Privacy policy

01Signing in

You sign in when you first open WanderLost, with Apple or with an email address and password. Either way, signing in doesn’t ask for your name.

Sign in with Apple

• WanderLost asks Apple for your email address and nothing else.
• If you choose Hide My Email, Apple gives WanderLost a private relay address that forwards to you. WanderLost never sees your real address.
• Apple also gives WanderLost an identifier for your Apple Account, so each sign-in reaches the same WanderLost account.
• WanderLost never sees your Apple password.

Email and password

• Supabase stores your password only as a salted hash, so nobody, including the developer, can read it.
• Supabase emails you a link to confirm the address is yours, and a link to choose a new password if you ask for one. WanderLost sends no other email.

02Location

WanderLost builds your days from your iPhone’s location, so it asks for location access. When you set it up, it asks for access While Using the app. With that, it keeps following your day in the background after you leave the app, until you force-quit it or restart your iPhone. Later, a reminder in the app, at most once a day, may suggest Always access, so it can follow your day while the app is closed too. You can change or turn off its access at any time in iOS Settings.

How it follows your day

• While you stay in one place, GPS is off. iOS wakes WanderLost when you arrive somewhere, leave somewhere, or move a long way, and when you step outside a circle of about 150 metres around where you stopped.
• While you’re moving, it records your location: to about 10 metres on foot or by bike, and about 30 metres in a car.
• It also asks for Motion & Fitness access, to tell whether you’re still, walking, cycling or driving, which sets how closely it follows you. When you’re at home overnight, the hours your iPhone lies still count as sleep, and this is worked out on your iPhone. It reads up to the last 7 days of this motion history from iOS.

Pausing

• In Settings you can pause tracking for an hour, until 7 the next morning, or until you turn it back on. While it’s paused, nothing is recorded: no location points, visits or motion readings. Paused time lights no block and doesn’t count in Life.
• “Until I turn it back on” turns location off completely until you switch tracking back on.
• For an hour or until morning, with Always access, iOS’s visit monitoring alone stays on, so iOS can wake WanderLost when you arrive somewhere or leave. Whatever it reports before the pause ends is thrown away. Tracking starts again when the pause ends if WanderLost is still running, at the first wake after that, or when you open the app. The time in between isn’t filled in. With While Using access nothing stays on, and tracking starts again when you next open the app.
• The pause (when it started and when it ends) is one of your settings. It syncs to your account (see section 7), so it follows your account to whichever iPhone tracks.

Your raw location

• The raw location points and motion readings are saved on your iPhone, and never sent anywhere in a form anyone else can read.
• Each point is saved with how you were moving at the time (still, walking, running, cycling, in a vehicle or on transit), how sure that is, and whether that came from Motion & Fitness, your speed, or a correction you made.
• Each day’s record is packed into one file and encrypted on your iPhone (AES-256-GCM), with a key that’s made on your iPhone and kept in your iCloud Keychain. Only that encrypted file syncs to your account (see section 7). The key never reaches WanderLost’s server, so neither the server nor the developer can read the file; your devices that share your iCloud Keychain can.
• The encrypted copy is kept so a new iPhone keeps your history, and so the app can work out your light again if the way it counts changes. That work happens on your iPhone, never on the server.
• If the key is lost, for example because iCloud Keychain is turned off or reset, the old encrypted files can’t be read by anyone, you included. What you’ve lit still comes back from your account.
• From the raw points, the app works out your stops (visits), the simplified path between them, and how you were getting around. Raw points are kept on your iPhone for 30 days. Their encrypted copy stays in your account until you delete your WanderLost data or your account.
• Along with the encrypted file, the visits, places and trips sync to your account (see section 7). They are what the app shows you. A trip syncs where it started and ended, never the path between.

03Places

Naming places

• When you stop somewhere WanderLost hasn’t seen before, it asks Apple Maps what’s there by sending that one coordinate. Apple sends back a name, a category (such as café or park) and an identifier for the place.
• Only one coordinate per new place is sent. Your path, your other places and your times aren’t.

