, axles, trailer, dangerous goods;
• Messenger: messages, photos, voice messages, read receipts, groups;
• “My contacts”: the user’s personal address book in the app (including photos added by the user);
• Access permissions and orders: access permissions between driver, dispatcher and company; orders with loading and unloading points, times, cargo, notes, status, reasons for rejection or cancellation, automatically detected arrival and departure times at the points (waiting time) and delay notices;
• CMR photos: photos of consignment notes taken by the driver at unloading points, stamped with date, time, GPS position and order number; visible to the dispatchers or the company of the order (also as PDF);
• Tachograph summary: current activity (driving, work, rest) with start time and remaining driving and rest times – visible only to dispatchers or the company to whom the driver has granted access;
• Tachograph backup: a compressed copy of your driving, working and rest times so that it can be restored when you change phones; accessible only to you;
• Companies: company name, owner, dispatchers, fleet vehicles and an activity log (“History”) whose retention period the owner sets;
• E-mail notifications (web portal): if dispatchers or company owners voluntarily enter an e-mail address in the web portal, we send a reminder there when a message stays unread for 10 minutes (sender's name and message text). We store the address, the language and, per conversation, the time of the last reminder. The address can be deleted at any time (clear the field). Sending is done via our host's mail server (section 3). The legal basis is Art. 6(1)(a) GDPR;
• Device ID for notifications (Firebase Cloud Messaging) to report new orders, messages and calls.

The legal basis is Art. 6(1)(b) GDPR.

6. Data stored only on the device

App settings, recent map searches and the detailed data of the tachograph function are stored on your device (except the backup and the summary under section 5).

7. App permissions

• Contacts (optional): to show which of your contacts use SnailGo, the phone numbers in your address book are matched one by one against the directory of registered users. Names are not transmitted and the numbers are not stored. Before the system prompt the app explains this and asks for your consent. Write access is used only when you yourself rename or delete a contact in the phone book. Legal basis: Art. 6(1)(a) GDPR.
• Location: map, navigation and location sharing under section 8.
• Microphone (optional): voice messages and internet calls.
• Camera and photos (optional): photos in the messenger, CMR photos and video calls (only during the call). The document scanner (Google ML Kit) works on the device.
• Notifications, full-screen notifications, start after reboot: break and rest alarms, incoming calls and display of running timers.

You can revoke any permission at any time in the Android settings.

8. Location sharing

The app transmits the location (coordinates, speed, heading, accuracy, time) together with the current activity according to the tachograph function to Firebase, only in these cases:

• Order in progress: visible to the dispatchers of this order;
• Working day (from “Start day” to “Close day”): visible to dispatchers or the company to whom the driver has granted access;
• Vehicle in the company fleet: if the driver has expressly confirmed that his vehicle belongs to a company’s fleet (the vehicle’s company phone), the position of this vehicle is shown to the company also outside the working day (vehicle tracker).

While driving, transmission takes place about every 20 seconds, less often when stationary (vehicle tracker: about every minute or every 10 minutes). During each transmission the app shows a persistent notification. Only the last position and – during navigation – the planned route are stored; a movement history is stored only as described in section 8i. For the arrival forecast a route is also calculated regularly with the map service HERE.

The legal basis is Art. 6(1)(b) GDPR (performance of transport orders). If a company uses SnailGo for its employed drivers, the company itself is responsible for the processing within the employment relationship and must inform its drivers accordingly. The driver can revoke access permissions in the app (for company vehicles via the company) and revoke the location permission at any time in the Android settings.

Car mode (private mode): if the driver switches to car mode, the app does not transmit any location to dispatchers or companies, not even for a vehicle in the company fleet. The company or dispatcher sees only the note “Private mode since …” (time of the switch). The last transmitted position is deleted.

8a. Shipment tracking for customers

A dispatcher can create a shipment-tracking link for an order and pass it on to his customer. Via this link the following is visible without sign-in: loading and unloading points with times, order status, name and phone number of the dispatcher and – only while the order is “In progress” – the current location of the vehicle, the route and the estimated time of arrival. The driver’s name and phone number are not shown. The link contains a random key that cannot be guessed, is valid for at most 14 days and can be deactivated by the dispatcher at any time. The legal basis is Art. 6(1)(b) and (f) GDPR.

