Privacy Policy
Fogbound · last updated 6 September 2026
Fogbound records where you have walked so it can clear the fog on your map. That record never leaves your phone. There is no account, no server, no analytics, and nothing is uploaded anywhere.
Two things do reach the internet: the map itself is drawn from tiles fetched from OpenFreeMap, and you can download the neighbourhood data for a region you want statistics in. Both are explained below, because they are the only places this policy cannot claim that nothing leaves your device.
What the app records
While tracking is on, the app stores on your phone:
- Positions from your device's location services — latitude, longitude, accuracy and a timestamp.
- Which parts of the map you have uncovered, derived from those positions.
- A diagnostic log of what the app did: timings, map zoom levels and counts. It does not contain your coordinates.
All of it lives in a database inside the app's own storage on your device. Nobody else can read it, including the developer.
What leaves your phone
Map tiles. The map is drawn using data from OpenFreeMap. To draw the part of the map you are looking at, your phone asks that service for the tiles covering it.
That request necessarily tells OpenFreeMap which part of the world you are looking at, along with your IP address, in the same way that loading any web page tells the server you loaded it. It is not your recorded history and it is not tied to an identity, but it is an approximation of where you are, and it would be dishonest to describe it as nothing. Requests are handled under OpenFreeMap's own terms.
Region downloads, if you ask for one. The neighbourhood and district boundaries used to work out where you have been are what the Progress tab needs. Berlin and Hamburg are bundled inside the app and need no network at all. Larger regions are too big to ship to everybody — the data for Baden-Württemberg alone is around 22 megabytes — so you can download one if you want statistics there.
That download is a request for a file you chose from a list, by name. It tells GitHub, which hosts the file, that somebody asked for that region, along with your IP address. It does not say where you are: the app downloads the whole list of available regions and works out which one you need on your phone, so your position is never sent anywhere to answer it. This reveals less than the map tiles above already do, and you can avoid it entirely by not downloading a region — the map and the fog work everywhere without one.
Once downloaded, a region is stored on your phone and answering "which neighbourhood am I in?" needs no network request at all.
There is no analytics service, no advertising, no crash reporter, no tracking of any kind, and no third-party code that phones home. The app's iOS privacy manifest declares no collected data types and no tracking, and that is accurate.
Location, and why the app asks for background access
The app asks for location access while in use and, separately, always.
The "always" permission exists for one reason: this app records walks. If it could only see your location while it was open on screen, you would have to hold your phone in front of you for the whole walk, and everything else would be missed. Background access is what lets the map fill in while the app is in your pocket.
You can decline it, or grant only "while in use", and the app still works — it simply records less. You can change or revoke this at any time in iOS Settings.
When you choose to share something
The app has two share buttons. Both do something only when you tap them, and both hand the file to the iOS share sheet — you choose where it goes.
- Export history produces a file containing your complete recorded history, including raw positions. This exists so you can move your map to a new phone and so you can take your data with you. Treat the file as personal: it is a record of your movements.
- Share diagnostics produces the log described above — timings and counts, no coordinates. This is the one to send if you are reporting a problem.
Neither is ever sent automatically, and neither reaches the developer unless you send it.
While the app is in TestFlight
During beta testing, Apple provides the developer with:
- the email address you used to accept the TestFlight invitation;
- crash reports, and any feedback or screenshots you choose to submit through TestFlight.
This is Apple's process rather than the app's, and it is covered by Apple's privacy policy as well as this one. The email address is used only to manage beta access and is not added to any mailing list.
Deleting your data
Delete the app. iOS removes its entire storage container with it, and the recorded history is gone from the device. There is no copy anywhere else to delete, because no copy was ever made.
Your rights
The app is developed in Berlin, Germany, and the GDPR / DSGVO applies.
Because your walking history stays on your own device and is never transmitted, the developer holds none of it and cannot access, correct, export or erase it on your behalf — you already hold the only copy, the export button is your right to data portability, and deleting the app is your right to erasure.
Where the developer does hold personal data — your beta tester email address, and anything you actively send — you have the usual rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. Use the contact below.
Children
The app is not directed at children and collects nothing that would identify anyone.
Changes to this policy
If what the app does with data changes, this document changes with it, and the date at the top moves. Material changes will be mentioned in the app's release notes rather than made quietly.
Contact
Questions about this policy, about the app, or about your data:
support.terra.app@proton.me