Moving a visit

• If GPS put a visit at the wrong place (the shop next door, say), you can move that visit to the right one. WanderLost shows your own places within 150 metres, then the places Apple Maps knows nearby.
• To get the Apple Maps list, WanderLost sends that visit’s coordinate to Apple once more. That happens once each time you open the list of nearby places to move a visit, whether or not you then move it. Nothing else is sent: not your path, your other places or your times.
• The spot where GPS put the moved visit is kept on your iPhone only, as one more point of the right place, so your next stay there lands at the right place. It never syncs, like the rest of your places’ coordinates (see section 8).

Changing categories

• On Day, you can change the category of one visit or one trip, and set a place’s default category, which is what its visits start as. These are saved and synced like your other categories and day records (see section 7).

Guesses

• WanderLost guesses what you were doing at each place, and splits each day into Rest, Duty and Out There (away from home and not working). The guesses are worked out from your own places, times and answers. Nothing is sent anywhere to make them.
• Your answers are saved as labels. Each label notes where it came from: you, a rule, or a guess.
• After a few answers that agree, WanderLost offers a rule (for example, that a place is work). Rules you accept are saved and used for later guesses.

Ignoring a place

• You can ignore a place. While you do, time at it doesn’t count in Life, and time in the block it’s in lights nothing.
• Ignoring a place doesn’t stop your location being recorded there. The tracker doesn’t know which places you ignore, so raw location points from an ignored place are kept and synced like any others (see section 2).
• The time and light a place already had before you ignored it are kept but hidden, on your iPhone and in your account (see section 7). They come back if you stop ignoring it. Time spent there while it was ignored is left out for good and doesn’t come back.
• The times you ignored and stopped ignoring each place are kept in your synced settings, for 3 days after you stop ignoring it (see section 7 and section 13).
• An ignored place’s location is handed to the map on your iPhone so it can hide that light. It isn’t sent anywhere new.

04The map

• The map is drawn on your iPhone by MapLibre, an open-source map library. It sends no usage data or location to anyone.
• Its streets, water, parks and place names come from OpenStreetMap map tiles (Protomaps’ basemap) that WanderLost keeps in its own storage on Supabase (see section 10). No map company is involved. The app downloads the tiles and keeps them on your iPhone, where the map reads them. The map shows “© OpenStreetMap” in a corner.
• The parts of the map you’ve spent time in light up block by block. A block is the land between streets. Blocks are worked out on WanderLost’s server from OpenStreetMap streets, and come to your iPhone as block tiles. Your time in each block is counted on your iPhone, from your raw location.
• To show how much of a city or neighborhood you’ve lit, the app downloads its outline from WanderLost’s storage. The outlines come from Overture Maps’ open data, which is mostly OpenStreetMap’s. How much of each you’ve lit is worked out on your iPhone.
• A block is named by its nearest street corner, which your iPhone finds in the street names of the map tiles it already has. Nothing is sent to name a block.

What the map asks for

• Map tiles, block tiles and city outlines are asked for by tile number, never by sending your location. A tile number names a square of the map, so it does say roughly where that square is.
• Map tiles and block tiles are asked for only in whole squares about 15 km (10 miles) across, all of a square’s tiles together. The squares asked for are the one you’re in and those within about 25 miles (40 km) of it, so the map is ready before you go out; the squares you’ve been in whose blocks, streets or buildings the app still needs to count your time; the squares that hold light already synced to your account; and the square you’re looking at closely on the map, only when it’s one of those.
• So from these requests, WanderLost’s server can learn which of these squares you’ve been in or near, and when the app asked, but never where inside a square you were.
• City outlines are asked for only by the tile numbers of blocks whose light has already synced to your account, so the request tells the server nothing it doesn’t already hold. A block lit since the last sync waits for the next one.
• These requests are made while you’re signed in. Like any web service, Supabase also sees your device’s IP address.

