No accounts. No tracking. Your trip lives on your device. When it syncs, it's end-to-end encrypted - we only ever hold scrambled data we can't read, and you hold the keys. The rest of this page is the long-form version of that sentence.
a plain-English tour →Here is everything Switchback writes down on your phone. It's a short list because the app is a small app.
The container for each road trip - a name, the dates, who was along, the totals. Everything else hangs off a trip.
One row per plate the kids catch. The state, the time, and which player called it. Caught once, kept forever - a fresh catalog update can't erase a sighting.
The list of who's on the trip - first names the family typed in, no accounts. Identity is a local ID on the phone; there's no "user record" anywhere, just the names that ride along with the trip, end-to-end encrypted.
The road-sign bingo cards each player draws for the drive, plus which squares got marked. The card layout is on the device; so is the tally.
Which game is the "active" one on the trip and who's running it (the adult-controlled "director" toggle). It's the in-app state for whose phone shows what tab - nothing more.
If the route recorder is on, the app notes the moment your line crossed a state border - so the keepsake book can say "you entered Utah at 4:12pm." A timestamp and the state code, drawn from the same route data underneath.
Pictures the family takes inside the app. Stored on your device. Optionally synced to the rest of the crew, end-to-end encrypted (more on that below).
The notes kids and parents write during the trip. Dated, attributed, optionally tagged with where you were when you wrote it.
If you turn the route recorder on, the app drops a precise location point every so often while the trip is running. That's the line that becomes your real route on the keepsake-book map.
The badges the crew unlocks - "50 plates," "first state line crossed," and so on. Each one is a small record on the trip with which patch, who earned it, and when.
That's the whole inventory. There's no "user profile" because there's no account. There's no "device ID" because nothing on our end is keeping count of devices. Each item above is one kind of row in the on-device database, and that database doesn't have other kinds of rows.
Your trip lives on your device first - a full local copy, so nothing is ever lost. When a trip needs to reach the rest of the family's phones, the data is end-to-end encrypted before it leaves. We only ever hold scrambled data we can't read, and you hold the keys.
Here's the whole hop. Before any trip data leaves your phone, it's locked with a key only your family's devices have. The scrambled version travels to the other phones on the trip - over the internet, or directly between phones in the car - and they unlock it on the other side. The key never leaves your devices, so the data is unreadable the entire way across.
Switchback the company can't open it. We don't have the key, and we never will. What passes through our systems is ciphertext - scrambled data we have no way to decrypt - so there's nothing for us to read, sell, or profile, even if we wanted to.
Your trip lives on your device. When it syncs, it's end-to-end encrypted - we only ever hold scrambled data we can't read, and you hold the keys.- Settings → Privacy → What we collect, in the Switchback iOS app
A footnote on the keys. The encryption key that locks your trip lives in your device's keychain, which Apple itself keeps end-to-end encrypted. When a new family member joins a trip, that key is handed to them through the join flow - so the crew can all read the trip, and no one else can. The protection is Switchback's own, built into how the trip is stored and synced; it doesn't depend on any setting you have to find and switch on.
"you hold the keys" is literal - the key lives on your family's phones, not on anything we run.
Location is the most sensitive thing a road-trip app could touch, so we're going to spend a minute on it.
Precise, on purpose. When location is on, Switchback records the real route at full precision - because a fuzzy, neighborhood-only line makes the keepsake-book map a useless scribble, not the road you actually drove. That precise route stays on your device, and only ever leaves it end-to-end encrypted, locked the same way the rest of the trip is.
Opt-in. Location is off until you turn it on, and there are two switches: the iOS-level permission (which you grant or revoke in iOS Settings) and an in-app master toggle (which you can flip off without revoking the iOS permission). Either one being off means the app isn't getting fixes.
Continuous only while you're recording. The breadcrumb trail that becomes your keepsake-book map needs more than the occasional location ping - it needs a series of points across the drive. So while a trip is actively recording, the app does receive background location updates from iOS. The moment the trip ends, that stops. There is no "always tracking" mode, ever.
A persistent indicator while it's on. When the recorder is running, there's a visible banner inside the app on every tab, and iOS shows its own status indicator at the top of the screen. The "stop" button is one tap.
We can't read where you were. The breadcrumb points sit in the trip on your device, the same way the plate finds and journal entries do. They go where the rest of the trip goes, and they travel the same way - end-to-end encrypted. We only ever see scrambled data, so your route is unreadable to us.
