Privacy policy

The short version

• Your walks, routes, history, settings and exported GPX files stay on your phone. We never see them.
• To find loops, the app sends only the map square you are in. The squares are a fixed grid, about 500 m across, and are the same for everyone. Your exact position never leaves the phone: everything the app asks our server for is worked out from the square, never from where you stand, and nothing sent with it identifies you or your phone.
• A postcode you type is looked up on your phone and never leaves it. The app downloads the list of postcodes for its area (for "SW4 0AA", the "SW" list) from our own website and finds it there.
• Routes are drawn by our own server in London (UK), hosted by Oracle Cloud. It receives only the centre of that square and the rounded walk length, and keeps no logs.
• "Find a way home" is worked out on your phone.
• There are no accounts, no adverts, no tracking cookies, no crash reporting, and no install id or any other identifier.
• We count things like "a walk was started" as plain daily totals that hold nothing about you. This is on by default, and you can switch it off in Settings.
• Our server code never reads or stores IP addresses. Cloudflare, which hosts our website and server, sees them to deliver traffic, as any web host must.
• "Delete all data" in Settings wipes everything Offlead keeps on your phone.

Who is responsible

Offlead is made by Jack Trute, trading as PropaApps, "we" in this policy. We hold no personal data about you: what reaches our server cannot be linked to anyone, and everything about your walks stays on your phone. So there is no account and nothing for us to look up. Questions about this policy or your rights: [email protected].

Offlead is for people in the UK aged 13 and over. It is not meant for younger children.

What stays on your phone

These are kept in the app’s own storage on your phone. They are never uploaded:

• Your walks: start and end time, distance, duration, and the recorded track (a list of points with time and GPS accuracy).
• Loops you were shown or saved, your favourites, and the parks you have passed. A loop you were shown but did not walk or save is deleted from your phone after 7 days.
• Your places: pins you drop on the map, each with a name you choose and its position. They are private to your phone and are written into a GPX file only when you export one.
• Which parks you have answered "Was off-lead OK?" for today, so the app does not ask again.
• Your settings (units, theme, walking pace, and whether usage counts are on).
• On Android, a copy of the map around the loops you walk, so the map still draws with no signal. It holds up to 800 map tiles, the oldest dropped first.
• Photos you pick for a share card. They are drawn into the image on your phone and never uploaded by us.
• GPX files you export, of one walk or all of them. They are made on your phone and handed to your phone’s share sheet. Once you save or send one somewhere, that copy is yours to keep or delete.

Location. The app asks for your location to find loops near you and to guide and record a walk, and uses it only while the app is in use. On Android, recording a walk shows a "Recording your walk" notification so that it keeps working with the screen off. Offlead never asks for "allow all the time" location. If you say no, you can type a postcode instead. You can change this at any time in your phone settings.

What leaves your phone, and where it goes

Nothing below carries your name, an account, an install id or any other identifier. Our server is a Cloudflare Worker; its code never reads or stores your IP address, and we have not switched on Cloudflare’s request logs.

• Finding loops, to our server: the map square you are in (one square of a fixed grid about 500 m across, never your position), the length of walk you want rounded to a fixed step that everyone shares (50 m for most walks, wider for long ones, never your exact pace), the loops you have already been shown, and a random number made for that one search so that its follow-up calls count once against our daily limits. Our server plans loops around the centre of the square and keeps them in a cache for that square, so everyone in the same square gets the same loops. Your phone then starts each loop at its point nearest you. To draw the loops, our server sends the centre of the square and that rounded walk length, and nothing else about the request, to our own routing server, which Oracle Cloud hosts in London (UK) and which keeps no logs. If that server is down, it sends the same to openrouteservice instead (see "Who handles data for us").
• Walkers' off-lead scores, to our server: the app asks for the scores of parks in a box built from your map square: around the centre of the square, as wide as the walk is long, then widened outwards to a fixed grid of about 1 km. It is built from the square and the rounded length only, never from your position, so everyone in the same square asking for the same length of walk sends the same box. Nothing else is sent with it.
• Off-lead answers, to our server, only when you answer "Was off-lead OK?": the park, and your answer (yes, no or not sure). Nothing about you, your phone or your IP address is stored with it. We store the park, the answer and the day, add it to that park’s running totals, and delete the individual answer after 90 days. The totals per park, which hold nothing about anyone, are kept. Your phone, not our server, stops a second answer for the same park on the same day.
• Usage counts, to our server, unless you switch them off: see the next section.
• A postcode you type is looked up on your phone and is never sent anywhere. To find it, the app downloads the list of postcodes for its area, the letters at the start (for "SW4 0AA", the "SW" list, which covers a large part of south-west London), from our own website; the Android app has these lists built in. So all our website can see is the area, and we keep no record of it. No postcode service is involved, and our server never sees the postcode.
• Map tiles and map fonts come straight to your phone from OpenFreeMap, run by Hyperknot Software in Hungary. Like any map service, it sees your IP address and which part of the map you are looking at. Its privacy policy says its logs leave out IP addresses unless it is dealing with an attack, and are deleted after 7 days.
• Dog spots and green-space data, when we switch them on: the app reads parts of map data files from our server. To score loops, the parts it reads are worked out from your map square and the loops our server sent, never from your position. To show dog spots on the map, they follow the map on screen, much like map tiles. Our server code does not log which parts.
• "Find a way home" sends nothing: it is worked out on your phone from the loop on screen.

Usage counts

To learn whether Offlead works and how to improve it, the app counts a short, fixed list of events: the app opening, loops being shown (how many, and a rough loading time), a loop being chosen, a walk starting or finishing (with a rough length band and how much of the loop was walked), a share, and an off-lead answer. Your phone keeps a small queue of these and sends them now and then.

