Privacy Policy
This policy is versioned alongside the app's source code; the most recent commit on master is authoritative.
TL;DR
Geo doesn't create accounts, doesn't run analytics, and doesn't display advertising. The only data that leaves your device is what's necessary to render the things you ask the app to render: a few network requests for map tiles, quantised-coordinate queries to two public APIs that look up nearby mountains and their ground elevation, and one parameterless request to NOAA for the planetary K index that carries nothing about you at all. Your altitude and pressure history, your recorded trips, and your summit log are stored on your devices and in your private iCloud — and go nowhere else. We run no servers and have no access to any of it.
What the app accesses, and what each access does
Location — When In Use
(NSLocationWhenInUseUsageDescription). Requested via the system Location Services prompt the first time you launch the app, because the Info tab you land on is itself a live position readout. Used exclusively to:
- Show your current position on the in-app map.
- Compute distances, bearings and the true-north compass arrow to known peaks for the Nature view, the closest- and highest-mountain cards on the Info tab, and the summit-log proximity check.
- De-trend the barometric storm-warning tendency by altitude (so a climb isn't mistaken for a pressure drop).
- Build the Overpass and Open-Meteo API queries described below.
- Work out your magnetic latitude — and from it the local compass, GPS and aurora consequences shown on the Magnetic Conditions card. That calculation runs on the device and its result is never sent anywhere.
Geo does not request "Always" location authorisation. Background sampling of the barometer is performed by iOS's
BGTaskScheduler system, which works without continuous location access; the app never tracks the user's position while the screen is off.
Camera (NSCameraUsageDescription). Used by the Nature (AR) view to overlay peak names on the camera feed and, when you tap the shutter, to capture the optional freeze-frame share image. Frames are processed entirely on-device by ARKit and the live feed itself is never recorded or transmitted. The shutter composites the frozen frame with the peak labels into a single image held in memory and hands it straight to the system share sheet — the app writes no file of its own — so it only leaves the app if you choose a destination there. Saving it to Photos is one of those destinations: iOS asks for add-only photo access the first time (NSPhotoLibraryAddUsageDescription), which lets Geo add that one image and never lets it read your library.
Motion & Fitness (NSMotionUsageDescription). Reads the device's barometer and motion sensors so the app can compute altitude (from atmospheric pressure), drive the trip recorder and storm-warning tendency, and stabilise AR peak labels. Sensor values stay on the device.
Notifications (requested at first launch). Geo asks permission to send local notifications. There are two. The storm warning is a single "pressure falling fast" advisory raised when the barometer drops sharply. The aurora alert tells you when the auroral oval could reach your latitude tonight; it is off by default, behind a switch in the Magnetic Conditions card's "What this means" sheet — until you turn it on that path issues no request and reads no position — and once on it fires at most once in any 20 hours. The alert is worked out from the last fix the app already recorded, so it starts no background location of its own. Both are scheduled on the device by the app itself — there is no push server, no device token leaves the phone, and denying the permission simply disables the advisories; nothing else changes. There are no marketing or remote notifications.
The Apple Watch companion app and Watch widget request only Motion & Fitness to read the Watch's barometer.
What goes over the network
Apple MapKit. The Map view uses MapKit to render map tiles and your-location pin. Apple is the data controller for those requests; data flow and Apple's use of it are governed by the Apple Privacy Policy and the on-device privacy preferences you control in Settings → Privacy & Security → Location Services → Maps. MapKit on iOS doesn't require an API key and routes all requests through Apple's privacy-preserving infrastructure.
