← Dashward Support

Dashward Privacy Policy

Effective 21 June 2026 · Last updated 6 October 2026

1. What leaves your device, and when

Dashward uses your Apple Account for iCloud features and purchases; it does not require a separate Dashward username or password. Data leaves your device in these cases:

• Save to Photos — clips you save (or that the app saves because you turned on “Save important clips to Photos”) go to your Apple Photos library.
• Evidence vault (Cloud Backup, Pro) — locked clips are uploaded to your own private iCloud database.
• Alerts to your other devices (Pro) — when the parking sentry records an event, the short event clip and a description are sent through your private iCloud database to your other devices signed in to the same Apple Account.
• Live View of your own devices (Pro) — if you turn on “Allow live view of this device”, still pictures from its cameras and its storage and temperature status are sent through your private iCloud database while one of your other devices is watching.
• Sharing sentry clips with another person (Pro) — if you invite someone, parking-sentry event clips (which can include audio and, if “Stamp location on clips” is on, location) are shared with them through iCloud sharing.
• Remote Viewing (sharing is free; viewing needs Dashward Pro or Business Pro) — if you share a vehicle, the information you choose, including live video if you allow it, is sent to the people you invite. See section 6.
• Live-viewing authorization and usage — devices send verification proofs and viewing requests to our service, which retains access-control records and aggregate reservation totals. See section 6.
• Advertising (free tier) — see section 8.

Dashward for Mac is a viewer for vehicles shared with you. It has no camera, microphone or location access and records nothing. It reads and plays the Remote Viewing updates and recordings described in section 6, checks subscription status with Apple, and sends the authorization proofs and viewing requests needed to use those features.

2. Camera & microphone

Dashward uses the front and/or rear camera to record your drive and the microphone to record sound with your clips. Recording is processed on your device. Pictures or clips leave the device only through the features you turn on in section 1. MW Supply Limited does not receive pictures, video or audio in a form it can read: Remote Viewing’s live video passes through its relay encrypted (section 6).

3. Location

If you allow location, Dashward embeds GPS position and speed in the clips you record, shows them on screen, and computes today’s driving summary (distance, time, harsh braking, hard acceleration, sharp turns and time over a speed you set) on your device. Location leaves the device only inside clips you save or share, or through Remote Viewing if you turn on “Location, speed and today’s driving” (section 6). Dashward asks only for location “While Using the App” and never tracks you in the background. You can turn location off in the app’s Settings or in iOS Settings → Privacy & Security → Location Services.

4. On-device storage & automatic deletion

Clips are stored in the app’s own storage on your device. Dashward loop-records into segments and keeps within a storage limit you choose, deleting the oldest unlocked clips to make room. Locked clips and parking-sentry event clips are kept until you delete them. Today’s driving summary is kept on the device and replaced at midnight. Event labels and times linked to a saved clip remain with that clip until it is deleted. Preferences are stored locally.

5. iCloud (CloudKit)

The iCloud features in section 1 use Apple’s CloudKit under your Apple Account and are governed by Apple’s privacy policy. Data in your private iCloud database, and data you share with invited people, is not accessible to MW Supply Limited. The public CloudKit database also holds encrypted Remote Viewing updates and device-verification challenges, as described in section 6. Clips alerted to your other devices are removed from iCloud after 14 days; evidence-vault clips stay until you remove them. You can turn iCloud off for Dashward in iOS Settings → [your name] → iCloud.

6. Remote Viewing

Remote Viewing lets the people you invite see a vehicle in which Dashward is running. It is off until the person setting up the vehicle turns it on. You can pair using QR codes or invite people through iCloud using their Apple Account email address or phone number. Pairing and sharing still require the relevant owner approval and the driver’s sharing acknowledgement.