What syncs and what stays

• Your time in each block syncs to your account (see section 7), so your light comes back on a new iPhone.
• Blocks you’ve only driven through don’t sync. Their driving time stays on your iPhone.
• These stay on your iPhone only (see section 8): your time in each block on each day, your time on foot in small squares about 12 and 40 metres across, and how many times you’ve driven each street.

05Camera and photo library

Moments

• A Moment is taken with WanderLost’s camera, which uses the front and back cameras together, so it asks for Camera access. The camera runs only while the capture screen is open.
• Each Moment keeps its two photos, when it was taken, and the place and block it was taken at, which are stamped on it as a postmark.
• A copy of each Moment, the back photo with your selfie and the postmark on it, is saved to your camera roll. For that, WanderLost asks only to add photos to your library: it can’t see or read anything already in it.
• A compressed copy, both photos in one file of about 300 KB, is uploaded to private storage for your account. Only your account can read it, and it isn’t shown to anyone else.
• The app also declares Microphone access (“Records sound with a video Moment”), because its camera library includes the code for recording sound. Video Moments aren’t built yet, so iOS never asks for the microphone and nothing is recorded.
• You can change WanderLost’s camera and photo access at any time in iOS Settings.

06People and contacts

• You can note who you were with at a place. You pick each person from your contacts.
• Only the name of each person you pick is copied into WanderLost and synced to your account, with the visits you were together.
• Your address book is never uploaded, and the people you add aren’t told or contacted.

07What’s stored on the server

WanderLost keeps your account and what it learns about your days with Supabase, a hosted database and sign-in service, so it syncs and comes back when you sign in on a new iPhone.

Your account

• Your email address (or relay address).
• If you sign in with Apple, your Apple identity: the Apple user identifier and the details Apple sends with a sign-in, such as whether the address is a relay address.
• If you sign in with email, the hash of your password, when you confirmed the address, and a note that the login was made in WanderLost (see section 11).
• Records Supabase’s sign-in system keeps as part of running sessions, such as when you signed in and from which IP address.

Your days

• Places: the name and category from Apple Maps, your own label for the place, the block it’s in, and whether you’ve ignored it.
• Categories: the name, color, band (Rest, Duty or Out There) and, if you write one, your description of each one.
• Visits: which place, when you arrived and when you left.
• Trips: where each trip started and ended, when, how far it was, and how you were getting around. The path you took never syncs.
• Raw location: one encrypted file per day, in private storage that only your account can reach. It’s encrypted on your iPhone before it’s uploaded, and the server never has the key, so it can’t be read there (see section 2).
• Labels, rules and check-ins: what you were doing at each visit and where that came from, the rules you accepted, the questions WanderLost asked, and how you’ve answered at each place.
• Day summaries: how much of each day went to each category and to Rest, Duty and Out There, and your sleep.
• Weeks: your frontier (the neighborhood picked for each week, by you or for you, and which of its blocks count), your streak, and each week’s insights entry: a few sentences about that week’s time, which can name your places and their neighborhoods, written on your iPhone from fixed templates and that week’s numbers, with no AI and no server involved in writing them.
• The map: the light on each block, kept for each iPhone as one record per map tile: for each block in it, how much time you’ve spent there and how much of that was driving, on how many days, and the first day it lit. Blocks you’ve only driven through aren’t included (see section 4). City and neighborhood outlines are public map files, the same for everyone, not records of yours.
• Map requests: for each day, how many new block tiles your account caused to be built, used only for the daily limits. Not which tiles.
• Moments: a compressed copy of the two photos, when they were taken, and the place and block.
• People: the names you picked from your contacts, and which visits they were at.
• Your iPhones: a random identifier the app makes each time it’s installed, a second random identifier that stays with each iPhone (see section 8), and which iPhone is tracking. Only one iPhone tracks at a time, so no time is counted twice. The second identifier lets a reinstall on the iPhone that tracks take tracking back without asking.
• Your settings, such as which kinds of notification you get and your quiet hours.

