Privacy Policy

Whereabouts ("Whereabouts", "we", "us", "our") is a location-tracking app for outdoor activities such as hiking, trail running, and cycling. This policy explains what information the app collects, how we use it, and the choices you have. Whereabouts is operated by WA Labs.

1. Information we collect

Account information

If you create an account, we store your email address and, for email sign-ups, a securely hashed password. If you sign in with Google or Apple, we receive a unique identifier for your account and your email address from that provider; we do not receive your provider password.

Guest mode

You can use Whereabouts as a guest without creating an account. Guest activities are associated with an anonymous identifier on your device rather than personal account details.

Location data

While an activity is active, the app collects precise GPS location points (latitude, longitude, and related data such as accuracy, altitude, speed, and timestamp) at the reporting interval you choose in Settings. These points form the track of your activity.

Activity data

We store the activities you create: name, activity type, start and end time, the route of GPS points, and computed statistics (distance, duration, moving and stopped time).

Technical data

To operate and secure the service we process limited technical data such as your device's IP address and basic request information in server logs. When the map is shown, your device requests map tiles from OpenStreetMap tile servers (see Service providers).

2. How location works

• Only during activities. Location is collected only after you explicitly start an activity and stops when you end it.
• Background collection. So your track is not lost when your screen is off or the app is backgrounded, location continues to be collected during an active activity using a foreground service (Android) / background location (iOS). This stops when the activity ends.
• Offline queue. When you have no connectivity, points are stored locally on your device and uploaded when a connection is available.
• Your control. You grant location permission through your operating system and can revoke it at any time in your device settings; the app also lets you choose how often location is reported.

3. How we use information

• To record your activities and show your track and statistics.
• To display the live location of participants in a group activity you join.
• To generate shareable activity links when you choose to share.
• To authenticate you and keep your account secure.
• To operate, maintain, troubleshoot, and protect the service.

We do not sell your personal information, and we do not use your location for advertising.

4. Sharing & disclosure

Group activities

If you start or join a group activity, your real-time location and identity within that activity are visible to the other participants for the duration of the activity. The activity owner controls the group.

Shared activity links

When you share an activity, we create a link secured by a non-guessable token. Anyone with the link can view that activity's name, type, track, statistics, and — while it is live — real-time updates, without needing an account. A share link is valid while the activity is ongoing and for 24 hours after it ends, after which it stops working. The activity owner can revoke a link at any time.

Service providers & legal

We share data with the limited service providers described below, and may disclose information if required by law or to protect the rights, safety, and security of our users and the service.

5. Service providers

• Google & Apple — for "Sign in with Google/Apple" authentication, when you choose to use them.
• OpenStreetMap — map tiles are requested from OSM tile servers to render maps; those requests include the map area being viewed and your IP address, and are subject to the OpenStreetMap Foundation's privacy policy.
• Hosting & infrastructure — the Whereabouts backend that stores your accounts, activities, and location tracks is operated by us on our own infrastructure.

6. Data retention

We keep your account and activity data until you delete it or ask us to delete your account. Shared-link access expires automatically 24 hours after an activity ends. Server logs are retained only for a limited period for security and troubleshooting. Guest activity data stored on your device is removed when you clear the app's data or uninstall the app.

7. Your rights & choices

• Access & correction. You can view and manage your activities in the app.
• Deletion. You can request deletion of your account and associated data — see how to delete your account on our Support page.
• Location permission. You can revoke location access at any time in your device's system settings.
• Sharing. You can revoke a shared activity link at any time.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right to access, correct, port, or delete your personal data, and to lodge a complaint with a supervisory authority. Contact us to exercise these rights.

8. Security

We protect your data with measures including encrypted connections (HTTPS), hashed passwords, authenticated API access with expiring tokens, and non-guessable sharing tokens. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children

Whereabouts is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide a more prominent notice.

11. Contact us

Questions about this policy or your data? Email us at support@walabs.net.