Privacy Policy

1. Who is responsible for what

Three separate parties can be involved when you use wanderer, and they hold different data. Confusing them is the most common misunderstanding about this project, so they are named first.

The wanderer project

Publishes this website, the documentation, and the wanderer mobile apps in the App Store and Google Play. We operate no account system for the app and receive none of your trails, recordings, photos or account details.

Your instance operator

The app connects to a wanderer instance that you choose: one you host yourself, one run by a community member, or a company's. That operator stores your account and your content, and is the data controller for it. Their privacy policy governs that data, not this one.

Other instances, through federation

If your instance is connected to others, content you have marked public can be copied to those instances and stored by their operators. See section 8.

Everything below distinguishes between data that stays on your device, data that goes to your chosen instance, and the small number of cases where something reaches a third party.

2. This website

openwanderer.com serves documentation and information about the project. It has no user accounts, no login, and no comment system.

• No analytics or tracking. The site runs no analytics, no tracking pixels and no advertising, and sets no tracking cookies.
• No third-party fonts or embeds. Fonts are served from this site, not from a font CDN, so visiting a page does not disclose your IP address to a third party.
• Server logs. Our hosting provider records standard request data (IP address, timestamp, requested URL, referrer and user agent) to deliver the site and defend against abuse. These logs are not combined with anything else and are not used to profile visitors.
• Links leave us. Pages link to GitHub, Discord and other sites. Once you follow such a link, that site's own policy applies.

3. The app: data on your device

Most of what the app holds never leaves your phone unless you send it. Stored locally are:

• Trails you have saved or downloaded, including their route geometry, waypoints and photos.
• Map regions you download for offline use, and the map tiles inside them.
• Recordings in progress, including the track recorded so far, so a recording survives the app being closed.
• Your session with your chosen instance, and app settings such as theme and units.

Uninstalling the app deletes all of it. Clearing the app's storage in Android or iOS settings has the same effect.

4. The app: data sent to your instance

The app is a client for the instance you sign in to. What it sends there is what you ask it to send: your account details and profile, trails you create or save, recorded tracks you choose to save, photos you attach, comments, lists and summit logs.

That instance stores this data under its own operator's control and its own policy. If you host your instance yourself, that operator is you. We have no access to it, cannot retrieve it, and cannot delete it on your behalf.

5. The app: location data

Location is the most sensitive thing the app handles, so it is set out in full.

• When it is collected. Only while you are actively recording a trail or navigating one. Both start on an explicit action by you, and both run with a persistent notification that stays visible for as long as they are running. The app does not collect location at other times.
• Background collection. Recording and navigation continue when the screen is off, when another app is in front, and when the app has been cleared from recent apps. This is why the app asks for background location access. Without it, recording and navigation stop as soon as the app is closed and the rest of the trail is lost. Before that permission is requested, the app shows an in-app explanation of what it is for.
• Where it goes. The recorded track is written to your device as you walk. It is transmitted to your instance only when you choose to save the trail. If you discard a recording, it never leaves the device.
• What it is used for. Drawing your position on the map, turn-by-turn guidance, and building the saved trail: its track, distance, elevation gain and duration. Location is not used for advertising, profiling or analytics, and is not sold or shared with data brokers.

6. The app: permissions

Location (while using the app)

Shows where you are on the map, and records or navigates a trail.

Location (all the time / background)

Keeps a recording or navigation session running when the app is not in front. Optional: declining leaves the app working, but a session ends when you close the app.

Notifications

Shows the persistent notification for a running recording or navigation, and progress while a map region downloads. Without it a session can run without being visible to you, which is why the app asks.

Photos and files

Only when you attach a photo to a trail or import a GPX, KML or similar file. The app reads what you pick and nothing else.

