Privacy policy

Apple Health

With your permission, Elsewhere reads three kinds of data from Apple Health: your steps, your walking + running distance and your workouts, of which it uses only walks and hikes. It asks for nothing else and never writes to Health. If you connected Health before Elsewhere used workouts, it asks for them separately, from Activity. You can change any of this at any time in the Health app.

Elsewhere reads this on your iPhone to move you along your journey, fill in today’s activity and how long you walked, find each day’s walks, track walk goals and walking club pursuits, total up a walk you record, and measure your distance in walks with friends. So that the same walk isn’t counted twice by your iPhone and your Apple Watch, it also looks at which device recorded each piece of distance. It counts from the start of the day you first connect Health.

The Health records themselves (your daily totals, individual samples, workouts and their sources) stay on your iPhone, and so do the walks and walking times Elsewhere works out from them. Only two things worked out from them can ever leave it, and only if you choose:

• If you turn on backup, how far you’ve come on each journey is part of it.
• If you walk with friends, your walking distance since that walk began is sent to our server by itself and shared with the people walking with you.

Health data is never used for advertising or marketing, and it is never sold.

In the background

Elsewhere looks at Health in the background only while it can matter: when you’re in a walk with friends that is still counting distance, or when notifications are on with at least one kind switched on. Then Apple Health wakes it at most about once an hour, and only for new steps or distance; iOS may also give it a moment to catch up, at most every four hours. Each wake reads Health on your iPhone, saves your progress, finds your walks and may show one notification. It sends your distance in walks with friends, only when that has grown by 20 m or half an hour has passed since it was last sent, and may update your backup if you’ve turned backup on. Nothing else is sent. Otherwise nothing runs in the background.

On your iPhone

Everything Elsewhere makes for you lives on your iPhone first: your journeys and the stops you’ve reached, your notebook entries and drafts, walks you record (their start and end times, distance and steps), the walks Elsewhere finds in Health over the last week (when each began and ended, its distance and time, and whether it was a workout), your walk goal, keepsakes, medals, walking club pursuits, your walks with friends as last seen, and your settings, including your notification choices.

Your journal is stored in Elsewhere’s private space on the device with iOS data protection, and it is left out of iCloud and computer backups of your iPhone. To move it to a new iPhone, use Elsewhere’s own optional backup. If you sign in, your session is kept in the iPhone’s Keychain, on this device only.

Deleting the app removes your journal from your iPhone.

Elsewhere also uses your iPhone’s motion sensors while you look at a medal, so it swings as you tilt the phone. That motion is used in the moment and is not stored or sent anywhere.

Elsewhere reads your clipboard only when you tap Paste on its welcome screen or Walk together page, to open an invitation link you copied.

Sample mode, which shows Elsewhere with made-up walking, never changes your real journal and is never backed up or shared.

Sign in with Apple

An account is optional. You need one only for backup, for keeping postcards in the cloud, for walking with friends and for friends’ news as notifications. Elsewhere uses Sign in with Apple, so you never create a password with us.

When you sign in, we keep:

• the account identifier Apple gives Elsewhere, which is unique to our app;
• the name you choose to share with Elsewhere, or “Walker” if you don’t share one; and
• when your account was created.

Elsewhere asks Apple for your email address when you sign in, but our server does not store it. To confirm The app requests the email scope it doesn’t use; consider removing it, or say how the address will be used.

To keep you signed in, our server stores only scrambled (one-way hashed) versions of your session keys, never the keys themselves. A session refreshes every 15 minutes while you use the app and lasts up to 90 days, after which you sign in with Apple again. Signing out ends the session on our server.

Backup

Backup is off until you turn it on in Settings → Your account. When it’s on, Elsewhere sends a copy of your journal to your account each time it changes. A backup contains:

• your journeys: which one you’re on, how far you’ve come on each, when you started and finished, and when you reached each stop;
• distance saved for your next journey, and journeys you’ve saved for later;
• your notebook entries and drafts;
• your walk goal, short walk goals and the keepsakes they earned; and
• walking club pursuits with Rowan, Wren or Sol, and how far you walked in each.

A backup never contains Health records, daily step or distance totals, Health sources, walks found in Health or their times, recorded walks, location, photos, notification choices or sample-mode data. The server checks each backup against a fixed list of allowed fields and rejects anything else.

Your backup is stored in a private database that belongs to your account alone. To stop two phones from counting the same walking twice, only one iPhone writes to it at a time; the app identifies that phone with a random code it creates itself, not a hardware identifier. The same phone is the one that shares your distance with friends.

