Privacy Policy
Last updated: 15 October 2026
Unmapped is a GPS-based app, allowing you to reveal the map by actually exploring the world. To make this work, the app has to know exactly where you are. Location data is among the most sensitive categories of personal data, so this policy explains exactly what we record, how precise it is, how long we keep it, how we protect it, and how you delete it.
The short version. Unmapped records your precise GPS position — full-resolution coordinates, with timestamps — for as long as tracking is on, including while the app is in the background if you allow that. That record is written to your device, and it stays there unless you choose otherwise. Nothing about your exploration — your distance, your territory coverage, the places you reveal, your achievements or your GPS tracks — reaches us until you turn sharing on, and that is true whether or not you have an account. You make the choice once, the first time the app asks; until you answer, nothing leaves your device. You can also back your map up to your own iCloud (iOS only), in which case it goes from your phone straight to Apple, and we never receive it or your sign-in to it. Whatever we do hold, we store separately from your account identity, under a pseudonymous ID whose link back to you is held outside our database — so a stolen database on its own cannot tie your movements to you; and we delete the raw GPS data we receive automatically after 60 days. We never sell your data, use it for advertising, or share it with data brokers, and you can get a copy of what we hold, or permanently delete it, at any time. Versions of Unmapped before 1.2.0 do not have this choice and upload your tracks and statistics regardless — update the app to get it.
1. Who we are
When you read "Unmapped" in this policy, it refers to our iOS and Android apps, our backend service, and this website. The data controller for Unmapped is Artem Viacheslavovych Grishin, based in London, United Kingdom.
For any data-protection enquiry, contact privacy@getunmapped.app.
2. Location data — what we actually record
This is the core of the product and the most sensitive data we hold, so we describe it in full. Start with 2.1: whether any of it reaches us at all is your choice, and the default is that it does not.
2.1 Your exploration stays on your device unless you choose otherwise
Unmapped runs on your device. The map reveals as you move, places appear and unlock as you reach them, and your distance, territory coverage, level, experience and achievements are all computed on your phone — with an account or without one. You do not need an account to use the app.
By default, none of that reaches us. Your positions, the map area you have revealed, the places you reveal and the statistics derived from them are written to storage on your phone and read back from there. We do not receive them and we hold no copy of them. Signing in does not change this by itself: an account gives you a profile, friends and your subscription — not an upload of your map.
You choose once. The first time it is relevant — during onboarding on a new install, or straight after signing in if you are upgrading from an older version — the app asks how your data should be handled, and records your answer. There are four possible states:
- Not answered yet. This behaves exactly like keeping everything on your device: nothing about your exploration leaves it. A question you dismissed, an answer that failed to save, or any doubt counts as not answered.
- Keep everything on this device. Nothing about your exploration is sent to us. This is the option preselected when you are asked.
- Share statistics with Unmapped. We receive your distance per trip per day, the area you have uncovered in each territory, each place you reveal and when, and your achievements. We do not receive your GPS tracks. This is what puts you on the leaderboards.
- Sync with Unmapped. We receive the statistics above and your GPS tracks, which are kept with your account so your full map can be restored on another device.
You can change this at any time in Settings → Data & backup, which carries one switch for statistics and one for GPS track sync. Turning track sync on turns statistics sharing on with it, because an uploaded track lets us work out every statistic anyway and we will not pretend otherwise. Turning either off stops new uploads from that moment.
Turning sharing off does not delete what we already hold. What was already uploaded stays with your account: frozen, taken off every leaderboard, hidden from other users, still returned to you on request, and deleted when you delete your account. To remove GPS tracks we already hold without deleting your account, use Delete remote cache in Settings → Data & backup — it deletes the tracks on our servers and leaves your account, your distance, your territory coverage, your places and your achievements as they were, including the copy on your device.
Signing in attaches the exploration already on your device to that account, on the device. It is uploaded to us only if that account shares, and only as far as its setting allows. If the question has never been answered, nothing is uploaded.
Logging out erases that account's data from the device. Before erasing, the app sends anything not yet copied to wherever you have asked it to go — your own cloud, Unmapped, or both — and if that cannot be completed you stay logged in and nothing is erased. When the device holds the only copy, the app warns you and asks you to type the words to confirm.
