Privacy policy

The short version

• Your walks, routes and favourites are stored on your device only. We cannot see them.
• To find loops, the app sends the point you start from to our server. We use it to answer and do not log it.
• There are no accounts, no adverts and no tracking cookies.
• We count things like "a walk was started" with an anonymous code that changes every week. It cannot be traced back to you.
• You can wipe everything on your device at any time with "Delete all data" in Settings, and switch the anonymous counts off in Settings.
• When our server deletes something, our database backups keep a copy for 7 more days. See "Backups of our database".

Who is responsible

The controller of your data is Jack Trute, trading as ProperApps, "we" in this policy.

Contact: [OWNER: contact email for privacy requests].

Offlead is for dog owners, and is not aimed at children. If you think a child has used it and you want data removed, use the contact above.

What stays on your device

These are saved in your browser or app storage and are never uploaded in this release:

• Your walks: start and end time, distance, duration, and the recorded track (a list of points with time and GPS accuracy).
• Loops you were shown or saved, your favourites, and which parks you have passed. A loop you were shown but did not walk or save is deleted from your device after 7 days. It includes the point you started from, which is why.
• On Android, a copy of the map around the loops you walk, so the map still draws with no signal. It holds up to 800 map tiles, the oldest dropped first.
• Photos you pick for a share card. They are drawn into the image on your device and are not uploaded by us.
• Your settings (units, theme, walking pace) and a random install code made on first use.

The install code never leaves the device as it is. Only a hashed version, mixed with the current week, is ever sent (see "Anonymous counters" below).

Location. The app asks for your location to find loops from where you are and to guide and record a walk. It uses it while the app is in use. On Android, recording a walk runs as a visible "Recording your walk" notification so that it keeps working with the screen off. Offlead never asks for "allow all the time" location. If you say no, you can type a postcode instead.

What is sent to our server

Our server is a Cloudflare Worker. It receives only what it needs for each request, and its logs never contain coordinates or your install code.

• Finding loops: the point you start from, rounded on your phone to about 100 m, the length you want, and a random request number. We reuse answers for nearby requests for 24 hours. We pass the rounded point to the routing providers listed below to draw the loops. We do not store it. The request number is stored only as a scrambled code (see "IP addresses and rate limiting"), so that the follow-up calls of one load count as one. It stops working after 10 minutes and is deleted in the next nightly clean-up.
• Finding a way home: your current position and the point you started from, as they are. We pass them to the routing providers to draw the way back, and do not store them.
• A postcode you type: the app sends it to our server inside the request, not in the web address, and we look it up through postcodes.io. We do not log it. We keep the answer for up to 30 days in a cache, filed under a scrambled form of the postcode (a keyed hash that cannot be turned back into it without our secret key), not linked to you.
• Walkers' off-lead scores: to show them on loop cards, the app asks for the scores of parks in an area around your start. The area is rounded outwards to a grid of about 1 km, so it names a neighbourhood, not a street.
• Dog spots and green space data: your device asks our server for map data files. These requests say which file you want, not where you are.
• Off-lead reports: when you answer "Was off-lead OK?", we store the park, your answer (yes, no or not sure), and the day. Not the time, and not where you were.
• Anonymous counters: see the next section.

Anonymous counters and reports

We count a short list of events, such as the app opening, loops being shown, a walk starting or finishing (with a rough length bucket), a share, and an off-lead report. This tells us whether Offlead works. Each event carries a code made by hashing your install code with the current week, so it changes every Monday and one week cannot be joined to the next.

• The counters table keeps totals per day and event. It records how many different installs there were as an approximate count, never a list of codes.
• Off-lead reports: so that one person cannot vote twice on a park in a day, the server keeps a scrambled (HMAC) form of your weekly code and of your IP address, apart from your answer, for that day only, and deletes it in the nightly clean-up that follows. The answer itself is stored as the park, the answer and the day, so once that clean-up has run it cannot be linked to anyone in our live database. We delete individual reports after 90 days. The running totals per park, which hold nothing about you, stay. Backups keep deleted rows for 7 more days (see "Backups of our database").
• Counters hold no coordinates, no device identifiers and no third-party analytics code.

You can switch the counters off. In Settings, "Share anonymous usage counts" is on by default. When you switch it off, the app stops counting at once, throws away any counts it has not sent yet, and does not send your hashed install code for counting. This does not affect off-lead reports, which you send only when you answer.

Aggregate daily counters, which hold nothing about you, are kept. [OWNER: this page used to promise 13 months, but nothing deletes these counters yet. Choose a period and add the delete, or keep this wording.]

IP addresses and rate limiting

To stop abuse and to stay inside free usage limits, the server limits how often one install and one network address can ask for loops, reports or counters. For this it uses your IP address, but it stores only a scrambled form (an HMAC), in counters. The address itself is not written to a database.

