Privacy Policy

1. Who we are and what this covers

iTrailog is developed and operated by the independent developer Yiwei Cao ("we"). Under applicable data protection laws, we are the controller of the personal data described in this policy.

This policy covers the iTrailog iOS app (including the Apple Watch app, widgets and Live Activities), the Android app and the website itrailog.com (including its APIs). For general questions write to [email protected]; for privacy requests write to [email protected].

2. Data that stays on your device

The following is stored only on your phone (and watch). It is never uploaded to our servers and we cannot access it:

• Location and tracks: while recording, the app reads your position from GPS (with your permission it keeps recording when the screen is locked or the app is in the background) and saves it with time, altitude, speed and so on as a track. The iOS app uses SwiftData; the Android app uses an SQLite database in the app's private storage.
• Waypoints: name, coordinates, altitude, time, note, icon and the place name looked up for it.
• Photos and videos: once you allow photo access, the app reads only the capture time and location of photos and videos taken during a track, and shows thumbnails on the map and the track. Photos are never copied, modified or uploaded. The Android app caches photo locations in its private folder so they show faster.
• Imported and exported files: GPX / KML files are read or created only when you ask; exported files go wherever you send them through the system share sheet.
• Apple Watch: the watch and the iPhone exchange recording status and data directly through Apple's WatchConnectivity, never through our servers.
• Settings and map cache: your preferences and map tiles already downloaded (for offline use).

iCloud sync (iPhone): while Map & Settings › iCloud Sync is on (the default), tracks and waypoints are kept through Apple's CloudKit in the private iCloud database of your own Apple Account, so they come back after deleting the app or moving to a new phone, and sync between devices signed in to the same Apple Account. Apple stores and protects this data under its privacy policy; only you can access it, we cannot see or read it, and it never passes through our servers. With the switch off, new changes stop syncing; data already in iCloud can be deleted in the iPhone's Settings › Apple Account › iCloud › Manage Storage. In addition, while Back Up to iCloud Drive is on (the default), each track is also saved as a GPX file in the 行迹 folder of your iCloud Drive, where you can view, share or delete it in the Files app. The Android app has no cloud sync.

Deleted tracks first go to Recently Deleted and can then be removed for good; uninstalling the app deletes everything it stored on the device (tracks synced to iCloud stay there and come back when you reinstall). If you use iCloud Backup or Android system backup, app data may be included in those backups with Apple or Google, governed by your system settings and their privacy policies; we cannot access them.

3. Permissions and why we ask

• Location (while using / always): show where you are, record tracks and navigate along a track. Background location is used only to keep recording when the screen is locked or the app is in the background.
• Motion & Fitness (iOS) / Physical activity (Android): with auto-pause on, tells when you stop or set off again, so GPS can be switched off while you rest to save battery.
• Photos and videos (read only): show the photos you took along a track. On Android, "Access photo location" is also needed to read the GPS stored in photos.
• Notifications: show recording status and navigation alerts.
• Ignore battery optimization (Android): keeps the system from stopping the app in the middle of a recording.
• Install unknown apps (Android, website version): used for in-app updates.

You can turn any permission off at any time in system settings; the feature that needs it will then stop working.

4. Anonymous usage statistics and crash reports

To understand how the app is used and to find and fix crashes, iTrailog sends anonymous usage statistics and crash reports. Both are controlled by one switch, Help Improve iTrailog (in the app's Map & Settings). It is on by default and can be turned off at any time.

Usage statistics (at most once a day)

• App version and build number
• OS name and version; phone manufacturer, brand and model; on Android also the version properties of the vendor system (such as MIUI, HyperOS, HarmonyOS or ColorOS)
• App language and device region (for example en-US)
• How many tracks and waypoints are saved, and whether a track was recorded that day (counts only, no content)
• A random install ID: a random number the app generates for itself on first launch, used only to count each install once a day and to group crashes from the same install. It is not a device identifier and changes if you reinstall the app.

Crash reports

• iOS: crash and hang diagnostics provided by the system through MetricKit, and uncaught exceptions. Android: uncaught Java / Kotlin exceptions, and on Android 11 and later the native crashes and ANRs (app not responding) recorded by the system.
• Contents: error type and description, call stack, thread, time of the crash, plus the version, model, language and random install ID listed above. Crashes are uploaded the next time you open the app.

The data is sent over HTTPS to itrailog.com/api/ping and itrailog.com/api/crash and stored in a Cloudflare D1 database. The server also records when it was received and the country / region code Cloudflare derives from the request's IP address; the IP address itself is not stored.

Statistics and crash reports never include location, track or waypoint content, photos, your name, phone number, email, accounts, advertising identifiers (IDFA / GAID), or device identifiers such as the IMEI or Android ID.

When you turn the switch off, the app stops sending at once and deletes any crash records on the device that have not been uploaded. Separately, if you chose "Share with App Developers" in iPhone Settings › Privacy & Security › Analytics & Improvements, Apple also gives developers aggregated crash data through App Store Connect; that is governed by Apple's privacy policy.

5. Feedback

Only when you write feedback in the app and tap Send is the following uploaded to itrailog.com/api/feedback:

• The type (feature request / problem report) and your message
• The contact you choose to add
• The screenshots you choose to attach (up to 3, stored in Cloudflare R2)
• Platform, app version and build, OS name and version, phone manufacturer / brand / model, app language
• The country / region code Cloudflare derives from the request
• A salted SHA-256 hash of your IP address, used only to limit each network to 10 submissions an hour against abuse; the IP address itself is not stored

When feedback arrives, a notification email with the message, screenshots, contact and device details is sent to the developer's inbox through the email service Resend. If you left an email address, we may reply. The app shows a feedback ID; please quote it if you want the feedback looked up or deleted.