A road-trip app full of pictures of your kids deserves a paragraph of its own.
When the family takes a photo inside Switchback, it lands on the device's storage. From there it syncs to the rest of the crew end-to-end encrypted - scrambled before it leaves, unlocked only on a family phone. The version that ever passes through our systems is ciphertext we have no way to open.
There is no image-recognition model running on your photos. We're not detecting faces, scenes, "is there a license plate in this picture," or anything else. The plate-spotting game uses manual taps on a state list, not OCR or vision. No vision model, no analysis, full stop. That's a deliberate product decision.
Photos imported into the app have their EXIF metadata stripped on the way in - including the GPS coordinates a camera embeds by default. The trip's own breadcrumb (if you opted in) is what places a photo on the route map, not the GPS that came with the photo file. This is so a photo you share off-app can't accidentally carry a precise location it never needed.
No model is being trained on your family's photos. Not by us, not by an "AI partner," not by anyone. There is no partner. The pictures live on your family's phones, and anything that travels does so end-to-end encrypted. We couldn't feed them to a model if we tried - we can't read them.
no model training, no "we sometimes review samples to improve…" - we only ever hold scrambled data.
The whole point of Switchback is the printed book at the end. So this is worth being precise about.
Today, the book lives entirely on your phone as a preview. The layout, the maps, the pages-per-kid, the patches - all rendered on the device from the trip's data. You can flip through it before you've spent a dollar.
When real book ordering ships (after the TestFlight beta), the order will work like this: you tap "order," the app builds a finished PDF, and the print partner gets exactly two things - the PDF and the shipping address. They print the book, they mail it to you, and that's the end of their job. There's no persistent cloud account, no "your book library" sitting on their server. The handoff is one shipment, then it's done.
There's no analytics on which pages you flip through. There's no recommendation engine. Nobody is grading whose book got more spreads.
The print partner is a real company we don't operate, and they have their own data handling. Once that vendor is locked in, we'll point at exactly what they do and don't keep, in their own words. Today the book ships as on-device preview only.
Most apps you've ever opened are reporting back. Switchback isn't. The full list of telemetry the app sends:
The developer literally cannot tell whether you opened the app today. They cannot tell which plates the kids tapped. They cannot tell you exist, unless you write to us. That's not a marketing flourish - that's a property of what we did and didn't bundle.
The reason "we can't read it" holds up is the order of operations: the data is encrypted on your device, before it goes anywhere, with a key we never get.
Each trip has its own encryption key. It's created on a family device and lives in the device keychain - which Apple itself keeps end-to-end encrypted. When you add someone to the trip, that key is handed to their phone through the join flow, so the whole crew can read the trip and no one outside it can.
From our side, the sync layer is a pipe we can't see into. Your phone scrambles the trip with that key, then sends the scrambled version on - over the internet to reach phones that aren't with you, or directly between phones when you're all in the car with no signal. The other family devices unlock it on arrival. What sits on our systems in between is ciphertext we have no key for. Same data the crew sees, but to us it's noise.
This is Switchback's own end-to-end encryption, baked into how every trip is stored and synced. It isn't a setting you have to find and turn on, and it doesn't rely on us holding your data in readable form anywhere. The only key that can open your trip lives on your family's devices - so even we, the people who built the app, can't read what's there.
Honest list, not finalized. Listed here because pretending these are decided would be the kind of thing this page exists not to do.
App is free during the TestFlight beta. After that, it might stay free (with the book as the only thing that costs money) or move to a one-time unlock (likely $5, eventually $10, with a public warning before any raise). Founding-beta families stay free for good either way. There will never be a subscription.
Not for v1. We're iOS-first while the app finds its feet. An Android build is possible on the same end-to-end-encrypted model - we'd still only ever hold scrambled data we can't read - but it's a second platform's worth of work we're not taking on yet.
Once the print-on-demand vendor is locked in for the real book-ordering flow, we'll point at their data handling explicitly. Today the book ships as on-device preview only.
Per-device persistence is bedrock - every phone keeps a full local copy, so nothing is lost. Sync across the crew's phones - so each kid's device sees the same shared trip, whether over the internet or directly in the car - rides the end-to-end-encrypted path described above. We're still hardening the key-sharing and recovery details, which is why it's listed here.