Privacy Policy

Last updated: August 2026

CityWalker is a tool to help you track your walking progress and street coverage. This page explains how I collect, use, and disclose data when you use the app, on both Android and iOS.

1. Information Collection and Use

CityWalker is designed with a privacy first approach. Your location data is yours alone.

• Location data: The app requires access to your device's GPS (Fine/Precise Location) to record your walks and calculate which streets you have covered. This collection occurs only during active walk recording.
• Background tracking: To keep recording your walk accurately when the app is in the background or your screen is off, the app uses a foreground service with a persistent notification on Android, and background location updates on iOS.

2. Data Storage

All location data, walk history, and city progress are stored locally on your device in a private database. Coordinates, paths, and other behavioural patterns are never transmitted to any external server, except when you explicitly choose to use the optional View on Computer feature (Android only, described below).

3. Third-Party Services

The app interacts with the following services:

• Cloudflare Workers (CityWalker proxy): Requests for a city's street data are routed through a Cloudflare-hosted proxy that caches Overpass API responses for performance. Cloudflare may log your IP address and the request URL for security and abuse-prevention purposes. No GPS coordinates, walk history, or personal information are sent.
• Map tiles (osmdroid on Android, MapLibre on iOS) / OpenStreetMap tile servers: Display map tiles. Tile servers may receive your IP address. Your walk history is not transmitted.
• Overpass API (overpass-api.de and mirrors): Backup endpoints used when the proxy above is unavailable. Requests contain only city queries. No GPS coordinates or personal information are included.
• Nominatim (OpenStreetMap): Resolves city names to map boundaries. Requests contain only city names, and in some cases an approximate search area based on your device's location when you add a city.
• Your device's location services (Google Play Services on Android, Core Location on iOS): Provides device location while a walk is being recorded or a city is being added. The platform provider's own privacy policy applies to this service.
• Firebase Anonymous Authentication: On launch, the app signs in to Firebase anonymously and uses the resulting identifier to authenticate requests to the CityWalker proxy (for rate limiting and abuse prevention). This identifier is not linked to your name, email, or any other personal information, is not shared with advertisers or data brokers, and is never used for tracking.
• Firebase Crashlytics (optional, on by default): Crash reports including stack traces, device model, operating system version, and app version are sent to Google Firebase. No GPS coordinates, walk history, or personal identifiers are included. You saw a disclosure during onboarding and can turn this off at any time in Settings › Privacy.
• View on Computer relay (Android only, optional, off unless you use it): If you use the View on Computer feature from the Coverage tab, the app builds a snapshot of that city's street coverage (including street coordinates and walk stats), encrypts it on your device with AES-256-GCM, and uploads only the encrypted file to a Cloudflare-hosted relay. The relay never receives the decryption key and cannot read the contents. The encrypted snapshot is deleted after a short expiry or once viewed on your other device. This only happens if you actively start this feature; it never runs in the background.
• Aptabase (optional, on by default): I use Aptabase, an open-source analytics provider that does not use cookies, device identifiers, or any personal data. Events sent are anonymous and limited to app usage, for example: app opens, walk starts and completions (duration only, no route or location), milestones reached, cities added, permission prompts, and screens viewed.

  Aptabase itself never receives your location, the routes you walk, the streets you have covered, the cities you have added, your name, or your email.

  You can turn usage stats off at any time in Settings › Privacy.

4. Permissions

• Fine/Precise and Coarse Location: Required to track movement during walks and to detect which area of a multi-region city you are currently in (used to highlight the matching area in the region picker).
• Background Location: Allows walk recording to continue when the app is in the background or the screen is off. On Android, this is implemented as a Foreground Service with a persistent notification while tracking is active.
• Foreground Service - Data Sync (Android): Used to download a city's street data in the background when you start a walk before the city has finished loading.
• Notifications: Used to display tracking and download notifications.
• Internet: Required to download map tiles and street layout data.
• Wake Lock (Android): Keeps the CPU active during walk recording so GPS samples are not dropped.
• Vibrate / Haptics: Used for short haptic feedback (for example, confirming a walk has started or finished).
• Photo Library (Save Only, iOS): Used only to save a walk summary card image to your photos when you tap Save. The app does not read your existing photos.
• Camera (Android): Used only to scan the QR code shown on the View on Computer web page, to pair your phone with that browser session. The camera is active only while that scanner screen is open. No photos or video are captured, stored, or transmitted.

5. Importing Walks (GPX)

You can optionally import walks from GPX files (for example, exported from Strava, Garmin, or Komoot). When you import a GPX file:

• The file is read directly from your device's storage using the platform's standard file picker.
• All processing, including matching the route against city streets, happens entirely on your device.
• No GPX file contents are transmitted to CityWalker, Cloudflare, or any third party.

6. Children's Privacy

CityWalker is rated for all ages and does not require an account. The app does not collect personal information, such as your name, email, or any other personally identifiable information, from any user, including children.

7. How to Delete Your Data

All data is stored locally on your device. There is no remote server to delete data from.

To delete everything:

1. Open CityWalker
2. Go to Settings
3. Scroll to the About section
4. Tap Delete All Data
5. Confirm deletion

This permanently removes all cities, street data, walk history, GPS tracks, coverage progress, and app preferences.

8. Changes to This Policy

I may update this Privacy Policy from time to time. You are advised to review this page periodically for any changes.

9. Contact

If you have any questions about this Privacy Policy, contact me at [email protected].