6. Device report (Android only)

Map & Settings › Report Device Info helps us track down display colour problems on a few phones. Only when you tap Send is the following uploaded to itrailog.com/api/report:

• App version; phone manufacturer, brand, model, device and product names, Android version and SDK level, system build number
• System properties describing the vendor system version (such as MIUI, HyperOS, HarmonyOS or ColorOS)
• Display settings: dark mode, font scale and weight, screen resolution and density, system language
• Accessibility and colour settings: high-contrast text, colour inversion, colour correction, night mode and similar, and the names of the accessibility services that are on
• System settings whose names relate to display, colour, fonts or themes
• Samples of the colours the app's text actually renders in on screen, and one screenshot of the app's own Map & Settings page
• The note you choose to add, and the country / region code derived by Cloudflare

Reports are stored in Cloudflare D1 and R2 and contain no location, tracks, accounts or device identifiers. The app shows a report ID; quote it if you want the report deleted.

7. Requests sent directly to third parties

Some features need the app to contact third-party services directly from your device. These requests do not pass through us; the provider sees your IP address and the request and handles them under its own privacy policy:

• Map tiles: depending on the base map you choose, tiles are downloaded from Apple Maps (MapKit, iOS only), Tianditu (China's National Platform for Common Geospatial Information Services), OpenStreetMap, OpenTopoMap, CyclOSM or USGS The National Map. Requests contain the tile numbers (from which the area you are viewing can be inferred) and a User-Agent naming this app. Downloaded tiles are cached on the device.
• Place names (reverse geocoding): to show place names for a track's start, end and places passed, and for waypoints, the app sends coordinates to the system geocoder (iOS: Apple; Android: the system Geocoder, usually provided by Google), and falls back to OpenStreetMap's Nominatim service when it finds nothing.
• Update check (Android, website version): the app requests update.json from itrailog.com and, once you agree, downloads the new package. No personal data is attached.
• Website: itrailog.com loads its icon font from Google Fonts (Google receives your IP address). The website uses Google Analytics (Google LLC) to count visits: pages viewed, clicks on the download buttons, the referring site, browser and device type, and an approximate location derived from your IP address. It sets first-party cookies (_ga) to tell repeat visits apart. We have turned off sharing this data with Google for other purposes, and it is kept for 2 months. You can block it with your browser’s cookie or tracker settings, or with Google’s opt-out add-on. The website also remembers the language you picked, locally in your browser. Opening our download links (including from a QR code) and downloading the Android app, also through its in-app update, are counted on our server and sent to Google Analytics as a count with only the source and country — no IP address, no cookie, no device identifier. The apps themselves send nothing to Google Analytics.
• App stores: when you download from the App Store, TestFlight or an Android app store, Apple or that store handles the related data under its own policies.

8. Service providers that process data for us

• Cloudflare, Inc.: hosts the website and APIs (Cloudflare Pages / Functions), stores usage statistics, crash reports, feedback and device reports (D1 database) and screenshots (R2 object storage), and forwards email sent to @itrailog.com addresses (Email Routing).
• Resend: sends the feedback notification emails.

The admin site admin.itrailog.com can be opened only by the developer, signed in through Cloudflare Access. We do not sell or rent your information or share it with anyone for advertising or marketing; we disclose it only where the law requires.

9. How long we keep data

• Usage statistics: 24 months
• Crash reports: 24 months
• Feedback, its screenshots and notification emails: up to 24 months after it has been handled
• Device reports and their screenshots: 12 months
• Data on your device: up to you — deleting tracks or uninstalling the app removes it

After that, data is deleted or reduced to statistics that are no longer tied to any install. You can ask for earlier deletion at any time (see section 11).

10. Where data is stored and international transfers

Cloudflare and Resend run servers around the world, including in the United States, so data you send us may be processed and stored outside your country or region. All transfers are encrypted with HTTPS, and we rely on our providers' contracts and security measures to protect the data. Usage statistics and crash reports can be turned off; feedback and device reports are sent only when you send them.

11. Your choices and rights

• Turn off statistics: switch off "Help Improve iTrailog" to stop usage statistics and crash reports.
• Withdraw permissions: turn location, photos, motion and other permissions off in system settings at any time.
• Delete data on the device: delete tracks and waypoints in the app, or uninstall it.
• Access, correct or delete what you sent: email [email protected] with the feedback or report ID if you have it. We reply within 30 days (or sooner where local law requires).

Usage statistics and crash reports carry only a random install ID, so we usually cannot link them to a person and may not be able to find individual records; turning the switch off makes sure nothing more is sent.

Depending on where you live (for example under the EU GDPR or China's Personal Information Protection Law) you may also have rights to access, rectify, erase, restrict or object to processing, to data portability and to withdraw consent, and you may complain to your local data protection authority. We process usage statistics and crash reports on the basis of our legitimate interest in improving the app (you can switch them off at any time), and feedback and device reports on the basis of your request and consent when you send them.

12. Children

iTrailog is not directed at children under 13 (or the higher age set by law where you live, such as 14 in mainland China). We do not knowingly collect children's personal information; if you believe a child has sent us information, please contact us and we will delete it.

13. Security

All communication between the apps and the server is encrypted with HTTPS, and server-side data can be accessed only by the developer. Even so, no transmission or storage over the internet can be guaranteed to be completely secure.

14. Changes to this policy

When the way the app handles data changes, we update this policy and the version and effective date at the top of this page; significant changes are announced in the app or on the website. Earlier versions are available on request by email.

15. Contact

General questions: [email protected]
Privacy and deletion requests: [email protected]

See also the Terms of Use.