Last updated 28 September 2026.
This is a walking app. It needs to know where you are so it can offer you a walk that starts there. This page says exactly what stays on your phone, what reaches us, and how to switch it all off.
The permission asked for is While Using the App, never Always. It is requested the moment you tap "My location" or start recording, never at launch. The app's first screen works without it.
While recording, iOS shows the blue indicator for as long as the track is running, including with the screen locked. That is your visual guarantee, and it is why Always is never requested.
To learn which screens people reach and where they give up. What is sent:
No IP address is read, logged or stored. That is structural rather than a policy: the column does not exist in our database. Region comes from your device, never from an IP lookup.
Retention: 180 days, then deleted automatically.
You can switch this off in Settings. Turning it off also empties the local queue and changes the installation identifier.
If you rate a walk or tap a tag ("muddy", "gate closed"), we receive the rating, the tags, which walk it was about, your region and the date.
If you type or dictate a note, that text reaches us too. Nobody else reads it. We use it to describe the path with the same translated tags as above, and it is those tags other walkers see, never your sentences.
Your saved walks sync between your devices through your own private iCloud database. They pass through none of our servers and we cannot read them. If you do not use iCloud the app works normally, without syncing.
The home screen shows a banner for another app. It comes from Kickstart Exchange, an exchange between independent developers: we show their apps, they show ours. Nobody buys space and nobody sells yours.
What the banner sends is limited to what it takes to choose and count an advert: which advert was asked for, which was shown, and whether it was tapped. No advertising identifier, no IDFA, no tracking prompt, no location. Nothing is attached to you or followed from one app to another. Their privacy notice covers their side of the service.
Tourist offices and other partners who subscribe to the Partner Space send us their walks: a GPX file, a name, a description and up to three photos. Photos are scaled down and stripped of their GPS location on the device, then re-encoded on our servers. A person on our team reviews everything before it is shown. To know that a partner is subscribed, the app sends us the subscription transaction signed by Apple: we keep its identifier and expiry date, never a name, an address or a payment method.
To suggest a partner destination near you, the app may send your position rounded to about a kilometre, and only if you have already allowed location. It never asks for it for this. Without a position, the destination is picked at random.
Photos you add to a saved walk stay on your devices and in your iCloud, without their location. If you subscribe to Plus and choose to share them with a walk, they are sent to our servers with the link and can be seen by anyone who opens it. To check the subscription, the app sends the transaction signed by Apple, which we do not keep. Any shared photo can be reported, which hides it until we check it. To have one removed, write to us.
Basemaps and paths come from OpenStreetMap and are rendered on our own servers. Route calculation goes through openrouteservice, which receives a start point and a duration, never an identifier belonging to you.
The data described here does not identify you and is not linked to any account. For any question, a deletion request, or to find out what is associated with a particular installation identifier, write to support@randofacile.com. We answer within 30 days.