Each night we copy every backup to private storage and keep each copy for 30 days, so a journal can be recovered if something goes wrong.

Turning backup off stops new copies. The last backup stays in your account until you delete the account.

Walking with friends

If you’re signed in, you can start or join a private walk with friends: a shared journey along one of Elsewhere’s journeys over 7, 14 or 28 days, which starts when it’s created and can be joined until it ends, or a distance goal, which starts when its host starts it. Up to eight people can walk together.

For each walk we store its name, the journey or distance goal, how many days it lasts, its invitation code, when it starts and ends, and until when people can join. For each walker in it we store their account name, when they joined, how far they’ve walked since the walk began and up to what time, and their final result and award.

What the people you walk with see

The walkers in a walk see each other’s names, distances and results in it, and when each distance was last updated. On a shared journey they also see each other as figures on the route, at their shared distance. Nothing else from your journal or from Apple Health is shared: never your Health records, daily totals, walk times or notes.

How your distance is shared

Your distance is sent by itself from your walking phone, while Elsewhere is open and in the background, whenever it has grown by 20 m or half an hour has passed. Each time it is one total: the Health distance you’ve walked since the walk began. The server keeps the highest value it has seen, so a repeat adds nothing. Results settle 48 hours after a walk ends.

Invitations

Each walk has an invitation link. While the walk can still be joined, anyone who opens the link, with or without Elsewhere or an account, can see the host’s name, the journey or the walk’s name, its length, how many days it lasts, when it ends and how many people have joined. It never shows the other walkers’ names or anyone’s distance. The invitation page asks search engines not to index it, and tapping Get Elsewhere on it copies the link, so the app can open it after you install.

People who have shared a walk with you see your name in their list of people they’ve walked with, with how many walks you’ve shared and when. They can invite you to another walk with one tap: we store who invited you, to which walk and when, and you see the invitation in Elsewhere and, if you allow it, as a notification. Only people who have already walked with you can invite you this way; anyone else needs the link.

Leaving a walk

Tap Leave walk on the Walk together page. Your name and distance leave the walk’s standings straight away. A walk is deleted when its last walker leaves, or when its host leaves a distance goal that hasn’t started; a shared journey others are on carries on for them.

Finished walks are kept so everyone’s results stay. To confirm How long finished walks and unanswered invitations are kept; the code keeps both until an account is deleted.

Notifications

Notifications are optional. Elsewhere asks for them only after you reach your first stop, when you join friends, or when you turn them on in Settings, never when you first open it. Settings → Notifications has a switch for each kind (Friends, Finished walks, Almost there and A walk to try) and your quiet hours, from 9 pm to 8 am unless you change them.

Notes about your own walking, such as a finished walk, a stop that’s a short walk away or a journey to try after a few quiet days, are worked out on your iPhone from your Health data and journal. Your iPhone shows at most one a day, never in quiet hours, and nothing about them is sent anywhere.

Friends’ news

If you’re signed in and allow notifications, your iPhone sends our server its push token (the address Apple’s push service gives your iPhone for Elsewhere), whether it’s a development or App Store build, your time zone, your quiet hours and whether the Friends switch is on. When something happens in a walk you share (a friend joins, passes you, reaches a stop or finishes, a friend invites you, or results are in), our server writes the news down and sends it through Apple Push Notification service every 15 minutes, folding news that arrives together into one.

The server follows your choices: nothing while Friends is off; nothing in your quiet hours, in your own time zone (news of passing and stops is dropped, the rest waits for the morning); at most one push of each kind a day; at most three pushes a day, not counting results and invitations; at most one every two hours for the same walk; and nothing more than a day old. A push contains your friends’ names, the journey and stop names and distances, such as “Asha passed you on The old road to Tsumago. Asha is 770 m ahead.” Until the server can send pushes, your iPhone finds the same news itself when it looks at Health.

We store your push token and choices, and each piece of news: its text, who it’s for, and when it was written and sent. Signing out removes the token from our server, and so does Apple telling us it no longer works. Settings → Notifications can also send you a test notification, at most five an hour. To confirm Sent news is never deleted by the code; consider removing it after a few days (the daily limits need about one day of it).

Postcards and photos

Postcards are made on your iPhone. If you add a photo, you choose it with the system photo picker, so Elsewhere sees only that photo, never your library. It is reduced in size and redrawn into the postcard; its location and other details are not copied. Elsewhere can lift the person or subject out of your photo to place them on the card, and that also happens on your iPhone.

