Privacy Policy

Last updated: October 12, 2026

Pegasus Coders LLC ("we", "us", or "our") operates Michi (the "Application"), an app for iPhone and iPad on Apple's App Store and for Android on Google Play. It calculates what a road trip in Japan will cost in expressway tolls and whether an expressway pass would save you money. This Privacy Policy explains what information the Application handles, where it goes, and the choices you have.

1. Your trips and recent places

The trips you plan (their names, dates, stops, the places you pick, the vehicle class and whether you pay by ETC or cash) are saved in a file on your device. The last ten places you picked from search are kept on your device too, so you can pick them again with one tap.

We do not keep a server-side copy of your saved trips or recent places, and the Application does not sync them through iCloud or any other service. Search and route requests use some of the places you choose, as explained in Section 2.

If you enable device backups, app data may be included in iCloud or computer backups on iPhone and iPad, and in Android cloud backups or device-to-device transfers. Backup and restoration are handled by your device and backup provider under their settings and policies.

Deleting a trip removes it from the Application's local storage. Uninstalling the Application removes its local trips and settings; it does not necessarily erase existing backups, which may restore data on reinstallation, or information already collected by Apple, Google or Cloudflare. See Section 8 for retention and your rights.

2. Place search and driving routes (Apple Maps)

Both versions use Apple Maps for place search and driving routes. Search text, selected places and the coordinates of planned stops are used to suggest places in Japan and calculate routes. Tolls and the pass verdict are then calculated on your device from the roads each route uses.

On iPhone and iPad, the Application uses Apple's MapKit services directly. On Android, search text, selected-place lookup requests, stop coordinates and the requested language are sent over HTTPS to our service hosted by Cloudflare, which forwards the mapping requests to Apple's Maps Server API. Cloudflare receives your IP address and request details and uses your IP address to limit requests and protect the service. This service processes search and route requests; it does not maintain a saved-trip archive or receive your trip names or dates.

Android also displays route maps using Apple's MapKit JS, which contacts Apple to load map content. Apple and Cloudflare may process technical and security information under their respective policies. Apple explains its Maps practices in Apple Maps & Privacy; see also the Cloudflare Privacy Policy.

The Application does not request or use your device's GPS location. It uses the places you select for planning. Stop coordinates describe those selected places, not a live record of your device's movements.

3. Toll data updates

Expressway tolls and discounts change, so from time to time the Application checks for updated toll data, using a Google service to find out whether a new version is available and our hosting provider to download it.

These requests contain nothing about your trips. Like any request on the internet, they reveal your IP address and basic technical details such as the app version, and Google also receives the random installation identifier described in Section 4. We use these requests only to keep the Application's tolls up to date.

On iPhone, iPad and Android, the update check uses Firebase Remote Config. Google receives installation identifiers and technical information, including app version, country and language information used to deliver configuration and toll-data updates.

4. Advertising, usage statistics and crash reports

Michi is free with banner advertising, which Michi Pro removes. Google provides usage analytics and crash reporting. On iPhone, iPad and Android, these are controlled separately through Privacy settings; the descriptions below apply when the respective service is enabled.

• Google AdMob (advertising). Shows banner ads on the trip, cost and day screens. Google and its advertising partners may collect and share IP-derived approximate location, device information, app and ad interactions, diagnostics, and device identifiers for advertising, measurement and fraud prevention. On iOS, the advertising identifier is the IDFA, available only if you allow tracking. On Android, identifiers may include the Android advertising ID and app set ID, subject to device settings and applicable consent; app set ID is used for purposes such as analytics and fraud prevention, not personalized advertising. In the EEA, the UK and Switzerland, the consent message describes purposes and partners that may store or read information on your device. See How Google uses information from sites or apps that use our services. Once Michi Pro ownership is recognized, no ads are requested. On launches where Pro ownership is recognized before ad initialization, the Application does not start AdMob.
• Google Analytics for Firebase (usage statistics). The following applies when usage analytics is enabled. Our custom events record screens and feature actions, such as calculating costs, the vehicle class and payment method, the recommended pass, counts of days, and whether Pro was offered, bought or restored. These custom events exclude place names, search text, stops, coordinates, trip names and dates, and do not include purchase prices or purchase tokens. Separately, the Firebase SDK automatically collects data such as app-instance identifiers, device information, lifecycle and interaction events, and approximate location derived from IP addresses. On Android, Analytics advertising-ID collection is disabled; on iPhone and iPad, Analytics is built without IDFA support. When usage analytics is enabled, automatic SDK collection may include installation identifiers, device information, approximate location, interactions and purchase events with product identifiers and prices.
• Firebase Crashlytics (crash reports). When crash reporting is permitted, technical crash and error reports may be submitted on a later launch. They can include the device model, operating-system and app versions, app state and an installation identifier. Crashlytics can write reports locally while uploading is off; the controls and queued-report limitation below explain what happens to those reports.