• What can be shared: sharing starts off. Camera, location and recorded-clip options are chosen in sharing settings; basic device status accompanies a configured share. The driver notice describes the selected content and status before sharing starts: live location, speed, heading, today’s route and driving summary and events; pictures from the road camera; live video from the road camera and from the cabin camera, sent only while someone is watching live (if “Allow live video” is on; the cabin camera shows the inside of the vehicle, including the driver and any passengers); finished road and cabin recordings, including recorded sound, embedded stamps and event labels/times, if “Recorded clips” is enabled; and whether the vehicle is recording, its battery level and its temperature. If a possible crash is detected, the people viewing the vehicle are sent an alert, which can include the location.
• Who can see it: only people who accept the vehicle’s iCloud invitation, and that account’s own devices if “Also show on my other devices” is on. Invitations are private to the people named and can’t be forwarded. In the device-approval flow described below, a monitor also needs explicit live-device approval. Removing that approval stops its live-video access; remove the person through Team or Manage People to revoke their iCloud access to status, pictures and recordings as well.
• How it travels: updates are encrypted on the vehicle’s device with a key held by the vehicle and invited people (the key travels inside the iCloud share), and are relayed through Dashward’s CloudKit public database operated by Apple. MW Supply Limited does not hold the key and cannot read the updates. CloudKit records that an encrypted update exists, when it was last changed, and a container-scoped iCloud identifier of the account that wrote it. Live video is encrypted on the vehicle with the same key and passed through a relay operated by MW Supply Limited on Cloudflare (dashward-live.mwsupplylimited.workers.dev). The relay forwards encrypted video to authorized viewers, cannot decrypt it, and does not store it. TestFlight and App Review use a separate Sandbox relay. Cloudflare processes connection data such as IP addresses to run the service. Our relay keeps network addresses in memory for operational limits, does not write them to its database, and has request logging disabled. Authorization and usage records are described below.
• Recorded clips: this separate setting is off by default and changes the driver notice when enabled. An authorized monitor can request the finished-clip catalogue and download a selected recording for playback. Catalogue details and bounded video chunks are encrypted on the vehicle and transferred through Apple CloudKit using the vehicle’s sharing key; recordings do not pass through the live-video relay. The app does not upload the whole recording library. Event links use labels and times stored with the clip; the recording itself may include sound and location/speed stamps chosen when it was captured. Downloads require Dashward to remain open on the vehicle with sharing enabled.
• Temporary recording transfers: one encrypted response chunk per viewing window replaces the previous chunk. The vehicle attempts to delete it after the transfer closes or expires (ten minutes), and retries cleanup when it is next running and online. A force quit or lost connection can delay deletion. Playback copies on the monitor are removed when that clip browser closes, or on the next clip-browser launch after an interrupted session. Pausing or revoking sharing stops new access when the devices process the change, but cannot recall information a viewer already received or copied. Original recordings remain on the dashcam under its normal storage rules.
• Viewing duration in version 1.4: opening a vehicle starts a five-minute live view. A viewer can explicitly choose continuous monitoring while the viewing screen stays open, or use “Stop live view” to end that session. Foreground and window-visibility checks can suspend requests; multiple viewing windows and other authorized monitors have separate sessions. Short-lived permission and heartbeat checks bound interrupted sessions. The driver can pause or stop sharing at any time.
• Camera sharing requires the app to be open: the dashcam’s camera feed requires Dashward to remain in the foreground. Interrupted transfers and cleanup can finish when the app is next running and online.
• The person in the vehicle is told: the vehicle’s screen shows a notice when sharing starts and each day, and an indicator whenever sharing is on or someone is watching live, from which sharing can be paused at any time.
• Shared-content retention: each update replaces the previous one; live video is not stored by the relay; the route is replaced each day; crash alerts are deleted after 24 hours. In version 1.4, “Stop sharing” pauses new uploads and live video while preserving connections for later. “Disconnect everyone” is a separate action that withdraws the source, deletes its iCloud share and replaces the sharing key when the operation completes. If your version shows “Stop sharing with everyone”, that action removes the share. Removing a person also changes the key when the vehicle processes the change. Network interruptions can delay deletion and revocation processing, and material already received or copied cannot be recalled. A viewer can remove a vehicle from their app. These controls do not erase the service metadata described below.
• Your responsibility: if you set up Remote Viewing on a vehicle that someone else drives or rides in, you are responsible for telling them and for following the laws that apply to you about recording, location sharing and workplace monitoring.

Live-service authorization and usage

The device-approval flow introduced during version 1.4 testing adds the following records to protect live access and operate the relay. These records are separate from encrypted camera and location content; earlier clients can use the preceding subscription-only relay checks.

