Privacy Policy

1. Information stored by the app

MichiLoop stores the profile, vehicles, trip plans, journal entries, locations, photos, videos, voice notes, travelled routes, distances, per-journey budgets, trip expenses (amount, currency, date and time, category, merchant, memo, purchase items, fuel details, and a confirmed merchant and location), and receipt images the user chooses to keep. A journal entry may include weather and attribution returned by Apple Weather for its recorded time and place.

This information is stored on the user’s device in SQLite and Application Support. When iCloud is available, it is synced to the user’s private MichiLoop CloudKit database. Per-journey budgets, trip expenses, and receipt images remain on this device until the staged rollout of a compatible app version is complete. Journal data and media are not stored on a server operated by the Provider.

When the user explicitly selects walking as the travel mode for a recorded segment, MichiLoop may obtain step count, distance, pace, and floors ascended or descended measured by Apple Core Motion. These measurements are used for the journey’s walking record, not for health goals. During a ride, if Motion access is already authorised, on-device activity classification is also used only to check whether it conflicts with a GPS-based prompt to review the travel mode. Motion alone never creates a prompt or automatically changes the travel mode or trip record. Walking measurements are stored only in Application Support within the current storage scope. Activity classification and the evidence for a review prompt are transient on-device state during the ride; they are not saved or sent to the journal, CloudKit, GPX, sharing, or analytics. Walking measurements, classification, and prompt evidence are not automatically sent to the widget, the Provider, or a third party.

Receipt text recognition uses Apple Vision and runs on the device. MichiLoop does not send the image or recognised text to a third-party AI or external OCR service. The user reviews the result before saving. Full recognised text, text positions, confidence values, and candidate history are not stored, synced, exported, or logged. When finding nearby stores from a trip location, the merchant-name suggestion and search location are sent to Apple Maps; the receipt image and full recognised text are not sent. A receipt image is attached only when the user chooses to keep it.

The main app stores the next plan, preparation progress, ride statistics, the latest journal title, date, distance and duration, up to 40 trip-plan coordinates, and up to 120 points from a simplified travelled route in an App Group. Only the app and its widget use this information on the same device; it is not sent to the Provider or a third party. It is removed when the user chooses Delete Data or switches the Apple Account whose data is displayed.

During a ride, Live Activity displays elapsed journey time including breaks and stopped movement recording, movement-recording status, distance, travel mode, and GPS status on the Lock Screen and Dynamic Island. It may also show the linked plan name, next checkpoint, schedule difference, arrival place, photo count, distance-milestone progress, rest reminder, and a prompt to review the travel mode. It does not show coordinates or the recorded route.

2. Accounts, advertising and analytics

No MichiLoop account is required. The Provider cannot access the email address or credentials for the user’s Apple Account.

The released App Store version 1.1.10 does not show advertising or include third-party advertising SDKs. Advertising update 1.1.11 (build 120) uses Google Mobile Ads 13.11.0 and User Messaging Platform (UMP) 3.1.0 in the main app. As a general travel and private-journal app, MichiLoop may show banners on safe content screens for free users and a frequency-limited full-screen ad after a new completed plan is saved. Ads are excluded when safety or an action takes priority, including an active journey, capture, text entry, purchases, consent, privacy, recovery, deletion and export.

If the user voluntarily chooses and completes a rewarded ad, one creation credit allows an additional basic one-day plan or draft to be saved. Up to three credits can be acquired per day for the on-device storage scope, with at most one held; a credit is used only after a successful save. No ads are requested or displayed for active Plus, including an eligible trial or valid grace period, purchased Creator Pack, or verified eligible legacy purchases. Creator Pack and eligible legacy purchasers can acquire an ad-free credit under the same acquisition conditions. Unresolved purchase status also stops ad requests. Development, test environments and TestFlight do not request production ads.

Journal text, precise location, travelled routes, search terms, profile or vehicle information, photos, videos, audio, receipts and StoreKit transaction details are not attached to ad requests or used for ad targeting. However, Google's advertising SDK may process IP addresses and the approximate location inferred from them, device information and device identifiers, ad impressions and interactions, and diagnostic information for ad delivery, fraud prevention or advertising measurement. Consult Google's Privacy Policy and advertising-service information for processing details, retention and deletion.