OpenStreetMap Overpass API (https://overpass-api.de/api/interpreter). When you open the Nature tab, the app sends an HTTPS request containing your quantised latitude/longitude (rounded to three decimal places, ~110 m) and a 5 km search radius to fetch the list of nodes tagged natural=peak near you. The request body contains only those coordinates and the radius — no device identifiers, no IDFA, no account information — and is sent with a descriptive User-Agent and a client-side timeout. Downloading an offline expedition pack (Info tab → "Manage offline areas", or the Map tab "Download a region" mode) issues the same kind of query once for the area you frame, at the radius you choose (5 / 10 / 50 / 100 km), so the peaks can be cached on-device for no-signal use. The Overpass API is a free, public service hosted by OpenStreetMap volunteers and governed by the OpenStreetMap Foundation Privacy Policy.
Open-Meteo Elevation API (https://api.open-meteo.com/v1/elevation). When you open the Nature tab — or when you download an offline expedition pack — the app looks up the ground elevation of nearby peaks (for any whose OpenStreetMap entry doesn't already carry one) and of your own vantage point, so it can tell which summits rise above your horizon and place their labels at the right height. Each sample point is computed from a quantised coordinate (same ~110 m rounding) and requested in batches. No device identifier or account information accompanies the request. Open-Meteo is a free, open API; its handling is governed by the Open-Meteo Terms. (Earlier versions used the Open-Elevation endpoint, which was frequently unavailable; 1.1 moved to Open-Meteo for reliability.)
NOAA Space Weather Prediction Center (https://services.swpc.noaa.gov/products/noaa-planetary-k-index-forecast.json). The Magnetic Conditions card on the Info tab fetches the planetary K index — one global number describing geomagnetic activity, published in 3-hour steps — so it can tell you how much a geomagnetic storm may be disturbing your compass and GPS, and whether the aurora could be visible from your latitude. This request carries no location, no identifiers and no query string of any kind: it is the same fixed URL for every user of the app, byte for byte, and nothing about you is sent. Everything the card says about your position — your magnetic latitude, which way to look, when it gets dark — is computed on your device from that one global number and never leaves it. It is made at most once per 3-hour step, while you have the Info tab open; if you switch aurora alerts on, the same parameterless request also rides the app-refresh background task, and with alerts off that background path makes no request at all. The response is public-domain data published by the U.S. National Oceanic and Atmospheric Administration. Geo is not affiliated with, or endorsed by, NOAA.
iCloud (CloudKit). If you are signed into iCloud, your altitude/pressure/route history, your recorded trips, and your summit log sync to your other Apple devices through Apple's
NSPersistentCloudKitContainer infrastructure, in your private iCloud database. The developer has no access to that data and runs no servers that receive it. iCloud sync is private under Apple's terms; turning iCloud off in Settings stops the sync without deleting the on-device copy. A logged summit stores only the peak's public location and elevation plus your measured barometric altitude and any note — never a track of where you actually were.
That's the entire list: MapKit, Overpass, Open-Meteo and NOAA SWPC, plus your own iCloud. No other servers are contacted. There is no telemetry, no crash reporter, no advertising network, no attribution provider, no remote analytics. The Sun panel's solar times are computed on-device with the published NOAA solar algorithm and need no network — that is a formula, unrelated to the space-weather request above.
Data stored on your device
Altitude / pressure history, trips and summits — the device's barometer is sampled periodically and the readings, together with the GPS positions where they were taken, are stored in a local Core Data store inside the app's sandbox so the Stat tab, the home-screen widget, and the Watch complications can show altitude trends, trip profiles and your logged ascents. The store is mirrored to your private iCloud through CloudKit when iCloud is signed in. History older than ~1 year is pruned automatically, and a Clear history action on the Stat tab removes it on demand. Uninstalling the app removes the local copy; deleting the data from Settings → [your name] → iCloud → Manage Account Storage removes the iCloud copy.
Offline expedition packs — the cached OpenStreetMap peaks (name, coordinate and elevation) for an area you downloaded are stored as local files in the app's sandbox so the Nature (AR) view keeps naming peaks with no signal. Map tiles are not cached (MapKit licensing). This cache is purely local and is not synced through CloudKit; deleting a pack from the app, or uninstalling, removes it.