8b. Maps

In the app we use the HERE SDK of HERE Europe B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands (map, search, routes, search for truck parking along the route). Technical data such as IP address, map section, search terms and route points are transmitted to HERE. Lane data before turns is loaded by our server from OpenStreetMap (Overpass API) – only coordinates of the road section are transmitted, no user data. The map in the web portal and on the shipment-tracking page loads map images from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; your IP address is transmitted (adequacy decision of the EU Commission). The legal basis is Art. 6(1)(b) or (f) GDPR. We keep the route line calculated by HERE for at most 30 days. For map and route data, the HERE End User Terms also apply.

8c. Internet calls

Calls between SnailGo users run over WebRTC; voice is transmitted end-to-end encrypted (DTLS-SRTP) and is not recorded. If no direct connection is possible, the encrypted data stream is relayed via a relay server of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Cloudflare cannot decrypt the content. Connection set-up, time and duration of the call are stored in Firebase. The legal basis is Art. 6(1)(b) GDPR.

Video calls and calls in the web portal: Video calls are also possible, and dispatchers and company owners can make and answer calls directly in the browser (web portal). Camera and microphone are used only during a call and only after you allow it (Android or browser permission); picture and sound are transmitted encrypted like the voice and are not recorded. In the app the other person's video is hidden as soon as the vehicle drives faster than 10 km/h (only the voice continues); the speed is evaluated only on the device for this. If a call is not answered, a “Missed call” note appears in the chat. If you allow notifications in the web portal, we store an identifier of your browser (push token); via Firebase Cloud Messaging (Google) you then receive notices of calls and new messages even when the portal is closed. The token is deleted when it becomes invalid (e.g. notifications turned off in the browser) or when you delete your account. The legal basis is Art. 6(1)(b) GDPR, for notifications Art. 6(1)(a) GDPR.

8d. Crash reports

If the app crashes, it sends a crash report to Firebase Crashlytics (Google). It contains device model, Android and app version, a random installation ID and technical error details, but no messages, contacts or locations. The reports are deleted after 90 days. The legal basis is Art. 6(1)(f) GDPR (troubleshooting and app stability).

8e. Hazard reports

Users can report hazards on the road (accident, end of traffic jam, object on the road, roadworks, ice/weather, truck parking full). The type of hazard, the position where the user is when reporting, time, expiry time and the internal user ID of the reporter are stored. Other users nearby see the report on the map without the reporter’s name or phone number. Confirmations (“Still there” / “Gone”) are stored with the user ID so that each user can vote only once. Reports expire automatically after 30 minutes to 12 hours (depending on type, through confirmations at most 48 hours) and are deleted together with the confirmations at the latest on the following day. Speed cameras and police checks are not shown. The legal basis is Art. 6(1)(b) and (f) GDPR (road safety, protection against misuse).

8f. Trial period, subscription and payment (SnailGo PRO)

Free trial periods (14 days) are available once per person and once per portal account. To prevent them from being used several times through reinstallation or a new account, we store the phone number or the account ID with start and end date; this record is deleted 24 months after the end, even if the account was deleted earlier. For your account we store the access status (e.g. beta, trial, subscription, via a company, granted by us), its source and expiry date; granting or withdrawing access is logged with reason and time.

Subscription via Google Play (drivers): purchase and payment are handled by Google Ireland Limited; we do not receive card data. From Google we receive and store a purchase ID (token), the product, the status, start and end of the term, whether a trial is running, and the order number; Google notifies our server of renewals, cancellations and refunds. Google's privacy policy applies to the payment.

Billing in the web portal via Stripe (companies and dispatchers): the payment service provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes card data or IBAN, name, billing address, e-mail address and, where applicable, the VAT ID, partly as an independent controller (payment processing, fraud prevention). We store the Stripe customer ID, the subscription status, the billing period, the number of connections and the payment status of invoices; we do not store card or account numbers.

The legal basis is Art. 6(1)(b) GDPR (contract), for retaining invoices and accounting records Art. 6(1)(c) GDPR (statutory retention periods of up to 10 years, § 147 AO, § 257 HGB) and for protection against misuse of the trial period point (f).