Deletion bookkeeping

• Reset marker: your user ID and the time your WanderLost data was deleted, so your other devices know to throw away their old copies. It stays while your login exists (see section 11).
• Deletion requests: your user ID, what you asked to delete, when, and a short error note if an automatic step failed. Only created when a deletion has to be finished by hand.
• Deletion attempts: your user ID and the time, each time you try to delete your account, used only to limit how often account deletion can be used. They’re cleared after a day.
• A log of the outcome of each deletion (for example, whether it finished and whether a Sign in with Apple disconnect is still owed), without your user ID.

08What’s stored on your iPhone

• The raw location points from the last 30 days, each with how you were moving, and the motion readings from those days (see section 2). They leave your iPhone only encrypted, as the daily file in section 7.
• A log of how the tracker is running, with no locations in it: your battery level and whether it’s charging, whether Low Power Mode is on, when the app was launched or woken, how many location points it got each hour, how many minutes at a time it followed you, and Apple’s daily energy and performance reports for the app (MetricKit). It’s never sent anywhere automatically. Only in TestFlight test builds, a hidden screen lets you export this log as a file through the share sheet, and note a stay the tracker missed. App Store builds have no export.
• A small flags file in the tracker’s folder, which the tracker can read after a restart before you first unlock your iPhone. It holds whether tracking is on and running, and the pause: when it started and when it ends, and the times of pauses that finished, kept for 30 days (up to 64). It holds no locations, and is left out of your iPhone’s backups like the rest of that folder.
• If you delete your account and WanderLost can’t be sure Apple disconnected it (see section 12), one small mark that this step may still be owed. It names no account and holds no personal data, and it stays after you sign out or delete your account, until you delete the app.
• The key that encrypts your raw location, in your iCloud Keychain, which brings it to your other devices so they can read your history.
• The random identifier that stays with this iPhone (see section 7), in the iPhone’s own keychain. Unlike the key, it isn’t copied to your other devices, and it stays when you delete the app, so a reinstall can take tracking back.
• A copy of everything in section 7, so the app opens instantly and works offline, and changes that haven’t reached the server yet.
• Your blocks, in a folder of their own for each account that signs in on this iPhone, which no other account on it can see: the block tiles, your time in each block on each day, your time on foot in small squares about 12 and 40 metres across, how many times you’ve driven each street and the first day you traveled it, where your places are (including any spots where GPS put a visit you later moved to another place, which never leave your iPhone), which building each is in and which of them you ignore, light from your account’s other iPhones, and the map files drawn from all of it (see section 4). Only the light described in section 7 syncs from it.
• In the same folder, time that’s waiting for its block tile to arrive, kept as the two ends of each stretch of movement; the point and times of each stay already counted toward your blocks, so the app can count that time again on your iPhone if a block is later split into smaller ones; and the last location point counted. These are kept for at most 30 days. Signing out removes them and keeps that account’s light on the iPhone.
• The map tiles downloaded so far, in one file shared by every account on this iPhone. They’re public map data, the same for everyone, but which areas they cover shows where the map has been downloaded. An area is roughly 65–110 MB, and the whole world at low detail about 45 MB once. Tiles are only downloaded while you’re using the app, and aren’t removed once kept. Signing out or deleting your account keeps the tiles, so they don’t download again, and forgets which tiles that account asked for and when; nothing in the file says when an area was downloaded.
• Your blocks folder and the map tiles are left out of your iPhone’s backups, in iCloud or on a computer. A restored or new iPhone gets your light back from your account and downloads the map again.
• Your sign-in session (a token issued by Supabase), so you stay signed in.
• If you sign in with Apple, your Apple user identifier, so WanderLost can tell if you stop using Sign in with Apple for it.
• The notifications waiting for their time, which iOS keeps until it shows them (see Notifications, below).
• For WanderLost’s widgets, a small summary in a folder only WanderLost and its widgets can read: today’s numbers (how much of your city and your home’s neighborhood is lit, your new blocks today, your streak and frontier, and your hours this week by band and by category, with your category names), and two pictures of your map, which show the area around your home and can show where you are now. It holds no coordinates, and nothing in it is sent anywhere. iOS shows it on your lock screen and home screen only if you add a WanderLost widget there. Signing out or deleting your account empties it.