• Device verification: a device-generated signing key is verified using a challenge in Dashward’s public CloudKit database. The challenge contains a random value and the key’s digest; CloudKit also supplies the creator’s container-scoped account identifier. The relay converts account record identifiers into pseudonymous identifiers and does not persist the original record names or private contacts. It stores the public device key, its digest, the pseudonymous account identifier and short-lived security nonces. Enrollment authorization expires 30 days after each successful enrollment; expired enrollment records, challenges and nonces are removed during expiry cleanup. Using live viewing again can create a new enrollment. The app attempts to delete its CloudKit challenge after verification and retries failed cleanup when used again; interruptions can delay that deletion.
• Access-control records: the service retains pseudonymous subscription, purchaser, owner and member identifiers; approved monitor-key digests; vehicle, source-device and camera-room bindings; permission versions; and the latest verified capacity decision. Owner recovery retains a receipt digest, date and attempt identifier to prevent reuse. These are linked authorization records, not anonymous statistics. They contain no footage, recorded sound, GPS coordinates or vehicle decryption keys.
• Authorization retention: removing a member, monitor or vehicle removes the corresponding approval or source entry when processed. Unremoved approvals and active source bindings have no automatic inactivity expiry. The owner/subscription binding and recovery protections are retained to prevent ownership reassignment and replay, including after sharing or a team is stopped. These records currently have no automatic deletion deadline; the 30-day enrollment expiry does not erase them. See section 10 to request a review or deletion.
• Connection reservations: active connection and camera-room identifiers and their expiry times are persisted so a server restart cannot bypass a limit. These entries are removed on release or revocation, or after their renewable two-minute lease expires and cleanup runs.
• Aggregate usage: the service retains monthly totals of authorized vehicle, camera, connection and viewing-tile reservation time to operate and assess relay usage. The totals are associated with a pseudonymous subscription registry but contain no participant or source history. They do not establish that footage was delivered or watched, and are not subscription billing periods or invoices. Totals cover the current UTC calendar month and the preceding three months; older monthly totals are removed during scheduled cleanup. Minimal coverage and accounting-cursor timestamps remain with the registry.
• Subscription verification: a device sends Apple-signed subscription and, for owner verification or recovery, app-purchase records. These contain purchase identifiers, product and date information, but no Apple Account email address, password or payment-card details. The service checks them with Apple as needed. Full subscription-renewal responses can be cached in memory for up to five minutes; full receipts and renewal responses are not persisted in the relay database or request logs. The derived identifiers and access decisions described above are persisted.
• Latest transaction records: the service also keeps the latest retained base-subscription and seat-pack transaction snapshots to check purchase state and reject stale or repeated updates. These contain pseudonymous transaction/subscription identifiers, product and environment, verified service dates and check/signature times, Apple status, and available gross price, currency, storefront, offer, upgrade and revocation fields. Missing values remain unknown. These are purchase-verification records, not net proceeds, payment-card details or a complete purchase/refund history. Snapshot details are removed during scheduled cleanup 180 days after their signed service expiry; a newer verified snapshot can replace them sooner. A verified pack removal clears its detail; ambiguous conflicts can retain the prior snapshot until resolved or expired. Minimal verification/cleanup timestamps, status or missing-field labels and replay marks (signed/purchase times and pseudonymous transaction/content digests) remain with the registry without an automatic expiry, to prevent replay. Latest transaction snapshots use pseudonymous purchase identifiers. The separate history-reconciliation service retains encrypted Apple lookup identifiers as described below. Neither store retains full signed receipts. Manual data requests follow section 10, and provider recovery follows the separate rule below.
• Purchase reconciliation and service accounting in version 1.4: where enabled, we retain linked purchase and accounting records to verify purchases, reconcile renewals and refunds, manage service limits and prevent duplicate or replayed updates. These include pseudonymous purchase and account identifiers; product, purchase and service dates; price, currency and storefront information; financial adjustments; usage totals; and security/replay records. History reconciliation stores the original Apple purchase lookup identifier and history continuation token in encrypted form so the service can retrieve signed updates and resume interrupted checks. These are linked records, not anonymous statistics. Full signed receipts, camera footage, audio, location and vehicle encryption keys are not retained in this financial store.
• Live-hour allowance records: plans with an hourly allowance retain verified subscription-period identifiers, source bindings, confirmed delivered source time and time set aside for interrupted or pending sessions. Related interval and replay records prevent simultaneous Road/Cabin viewing from being counted twice and prevent reconnecting or restarting from resetting an allowance. These records do not contain camera images or location.
• Financial retention and ongoing checks: financial and reconciliation records currently have no automatic deletion deadline. Some completed work is compacted, while identities, replay records and outstanding accounting obligations needed for later corrections remain. Subscription expiry, cancellation, uninstalling the app or removing sharing access does not erase them. Enrolled purchase histories continue to be checked after service expiry. The service does not yet provide per-payer withdrawal from those checks or complete erasure of this financial history; do not assume a support request has stopped processing until its specific outcome is confirmed.
• Provider recovery: Cloudflare’s database recovery can retain previous database states for up to 30 days after a record is removed from active storage.

Business Pro teams (from version 1.4)

A Business Pro subscriber can create a team and invite people through iCloud sharing using their Apple Account email address or phone number. People who accept can view the vehicles the subscriber includes, on their own iPhone, iPad or Mac. Each vehicle’s driver must acknowledge the updated sharing notice before those team members can view it.

