Privacy policy
This policy explains what information the Leave By app handles and how. Leave By is published by Spikewave Pty Ltd (spikewave.tech).
Summary
Your data is used only to run the app’s features. It is never sold, never used for advertising and the app contains no analytics or trackers.
Information the app collects
| Data | What exactly | Why | Required |
|---|---|---|---|
| Event details | Titles, the address text you type and the coordinates it resolves to, start and end times, event type, transport mode, per-event buffer adjustments and cancelled status. For an address picked from a Google suggestion, Google's place ID is stored too, and the coordinates Google supplied are removed 30 days after the event ends. | To calculate your departure time and keep your events available across your devices. | Required |
| Computed alert schedule | The times the app has calculated to notify you for each event. | Stored server-side so alerts fire on time even when the app is closed. | Required |
| Push notification token | The device token needed to deliver notifications. It identifies the app install, not you personally. | To deliver your departure alerts. | Required |
| Email address and password | Only if you register one, to make your account permanent so you can sign back in on a new phone. Handled by Firebase Authentication — your password is stored only by Firebase, in hashed form, and we never see it. Password-reset emails are sent by Firebase. | Account management. | Optional |
| Google account profile | Your name and email address, linked to your account via Firebase Authentication. | Only if you choose to sign in with Google. | Optional |
| Google Calendar events | Read-only access to your upcoming events for the next 7 days. Nothing is ever written to your calendar. | Only if you connect Calendar (Premium), so imported events get leave-by alerts. | Optional |
| Location | Only if you have allowed location, and only while the app is open. Two uses — a rough position, taken once when you open the event form, is sent to our address-search providers so nearby places come first in suggestions; and with Premium, your position recalculates travel time from where you actually are. It is never stored, on your device or in your account. | Nearby address suggestions, and Premium's live travel-time recalculation. | Optional |
| Subscription status | Only if you subscribe to Premium. Whether your subscription is active, which plan it is on, and its renewal or expiry date, linked to your account so Premium follows you to a new phone. Your card and payment details stay with Google Play or the App Store and never reach us. | To unlock Premium and keep it across reinstalls. | Optional |
| App preferences | Default buffer, enabled transport modes and alert stages, and theme. Stored on your device only. | To remember how you like the app set up. | Required |
Using Leave By requires an account so your data can sync to your devices.
Where it is stored
Your account lives in Google Firebase Cloud Firestore on servers in the United States, protected by security rules so that only your signed-in device can read or write it. The app's requests are handled by our server functions in South Africa (Johannesburg); some older versions of the app still use functions in the United States.
Device permissions
Leave By requests the following permissions, and only for the reasons given:
- Notifications — To deliver your departure alerts. Requested on first launch.
- Location (while using the app) — The app asks for it only if you have Premium. While you use the app it recalculates Premium travel times from where you are, and if you have allowed it, a rough position also puts nearby places first in address suggestions. Never collected in the background, never stored, and declining is fine — travel time then comes from your events' addresses.
Service providers
These third parties process data on our behalf, only to make the app work:
- Google Firebase — Firestore database, Authentication, Cloud Functions and Cloud Messaging — stores your account data and delivers notifications. App Check, using Google Play Integrity, confirms that requests come from the genuine app. Privacy policy
- Mapbox — Computes real travel times, and suggests addresses as you type when Google's are unavailable. It receives origin and destination coordinates, the address text, and for suggestions your country and — if you have allowed location — a rough position; never event titles, calendar contents or account details. Privacy policy
- Google Maps Platform (Places API) — Suggests addresses and places as you type, shown with "Google Maps" attribution. It receives the text you type, your country and — if you have allowed location — a rough position so nearby places rank first, plus a session ID that groups one search; never event titles, calendar contents or account details. Leave By uses Google Maps features, and Google's privacy policy applies to that data. Privacy policy
- RevenueCat — Manages Premium subscriptions, only if you subscribe. It receives your account ID and the purchase receipt from the store — never your events, calendar or location. Privacy policy
Advertising and analytics
We do not share your data with advertisers and the app contains no advertising SDKs. The app contains no analytics or tracking software.
Security
All data sent between the app and our services is encrypted in transit using HTTPS/TLS.
Deleting your data
Deleting an event in the app removes it from your cloud account immediately. To remove everything, go to Settings → Account → Delete account, which permanently removes your account and all server-side data including events, alert schedules and push tokens. Uninstalling removes all on-device data, but your cloud account persists until deleted that way — which is what lets you reinstall without losing your events. Deleting your account does not cancel a Premium subscription — cancel it in Google Play or the App Store first.
You can also email leaveby@spikewave.tech and we will delete it for you.
Your rights
Under the Protection of Personal Information Act (POPIA) in South Africa — and under the GDPR if you are in the EU or UK — you may ask us to confirm what personal information we hold about you, correct it, or delete it. Write to leaveby@spikewave.tech and we will respond within 30 days.
Children
Leave By is not directed at children and we do not knowingly collect information from anyone under 13 (or the relevant age of digital consent in your region).
Changes to this policy
We update this page whenever what the app collects changes, and note the revision date at the top.
Contact
Spikewave Pty Ltd
Registration number 2026/658861/07
Johannesburg, Gauteng, 2090
South Africa
leaveby@spikewave.tech