Songline Service Providers

Last updated: 2026-09-25

This page names the outside services Songline uses to run the app and what reaches each one. It is maintained by Songline as content, separate from our Privacy Policy, and may change as the product does — check back here for the current list rather than relying on a saved copy.

Supabase

What it does: Our database, sign-in, and file storage. It holds your account, your notes and their transcripts, your routes, your ride tracks, and your recorded audio.

What reaches it: Account identity from Sign in with Apple (your email, and your name if you chose to share it), your notes and transcripts, routes, ride tracks and telemetry (GPS and speed), audio recordings, and records of your acceptance of our Terms.

Privacy policy: supabase.com/privacy

Apple

What it does: Sign in with Apple (so you don't need a separate password), on-device transcription of your voice notes, and TestFlight, which we use to distribute the beta.

What reaches it: For sign-in, your Apple ID token and — only if you choose to share it — your name and email. Transcription with Apple's Speech framework runs entirely on your device; the app requires on-device recognition and never sends your audio to Apple's servers. If on-device recognition isn't ready, the app tries its own on-device Whisper model and otherwise queues the note to retry later. Your audio is still uploaded to our own systems either way (see Supabase and DigitalOcean below), but never to Apple. If you use TestFlight, Apple gives us limited crash reports and beta usage analytics under Apple's own terms.

Privacy policy: apple.com/legal/privacy

Google Play

What it does: Distributes the Android beta — the Android counterpart to Apple's TestFlight above. We run it as a Google Play internal test: we add each approved tester's Google account to a tester list in Google Play Console, then email them Google Play's own link to install the app.

What reaches it: The Google account email we add to the tester list — the same address you applied with. Once you install through Google Play, your use of the Play Store itself (signing in, downloading, updates) is between you and Google under Google's own account and Play Store terms; the app does not send Google any of your in-app data (notes, routes, rides).

Privacy policy: policies.google.com/privacy

Mapbox

What it does: Draws the maps you see in the app and on the web planner.

What reaches it: Standard map-tile requests — which necessarily include your device's IP address and the map area you're looking at. Mapbox's SDK telemetry is on by default in our app (we haven't turned it off); you can turn it off yourself from the ⓘ button on any map ("Turn Mapbox telemetry off"). Mapbox does not currently calculate any of our routes — that's our own routing engine, described below.

Privacy policy: mapbox.com/legal/privacy

DigitalOcean

What it does: Hosts two things we built and run ourselves: our route-finding engine (at curvy.songline-ride.com) and a server-side transcription pass that runs on every voice note after its audio is uploaded, to produce a second, higher-quality transcript alongside the one made on your phone. In both cases the software doing the work — our routing engine and Whisper, an open-source transcription model — is ours; DigitalOcean is only the hosting company for the computer it runs on.

What reaches it: For routing, the coordinates of the route you're planning. For transcription, the recorded audio file for each voice note and that note's ID. The audio is deleted from storage 60 days after it is recorded.

Privacy policy: digitalocean.com/legal/privacy-policy

Open-Meteo

What it does: Weather forecasts along your route.

What reaches it: The coordinates and times you want a forecast for. No account information is sent or attached.

Privacy policy: open-meteo.com/en/terms

National Weather Service (NOAA)

What it does: Supplements Open-Meteo with thunderstorm-probability data for US locations.

What reaches it: Coordinates for the forecast point. This is a free public US government API — no account information is sent, and no API key or login is used.

Privacy policy: weather.gov/privacy

Overpass API

What it does: A public lookup service for OpenStreetMap data. The website uses it for one small, best-effort feature: the road-closure overlay on the planning map. It quietly does nothing if the lookup fails or times out — nothing else depends on it. The phone app does not contact Overpass.

What reaches it: The bounding box of the map area you're currently viewing. No account information is sent.

A note on who operates it: Overpass isn't one company — it's independently run public servers, tried in order. Ours are overpass-api.de (run by the FOSSGIS association) and overpass.kumi.systems. There's no single privacy policy covering both; see the OpenStreetMap Foundation's privacy policy for the umbrella organization behind the underlying map data.

Vercel

What it does: Hosts this website (songline-ride.com) and counts its page views (Vercel Web Analytics).

What reaches it: Standard web server request logs, which include IP addresses, for every page you load. For page-view analytics: the address of the page you load, the site that referred you, your browser and device type, and your approximate country. It sets no cookies and uses no advertising identifiers. We use it to see which pages are visited, where visitors come from, and which steps of the beta application people reach. It does not run in the app.

Privacy policy: vercel.com/legal/privacy-policy

Resend

What it does: Sends transactional email on our behalf — beta invitations and related account email.

What reaches it: The email address and name we're sending to.

Privacy policy: resend.com/legal/privacy-policy

Expo / EAS

What it does: Build infrastructure we use to compile and package the iOS app during development. It is not a service the app you're using talks to.

What reaches it: Nothing from your use of the app. We don't use Expo's update-delivery service, and the one Expo feature the app does use (local notification scheduling, for on-ride reminders) runs entirely on your device and never registers with or contacts Expo's push service.

Data sources

OpenStreetMap is the map data our own routing engine is built on. We don't send it any of your data — it's a source we build from, not a service we call with your information. Map data © OpenStreetMap contributors, available under the Open Database License (ODbL); this attribution is also shown on every map screen in the app.