Privacy Policy

Last updated: October 4, 2026

1. Local-first exploration

In Explore mode, accepted precise coordinates, saved routes, exploration cells, fog, History, Journey Replay, missions, achievements and progress stay on your device. Frontiers is an optional online territory mode: when you use it, the app sends the location and capture information described below to its server. Precise coordinates and routes are not sent to product analytics.

2. Information processed on your device

• foreground and, when explicitly enabled, background location samples;
• saved walks, route geometry, explored cells, fog, nearby calculations, statistics, missions, achievements, and profile progress;
• downloaded public boundary data, app preferences, analytics preference, and the last confirmed subscription expiration used for safe offline gating.

You can clear local History and exploration data from Settings. Deleting the app also removes app-container data, subject to normal device backup behavior controlled by Apple.

3. Information that may leave your device

• Optional account: if you choose Firebase sign-in, Firebase receives the account identifiers and credentials needed to authenticate you. An account is optional for Explore and required for Frontiers. Signing in does not back up your local Explore history.
• Frontiers and leaderboards: when you use Frontiers, Firebase authentication identifies your account. Your current map-view coordinates are sent to retrieve nearby territory. When you submit a capture, the server receives route coordinates and timestamps, distance, aggregate step count and whether steps were estimated. The server stores capture geometry, ownership cells, totals and an account-linked display name to validate claims and operate territory maps and rankings. Other participants can see territory boundaries and the associated display name and competitive totals. Computer-generated rivals may also appear. This feature does not upload your entire local Explore history.
• Privacy-safe product analytics: GeoFog sends product-interaction and app-usage events to PostHog by default to understand onboarding, reliability, and feature usage. When you sign in, limited account identifiers such as user ID, name, and email may be associated with those events. Device and app identifiers may also be processed. Precise or coarse coordinates, routes, geometry, area or city names, passwords, keys, and tokens are blocked from analytics events. You can turn analytics off at any time in Settings.
• Purchases: Apple and RevenueCat process product, transaction, entitlement, renewal, expiration, refund, and restore information plus an app-specific user identifier. Limited purchase and entitlement status may be used for app functionality and product analytics. GeoFog does not receive full payment-card details or store App Store receipts.
• Boundary downloads: the distribution host receives ordinary HTTPS request information such as IP address, timestamp, requested public catalog/file, and standard server logs. Requests do not contain your coordinates, routes, fog, visited areas, account token, or analytics identity.
• User-directed sharing: journey/profile cards leave the app only when you invoke the iOS share sheet and choose a destination.

4. Purposes

We process information to provide local exploration, authenticate optional accounts, verify and restore Premium, validate Frontiers captures and maintain territory maps and rankings, deliver public boundary files, provide support, protect security, and understand privacy-filtered product interaction and app reliability.

5. Sharing, sale, and tracking

We use Apple, Firebase, RevenueCat, PostHog, and static hosting/distribution providers for the purposes described above. We do not sell personal information, show third-party advertising, or use GeoFog data for cross-app advertising tracking.

6. Retention and deletion

Local Explore history remains on your device until you delete it. Clearing local History does not delete server-side Frontiers captures. Deleting your GeoFog account initiates removal of its stored Frontiers captures and ownership cells; purchase records are handled separately by Apple and RevenueCat. Optional account records, purchase records, analytics events, and security logs are retained only as reasonably needed for their stated purpose, service integrity, legal obligations, and dispute resolution. Use Settings to clear local data, turn analytics off, or delete the optional account where available. Email support@broox.group for an applicable privacy or deletion request.

7. Permissions and choices

Explore does not require an account; app features require an active subscription or eligible free trial. You can decline or change location permission, keep background exploration disabled, turn analytics off in Settings, remove downloaded areas, clear local History, restore purchases, and manage subscriptions through Apple.

8. Security

GeoFog uses platform protections, HTTPS, validated downloads, restricted production access, and privacy-filtered analytics. No system can guarantee absolute security.

9. Children and international processing

GeoFog is not directed to children under 13 or the higher minimum age required in their region. Service providers may process account, Frontiers location and capture information, purchase, analytics, or request-log information in other countries using safeguards appropriate to their services.

10. Changes and contact

We may update this policy when the app or legal requirements change. Questions and privacy requests: support@broox.group.