The app requests non-personalised ads, disables publisher personalisation and first-party IDs, and specifies restricted data processing. These settings alone do not guarantee that no information is collected or that tracking is absent. UMP handles ad consent and privacy choices where required for the region. When privacy choices must be reopened, the app's Settings entry lets the user change or withdraw consent. When first preparing ads, the app checks iOS tracking permission and only initialises the advertising SDK and requests ads when permission is authorised. It does not request ads when permission is denied or restricted. Tracking permission is not a condition for free features or additional creation credits: credits remain available without ads under the same limits when ads are unavailable.

No independent analytics SDK or third-party purchase-management SDK is being added. The official website itself has no ads or independent analytics. Google's Privacy Policy is available through the link below.

Google Privacy Policy

3. Permissions

When selecting existing photos or videos, MichiLoop uses the iOS system photo picker and receives only the items selected by the user. MichiLoop requests photo access so it can read when and where the selected photos and videos were taken and fill in the date and place of the entry. It reads only the items the user selected; it does not read or enumerate the rest of the photo library. Refusing this permission still allows attaching photos and filling in the capture date. MichiLoop requests add-only Photos permission to save a trip cover or share card the user creates. The camera is used for journal and saved-spot photos and for receipt scanning started by the user; expenses can still be entered manually when camera access is refused. MichiLoop requests access to the microphone, location, Motion & Fitness, and notifications only when the user uses a related feature. Motion & Fitness is used for walking measurements and, when already authorised, to support an on-device prompt to review the travel mode during a ride. Motion alone never creates a prompt or changes the travel mode or trip record, and the supporting evidence is not sent off this iPhone. After the user starts a ride log, location is recorded until the user ends it, including while the screen is locked or another app is in use. Location is not continuously collected outside an active ride session.

Permissions can be changed at any time in iOS Settings. Refusing a permission prevents the related feature but does not prevent use of unrelated features.

4. Apple services

MichiLoop uses Apple MapKit for place search and routes, Apple WeatherKit for weather, and Apple iCloud for synchronisation. Search terms, places, routes, times, and other information necessary to provide these features may be sent to Apple. Apple’s privacy policy applies to Apple’s handling of that information.

MichiLoop uses Apple StoreKit to purchase Creator Pack and MichiLoop Plus, check subscription status, and restore purchases. Apple handles the purchase process, reconciliation with the Apple Account, and payment information; the Provider does not receive full payment-card numbers. The app checks StoreKit entitlements and subscription status on the device to unlock features. It does not send entitlements, subscription status, or app data to a third-party purchase-management SDK. Apple’s terms and privacy policy apply to sales and transaction information Apple makes available to the Provider.

The App Store version does not include transmission to a third-party AI service or a feature for registering an external API key. If WeatherKit is unavailable, MichiLoop does not send location to a substitute weather provider.

5. Sharing and files

Travel Circle is invitation-only private sharing through Apple CloudKit Sharing. After the recipient accepts one invitation, MichiLoop uses a private control share that contains no journey or plan content to prepare independent read-only content shares so either person can explicitly send an item. Becoming connected publishes nothing. MichiLoop provides no public profiles, people search, public feed, follows, comments, reactions, collaborative editing, or live-location sharing.

An ordinary Travel Circle summary may contain only the title, day-level date range, category, selected distance and vehicle summary, sharing display name, and a plan’s start and destination display names and day count reviewed in the sharing screen. Only when the sender explicitly selects “Places and Routing for a Personal Plan” may it also contain the names and precise coordinates of the start, destination, and checkpoints, plus checkpoint day, category and stay, route type and condition, and toll or highway avoidance settings. It excludes current location, travelled routes, route geometry, exact start and end times, addresses, journal text, private notes, photos, videos, audio, expenses, receipts, source internal identifiers, and Apple Account email addresses or credentials. A plan saved by the recipient receives new internal identifiers and is an independent copy that does not automatically follow later edits or deletion of the source.