Notifications

• After your first block lights, WanderLost asks once whether it may send notifications. If you say not now, it doesn’t ask again on its own.
• There are four kinds: new ground today (your new blocks and new miles of street, in the evening, only on a day with something new); first light in a new neighborhood or city; the weekly game (your frontier ends tomorrow, pick next week’s frontier, your streak is at risk); and your weekly insights being ready on Monday.
• Every notification is made and scheduled on your iPhone, from data already on it. None passes through a push service, and showing one sends nothing to WanderLost’s server or to anyone else.
• iOS can show them on your lock screen. They can name a neighborhood or city you’ve been in, name your frontier’s neighborhood with its distance and direction from your home, and give counts such as new blocks and miles. They never name a street or a place.
• Each kind comes at most once a day, and none during your quiet hours. You can turn each kind off and set quiet hours in WanderLost’s settings; those choices sync with your other settings (see section 7). You can also turn notifications off at any time in iOS Settings.

Like other app data, what WanderLost keeps on your iPhone can be part of your iPhone’s own backups. Deleting the app removes everything WanderLost stores on your iPhone, except two keychain items: the key in your iCloud Keychain, which stays so a reinstall or a new iPhone can still read your history, and this iPhone’s identifier, which stays so a reinstall can take tracking back. Deleting your account leaves both in place too (see section 12).

Signing out signs you out of WanderLost on that iPhone only. It doesn’t sign you out of the developer’s other apps, and it leaves that account’s data on the iPhone.

09How your data is used

Only to run WanderLost for you: to sign you in, build your days, map and weekly insights, send the notifications you’ve left on, sync between the server and your devices, and carry out deletions.

• Nothing you add to WanderLost is shown to other people.
• No advertising, no analytics, no profiling, and no tracking across other companies’ apps or websites.
• Your data isn’t sold, and isn’t shared with anyone for their own purposes.
• Your location is never used for advertising or shared with data brokers.
• Your email address isn’t used for marketing.

10Who else handles your data

These service providers each handle data only to provide their part of the app:

• Supabase hosts the database, the private photo storage, the map’s storage and the sign-in system, and runs the server functions that build the map and delete accounts. Like any web service, it sees your device’s IP address when the app connects and keeps standard request logs. Your data may be stored and processed outside your country.
• Apple provides Sign in with Apple and names places through Apple Maps (one coordinate per new place, and one more each time you open the list of nearby places to move a visit, whether or not you then move it, see section 3). Location, motion, the camera, the photo library and contacts are provided by iOS on your iPhone. If you signed in with Apple, deleting your account shows Apple’s own sign-in sheet first. It gives WanderLost a one-time code, which goes to WanderLost’s server and from there to Apple, along with the app’s identifier and a request signed with a key WanderLost holds, in exchange for a token. Once your data is deleted, the server sends that token back to Apple, with the identifier and another signed request, to ask Apple to disconnect WanderLost from your Apple Account. The server doesn’t store or log the code or the token (see section 12). Apple’s handling of your data is covered by Apple’s privacy policy.
• The map’s tiles are OpenStreetMap data (© OpenStreetMap contributors, under the Open Database License), kept in WanderLost’s own storage on Supabase, or, for the example map you see when you set up WanderLost, inside the app. The map library, MapLibre, runs on your iPhone and sends no usage data (see section 4).
• Sentry (Functional Software) receives a report when the app crashes, freezes, is closed by iOS for using too much memory, or hits an unexpected error. Only release builds (TestFlight and the App Store) send reports. A report holds the error and where in the code it happened, the app version, the iPhone model, iOS version and whether the iPhone is jailbroken, its language and region setting, and its state at the time, such as free memory, screen size, Low Power Mode and how warm it’s running. WanderLost attaches no account, name or email, and sends no screenshots, no record of what you did before the error, no usage sessions and no performance data. Errors in the app’s own code are cleaned on your iPhone before they’re sent: WanderLost removes coordinates, pairs of numbers shaped like coordinates, map tile addresses, IDs and email addresses. Crashes in native code, freezes and memory closures are reported by Sentry’s iOS code directly and skip that cleaning. They also carry a random ID that Sentry creates when the app is installed, and a one-way hash of the identifier iOS gives this developer’s apps on your iPhone, so reports from the same install can be grouped. Neither is linked to your account. Like any web service, Sentry sees the IP address each report is sent from. Reports are used only to fix bugs.
• Protomaps and Overture Maps are where the map’s data comes from. WanderLost’s server reads OpenStreetMap streets, water and map tiles from Protomaps’ public builds, the first time anyone needs an area, and builds blocks from them. City and neighborhood outlines come from Overture Maps’ open data. What’s made is kept in WanderLost’s own storage and shared by everyone. Your iPhone never contacts Protomaps or Overture Maps, and neither receives anything about you or your account; at most, they see WanderLost’s server reading the data for an area. The map credits OpenStreetMap (see section 4).
• Email: Supabase’s sign-in system sends the emails that confirm your address or let you choose a new password, through the email service it’s set up to use.
• The website: this policy and WanderLost’s other pages are on the developer’s website at grantpankratz.com. They load no third-party scripts or analytics. Like any website, its host may keep standard visit logs.

