The short version: nothing leaves your phone, except when you opt in.

Last updated: 10 May 2026

What we collect on a server we operate

Nothing. OffTrail has no backend. There is no signup, no login, no profile, no leaderboard. We don't see how often you use the app, which features you tap, or where you ride.

What stays on your phone

• Imported tracks (.gpx files) — up to five tracks at a time, kept under your iOS app's Documents/Tracks folder. Each track has a stable per-slot colour on the map.
• Recorded rides (.gpx + sidecar JSON) — kept under Documents/Recordings. The History screen lists the last 30 days; older files are pruned automatically.
• Offline map tiles — kept in MapLibre's local cache (auto-cached as you browse, plus any country regions you explicitly download from the Maps screen).
• Preferences — units (metric / imperial), app language override, rider display name, the "have you been prompted to leave a review" flag. Stored in UserDefaults via @AppStorage; never transmitted.

You can back any of this up the way you'd back up any iOS app's local files (Files app, iCloud Drive backup, Finder sync). We don't see it either way.

Location

OffTrail asks for "When in Use" location permission so the user dot can render on the map and the rider can be tracked along an imported route. With your permission we keep listening to location updates while the app is in the foreground — that's how recording survives screen-lock and pocket use. Recording is suspended when the app moves to the background, to save battery. iOS shows its standard system blue bar while location is being used.

Your location is used in real time to render the map and write entries into your own ride recording. It is not transmitted anywhere — except during a Group ride session, where it is published to Apple iCloud as described below.

Group ride (opt-in, over Apple iCloud)

When you start or join a Group ride from Settings → Group ride, OffTrail uses Apple's CloudKit service to share live position with the riders you invite via QR code. Specifically:

• Your iCloud user identity (the initials Apple derives from your iCloud display name) and your live coordinates are written as CKRecord entries to a custom CloudKit zone shared with the other riders in your session.
• Other riders' initials and positions are read back to render dots on your map. Records older than 30 seconds are dropped client-side.
• The session is created by the leader as a CKShare attached to a one-off custom zone in their private CloudKit database. The leader presents the share as a QR code; participants scan and accept the share to join.
• Apple is the data controller for everything in CloudKit. Their privacy policy applies. We never see the data — there is no OffTrail server in this loop.
• Tearing down the session (leader taps "End ride" or the zone times out) deletes the records.
• Nothing happens until you explicitly enter the Group ride flow. Riding solo never touches CloudKit.

Camera (QR scanner only)

OffTrail asks for camera permission only when you tap "Join a group ride". The camera runs while the QR scanner sheet is on screen, decodes the leader's share URL, and shuts off when the sheet dismisses. We do not store frames, do not write images to disk, do not transmit anything. The session ends; the camera light goes out.

Network requests we make

The app loads basemap tiles online when you're connected, so the map keeps looking fresh in places you haven't pre-cached. Tile requests go to:

• OpenFreeMap for the On-road and Off-road styles (free public OpenStreetMap-based tile server).
• Esri World Imagery for the optional Satellite style. Satellite tiles are pulled live every render — there is no offline cache for satellite. The Esri terms require us to display the attribution string "Source: Esri, Maxar, Earthstar Geographics, and the GIS User Community" whenever satellite is on screen, which OffTrail does in the bottom-right caption above the MapLibre attribution.
• Open-Meteo for the live weather chip on the Ride screen (current temperature + condition icon, e.g. sun 24°C / rain 10°C). Before any request leaves the device, your GPS coordinates are coarsened to two decimal places (≈1.1 km at the equator, less at higher latitudes) so the upstream sees an approximate location, not your exact dot. Open-Meteo is free, requires no API key, and is only queried while you have a network connection — the chip simply doesn't render offline.

These requests are subject to the respective providers' privacy policies. OffTrail does not intercept, log, or proxy any of them. If you are fully offline, the app falls back to what you have cached (or, for satellite, surfaces a "Satellite needs network" banner; for weather, the chip just hides).

External links from inside the app

The About screen has two opt-in outbound links: Share OffTrail (system share sheet seeded with the App Store URL + a short pitch) and Follow on Instagram (deep link to @offtrailgpx, falls back to Safari if Instagram isn't installed). Both open in their respective destinations and are subject to those services' policies. OffTrail does not collect anything before, during, or after the tap.

Review prompt

After three saved recordings on the same install, OffTrail asks iOS to surface its native App Store review sheet (SKStoreReviewController). The sheet runs entirely inside the system frame; we do not see your review or rating. Apple's own throttle limits this prompt to at most three appearances per rider per 365 days across the whole iOS device. We additionally store a one-shot flag locally so OffTrail itself doesn't re-prompt within the same install.

Analytics, tracking, ads

None. The app does not use Firebase, Mixpanel, Sentry, App Store Analytics, AdMob, or any equivalent. There are no third-party SDKs that phone home.

Children

OffTrail is rated 4+ but is not directed at children. Because we don't collect any personal data, no special children's-data provisions apply.

Changes to this policy

If we ever add a feature that involves transmitting data off your device, we will say so plainly here and ship it as an explicit opt-in (the way Group ride and Satellite are today). The "no-cloud, no-account, no-tracking" stance is a product principle, not a phase.

Contact

Questions or pushback: offtrail@offtrailapp.com.