Privacy policy

On your device, by you, for you.

All of the following is written to local storage and nowhere else:

• Precise location — latitude, longitude, altitude, horizontal and vertical accuracy, speed and its accuracy, course, and timestamp. Each point also records how it was obtained: a GPS fix, a coarse significant-location change, or a visit.
• Motion activity — whether the device is still, walking, running, cycling or in a vehicle, and how confident that classification is.
• Device state — battery level and charging state, and which receiver profile was in force, so a track can be interpreted after the fact.
• Audit events — only if you turn the audit trail on. These describe the app's own decisions and include the location data those decisions were made about.

The app asks for background location because it is meant to keep recording with the screen off. It asks for motion activity because that is what lets it leave the GPS off most of the time.

Two ways data leaves, both yours to start.

Exports. When you export a track as GPX or JSON, or the audit trail as JSON or text — compressed by default, since it is large — the file is handed to the iOS share sheet. Where it goes next — Files, Mail, another app, a colleague — is your choice, and it is then covered by that destination's own terms, not this policy.

Maps. The map screen draws Apple Maps tiles. Displaying a map means Apple's mapping service is told which area is being shown, in the same way as any app using the system map. That is covered by Apple's privacy policy. Nothing else on the screen — your track, your history — is sent with it, and the rest of the app works with the map screen untouched.

Tips. Under Settings → About, Support the developer offers three optional tips as in-app purchases. They unlock nothing. Payment is handled entirely by Apple through the App Store; the developer receives no name, email or payment detail, and the app keeps no record of it.

There is no other path. The app makes no other network requests of any kind.

You hold the only copy.

• Retention is yours to set. Old samples are purged on the schedule you choose; you can also purge on demand from Settings.
• The audit trail expires sooner. Seven days by default, separately configurable, because it grows much faster than the track.
• Deleting the app deletes everything. Removing WhereIWas removes its database with it. There is no copy anywhere else to ask about, and no request to send anyone.
• No backup is made by the app. If your device backup includes app data, your history is inside it, protected by whatever protects that backup.

Nothing to request, because nothing is held.

Data-protection law gives you rights of access, rectification, erasure and portability against whoever holds your data. Here that is you: the developer holds none of it and has no technical means to obtain it. Access and portability are the export function; erasure is the purge function or deleting the app.

If you email a bug report or attach an export to an issue, that message and its attachments are held by the email or issue-tracker provider, and you have shared whatever you chose to attach. Remove anything you would rather not send before attaching it.

The app is not directed at children and collects nothing for the developer, from anyone, at any age.

If a future version changes what is recorded or where it can go, this page changes with it and the effective date at the top moves. This page lives in the app's public repository, so any change to it can be read as a diff alongside the change in the app that caused it.

Questions about this policy

gabriel.landais@gmail.com

Policy history

github.com/glandais/WhereIWas