7. The app: third parties

Besides the instance you choose, the app contacts very little. In full:

• Avatar images (api.dicebear.com). When an account has no profile picture, the app requests a generated placeholder from DiceBear, sending the display name or username so the initials match. No other account data is sent. Requests carry your IP address to that service, as any web request does.
• Map data and routing. Map tiles, search and route calculation are served by your instance, using whichever providers its operator has configured. Your instance operator's policy covers that.
• External map apps. If you tap to open a location in another app such as Google Maps, Apple Maps or Organic Maps, the coordinates are handed to that app. This only happens when you tap it.
• App stores. Downloads and updates go through Apple and Google, who record their own data about installs. We receive only aggregate statistics, never anything identifying you.

The app contains no analytics SDK, no crash-reporting SDK, no advertising SDK and no social-media SDK. There is nothing in it that reports your behaviour back to us, because there is nowhere for it to report to.

8. Federation: how public content travels

wanderer instances can connect to one another using ActivityPub, the same protocol Mastodon uses. If your instance operator has connected it to others, this affects where your content ends up, so it is worth understanding before you post publicly.

• Trails, lists and summit logs federate only when public.Marking one of these public is what makes it eligible to be copied to connected instances. Content that is private or shared with specific people is never sent this way.
• Comments are the exception. A comment is delivered to the people it concerns regardless of whether the trail it is on is public or private: if you @mention a remote account, the comment text is sent to that account's server, and a copy also goes to the trail's author if their account is on another instance. The receiving server can reject it, but by then the text has already left your instance. In practice, this means a comment on a private trail can still leave your instance if it mentions someone, or if the trail's author is on a different one. Nothing about the trail itself travels with the comment, neither its title nor its description nor its location, only a reference to which trail it replies to.
• Copies live on other servers. A federated copy is stored by the operator of the receiving instance, under their control and their policy. You remain the author, and editing rights stay with your own instance.
• Unpublishing is not deletion. Making a public trail or list private again stops it from being sent onward, but no deletion is sent, so copies already held by other instances stay where they are. If you want a deletion to reach instances that already received the trail, delete it while it is still public rather than unpublishing first: deleting it afterwards still reaches anyone who was mentioned in it, commented on it, logged a summit on it, liked it or had it shared with them, but no longer your followers.
• Deletion is a request, not a guarantee. Deleting public content sends a deletion to the instances your own instance knows to hold a copy: those following you, and anyone who was mentioned in it, commented on it, logged a summit on it, liked it or had it shared with them. Well-behaved instances honour it. An instance that is offline, misconfigured or hostile may not, and an instance that fetched a copy on its own, because one of its users opened your trail, is not known to yours; such a copy is removed when that instance next refreshes it and finds it gone. Treat anything published publicly to a federated network as difficult to fully retract.
• Departing accounts travel too. When an account is deleted, its instance announces that to the other instances it has reason to believe hold something of that account, and this one acts on such a notice by removing its copy of that account along with the content of theirs it was holding. Your own account leaving is announced the same way. See section 12 for who is told and what that does and does not cover. A notice is only ever accepted for the account that signed it: another server cannot ask this one to delete somebody else.
• Who you federate with is your operator's choice. If you run your own instance, it is yours.

9. Security and safeguards

This section states plainly what protects your data in transit and in storage, and what does not. We would rather say this clearly than let you assume more than the software provides.

• In transit. wanderer does not ship or run its own TLS termination. Whether your instance is served over HTTPS is entirely your instance operator's responsibility, and the app connects using whatever scheme your instance's address uses. On Android, the app itself blocks plaintext (cleartext) network traffic to everything except a local loopback connection used for offline map tiles, so it cannot be tricked into talking to a remote server over plain HTTP.
• Between instances. Activities exchanged between federated instances are signed with HTTP Signatures, so a receiving instance can verify which server actually sent them. This authenticates the sender. It does not encrypt the content: a signed activity is still readable plaintext in transit, protected only by whatever transport encryption (see above) is in place.
• Passwords. Stored hashed by your instance's authentication system, never in readable form.
• Files. Photos, GPX files and avatars are served from a direct URL. There is no additional access token guarding that URL. An unguessable filename is the only thing standing between a link and the file it points to, and anyone who has or guesses that link can retrieve the file.
• At rest. Content is not encrypted at rest by wanderer. Whatever protection your data has on disk, whether that is full-disk encryption, a secured server, or none at all, is your instance operator's decision, not something this project provides.
• On the device. As described in section 3, the local database, downloaded map regions and your session are held inside the app's own OS-managed sandbox and removed when you uninstall it.
• In-app disclosures. Before background location is requested the app shows an explanation of what it is for, and a persistent notification stays visible for as long as recording or navigation is running. See section 5. The app contains no advertising or analytics SDKs, and location is never sold or shared with data brokers.

