Privacy

Last updated August 4, 2026

TenFour runs on location data from working drivers. That only works if handling it carefully is a design constraint, not a paragraph in a policy. Here is exactly what we collect, what we never collect, and when data dies.

What we collect, and why

Your precise position, when you check in or file a report. It is used once, to work out which market cell (about a 36 km² hex) or road segment you are reporting about, and to sanity-check that reports come from somewhere near their subject. Precise positions are deleted within 24 hours — enforced by a scheduled database job, not a promise. What outlives them is the hex-level aggregate.
Your check-ins and road reports. Status, equipment type, the derived cell, and anything you put in a report. Other drivers see reports with your handle on them — that attribution is how the trust system works.
Your email address. Used to sign in and to reach you for password resets. The app's own database stores only a one-way hash of it; the raw address lives in the credential store.
A salted hash of your IP address, kept briefly for rate limiting. The raw IP is never written to disk, never logged, and never stored with your account or sessions.

What other drivers can see

Each of your check-ins appears on the driver board as a market area (the ~36 km² hex, never a point) and your status — loaded or hunting. By default it is listed as “Anonymous driver.” Your handle appears only if you tick “show my handle” on that check-in, and your load's destination area and rate appear only if you tick “share load details.” Each check-in's choices are its own.
No driver's precise position is ever visible to another driver. Not on the map, not on the board, not through the API. The board's data path is structurally unable to carry a coordinate finer than the market area, and the table holding precise positions is locked with database row-level security and purged within 24 hours.
Your road reports carry your handle and your reports' track record. They never carry your position beyond the report's own location.

What we don't do

No advertising, no ad trackers, no analytics scripts.
No selling or sharing of data with data brokers. Ever.
No background location from the web app — it cannot, and we don't try.
No cookies except the session cookie that keeps you signed in.

Deleting your account

Account → Delete. It takes your password and takes effect immediately: sessions are revoked in the same request, credentials are erased, and your profile, saved positions, raw check-ins and reports are permanently erased within 30 days. What survives is the anonymous hourly market totals other drivers already saw — numbers with no name attached.

Questions

Write to the address in your account emails. If any of this page ever disagrees with what the product does, that is a bug — tell us and we will fix the product or the page, whichever is wrong.