Versions of Unmapped before 1.2.0 do not have this choice and upload your tracks and statistics whichever way these settings are set. If you still run an older version on another phone, that phone keeps uploading until you update it.
What we receive whatever you choose. Loading places on the map tells us which area the map is showing, and your IP address; while statistics sharing is off, those requests are sent without your account, so we cannot tie a map area to you. Downloading the territory maps for your area tells us which state or region you asked for, and your IP address. If you have an account, we hold the account itself — see section 3.
The rest of section 2, and sections 3 and 8, describe what we record and keep on our servers. How much of it applies to you follows from the choice above.
2.2 Precision
We do not blur or round your coordinates. When tracking is active, your device reports its position and full-fidelity latitude and longitude are stored exactly as your device reported them — on your device always, and on our servers only if you have turned on GPS track sync (2.1). Alongside each position the app stores:
- The timestamp of the reading
- The reported accuracy of the reading
- The speed derived from it
- The inferred transport mode — walking, cycling, or travelling by vehicle
- A session identifier grouping the readings from one period of tracking
Taken together this is a detailed, time-stamped record of your movements. It can show where you were, when, how long you stayed, and how you travelled. Please read the rest of this policy with that in mind.
2.3 Two copies: the filtered track and the raw archive
The app applies quality filters before a position counts towards revealing the map — discarding readings that are too inaccurate, or that show you standing still. If you have turned on GPS track sync, your positions are uploaded and we store two things (with track sync off we store neither, because nothing is uploaded — see 2.1):
- The filtered track, which is what the app draws and what your statistics are computed from.
- A raw archive of every position your device sent us, including the readings the filters rejected, together with a flag recording whether each one passed. We keep this raw data solely to fix our own bugs. For example, if we need to re-process your history after fixing a bug that wrongly discarded movement.
The raw archive is more complete than the track you see in the app. Because we only need this raw data to temporarily debug filtering issues, it is automatically and permanently deleted after 60 days. If you delete your account, or use Delete remote cache, before 60 days are up, any remaining raw data is destroyed immediately.
Low-accuracy positions are kept for three days. A reading too imprecise to reveal the map still counts towards your distance. Three days after it was recorded, each run of such readings is replaced — on your device, and on our servers if it was uploaded — by a single record of how far it covered and when, holding no coordinates at all. Low-accuracy positions are never written to a backup.
2.4 Background collection
If you grant background location permission, the app records your position while it is not on screen, so the map keeps revealing as you move without you having to hold your phone. This is optional. Unmapped works without it; you simply need the app open for the map to reveal. You can withdraw the permission at any time in your device settings; the app stops recording background positions immediately, and if GPS track sync is on we stop receiving them.
2.5 Consent
The timestamp at which you consented to location collection is recorded, as is the data-handling choice of 2.1 and every later change to it, so that consent can be demonstrated. Until you share something, those records exist only on your device; once you have an account they are held with it. Withdrawing consent is always available: turn tracking off, revoke the permission in your device settings, turn sharing off in Settings → Data & backup, delete your account, or use the app's Delete control to wipe what is stored on your device (section 9).
2.6 We store your location apart from your identity
Because location history is so sensitive, we do not keep it in the same place, or under the same identifier, as your account. Your traces, coordinates, and the exploration statistics derived from them are stored under a separate, pseudonymous identifier, carrying no name or email. The link back to your account is never written down; it can only be recomputed with a key we hold outside the database. How this works, and its limits, is described in full in section 10.
This is pseudonymisation: your location history is still your personal data, with all the rights set out in this policy.
This describes location data we hold. While you are not sharing, we hold none of it, so there is nothing on our side to separate — see 2.1.
2.7 Backups to your own cloud
Because your map lives on your phone, losing the phone would lose the map. Unmapped can therefore back your exploration up to your own iCloud (iOS only).
This is not a copy held by us. The backup goes from your device straight to your provider. We never receive the backup, its contents, or your sign-in to that provider, and we can neither read nor delete it. It is as private as the cloud account it sits in. Backups are automatic and are not protected by a passphrase of their own.
A backup is therefore yours to manage, and yours to remove. Deleting your Unmapped account does not delete it, and neither does deleting the app — see Delete your account and data for how to remove it yourself.