• What is sent is the event’s name and a small band such as "40-60min". No id, no place, no time of day, and nothing that tells one phone from another.
• Our server only adds each event to a total for that day. It keeps no record of single events or of who sent them.
• The daily totals are kept for 13 months, so we can compare a month with the same month a year before, then deleted by a daily clean-up.
• They are never shared with anyone or used for advertising.

Counting is on by default. UK law allows this for statistics that improve a service, as long as we tell you and you can say no. To switch it off: Settings, then "Share anonymous usage counts", then Off. The app stops counting at once and throws away anything it has not sent. Switching it off does not change anything else in the app.

IP addresses

Every request from your phone to any website or server carries your IP address, because that is how the answer finds its way back. Here is who sees it:

• Our server code never reads, uses or stores it. Our limits against abuse are daily totals for the whole service, not per person or per address.
• Cloudflare, which hosts our website and server, sees it to deliver the traffic and protect its network. It handles it under its own terms and its data processing agreement with us. We have not switched on Cloudflare’s request logs, so we keep no record of addresses.
• OpenFreeMap sees it when your phone asks it for map tiles (see above).
• Our routing server (at Oracle) and openrouteservice never see it: they are called by our server, so what they see is the address of Cloudflare’s network, never yours.

Because Cloudflare sees your IP address along with each request, in principle it could see an address next to the map square your phone asked about. We cannot: our code never receives the two together, and keeps neither.

Crash reports

Offlead does not send crash or error reports to us or to any crash-reporting service. If you install from Google Play and have chosen to share diagnostics with Google, Google may collect crash reports for the app under its own policy, and shows us a summary without your identity.

Offlead Unlock (the optional purchase)

Offlead can be unlocked with a one-time purchase made through Google Play. You pay once, and the paid features are available on any Android device signed into the same Google account. Here is what happens when you unlock:

• Google processes your payment and handles refunds under its own terms. We receive no payment details, name or email.
• The app asks Google Play whether this Google account owns the purchase and keeps a yes or no on your phone so the app works offline. We do not store purchases on our server.
• Google’s own privacy policy applies to the purchase.

Backups of our database

Our database (Cloudflare D1) holds only the off-lead answers and totals and the daily usage totals described above. It keeps automatic backups, so that it can be restored to any moment in the last 7 days, and we cannot switch this off. So when this page says we delete something, it is deleted from the live database, and the backups still hold it until 7 days after that. Only the account owner can open a backup, and nothing in the app reads from one.

Who handles data for us

• Cloudflare (US company, worldwide network): hosts the website, our server and our database, with its backups. It acts for us under its data processing agreement.
• Oracle Cloud Infrastructure (Oracle is a US company; our server is in its London data centre, in the UK): hosts our own GraphHopper routing server, which draws walking routes. It receives, from our server only, the centre of a map square and the rounded walk length. It receives nothing from your phone, and the server keeps no logs of what it is asked. Oracle acts for us as the host, under its data processing terms.
• openrouteservice, run by HeiGIT in Germany: draws walking routes when our own routing server is down, from the same map-square centre and rounded walk length that our server sends. It receives nothing from your phone.
• OpenFreeMap (Hyperknot Software, Hungary): your phone talks to it directly for map tiles, as described above, under its own terms.
• Google Play: if you install the Android app from Google Play, Google handles the download, updates and anything Play itself collects, under its own policy.

Data outside the UK

Some of these providers are outside the UK. Each one is covered by the standard UK protections for that transfer:

• Cloudflare: its data processing agreement includes the UK addendum to the EU standard contractual clauses, and Cloudflare is certified under the UK extension to the EU-US Data Privacy Framework (the "UK-US data bridge").
• Oracle: our routing server is in its London data centre, so what it receives is not sent outside the UK.
• HeiGIT (Germany) and OpenFreeMap (Hungary): the UK treats the European Economic Area as having adequate protection, so no extra paperwork is needed.
• Google: under Google’s own terms and transfer safeguards.

Why the law lets us do this

Most of what leaves your phone says nothing about who you are, so data protection law does not apply to it. Where it might, for example your IP address while Cloudflare delivers a request, or the map square sent with it, we rely on these grounds under the UK GDPR:

• Providing the service you ask for (Article 6(1)(b)): finding loops, showing walkers’ scores and the map.
• Our legitimate interests (Article 6(1)(f)): keeping a free service running and safe, counting usage to see whether it works, and collecting off-lead answers that help other walkers. These hold nothing that identifies you and have very little effect on you, and you can switch counting off.

Storing the usage-count queue on your phone relies on the exception for statistics in the UK’s Privacy and Electronic Communications Regulations, which needs clear information (this page and the line under the switch) and a free, simple way to say no (the switch). We use no cookies, and nothing on the app or this website needs a consent banner.

Your rights

Under the UK GDPR you have the rights of access, rectification, erasure, restriction, portability and objection. Because your data is on your phone, you can use most of them yourself:

• See or take your data: open Walks, Stats and Settings, or export your walks as GPX files.
• Delete it: Settings, then "Delete all data". This empties the app’s database, the saved copy of the map, its saved settings and, on Android, any walk still being recorded, the app’s web cache and its exported files. Uninstalling the app does the same.
• Stop location: switch it off in your phone settings.
• Object to counting: switch off "Share anonymous usage counts" in Settings.
• What we hold on our server (off-lead answers and totals, daily usage totals) is not linked to anyone, so there is no "your" part of it to find, show or delete.
• Complain: you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If what Offlead does with data changes, we will update this page before the change goes live and change the date at the top. A later version may add optional accounts that back up your walks; that would always be your choice.