Privacy policy

What we never do

• No account, ever

  There is no sign-up and no sign-in. We do not ask for your name, email address, or phone number, and we have no way to associate your use of FlockDetour with your identity.

• No analytics and no tracking

  The app ships with no analytics SDK, no crash-reporting SDK, no attribution or advertising SDK of any kind. Our iOS privacy manifest declares no collected data types and no tracking, and that declaration is checkable by anyone who inspects the app.

• No advertising, and nothing sold

  We do not sell, rent, or share your data with data brokers or advertisers. There is nobody to sell it to who would want it, because we do not build a profile of you in the first place.

• No plate data

  FlockDetour reads no license plates and stores none. We map where cameras are. We have no access to what any camera sees, and no relationship with any camera operator.

What stays on your device

• Your preferences

  Alert distances, voice guidance, map style, how much detour you are willing to accept. Kept locally so the app behaves the way you left it.

• Recent and saved places

  Places you searched for or saved, held on the device so you do not retype them. This is a history of where you have been interested in going, which is why the app can erase it on demand.

• Turn-by-turn guidance, computed here

  Once a route is loaded, screen-off turn prompts are worked out entirely on the phone. That part of navigation makes no network calls at all — it reads the route already on the device and matches your position against it locally.

• A cached copy of the camera map

  So the map works with a poor signal or none. It is a copy of public data about camera locations, not a record of anywhere you went.

• A random installation identifier

  A randomly generated identifier, stored in the operating system keychain. It is not derived from your hardware, it cannot be used to sign in, and it exists so that community reports from one device are not counted as several independent confirmations. It is deleted when you reset your data or delete the app.

What leaves your device, and why

Plenty of apps claim nothing ever leaves your phone. For a navigation product that is rarely true, so here is ours in full.

• Route calculation

  When you ask for a route, the start and end coordinates are sent to our backend, which computes the comparison and returns it. We use them to answer that request. We do not attach them to your installation identifier, we do not build a travel history from them, and there is no account for them to be filed against.

• Place search

  What you type into search is sent to our backend, which queries an open geocoding service and returns matches. If you have granted location, your approximate position is included so that a search for “coffee” returns somewhere near you rather than somewhere arbitrary.

• Proximity alerts, if you switch them on

  This is the most sensitive thing the app does, so it gets its own entry. When proximity alerts are enabled, the app periodically sends your current position to our backend to ask which cameras are near you. That lookup is a read-only query — it cannot write to our database, and there is no table for it to write to. It happens only while the feature is on, and it stops when you turn it off or force-quit the app.

• A push token, only if you opt in to notifications from us

  Alerts the app generates itself never leave your phone. If you separately switch on notifications from us, your device asks Apple or Google for a delivery token and we store it — filed against the same random install identifier used for reports, never a person, and never alongside anywhere you have been. Switching the setting off deletes it from our servers immediately, the local privacy reset deletes it too, and a token we stop hearing from expires on its own. Leave the setting off and no token is ever created.

• Camera place labels

  To show which town a camera sits in, the app asks an open geocoding service directly rather than through our backend, which means that provider sees your device's IP address for that request. What it is given is the camera's own public coordinates, not your position.

• Nearby camera lookups

  To show cameras around you, the app asks the backend for a map area. That request describes a region of the map, not a person.

• Map tiles

  Map imagery is served by third-party open tile providers. As with any request to any server on the internet, those providers can see the IP address making the request and which part of the map was asked for. We do not control their logs, and we would rather say so than imply a guarantee we cannot make.

Behind our backend sit open services — OpenStreetMap-derived routing and geocoding. Because our server makes those calls rather than your phone, they see our address, not yours. Map imagery is the exception: tiles are fetched by your device directly from open providers, with no API key or account attached, so they see an IP address and which squares of the map were requested.

One design detail worth stating because it is unusual: our rate limiting counts requests globally, in hourly buckets, rather than per device. Most services throttle by user or by address, which requires keeping one. We do not keep one, so we cannot.

Permissions, and why each one is asked for

• Location, while using the app

  To show where you are on the map, start a route from where you are standing, and place a camera report at the right spot.

• Location, in the background

  Only if you switch on proximity alerts or screen-off turn prompts. It stops when you turn those features off, and it stops if you force-quit the app.

• Motion

  The map's heading arrow uses the phone's magnetometer and accelerometer to point the way you are actually facing. These readings are used on the device as they arrive and are never stored or transmitted.

• Notifications

  To deliver the alerts you asked for. Proximity alerts, turn prompts and the weekly summary are all scheduled on your own phone and never involve a server. Notifications we send ourselves are a separate, opt-in thing — see below.

Every one of these is optional. Decline any of them and the features that need it stop working, while the rest of the app carries on.

Your controls

• Erase everything local

  The app's privacy reset clears your saved and recent places, your preferences, the cached map, downloaded offline areas, and your installation identifier — and then verifies each deletion actually succeeded rather than assuming it did.

• Delete reports first, then reset — in that order

  The local reset does not reach reports already on our servers, and it erases the on-device key that proves those reports are yours. Once that key is gone you can no longer delete them yourself, though they still expire on their own schedule. If you want both, delete your reports first and reset afterwards. We would rather tell you that plainly than let you find out later.

• Delete reports you submitted

  Your device holds a secret that proves a report is yours. The server stores only a cryptographic hash of it, never the secret itself, which is what lets you manage your own submissions without ever having an account.

• Turn off permissions

  Location, background location, motion and notifications can each be revoked in your operating system settings at any time. The app degrades feature by feature and keeps working.

• Delete the app

  Removing FlockDetour removes everything held on the device, including the installation identifier. Nothing about you survives on our side, because nothing about you was stored there.