Privacy policy

Pocket Atlas is made by Savvas Pythakakis. Contact: support@pocketatlas-app.com. We are the data controller for everything described here.

On your phone, always, and this is the copy that matters:

• your stickers — which landmarks you collected, when, and the coordinates at the moment of collection
• your walks, including a route recorded while a walk is running
• your photographs, at the size your camera took them
• your trophies, quest progress and XP

On our servers, in Frankfurt, so the passport survives a lost phone:

• the same stickers, walks and trophies
• your photographs, in private storage that only your account can read
• your email address, which is how you sign back in
• a handle, if you choose one, and who you follow
• first-finder claims, which have to be server-side because they are a race
• a count of how signing in went, described in its own section below

If you ask to join alpha testing on the website, the address you type is emailed to us so we can invite you on TestFlight. It is not stored anywhere else, and you can ask us to delete that email.

Location is the whole app. It is used to notice you have arrived somewhere and to record the walk you are on. Three things about it are deliberate:

• Nothing happens between walks. Pocket Atlas uses your location while the app is open and while a walk is running. When neither is true, it does nothing with your location.
• Notifications are decided on your phone. If you allow them, Pocket Atlas tells you when a landmark you haven’t collected is a few minutes’ walk away during a walk — at most three a day, never at night. Nothing is sent from our servers: the phone decides, using the landmarks it already has. No other notifications are ever sent.
• Shared routes are coarsened by about 40 metres, so a walk you share doesn’t lead back to your front door.

We store accuracy and speed alongside each sticker. That is used to tell a real arrival from a spoofed one before a leaderboard counts it, and for nothing else.

If you allow motion access, Pocket Atlas adds steps and floors climbed to each walk. When a walk ends it asks your phone how many fell between the walk’s start and its end, and keeps those two totals with the walk. It does not read your step history outside your walks, and it counts nothing while no walk is running. The totals sync with the walk, are as private as its distance, are in your export and are deleted with your account. If you say no, nothing is counted and the figures do not appear. You can change this in Settings at any time.

Apple Health is optional and off unless you turn it on. When it is on, each finished walk is saved to Apple Health on your phone as an outdoor walk, with its distance, its steps and its route. Pocket Atlas only writes to Apple Health; it never reads from it, and nothing from Apple Health is sent to us. Data written to Health is never used for advertising or sold. You can delete it, or turn off access, in the Health app.

Your photograph is the sticker. It is stored on your phone and uploaded to private storage tied to your account. Nobody else can read it unless you share a walk that contains it. We do not analyse the contents of your photographs and we do not use them to train anything.

You need an account to use the app. It signs you in anonymously at first launch, then asks for your email address on the second screen, so your passport can be recovered if you lose your phone.

There is no third-party login and never will be. No Google, no Apple, no Facebook. We email you a six-digit code; there is no password to make and none to forget, and no other company is told that you use this app. Signing in with the code links the anonymous identity the app already gave you — it does not replace it, and nothing collected beforehand is lost.

We store the address, and we use it for exactly two things: sending you a sign-in code, and knowing which passport is yours. We do not email you anything else. There is no newsletter and no announcement list.

There is one place in the app that keeps a count, and this section exists because it would be dishonest to bury it in a list.

When you sign in, the app records that each step happened: the screen was shown, a code was sent, a code was wrong, a name was taken, it finished. It is nineteen named events, it is ours, it goes to the same Frankfurt database as everything else, and it exists so we can see where people get stuck on the one screen they cannot skip.

None of it carries anything you typed. Not the address, not the code, not the handle. Where a reason is recorded it is a word we chose — no_at for an address with no @ in it, offline for a code that could not be sent — and the column it goes in is constrained by the database to short lowercase words, so an address could not be written there even by mistake. The events are attached to your account, which means they are in your export and they are deleted with it.

Once a day, and whenever the app crashes or freezes, your iPhone hands the app a report through Apple’s MetricKit: how long it ran, how much processor time and GPS it used, how much memory it peaked at, and — after a crash or a freeze — which line of our code it was on. The app sends that to the same Frankfurt database, so we can fix what broke and keep a day’s walk from flattening your battery.

These reports are anonymous. They carry the app’s build number, the iOS version and the iPhone model, and nothing else about you: no account, no device identifier, no location, nothing you typed. The one part of a crash report that can contain text from inside the app — an error message — is removed on your phone before the report is sent. Because a report cannot be tied to you, it is not part of your export and cannot be found to delete; there is nothing in it that is yours.

Nothing else in the app is counted. There is no screen-view tracking, no session recording, and no third-party analytics SDK anywhere in the binary.

Landmark names, coordinates and descriptions come from Wikidata (CC0), OpenStreetMap (ODbL) and Wikimedia Commons, each credited in the app. Landmark photographs are other people’s work under their own licences, and each one shows its photographer and licence beside it.

Most of what the app loads comes from our own backend. Two things come straight from someone else’s server, because that is where they live:

• The map is drawn from tiles served by OpenFreeMap.
• Landmark photographs come from Wikimedia Commons, run by the Wikimedia Foundation in the United States, the first time you open a landmark that has one. After that the phone keeps a copy.

Like any web request, these show the server your device’s IP address and which tile or photograph was asked for — and so, roughly, which part of the world you are looking at. They are not sent your account, your email, your location or any identifier of ours, and nothing about you is sent back to them beyond that request. Each handles its own server logs under the policy linked above.

Walking directions are worked out by our server, not on your phone. When you are online and ask for a route to a landmark, our server sends your starting point and the landmark’s position to OpenRouteService, run by HeiGIT in Heidelberg, Germany, which returns a route along real streets. It is not sent your account, your email or your IP address.

Under the GDPR you may see, correct, export or delete your data, and object to how it is handled. Three of those are buttons in Settings rather than a request you have to make:

• Export produces two files: a document you can read, and an archive containing everything, photographs included.
• Delete removes your stickers, photographs, walks and trophies from the phone and from our servers. Landmarks you found first become unclaimed again. There is no thirty-day window and no soft delete.
• For anything else, or to complain to a supervisory authority, contact us first and we will answer.

Pocket Atlas is not directed at children under 13 and we do not knowingly collect their data.

Until you delete them. There is no automatic expiry, because a passport whose early pages vanished would not be a passport. That includes each walk’s route, which is kept as recorded until you delete the walk or your account.

If this policy changes in a way that affects what happens to your data, the app will say so rather than quietly updating a web page.