• Inside the team’s iCloud share: the team name; the subscriber’s and members’ iCloud display names and container-scoped iCloud identifiers; and each included vehicle’s key. Only the subscriber and the invited people in the team can open this share.
• What the vehicle receives: the team’s name and its people’s names, encrypted with the vehicle’s key in Dashward’s CloudKit public database. The vehicle uses these to show its driver who can view it.
• Checking the subscription: the team holds the subscriber’s Apple-signed Business Pro subscription record. It contains purchase identifiers, product and date information, but no Apple Account email address, password or payment-card details. A member’s app can send it to the relay, which asks Apple’s App Store Server API for the latest subscription state and returns Apple’s signed answer. Full renewal responses are cached in memory for up to five minutes and are not written to the relay database or request log. The service persists the derived identifiers and access decisions described above.
• Leaving or removing someone: members can leave and the subscriber can remove them. The affected vehicles replace their keys when they process the change, so former members cannot read subsequent updates. Keys also change when a vehicle is removed from the team or the team is stopped.
• Seats: Business Pro includes a number of people. Optional Team Seats subscriptions add people to that team; they do not change what a vehicle shares.

Crash detection is best-effort and does not replace emergency services.

7. Subscriptions & payments

Dashward Pro and Dashward Business Pro are auto-renewable subscriptions sold through Apple’s In-App Purchase and shared by your iPhone, iPad and Mac under one Apple Account. Business Pro also covers invited team members for the team’s vehicles. Optional Team Seats packs are separate auto-renewable subscriptions and require an active Business Pro plan. Purchases and renewals are handled by Apple under your Apple Account. MW Supply Limited processes the purchase-verification information described in section 6, but does not receive your Apple Account email address, password or payment-card details through that verification. Manage or cancel any time in your Apple Account settings.

8. Advertising (free tier only)

In version 1.4 and other Unity-based builds, the free tier shows advertising through Unity LevelPlay (ironSource, a Unity Technologies company) and Unity Ads. Dashward Pro shows no ads and the ad SDK is not started. Advertising SDKs are also not started in TestFlight or local development installs.

• What these partners may process: device and SDK user identifiers, IP-derived country information, purchase information, ad impressions and interactions, other usage data, SDK performance and diagnostic information, and device characteristics such as language, model, screen size and connection type. A report you choose to submit about an ad can include customer-support information. These data are used for advertising, measurement, SDK operation and fraud prevention according to the partner’s practices; device advertising identifiers are used for tracking only with the required permission.
• Your consent: the app asks for Apple’s App Tracking Transparency permission before any identifier is used for personalised ads, and has a personalised-ads switch in Settings. If you decline, ads are not personalised.
• Your choices: iOS Settings → Privacy & Security → Tracking, and the personalised-ads switch in the app’s Settings.

This advertising data is processed by Unity Technologies (ironSource) and its mediated networks as independent controllers, not by MW Supply Limited. Unity’s practices are described in Unity’s privacy policy.

Legacy version 1.1: this earlier App Store version uses Google Mobile Ads (AdMob) and Google’s User Messaging Platform, rather than the Unity integration above. Their SDKs may process device identifiers, coarse location inferred from IP, advertising and interaction data, performance data, crash data and other diagnostics for advertising, analytics and consent functionality. The privacy manifest packaged with that version also declares developer advertising and marketing purposes for several advertising-related categories. Its advertising disclosures remain applicable while that version is in use; the new relay-device collection described above is not a feature of version 1.1. See Google’s privacy policy.

9. Children

Dashward is not directed to children under 13.

10. Deleting your data

Delete clips in the app. Deleting the app removes its ordinary local app storage, but does not delete copies in iCloud, server authorization metadata, or device-only Keychain items that may survive reinstall. Evidence-vault clips can be removed in the app or with iCloud storage management. In version 1.4, use “Stop sharing” on the dashcam to pause uploads while preserving connections, or “Disconnect everyone” to remove its share. If your version shows “Stop sharing with everyone”, that action removes the share. Version 1.1 instead has an “Allow live view of this device” switch under Live View; turn it off to stop that device’s private live view. A viewer can remove a vehicle from its Vehicles screen. Remove a person through Team or Manage People to end their iCloud access to status, pictures and recordings; revoking only their monitor approval stops live video. These changes cannot recall copies another person already received.

To request review or deletion of service-held data, contact us using the support address in section 12. We handle these requests manually and may need to verify that you control the relevant account or device. There is currently no automated whole-registry deletion control. Owner/subscription bindings and recovery protections are retained to prevent unauthorized reassignment or reuse; they are not automatically erased by stopping sharing, cancelling a subscription or deleting the app. We will explain any security records that need to be retained when responding to a request. Do not send passwords or verification codes.

11. Changes to this policy

If we change how Dashward handles data, we will update this page and the “Last updated” date, and the App Store privacy details for the affected version.

12. Contact

Questions about this policy: mwsupplylimited@gmail.com.