If you save a postcard or trail card to Photos, Elsewhere asks only for permission to add images. When you share one, it goes only where you send it with the share sheet.

If you’re signed in, you can keep a private copy of a finished postcard in your account. That copy is the postcard image itself, including any photo, name and note on it. You can keep up to 100. You can also make a share link: anyone with the link can view that one image for 30 days, the page asks search engines not to index it, and you can revoke the link at any time. Deleting a postcard deletes its image and its link. Copies other people have already downloaded can’t be recalled.

Maps, artwork and widgets

Maps

Trail cards and Earth’s maps use Apple Maps to draw the map behind your route. The map is drawn for the journey’s own route, never your location. Apple handles those map requests under its own privacy policy.

Artwork

The journey paintings download from Elsewhere’s artwork server when you first need them, and are then kept on your iPhone. These requests ask only for a picture; they carry no account, journal or Health information.

Widgets

To show your journey on the Home Screen and Lock Screen, the app writes a small summary to a storage area shared only with its own widgets, on your iPhone: the journey’s name and region, how far you’ve come, the next stop and today’s distance. It never leaves your device, and sample data is never written there.

Who handles your data

Elsewhere’s server and its storage run on Cloudflare (Workers, D1, Durable Objects and R2). That is where accounts, backups, nightly copies, saved postcards, walks with friends, push tokens and friends’ news are kept. To confirm Cloudflare’s data processing terms, and the regions where this data is stored and processed.

Apple provides Sign in with Apple, Apple Health on your iPhone, Apple Maps, the App Store and Apple Push Notification service, which carries friends’ news to your iPhone, under Apple’s own terms.

To confirm The server can also send pushes through an optional relay, which is not used today. If it ever is, name who runs it here, since it would handle push tokens and the text of each push.

We don’t use advertising networks, analytics services or data brokers, and we don’t sell or rent your information.

Logs and security

All traffic to our server is encrypted. The server doesn’t keep a log of requests; when something fails it records only the kind of error, never Health distances, notebook text, sign-in keys, push tokens, notification text or images. To slow down abuse, it counts requests per account, and per network address for sign-in, share links and invitation pages. Addresses are held only in scrambled form, and each count is cleared after about a minute. To confirm Cloudflare may keep its own records for running and protecting the service; check the account’s logging and analytics settings.

How long we keep it

• Sign-in checks: five minutes, and removed soon after.
• Sessions: up to 90 days, or until you sign out or delete your account.
• Your account and backup: until you delete your account.
• Nightly copies of backups: 30 days each.
• Saved postcards: until you delete them or your account. Share links: 30 days, or until you revoke them.
• Walks with friends and invitations: as described above.
• Push tokens and notification choices: until you sign out or delete your account, or Apple tells us a token no longer works.
• Friends’ news: news that can’t be sent within a day is dropped; for sent news, see Notifications.
• Walks found in Health: a week, on your iPhone only.
• Request counts: about a minute.

When you delete your account, you’re signed out everywhere and your push tokens are removed straight away. Your backup, its nightly copies, your saved postcards and their links, your place in any walk, invitations you sent or received, and news written for you are then deleted, with the server retrying every 15 minutes until everything is gone. A walk already under way continues for the other walkers without you. To confirm News about you already written for your friends, such as “Asha passed you”, names you and stays with theirs; it can still be delivered within a day.

Your choices

• Turn Health access on or off in the Health app: tap your profile, then Apps and Services → Elsewhere.
• Use Elsewhere without an account, or sign out at any time.
• Turn backup on or off in Settings → Your account.
• Delete saved postcards, or revoke their links.
• Choose which notifications you get, and your quiet hours, in Settings → Notifications, or turn them off in iOS Settings.
• Leave a walk with friends: Leave walk, on the Walk together page.
• Background updates stop when you’re not in a walk with friends and notifications are off.
• Delete your cloud account in Settings → Your account → Delete cloud account.
• Delete the app to remove your journal from your iPhone.

To ask for a copy of what we hold about you, or anything else about your data, write to elsewhere@goniffler.com. To confirm The rights you offer, and how quickly you’ll respond, depend on where you and your users are; a lawyer should word this part.

Children

To confirm Who Elsewhere is for (its App Store age rating) and how you handle children’s information. The code doesn’t ask anyone’s age.

Changes and contact

If this policy changes, we’ll update this page and the date at the top. To confirm How you’ll tell people about important changes.

Elsewhere is made by Owner’s name. Questions about privacy are welcome at elsewhere@goniffler.com.