If both people review journeys they already explicitly shared and separately propose and accept a Journey Association, MichiLoop shares only an association identifier, state, revision, and each journey’s title, day-level date range, and shared-content version. If they then separately propose and accept a shared checklist, MichiLoop shares up to 20 short item labels, each item’s open or completed state, creator, and revision. Associations and checklists are pairwise. They do not co-edit either person’s journey, plan, private preparation items, or notes and add no location, route, exact time, expense, photo, or other private record.

Trip images, GPX files, and other data are passed to a destination only after the user reviews the content, starts an export or share action, and chooses the destination. The selected service’s terms and privacy policy apply.

A GPX exported from a recorded journey contains precise locations within the scope selected by the user and timestamps only for GPS points whose observed timestamps were saved. Checkpoints are excluded by default; when the user adds them, only their name, coordinates, and record time are included. Journal text, addresses, photos, videos, audio, notes, and vehicle IDs are excluded. An exported file is an independent copy and does not automatically follow later edits or deletion of the source record.

A GPX file is imported only after the user selects it on the device. MichiLoop does not automatically send GPX files to a server operated by the Provider.

Data Management in Settings can export rider data in the current storage scope, including per-journey budgets, confirmed trip expenses, active or unsaved rides, and walking measurements stored on this device. The export contains rider records and settings but excludes internal sync history, deletion metadata, and CloudKit bookkeeping. Readable attached media, including receipt images the user chose to keep, is included in a TAR file created in protected temporary storage. It is never sent automatically and leaves the app only after the user chooses a destination. Expired temporary exports are deleted automatically.

6. Support and the official website

If a user contacts support by email, the Provider handles the email address, message, and any app version, device details, or attachments the user chooses to provide to answer the request, investigate a problem, and prevent abuse. Do not send unnecessary location data, photos, GPX files, or credentials.

The hosting provider may process request information such as IP address, browser information, and access time to deliver and secure the official website. The Provider does not add independent analytics, advertising, tracking cookies, or a contact form to the website.

7. Retention and deletion

Content received through Travel Circle may remain in an on-device cache scoped to the Apple Account currently displayed. Revocation, source deletion, blocking, and disconnection take effect after CloudKit synchronisation and may be delayed while offline. After ordinary shared content is removed, MichiLoop may temporarily retain only payload-free identifiers needed to finish remote cleanup. MichiLoop cannot retrieve a copy the other person saved or captured outside the app.

Journal entries, plans, trip expenses, profile, and vehicle information can be deleted in the app. Deleting a ride log also deletes its corresponding on-device walking measurements. Delete Data in Settings removes data, walking measurements, attached media including receipt images, current-scope recovery backups, unsaved rides, notifications, and widget content in the currently displayed Apple Account or on-device storage scope. When iCloud is in use, deletions of CloudKit-enabled items are synchronised to the same Apple Account’s other devices, including iCloud media in the current scope.

Data from an older app version whose storage environment cannot be identified is separated as Protected Legacy Data and is not removed by Delete Data. Each protected source can be explicitly deleted from its detail screen after the user exports it or confirms deletion without exporting.

Original photos and videos in Photos are not deleted. Media captured in MichiLoop and not saved to Photos will not remain after its MichiLoop data is deleted. On-device data is removed when the app is deleted. iCloud data can be deleted in the app or through iOS storage management.

Support information is kept only as long as necessary to answer the request, recheck a problem, comply with law, or handle a dispute, and is deleted when no longer needed. To request deletion of support information, contact us from the same email address. The hosting provider’s retention policy applies to its logs.

8. Security

The Provider takes reasonable measures to protect support information against unauthorised access, loss, alteration, or disclosure. App data is managed through Apple-provided device storage and the user’s private iCloud area.

9. Changes

This policy may be updated when features, practices, or applicable law change. Material changes will be identified by the updated date on the official website and, where appropriate, in the app.

10. Contact

Questions about this policy or information handling: info@tkgshoyu.jp