• Per-address counters: for each kind of request, the server counts how much of the day's allowance one address has used, so that one address cannot use it all up for everyone. The counter is filed under a scrambled form of the address and the day, and holds a number, not what you asked for.
• Per-install counters work the same way, with your weekly install hash, for an hour or a day.
• How long they last: a counter stops counting when its hour or day ends, and the nightly clean-up deletes it a day later, so each one exists for two days at most. Backups keep it 7 more days (see "Backups of our database").
• For IPv6 addresses, the counter uses the first half of the address (a /64), which is shared by one home or phone, not the whole address.
• The totals for a whole day, over all callers, hold no address.

Cloudflare, which runs our server and website, sees IP addresses as part of delivering web traffic (see "Who processes your data").

Crash reports (Sentry)

Offlead can send crash and error reports to Sentry so we can fix bugs. This is switched off until we configure it, and we will update this page the day we do. When it is on, the app removes latitude, longitude, other coordinates, the addresses of map tiles, postcodes, ids and any query part of a web address from a report before it leaves your device. It sends no screen recording, no screenshot, no IP address from the app and no user id, and it leaves out the console and the map and postcode requests that led up to the error. A report can include the error message, the type of phone and browser, and the app version.

On Android we have switched off Sentry's own native crash reporting. We cannot clean those reports before they leave your phone, so we do not use it. That means a crash in the Android part of the app is not sent to Sentry. Only errors in the app's own code are, cleaned as above. If you install from Google Play, Google may separately collect crash reports from people who share diagnostics (see "Who processes your data").

Backups of our database

Our database (Cloudflare D1) keeps automatic backups, so that its owner can restore it to any moment in the last 7 days. We cannot switch this off. So when this page says we delete something from the server, we mean that it is deleted from the live database, and that a copy stays in the backups until 7 days after that.

• It applies to everything the nightly clean-up deletes: the scrambled codes that stop duplicate reports, the scrambled counters, the install buckets used to count distinct installs, and individual reports after their 90 days.
• For up to 7 days after the clean-up, a report could therefore in principle still be matched to the scrambled codes of its day, from a backup. Only the account owner can open a backup, and nothing in the app reads from one.
• Backups hold only what the live database held, so they contain no coordinates, no postcodes and no unscrambled IP addresses or install codes.

The 7 days is the length on the Cloudflare plan we use. If it changes, we will change it here.

Who processes your data

These companies handle data for us or serve data to the app:

• Cloudflare (Pages, Workers, D1, R2): hosts the website, the server and our database, with its backups. Requests to our site and server pass through Cloudflare.
• openrouteservice, run by HeiGIT: draws walking routes from the start point we send. Requests come from our server.
• The GraphHopper server we use for walking routes: it receives the same route requests. [OWNER: name the hosting company and country once chosen; until then routes come from openrouteservice only]
• OpenFreeMap: serves the map tiles and map fonts straight to your device, so it sees your IP address and the map area you view. It does not need an account from you.
• postcodes.io: turns a UK postcode into a place. We send it only the postcode you type, from our server.
• Sentry: crash reports, once switched on (see above).
• Google Play: if you install the Android app from Google Play, Google handles the download, updates and any data Play collects under its own policy.

Some of these are outside the UK. Where personal data is transferred, it is covered by the UK adequacy regulations, the UK addendum to standard contractual clauses, or the provider's own approved safeguards. [OWNER: confirm transfer mechanisms with each provider]

Why we may use your data

Under UK GDPR we rely on:

• Contract (Article 6(1)(b)): to find and guide your walk, which is what you asked the app to do.
• Legitimate interests (Article 6(1)(f)): to keep the service safe and running (rate limiting), and to understand whether it works (anonymous counters, crash reports). We keep this to a minimum and it has little effect on you.
• Consent (Article 6(1)(a)): for your device location, which you grant in your browser or phone and can withdraw there at any time.

We use no cookies or trackers that would need a consent banner, on the app or on this website.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, under UK GDPR. Because almost everything is on your device, most of them work like this:

• See your data: open Walks, Stats and Settings in the app. That is everything we hold about your walks.
• Delete your data: Settings, then "Delete all data". This empties the database on your device, the saved copy of the map, and the app’s saved settings in the browser. On Android it also clears any walk still being recorded, the app’s web cache and any exported walk files. Uninstalling the app or clearing site data does the same.
• Stop location: switch it off in your browser or phone settings at any time.
• Object to counting: switch off "Share anonymous usage counts" in Settings.
• Server-side data: we do not hold anything that identifies you, so we usually cannot find your data to show or delete it. Reports hold nothing that links them to anyone once their day's clean-up has run, and counters are keyed to a scrambled address or a code that changes weekly. Anything we delete is gone from our backups 7 days later. If you think we hold something about you, write to us and we will look and answer within one month.
• Complain: if you are unhappy, tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

To use any right, or ask a question, contact [OWNER: contact email for privacy requests].

Changes to this policy

If what Offlead does with data changes, we will update this page before the change goes live and change the date at the top. Release 2 may add optional uploads of walks; that would need your agreement first.