If you’ve chosen in iOS settings to share analytics with app developers, Apple may give the developer crash reports and diagnostics under Apple’s own terms. WanderLost adds nothing to them.

Data is disclosed to anyone else only if the law requires it.

11If your login is shared with other apps

WanderLost’s Supabase project, including its sign-in system, is shared with other apps by the same developer. They offer the same ways to sign in. Your WanderLost login is separate from them unless you use it there too.

If you sign in to WanderLost with the email and password of a login you already have for one of those apps, or Apple shares the same verified email address as that login (not a Hide My Email relay address), it’s the same login and the apps share it. A login you create in WanderLost is marked as made here.

Because the sign-in system is shared, every new login, a WanderLost one included, also gets a basic profile in a table that belongs to one of the other apps: the login’s user ID, email address and name (WanderLost never asks for or sets a name). That app’s access rules don’t let other users read it. WanderLost never writes to it. The basic profile is removed only when the login itself is deleted.

WanderLost never changes the data the other apps keep. When you delete your account, the server checks which of those apps hold data linked to your login, only so it knows what it can safely delete. Section 12 explains what deleting your account does in each case.

12Deleting your account

You can delete your account in WanderLost’s settings. You’ll need an internet connection. There is one option in the app. It deletes everything WanderLost stores for you, immediately: every row, your Moments photos in the cloud and the encrypted raw location files. WanderLost checks whether another app by the same developer holds data linked to your login, which decides what happens to the login.

If no other app holds data linked to the login

The login itself is deleted too, with its basic profile (see section 11). In the rare case the server can’t remove the login automatically, your WanderLost data is still deleted immediately and the login itself is removed within 30 days.

If another of the developer’s apps holds data linked to the login

Your login, its basic profile and your data in those apps stay as they are, along with the reset marker described in section 7. To delete the login and your data in the other apps too, write by email (below); that is completed within 30 days.