We use this information to keep Michi working and improve its features, and use AdMob to show ads. Google processes it under the Google Privacy Policy. On Android, usage analytics and crash reporting operate only when enabled, independently of Pro ownership.

On iPhone, iPad and Android, Privacy settings at the bottom of the trip screen let you control usage analytics and crash reporting separately, whether you use the free version or Michi Pro. We ask for separate choices worldwide. Both options stay off until you enable them; you can turn either off at any time. Your explicit choices are remembered on your device. Advertising consent and buying Pro do not change these choices. Turning collection off does not delete data already sent to Google. On Android, reports already queued for upload while reporting was permitted may still be delivered after you turn it off, and Crashlytics may save reports locally; reports from periods when reporting was not permitted are discarded rather than submitted when you later enable it. On iPhone and iPad, turning crash reporting off deletes crash reports not yet sent, and reports written while it is off are deleted rather than kept for later. Permitted reports may be submitted on a later launch.

Saved Analytics reference. While usage analytics is enabled, Michi saves one available Analytics reference in encrypted storage on your device to help with later privacy requests. It expires 14 months after it is saved and is excluded from backups. You can clear it in Privacy settings → Copy privacy reference; this does not delete data held by Google or copies you have shared. If Analytics remains on, a reference may be saved again later.

For the Application’s Firebase Analytics property, we have disabled ads personalization, Google signals, and optional sharing for Google products and services, modeling contributions and business insights, and business recommendations. Google technical support access remains enabled. These Analytics settings do not turn off Analytics collection or control AdMob’s separate advertising practices.

5. Your choices about ads

• Consent in the EEA, the UK and Switzerland. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the Application asks for your consent before any ad is requested, using Google's consent message (a Google-certified consent management platform that follows the IAB Transparency & Consent Framework). In that message you can consent, decline where that option is offered, or choose purpose by purpose and partner by partner under "Manage options", including objecting to processing that partners base on legitimate interest. Your choice is stored on your device.
• Changing your choice. You can review, change or withdraw your consent at any time with Privacy choices at the bottom of the trip screen. This option appears only where the consent message applies. Withdrawing consent does not affect processing that took place before you withdrew it.
• If you don't consent. You can still use every feature of the Application. Google may then show limited or non-personalized ads, or no ads.
• App Tracking Transparency (iPhone and iPad). For free users, iOS may ask whether to allow tracking across other companies' apps and websites. If you allow it, AdMob may use your IDFA to personalize ads; otherwise it cannot use your IDFA. You can change this in Settings → Privacy & Security → Tracking. This Apple permission prompt does not apply to Android.
• Android advertising controls. You can reset or delete your advertising ID, or restrict ad personalization, using your device's Google or privacy settings. Available controls and their location vary by Android version and device. These settings are separate from the Application's consent message and do not turn off all Google data collection.

Advertising choices do not remove trip-planning features. Once Pro ownership is recognized, no ads are requested and advertising consent or advertising Privacy choices are not shown; recognized Pro users are not asked for Apple’s tracking permission. Android Privacy settings remain available to free and Pro users for the separate usage-analytics and crash-reporting controls in Section 4.

6. Michi Pro (in-app purchase)

Michi Pro is an optional one-time purchase that removes the ads and lets you keep more than two trips. Apple handles App Store payments and Google handles Google Play payments under their own policies. We do not receive your payment-card details, your name or your Apple or Google account credentials. See Apple's privacy policy and the Google Privacy Policy.

On iPhone and iPad, Apple tells the Application whether your Apple Account owns Pro, including through Family Sharing; Restore Purchase checks with Apple again. On Android, the Application queries Google Play for Pro ownership, receives purchase status and a purchase token, and sends that token to Google Play to acknowledge completed purchases. It keeps a local ownership flag so Pro can remain available offline and checks ownership again when possible. These checks do not create a Michi account or send purchase tokens to our mapping service.

Pro purchases restore within the store and account that supplied them; they do not transfer between the App Store and Google Play. Apple Family Sharing applies to eligible Apple purchases. Google Play in-app purchases of Pro are not shared through Family Library.

Our custom Pro analytics events contain actions and categories, not the price paid or purchase tokens. Firebase's automatic Android purchase analytics may include product identifiers and prices (Section 4). Refunds are handled by the store where you bought Pro: Apple refund requests or Google Play refund information.