3. Other data we collect
This table describes data we hold on our servers. Most of it exists only once you have an account, and the Exploration row exists only if you have also chosen to share statistics (2.1). What applies to everyone are the technical logs, because your device asks our backend for map, place and territory information, and the two website rows, which are about this site rather than the app. A subscription bought without an account is held by Google Play or the App Store rather than by us; we record it if and when you sign in.
| Category | What it includes |
|---|---|
| Account | Your sign-in provider (Google, Apple, or Facebook) and the account identifier it gives us, your email address, your nickname, your unit preference, whether your profile is public or private, and whether you have agreed to receive news and updates by email (with the date you last changed that choice). Your nickname is assigned automatically when your account is created; you can change it in your profile. Also your data-handling choice (2.1), the date you first answered, the date you last changed it, and a record of each change. |
| Website storage | Only if you allow it: a note that you joined the waitlist, and the email address you used, kept in your browser so the form does not ask you twice. Refuse and nothing is stored beyond the record of your answer. See section 4. |
| Exploration | Derived from your location data, and held only if you have turned on statistics sharing (2.1): your distance per trip per day, the area you have uncovered in each territory, which points of interest you revealed and when, your achievements, and the level and experience computed from them. Your GPS tracks themselves are held only if you have also turned on track sync. With sharing off, all of this exists on your device alone. |
| Social | Friend requests you send or receive, confirmed friendships, invite codes you generate, and your position on leaderboards. |
| Device & notifications | A push-notification token per device and its platform, used only to deliver notifications you have enabled. |
| Subscription | Your platform, plan, expiry date, and the purchase receipt from Google Play or the App Store. We never see or store your payment card — the app stores handle payment entirely. |
| Technical logs | Standard server logs of requests to our backend, including your IP address, timestamp, and the endpoint called. Used for security, abuse prevention, rate limiting, and debugging. |
| Waitlist | If you sign up on this website: your email address and which signup source it came from. |
4. Cookies and local storage on this website
We use no tracking or advertising cookies, and the site loads no analytics or third-party script. Fonts are served from our own servers, so opening a page contacts nobody but us.
What we do keep is one thing, and we ask first: a note that you joined the waitlist, together with the email address you used, so the signup form does not ask you again on your next visit. It is held in your browser's local storage rather than in a cookie, which makes no difference to your rights or to this policy. Nothing is written until you press Accept. Press Reject and the only thing kept is the record of that answer, which is what lets us honour it without asking on every page.
You can change your mind at any time: open the storage settings, or clear this site's data in your browser. Withdrawing permission deletes what was stored immediately.
The apps are separate. What they collect is described in the rest of this policy.
5. Analytics and crash reporting
We use Firebase (Google LLC) to catch crashes and understand how the app is being used. The apps send usage events and crash reports: screens viewed, onboarding steps completed or skipped, tracking sessions started and ended, places tapped and revealed, levels reached, friend requests sent and accepted, and similar interaction events. We also set a small number of properties describing your app state — subscription status, transport mode, level band, unit preference, and whether you are using the app with or without an account.
These events are pseudonymous, not anonymous. When you are signed in they are tied to your Unmapped account identifier so we can troubleshoot specific issues, though they carry no name or email.
Without an account, they carry no account identifier, and we do not create one for you. Usage without an account is counted only against the identifier Firebase's own SDK already assigns to the app's installation on your device. That identifier resets if you uninstall the app, is never joined to an advertising identifier, and is not used for advertising or cross-app tracking. Firebase remains the only analytics service we send anything to, with or without an account.
In either case we strictly exclude coordinates, addresses, and any other location content from analytics and crash payloads — the events record that you started a tracking session, not where.
Firebase's own privacy terms apply: firebase.google.com/support/privacy.
6. Why we process your data, and our legal bases
These bases cover the data we process on our servers. Exploration kept on your device is processed only there and never reaches us, so nothing below applies to it until you choose to share it (2.1).