Either way

• On the iPhone you delete from, WanderLost’s copy of your data is erased and you’re signed out. That includes the raw location points on that iPhone, the visits and motion records kept with them, the tracker’s diagnostics log and the times of finished pauses, and the Moments files saved inside the app. The key that encrypted your raw location files stays in your iCloud Keychain; with those files deleted, it has nothing left to open. Photos in your camera roll stay. So do the random identifiers for this install and this iPhone (section 7); the server’s copy of them is deleted with the rest of your data.
• If you used WanderLost on another iPhone and your login stays (another app holds data linked to it), that iPhone throws away its copy the next time it connects. If the login itself was deleted, that iPhone is signed out the next time it connects, and its copy stays on it until you delete the app there.
• If you signed in with Apple, deleting first shows Apple’s sign-in sheet, to get the one-time code described in section 10. If you close the sheet, nothing is deleted, and the next try goes ahead without it, so WanderLost doesn’t ask Apple to disconnect it that time. If the sheet can’t open, the deletion goes ahead without it too. The code is only used if it comes from the same Apple Account as your login.
• If Apple doesn’t confirm the disconnect, or the iPhone is signed in to a different Apple Account, your data is still deleted. You can stop using Sign in with Apple for WanderLost yourself, in the iPhone’s Settings app, under your Apple Account’s Sign in with Apple list. The iPhone then keeps one small mark that this step may still be owed (see section 8).
• Only WanderLost’s connection to your Apple Account is disconnected, even if your login stays because another of the developer’s apps holds data linked to it. The server keeps only the outcome of the disconnect, without your user ID (see section 7).

Your blocks folder on that iPhone (see section 8) is deleted too. The map tiles shared by every account on the iPhone stay, so they don’t download again, and WanderLost forgets which of them your account asked for and when.

By email

Write to grant.h.pankratz@gmail.com from, or naming, the email address your account uses. Requests are completed within 30 days.

13How long data is kept

• Until you delete your WanderLost data or your account: your places, categories, visits, trips, labels, rules, check-ins, day summaries, weeks, the light on each block, Moments, people, your iPhones and settings, and the encrypted raw location files.
• 30 days, on your iPhone: raw location points and motion readings, and the times of pauses that have finished.
• Your pause, in your settings: until you end it, or until it runs out and is removed the next time you open the app.
• 3 days after you stop ignoring a place, in your synced settings: the times you ignored and stopped ignoring it. While you ignore a place, the time you started stays.
• Deletion bookkeeping that holds your user ID is removed when your login is deleted. If your login is shared and stays, the reset marker stays with it. Records of deletion attempts are cleared after a day.
• Until you delete your WanderLost data or your account, on the server: the daily count of new block tiles your account caused to be built.
• Up to 30 days, on your iPhone: time waiting for its block tile, as the ends of each stretch of movement, and the last location point counted. Signing out removes them sooner.
• Until you delete your account or the app, on your iPhone: your blocks folder. Until you delete the app: the map tiles downloaded so far (see section 8).
• Logs: Supabase’s own logs, Sentry’s reports and the website host’s logs are kept as those services set.
• Deleted data can remain in Supabase’s backups for a while before those backups are replaced.

14Security

• Everything between the app and the server travels over HTTPS, so it’s encrypted in transit.
• Every WanderLost table has per-user access rules (row-level security): a signed-in account can read only its own data. Moments photos are in private storage that only your account can read.
• Your raw location is encrypted on your iPhone before it syncs, with a key the server never has. Only your devices can read it.
• WanderLost’s files on your iPhone are encrypted by iOS, and can be read only after the iPhone has been unlocked once since it started.
• Account deletion runs on the server and only ever acts on the account that asks for it.

No system is perfectly secure, but these rules keep each person’s data separate.

15Children

WanderLost isn’t directed at children under 13, and the developer doesn’t knowingly collect data from them. If you believe a child under 13 has an account, email the address below and it will be deleted.

16Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to how it’s used. You can delete your account in the app at any time (see section 12). For anything else, email the address below and include the email address your account uses so it can be found. If you chose Hide My Email, that’s the relay address Apple created for WanderLost. You can also complain to your local data protection authority.

17Changes to this policy

When this policy changes, the date at the top changes too, and big changes are noted on this page. WanderLost is still being built, so expect this page to grow before WanderLost uses anything it doesn’t describe yet.

18Contact

WanderLost is made by Grant Pankratz. For privacy questions or requests, email grant.h.pankratz@gmail.com. The terms of use cover the rest.