Privacy Policy

1. Plain-language summary

In short:

• Your conversations are stored in a local database on your phone only.
• AI inference — your prompts, images and voice recordings — happens entirely on-device. Nothing is sent to us or any AI provider.
• The app does not require an account and collects no personal information at sign-up because there is no sign-up.
• The only network requests the app makes are to Hugging Face when you choose to download a model file.
• We use no analytics, advertising or tracking SDKs.

2. Who we are

OffRoad is an independent open-source project. References to "we", "us" or "our" in this policy refer to the OffRoad project maintainers. The app is distributed via the Apple App Store and Google Play Store.

This policy applies to:

• The OffRoad mobile application (iOS and Android)
• The OffRoad website at the domain where this page is hosted

3. What we collect — and what we don't

The table below describes every category of data and where it lives.

4. On-device AI processing

All AI inference in OffRoad is performed by a model file downloaded to and running on your device. The inference engine (flutter_edge_ai) processes your input locally using your phone's CPU or GPU.

This means:

• Your text prompts are never transmitted to a remote AI service.
• Images you attach to a conversation are analysed locally by a vision model on your device.
• Voice recordings are transcribed locally; the audio data is not uploaded anywhere.
• The model's response is generated on your device and never passed through an external API.

We are structurally incapable of reading your conversations because they never reach our systems.

5. Network use

OffRoad connects to the internet in exactly one scenario: downloading model files you choose from Hugging Face.

5.1 Model downloads

When you tap the download button for a model, the app makes an HTTPS request to huggingface.co to fetch the model file. Hugging Face may log standard server-side data (IP address, timestamp, file requested) as part of their own infrastructure. Their privacy practices are governed by the Hugging Face Privacy Policy.

5.2 Gated models and access tokens

Some models (e.g. certain Google Gemma variants) require you to accept the publisher's licence on Hugging Face and provide a read-only access token. If you enter a token in Settings, it is:

• Stored locally in the OS secure keychain (iOS Keychain / Android EncryptedSharedPreferences).
• Transmitted only to huggingface.co as an Authorization HTTP header during model downloads.
• Never sent to us or any other party.

5.3 No other outbound connections

The app makes no other network requests. There are no analytics endpoints, no crash reporting services, no update-check pings and no advertising network calls.

6. Data storage and retention

All data created or stored by OffRoad exists solely on your device:

• Chat history — stored in a SQLite database in the app's private sandbox. You can delete individual messages, entire conversations or all history at once from Settings → Privacy Control.
• Model files — stored in the app's documents directory. You can delete any model from the Model Store or Settings → Storage.
• App preferences — stored in SharedPreferences. Uninstalling the app removes all data.

We have no server-side retention schedule because we hold no server-side data.

7. Third-party services

OffRoad does not integrate any of the following categories of third-party SDK:

• Analytics (e.g. Firebase Analytics, Amplitude, Mixpanel)
• Crash reporting (e.g. Sentry, Crashlytics, Bugsnag)
• Advertising (e.g. Meta Audience Network, Google AdMob)
• Attribution (e.g. Adjust, AppsFlyer, Branch)
• Social login (e.g. Sign in with Google, Sign in with Apple)

The only external service the app interacts with is Hugging Face, solely for model downloads, as described in Section 5.

7.1 App Store and Google Play

Distribution through the Apple App Store and Google Play Store means Apple and Google may collect standard platform-level data (e.g. purchase records if the app were paid, crash metadata at the OS level, app store search data). These are governed by their respective privacy policies and are outside our control.

8. Children's privacy

OffRoad is not directed at children under the age of 13 (or 16 in jurisdictions where that age applies under applicable law). We do not knowingly collect personal information from children. Because the app collects no personal information from any user, no special handling is required, but we ask that parents supervise use of AI applications by minors.

9. Your rights

Because OffRoad does not collect or hold personal data on any server, most data-subject rights (access, rectification, erasure, portability) are exercised by you directly on your device:

• Access — your data is in your app, readable by you.
• Erasure — delete messages, conversations or all history in Settings, or uninstall the app.
• Portability — your data is not locked in a server; it lives in files on your device.

If you are in the European Economic Area (EEA), United Kingdom or other jurisdiction with data protection laws, and you believe we have processed personal data about you, please contact us at the address in Section 11. We will respond within 30 days.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, if the change is material, provide notice through the app or on our website.

We encourage you to review this policy periodically. Continued use of the app after a change constitutes acceptance of the revised policy.

11. Contact