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Receiving the exploration statistics or GPS tracks you chose to share, and restoring them to a new device | Consent, given by your choice in the app and withdrawable at any time (2.1) |
| Running your account, subscription, and support | Performance of a contract |
| Social features — friends, leaderboards, shared territories | Consent; you choose whether to participate and whether your profile is public |
| Security, abuse prevention, rate limiting, debugging | Legitimate interests in operating a safe, working service |
| Product analytics and crash diagnostics | Legitimate interests in improving the app |
| Waitlist and launch announcement | Consent |
| News and updates by email | Consent. Only if you tick the box when signing in, or turn on Settings → Email updates. It is disabled unless you explicitly allow sending you emails. |
| Correcting historical data after a fault in our processing | Legitimate interests in the accuracy of your records |
We do not use your data for advertising, profiling, or automated decision-making with legal effects, and we do not sell it.
7. Who we share it with
We do not sell personal data or share it with data brokers. We only share data with the specific services we need to keep the app running, and they are contractually bound to act only on our instructions:
- Fly.io — application hosting and the database holding your account, location, and exploration data
- Amazon Web Services (AWS KMS) — key management for our encryption and for the separation of your location data from your identity. AWS holds only key material. Keys are held in the EU (see section 11).
- Google Firebase — analytics, crash reporting, push notification delivery, and remote configuration
- Resend — transactional email (deletion confirmations, support replies, waitlist confirmations)
- LaunchList and Loops — waitlist signup and launch-announcement email, and news and updates email if you have opted in
- Google Play and the Apple App Store — subscription billing and receipt validation
We also disclose data where we are legally required to, and to protect our rights or the safety of users.
7.1 Services your device contacts directly
To draw the map and describe places, the app requests data from third parties. These requests come from your device, so those providers receive your IP address and the map area or place being requested. They do not receive your account, your identity, or your recorded track.
- OpenFreeMap — base map tiles
- OpenStreetMap / Overpass — points of interest
- Wikimedia and Wikidata — descriptions and images of places
7.2 What other users can see
Without an account you have no profile, and nothing about you is visible to other users at all — the social features require an account.
An account that does not share statistics is not on any leaderboard, and other users see "Not sharing stats" in place of its numbers. Friends, requests and invite codes work the same either way, because your friends list is account data rather than exploration data.
If your profile is public, other users can see your nickname, your level and statistics, and your leaderboard position. If your profile is private, your identity is not visible anywhere, except to you and to friends whose requests you have accepted. Your location track is never visible to other users in any profile setting.
8. How long we keep it
These periods describe how long we keep data. They apply only to what has been uploaded to us — see the first two rows for everything that has not.
| Data | Retention |
|---|---|
| Everything kept on your device only | Never reaches us, so we apply no retention to it and hold no copy. It stays on your device until you erase it with Delete in the app, until you log out of the account it belongs to, or until you uninstall the app. |
| A backup in your own cloud | Kept by your cloud provider until you delete it. We never receive it, so we neither keep nor delete it — and deleting your Unmapped account does not remove it (2.7). |
| Filtered location track | Only exists if you turned on GPS track sync. Then for as long as your account exists, or until you use Delete remote cache, whichever is first. |
| Raw location archive | Automatically deleted after 60 days, or when you delete your account or use Delete remote cache, whichever is first. |
| Low-accuracy positions | Three days, on your device and on our servers alike, then replaced by a record holding no coordinates (2.3). |
| Exploration statistics you have shared | For as long as your account exists — including after you turn sharing off, when they are frozen and hidden from other users (2.1). Deleted when you delete your account. |
| Account, social, and content data | For as long as your account exists. |
| Analytics and crash data held by Firebase | Per Google's retention policy, up to 14 months. |
| Your email-updates choice | For as long as your account exists. Deleted when you delete your account. |
| Record of changes to your email-updates choice | Retained after erasure — see below. |
| Record of your data-handling choice and each change to it | Retained after erasure — see below. |
| Waitlist email | Until the launch invitation is sent or you unsubscribe, whichever is first. |
| Deletion and export audit record | Retained after erasure — see below. |
We keep a minimal audit record of account deletions, data exports, each use of Delete remote cache, each time you turn email updates on or off, and each time you set or change your data-handling choice. It consists of the event type, the timestamp, the internal account identifier, and — for the two consent events — the old and new setting. It contains no name, email, location, or other content. We retain it to demonstrate that we honoured your request, and that we only held and emailed what you allowed, both of which are legal obligations. Because the account it refers to no longer exists, the identifier cannot be linked back to you.