Known-elevation calibration — when you pin the altimeter to a marked elevation ("I am at X m"), the resulting correction is stored as a small, time-decaying offset in the shared app group (group.me.nettrash.Geo) so the widget agrees with the app. It contains no location and reverts to the system value after a few hours.
Space-weather cache — the last planetary K-index product fetched from NOAA is kept in a small JSON file (SpaceWeatherCache.json) in the app's Caches directory so the Magnetic Conditions card still resolves with no signal. It is the same global, public index every user receives: it holds no location and nothing about you, and it is not synced through CloudKit.
The Apple Watch companion stores its own pressure-history snapshot locally on the Watch and shares it with the iPhone via WatchConnectivity when the two are paired and reachable.
App Tracking Transparency
Geo does not "track" you in the sense Apple's App Tracking Transparency framework defines: it does not link any data collected in the app with data from other apps, websites, or offline sources to build a user profile, and it does not share any data with data brokers. Geo therefore does not present an ATT prompt. The app ships a PrivacyInfo.xcprivacy manifest in every binary (main app, iPhone widget, Watch app, Watch widget) declaring NSPrivacyTracking = false and the Required-Reason API codes for the system APIs it uses (UserDefaults CA92.1, file timestamp C617.1, system boot time 35F9.1, disk space E174.1).
Third-party services
| Service | What it sees | Whose policy applies |
|---|---|---|
| Apple MapKit | Coarse position + viewport requests for tile rendering | Apple's |
| OpenStreetMap Overpass API | ~110 m-quantised coordinates + search radius (5 km live, up to 100 km for an offline pack) | OpenStreetMap Foundation's |
| Open-Meteo Elevation API | ~110 m-quantised coordinates to look up peak / vantage-point ground elevation | Open-Meteo's |
| NOAA Space Weather Prediction Center | Nothing — a fixed URL with no query string, byte-identical for every user, returning the global planetary K index | Public domain (U.S. Government work); NOAA's |
| Apple ARKit | Camera frames + IMU data, on-device only | Apple's |
| Apple iCloud (CloudKit) | Your private CoreData store (history, trips, summits) for sync between your devices | Apple's |
Specifically NOT used: any third-party analytics SDK (Firebase, Mixpanel, Sentry, etc.), any advertising SDK (AdMob, Meta, AppLovin, etc.), any attribution / install-tracking SDK, any social-media SDK, any IDFA-consuming network.
Children's privacy
Geo is rated 4+ and is suitable for all ages. We do not knowingly collect personal information from children, because we do not collect personal information from anyone.
International data transfers
The Overpass, Open-Meteo and NOAA endpoints are global services; requests may transit servers in any country. The data sent (quantised coordinates + radius for Overpass and Open-Meteo, and nothing at all for NOAA) does not contain personal data under GDPR Article 4(1) when used in this app — it's not combined with any identifier we hold. MapKit and CloudKit requests are routed through Apple's infrastructure under Apple's standard privacy controls.
Your rights
Because we hold no data about you:
- There is no record to access under GDPR Article 15 / CCPA "right to know".
- There is no record to delete under GDPR Article 17 / CCPA "right to delete" — the local history, trips and summit log are yours alone, and you can remove them with Clear history, by deleting individual trips/summits, or by uninstalling the app and clearing the Geo entry from iCloud storage.
- There is no record to correct under GDPR Article 16.
- There is nothing being sold or shared under CCPA / CPRA, so no opt-out is required.
For data flowing through the third-party services listed above, the respective providers' privacy operators are the right point of contact.
Changes to this policy
If a future version of Geo changes any of the above — adds analytics, integrates a third-party SDK, adds a new network endpoint, or starts using a permission for a new purpose — this document will be updated in the same release and the Effective date will be bumped.
Contact
Privacy questions: nettrash@nettrash.me. For day-to-day support, see the Geo support page.