10. Demo instance

A public demo instance is linked from this site so people can try wanderer without installing it. It is for evaluation only: accounts and content on it may be reset or deleted at any time, without notice and without backup. Do not put anything there you would mind losing or anything you would mind others seeing.

11. Legal bases

Where the GDPR applies, we rely on the following legal bases for the limited processing we carry out:

• Art. 6(1)(f), legitimate interests for serving this website securely and keeping server logs to defend against abuse.
• Art. 6(1)(a), consent for device permissions such as location, background location and notifications, each of which you grant and can withdraw in your device settings at any time.

Processing carried out by your instance operator has its own legal basis, which they are responsible for stating.

12. Retention and deletion

• On your device: kept until you delete the content or uninstall the app.
• On your instance: governed by your instance operator's retention policy. Deleting your account removes your login credentials and API tokens, your public profile, and the content you authored: your trails, lists, summit logs and the comments you left on other people's trails. Comments you wrote go with the account even where they sit under someone else's trail, so a thread you took part in may read differently afterwards.
• Activity records outlive content deletion, but not account deletion. Your instance keeps a record of the federation activities it sent on your behalf, meaning the ActivityPub messages announcing your trails, lists, summit logs and comments to connected instances; comments are recorded even when the trail they sit on is private. These records embed a snapshot of the content as it was when it was sent, including its description and location coordinates where relevant, and deleting the content does not clear them. They can be read without logging in, and each account's records are listed at a public address, its ActivityPub outbox, so nothing has to be guessed. Deleting your account does remove them: every record made in your name goes with the account, and the only one written afterwards is the deletion notice itself, which carries your former account address and nothing else.
• Federated copies: once a piece of public content has reached another instance, whether as a live copy or as one of the activity snapshots described above, removing it there depends on that instance honouring a delete signal from yours. Seesection 8. Deleting a single trail, list or summit log while your account still exists sends that signal for that item. Deleting your whole account sends one signal for the account itself rather than one per item, which asks receiving instances to drop everything of yours; the individual items cannot each announce their own removal, because your profile goes before they do and there is no longer an identity to sign in your name. In both cases the content is removed from your own instance regardless. The account notice is sent once your account has actually been removed, and it goes to every instance yours has reason to believe holds something of yours: the accounts that follow you and those you follow, the authors of trails you commented on, logged or liked and the accounts that did so on your trails, the other side of every trail or list share you were part of, and every account one of your posts was addressed to directly, such as someone you mentioned. Two kinds of holder fall outside that and may never be told: an instance that received your content while one of its accounts followed you and has since unfollowed, and one that obtained a copy some other way, for instance by fetching it from your instance directly. Nothing about either remains on your instance to address a notice to.
• Website server logs: kept only as long as needed for security and troubleshooting, then deleted.

13. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing, and to complain to a supervisory authority.

Direct these to whoever holds the data. For your account, trails, photos and recordings, that is your instance operator. We cannot act on data we do not hold. For this website, use the contact details below.

14. Children

The app and this site are not directed at children and we do not knowingly collect data from them. Age requirements for an account are set by the instance you sign up to.

15. Changes

This policy may change as the software does. The date at the top reflects the current version, and material changes will be noted in the project changelog.

16. Contact

For questions about this policy or about data held by the project:

For data held on a wanderer instance you use, contact that instance's operator instead. We have no access to it.