7. This website and contacting us

This website uses Google Analytics, a Google service, to count visits and see which pages are read, but only if you accept it in the cookie message shown on your first visit. If you accept, Google Analytics sets cookies on your device and collects information such as the pages you view, how you arrived here, your browser and device type, and your approximate location derived from your IP address. Google Analytics 4 does not log or store IP addresses. If you decline, Google Analytics is not loaded and no cookies are set. You can change your choice at any time with Cookie settings at the bottom of every page. Your choices of language and cookies are remembered in your browser's storage.

The website uses a separate Analytics property. Google signals is disabled, but ads personalization remains allowed in its settings. Optional sharing for modeling contributions and business insights, technical support, and business recommendations is enabled; sharing for Google products and services is disabled. These settings apply to website Analytics data collected after your consent and are separate from the Application’s settings.

If you write to us through the contact form on this website, we receive your name, your email address, the topic and your message. We use them only to reply to you and to follow up on what you reported, and we delete them when they are no longer needed for that.

The form is delivered to us by Web3Forms, which forwards it by email, and is protected from spam by hCaptcha, which checks that the form is being sent by a person and processes information such as your IP address and browser details to do so.

8. Your rights in the EEA, the UK and Switzerland

If the EU or UK General Data Protection Regulation (GDPR) or Swiss data protection law applies to you:

• Who is responsible. Pegasus Coders LLC is the controller for the personal data we process to operate the Application. Google processes advertising data under its own privacy policy, and Apple or Google handles purchase and payment data for its respective store. Cloudflare hosts our Android mapping service and delivers toll data on our behalf. Apple processes mapping requests and map-content requests under its own policies. Google also provides Firebase usage statistics and crash reporting, and measures website visits for us with Google Analytics.
• Legal bases. Storing or reading information on your device for advertising, and personalized advertising, rely on your consent. Some ad measurement and delivery by Google and its partners relies on their legitimate interests, which you can object to in the consent message. For usage analytics and crash reporting on iPhone, iPad and Android, we rely on your separate consent, which you can withdraw in Privacy settings. Checking for and downloading toll data relies on our legitimate interest in keeping the Application's tolls accurate. Unlocking Michi Pro is necessary to perform our contract with you when you buy it. Website analytics rely on your consent. Answering a message you send us relies on our legitimate interest in replying to you. Processing the search and route requests you make is necessary to provide the Application's requested mapping functionality. IP-based rate limiting and protecting our mapping service rely on our legitimate interest in security and preventing abuse.
• How long data is kept. Your trips, recent places and local Pro ownership record stay on your device until you delete them or the Application. Firebase Crashlytics keeps crash data and associated identifiers for 90 days before beginning removal from live and backup systems. Firebase installation identifiers used by Remote Config are retained until the Firebase customer requests their deletion through Google’s API; the Application does not currently offer that deletion process. The Application’s Analytics property is configured for 2-month event-data retention and 2-month user-data retention, with reset on new user activity disabled. The website’s separate Analytics property is configured for 2-month event-data retention and 14-month user-data retention, with reset on new user activity enabled: each new event can extend the retention of a user identifier by another 14 months. These controls apply to user-level and event-level data associated with identifiers; they do not limit standard aggregated reports, which may remain available longer. Google applies Analytics deletion through its scheduled retention processes. Messages you send us are kept only as long as needed to deal with them. Uninstalling does not itself delete provider-held data or device backups. Our Android mapping service does not maintain a trip archive, and its Worker application logs and traces are disabled; Cloudflare and Apple may still retain technical and security records under their own policies. Backup retention and deletion are controlled by your backup provider and device settings.
• Your rights. You have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise these rights, contact us; for data held by Google, you can also use Google's own controls. You also have the right to lodge a complaint with your local data protection authority. Local deletion does not automatically delete Firebase, advertising or mapping-service data. We do not currently provide an established process that can identify and delete an installation’s off-device data, or an in-app deletion-request mechanism. You can contact us about your rights; because there is no Michi account, we may need information to identify the relevant data, and cannot promise to locate a particular installation from your name or email alone.
• International transfers. We are based in the United States, and Google and its partners, Apple and our hosting provider may process data in the United States and other countries. Where required, these transfers rely on safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

9. Children's privacy

The Application is a trip-planning tool for drivers and is not directed at children. We do not knowingly collect personal data from children under the age of 13, or from anyone under the age at which their country allows them to consent to it.

10. Links to other websites

The Application links to the websites of the expressway companies that sell the passes it recommends ("How to buy it"), and ads may take you to an advertiser's website. Those websites are not covered by this Privacy Policy; their own privacy policies apply.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when the Application or the services it uses change. We will post the new version on this page and update the "Last updated" date at the top.

This Privacy Policy is also available in other languages. If a translation differs from this English version, the English version applies.

12. Contact us

If you have any questions or suggestions about this Privacy Policy, contact us.