9. Your rights
Under UK and EU GDPR, and comparable laws elsewhere, you have the right to:
- Access and portability — get a copy of everything we hold for your account. Send a request to privacy@getunmapped.app and we will send you a machine-readable file containing: your account record (sign-in provider, email, nickname, avatar, unit preference, profile privacy, and the dates you consented); your data-handling choice and every recorded change to it; your email-updates choice and its changes; your totals, your achievements, and the places you revealed with the time of each; your distance per trip; the area you have uncovered in each territory; your friendships and friend requests; your subscription and any complimentary grant; your notification preferences; and the platform of each device registered for notifications (the notification tokens themselves are credentials, so they are left out). Your GPS tracks come as a separate GPX download, and the file states how many positions and raw archive points exist and how long the raw archive is kept. It contains only what we actually hold — so if you have shared nothing, the exploration parts are empty, and your data is on your device, where the app shows all of it.
- Erasure — permanently delete your data.
- With an account: Settings → Delete Account in the app erases the account and everything associated with it. If you have uninstalled the app, see Delete your account or email us.
- Without an account: the app's Delete control wipes everything stored on your device and resets the app to its first-run state. It reaches no server, because we hold nothing of yours to erase — and for the same reason it destroys the only copy that exists, unless you have a backup in your own cloud. We cannot recover it for you afterwards.
- Our copy of your GPS tracks only: Delete remote cache in Settings → Data & backup deletes the tracks on our servers and keeps your account, your totals and the copy on your device.
- A backup in your own cloud: you remove it yourself, in your cloud provider, by deleting the
Unmappedfolder. We cannot do it for you, and deleting your Unmapped account does not do it either (2.7).
- Correction — fix inaccurate personal data.
- Withdraw consent — turn off tracking, revoke the location permission, turn off statistics sharing or GPS track sync in Settings → Data & backup, unsubscribe from waitlist email, or stop news and updates email by turning off Settings → Email updates or using the unsubscribe link in any such email, at any time and without penalty to the rest of the service. Everything in the app except the leaderboards keeps working with sharing off.
- Object or restrict — object to processing based on legitimate interests.
- Complain — to your local supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
To exercise any right, email privacy@getunmapped.app. We respond within 30 days.
10. Security
Where we hold precise, long-term movement data, we have built the backend specifically to make that data hard to tie back to a person. This section is about the data we hold; exploration you keep on your device never reaches our servers in the first place (see 2.1).
10.1 Your location is separated from your identity
Your account details and your location history are stored in separate parts of our database, under different identifiers:
- Your identity and social data — sign-in provider, email, nickname, friends, subscription — are keyed to your account.
- Your location data — every trace and coordinate, and the exploration statistics derived from them — is keyed to a separate, pseudonymous identifier that is not your account ID and carries no name or email.
The value that connects the two is produced on demand from a secret key held in a dedicated key-management service (AWS KMS).
Your location history remains personal data — a detailed movement map can be re-identified from its own content — so we treat every part of it as personal data with all the rights set out in this policy.
10.2 Encryption
- Sensitive identity fields, such as your email address, are encrypted at rest.
- Where we need to find your account by email or sign-in ID, we match on a one-way keyed hash.
- All traffic between the apps and our backend is encrypted with TLS with certificate pinning.
- Session tokens are stored only as irreversible hashes, so a database compromise cannot yield a usable login.
10.3 Access, keys, and operations
- Our application connects to the database with least-privilege roles: the code serving your social features has no access to your location data, and vice versa.
- Encryption and linking keys are reached through short-lived, federated credentials.
- Database access is restricted to our application servers over private networking.
- Access to production data is limited to personnel who need it to operate the service, and use of the identity↔location linking key is logged and monitored.
Because we hold precise location data, we treat any breach of it as high-severity, and we notify affected users and the relevant supervisory authority as the law requires.
11. International transfers
Our processors operate infrastructure outside the UK and EEA, including in the United States. The key material that underpins our encryption and the separation of your location from your identity (AWS KMS) is held in the EU. Where data is transferred, it is protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, as applicable.
12. Changes to this policy
If we make material changes — in particular any change to what location data we collect or how long we keep it — we update the date at the top of this page and notify you in the app or by email before the change takes effect.
13. Contact
Privacy and data-protection enquiries: privacy@getunmapped.app
Everything else: hello@getunmapped.app
We aim to respond within 5 business days.