8g. Share trip, parking, fuel prices

Share trip: if you select “Share trip” during navigation, we store for the created link your name, the destination, your position (about every 30 seconds) and the estimated time of arrival. Anyone with the link sees this information; the link ends on arrival, when navigation ends, at the latest after 12 hours. Parking: the location of your parked car is stored only on your device. Fuel prices: for the search we transmit your approximate position to our server, which queries the prices from the Market Transparency Unit for Fuels (MTS-K) via the Tankerkönig service (data under CC BY 4.0); your position is not stored.

8h. Route warnings and possible violations (truck mode)

If you leave the planned route and, according to the map data, the vehicle drives on a road closed for its dimensions or weight, the app warns you. In truck mode an entry “possible violation” (time, position, reason, vehicle data, your explanation) is stored and transmitted after 10 minutes to the company and the dispatchers with access, not to customers. Legal basis: Art. 6(1)(b) and (f) GDPR (road safety, protection of vehicle and infrastructure). In car mode nothing is transmitted. We store the confirmation of the usage notes (version, time) in the profile.

8i. Route history for the company

If the vehicle belongs to a company fleet, our server stores a route history from the positions that are transmitted anyway under section 8 – only during the working day or while a job is in progress, never in car mode and never outside work. For each day it stores points roughly every 100 metres (coordinates, time, speed) and the kilometres driven. Only the driver (in the app) and the owner of the company in the web portal (map, stops over 5 minutes, kilometres per day, GPX download) can see the history. It is deleted automatically after 90 days; the company owner can set 180 days or 1 year instead. When the account is deleted, it is deleted immediately. The purpose is proof of trips towards clients and invoicing. The legal basis is Art. 6(1)(b) and (f) GDPR; for employed drivers the company as employer is responsible and must inform them.

8j. Usage statistics

To improve the app and find errors, the app (from version 0.9.65) stores, per user and day, only counters of how often certain functions were used (e.g. app opened, working day started, route calculated, message sent, call started, hazard reported), together with the app version, Android version, device manufacturer, language and mode. No message content, locations, contacts or destinations are stored for this. Only we evaluate the counters, in aggregated form; analysis reports contain no names or phone numbers. No third-party analytics or advertising services are used. The counters are deleted after 13 months and when the account is deleted. Legal basis is Art. 6(1)(f) GDPR (improvement and stability of the service); you can object at any time (support@snailgo.eu). Since app version 0.9.69 the app also counts the kilometres driven on the device (separately for truck and car mode) while the app is open and transmits only the daily total – no routes, locations or travel times. We evaluate these figures in aggregate (e.g. total kilometres); administrators see the kilometres of an individual account only as far as needed for support.

8k. Verification code from the SMS

When you sign in, your phone (Google services or the keyboard) may automatically insert or suggest the verification code from the SMS. The app itself does not read SMS and has no access to your SMS. The code is used only for signing in and is not stored.

Waiting list: if registration is temporarily closed, we store your phone number, language and the time, so we can notify you as soon as places are available. This is deleted when you register, otherwise after 90 days at the latest. Legal basis is Art. 6(1)(b) GDPR (steps taken at your request).

8l. Support and abuse protection

Our administrators see a user's account data (name, phone number, role, registration date, last use, app version, device manufacturer, access status, links to companies and dispatchers) only as far as needed for support, billing or protection against abuse. Message content and route histories are not viewed for this. Every administrator action (e.g. granting access, blocking an account) is logged with time, administrator and reason. Legal basis is Art. 6(1)(b) and (f) GDPR.

9. Transfer to third countries

Google, Cloudflare and Stripe may also process data in the USA. These companies are certified under the EU-US Data Privacy Framework; the transfer is based on the EU Commission's adequacy decision and additionally on the EU Standard Contractual Clauses.

10. Local storage in the browser

The web portal stores in the browser only what is technically necessary (sign-in, language, display). No tracking or advertising cookies are used (§ 25(2) TDDDG).

11. Retention and deletion

We store data as long as your account exists. You can delete your account yourself at any time in the app (“More” tab → “Delete account”) or in the web portal; your account and the associated data are then deleted. For phones of company vehicles, deletion is done by the company owner. Data assigned to a company (e.g. completed orders, CMR photos, history) is kept according to the company’s settings insofar as the company needs it for its business records. Alternatively we delete your account on request to support@snailgo.eu. Details: snailgo.eu/delete-account.html.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. Please contact support@snailgo.eu.

You also have the right to lodge a complaint with a data-protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf.