English translation · Les den norske versjonen (gjeldende)

Privacy Policy for TrackNavigator

TrackNavigator is a trip and map app for iPhone and Apple Watch with a companion web page. This is what is stored, where, for how long and who sees it – on the phone, in the account and on the web pages.

Last updated 17 October 2026 · Applies to the app from version 2.0.2 and the web page tracknavigator.app. The Norwegian text is the authoritative version; this is a translation.

1. Controller

The controller is Marius Arnesen, private individual, Norway. TrackNavigator is developed and run by him alone, with no employees, so no data protection officer has been appointed.

Privacy contact: support@tracknavigator.app. We answer within one month.

2. What stays on the phone, and what the app fetches

You need an account to use the app. Without signing in it shows only the welcome screen, where you sign in with Apple (section 3). Once you are signed in, your projects are stored in the account and synced (section 3). Everything you make – routes, points, drawings, recordings, photos and documents – is also on your phone, and during a recording on your Apple Watch.

Some things stay on the phone only and are not sent to us: maps you download for offline use, projects that were on the phone before you signed in, until you answer «Last opp» (Upload) (section 3), and whatever is on the phone after you sign out or delete the account. The app then shows the welcome screen again, and the projects stay on the phone. What is on the phone follows its ordinary backup (iCloud or a computer), which Apple handles according to your settings.

The app fetches data from other services while you use it, most of it directly from the phone. The service then sees your IP address and what the app asks for:

• Map tiles: which map area you look at, and which areas you download for offline use (Kartverket, Esri for satellite imagery – online only, not for offline use –, and the Norwegian Polar Institute; OpenTopoMap and the other countries' maps via our server). OpenTopoMap is the world map under the other maps: it is always shown (since 13 October 2026 the tiles come through our server, so OpenTopoMap sees only our server), and it is never downloaded for offline use. You turn it off with «Resten av verden» (Rest of the world) under «Topokart per land» (Topo maps by country).
• Weather: the position of the place you view a forecast for, rounded to three decimals (about 100 m), goes to our server. The server asks MET/Yr with the position rounded to two decimals (about 1 km) and the place's height above sea level rounded to 10 m (so mountain temperatures come out right), so MET sees only our server, not you. Wind aloft and the freezing level the server computes from its own files from ECMWF (the European weather centre), downloaded twice a day, and measured wind comes from the Norwegian Public Roads Administration's weather stations that the server already holds – no position is passed on. For the avalanche forecast's mountain weather the server finds the forecast region itself and asks Varsom only for the region, not the position. The server answers signed-in users only, leaves the position out of its logs, and keeps MET's answer in memory until MET says it is out of date, without linking it to you.
• Tide: the position of the place you view the tide for, rounded to two decimals (about 1 km), goes to our server. In Norway the server asks Kartverket, in US waters NOAA (the US National Oceanic and Atmospheric Administration), both with the rounded position – they see only our server, never your IP address or who you are. Elsewhere the server computes the tide itself from a global tide model (EOT20), without asking anyone. The server answers signed-in users only, leaves the position out of its logs, and keeps the answer in memory for up to an hour per place, without linking it to you.
• Waves (the «Sea» tab): the position of the place, rounded to two decimals (about 1 km), goes to our server. In Northern Europe the server asks the Norwegian Meteorological Institute for the wave and ocean forecast with the rounded position, and along the Norwegian coast also BarentsWatch (wave period and highest wave) – they see only our server. Wave period, and waves outside Northern Europe, the server reads from its own wave files, downloaded from the German weather service DWD twice a day without sending any position. The server answers signed-in users only, leaves the position out of its logs, and keeps the answer in memory for up to an hour per place, without linking it to you.
• Place name in the weather box: to show the name of the nearest place on the map («Kalyves» instead of «My position»), your position or the map centre, rounded to three decimals (about 100 m), goes to our server, which looks it up in a place list kept on the server (from OpenStreetMap and GeoNames). No one else is asked, the position is left out of the logs, and the answer is only kept in memory without being linked to you.
• Elevation: points you place and routes you draw or save are sent to Kartverket's elevation service to get heights. Outside Kartverket's coverage, when the service does not answer, in elevation profiles and in the 3D view, terrain tiles from Amazon Web Services (USA) are used, see section 5. On Svalbard, heights come from our own server (the Norwegian Polar Institute's terrain model).
• Point lookups: when you open a point, its coordinate is sent automatically to Kartverket (property and municipality), NVE (avalanche terrain) and Artsdatabanken (red-listed species). When you create a route analysis or an analysis of a recording, the coordinates of the start, the end, the highest point and your points along the route or track – at most 24 places – are sent to the same services in the same way. Zones, mobile and emergency-network coverage are looked up in data bundled with the app, without network, along the whole route or track as well. None of this is stored by us.
• Place search: the text you type and the map centre and zoom level go to our server, so that places near where you are looking rank first. Our server searches stadnamn.no (Norwegian place names) and our own place index from OpenStreetMap. Searches are not stored: our logs leave out the search text and the position, and an answer is only kept in memory for up to five minutes to make the next search faster. If our server does not answer, or your sign-in has expired, the app asks stadnamn.no directly with the search text (see section 5). In the weather box's «Search for a place», the search text and the place the box shows (your position or the map centre), rounded to half a degree (about 50 km), go to our server, which then also searches a list of cities and towns worldwide from GeoNames kept on our server – no one else is asked, and nothing is stored. Weather and tide for a place you pick are fetched as for any other place (see Weather and Tide).
• Avalanche bulletins: the region you tap, to NVE.
• Map layers: the map area, to Geonorge/Kartverket, NVE, the Norwegian Environment Agency, DSB and the Norwegian Polar Institute while the layer is on.
• Air traffic (off by default): the map centre rounded to 0.1° (about 10 km), to adsb.lol.
• Drone zones and NOTAMs: the whole dataset is fetched from dronesoner.no; no position is sent.
• Version check: once a day the app asks our server which version is the newest in the App Store and what is new, sending the app's version number and language. No account, position or anything else about you goes with it, also when you are not signed in, and the answer is the same for everyone. The web page asks the same when you sign in or open it.
• Sea charts, contour lines and Swedish, Finnish, Icelandic, Spanish, Swiss, Danish, Czech, Slovak, Austrian, German, Luxembourgish, Dutch, Greenlandic, US, Canadian and Faroese maps are fetched from our own server, which fetches them from Kartverket, the Norwegian Coastal Administration, the Norwegian Polar Institute, Lantmäteriet, Maanmittauslaitos (the National Land Survey of Finland), Náttúrufræðistofnun Íslands (the Natural Science Institute of Iceland), Instituto Geográfico Nacional (Spain), swisstopo (Switzerland), Klimadatastyrelsen (the Danish Climate Data Agency), ČÚZK (the Czech Office for Surveying, Mapping and Cadastre) GKÚ Bratislava (the Geodetic and Cartographic Institute of Slovakia), basemap.at (Austria), the Bundesamt für Kartographie und Geodäsie (the German Federal Agency for Cartography and Geodesy), the Administration du cadastre et de la topographie (Luxembourg) and Kadaster/PDOK (the Netherlands); Klimadatastyrelsen also supplies the Greenland map; the US map comes from the U.S. Geological Survey and the Canadian one from Natural Resources Canada and the Faroese one from Umhvørvisstovan. They see only our server, not you. The server keeps a technical log with a masked IP address for 14 days (section 4).
• The Antarctic polar map consists of our own map files on the server, built from open data: the REMA elevation model (Polar Geospatial Center, CC BY 4.0), the MODIS Mosaic of Antarctica (NSIDC/NASA), the SCAR Antarctic Digital Database (coast, rock, contours, CC BY 4.0), the SCAR Composite Gazetteer (place names, CC BY), the crevasse map of Surawy-Stepney et al. 2023 (CC BY 4.0), the Antarctic Treaty Secretariat (protected areas, ASPA/ASMA) and OpenStreetMap. The «MODIS (today)» satellite image and the «Sea ice (satellite)» extent are fetched from NASA GIBS through our server when you switch them on, also for a chosen date. The «Sea ice (concentration)» pictures are made by our server from the NSIDC Sea Ice Index v4 (National Snow and Ice Data Center, daily since 1978), and «Icebergs» is the U.S. National Ice Center's weekly list of large icebergs; both are fetched by the server, never by your phone.

Apple Watch: during a recording the watch app reads heart rate, active energy and distance from Health (HealthKit) and saves the workout to the Health app. The samples are sent to the phone and stay in the recording there. Heart rate leaves the phone only in the cases listed in sections 4 and 5.

Location: the app asks for location access «while using the app». During a recording, and when you have turned on live sharing «also in the background», location updates continue after you put the app away and iOS shows the blue location indicator. Otherwise all location use stops when the app is in the background.

Mobile coverage in recordings: if you turn on «Registrer mobildekning» (record mobile coverage) when you start a recording (off by default), the phone notes which type of mobile network it is on – 5G, 4G, 3G, 2G, none or flight mode – and when that changes, and stores it in the recording with the track. iOS gives apps no access to signal strength or the operator, and the app reads no IP address, cell ID or other identifier. The data follows the recording and is stored in your account with it (section 3), it is private like the recording, and it never appears on share pages.

Camera in «Sol og måne» (sun and moon): the camera view draws the paths of the sun and the moon over the camera image. The image is used on the phone only and is neither stored nor sent. A picture is saved only when you press «Ta bilde» (take picture) and then choose to save it to Photos or share it; it carries no location.

3. Account and sync

You sign in with Sign in with Apple. We receive a technical Apple identifier (not your e-mail address) and a display name you can change yourself – Apple suggests your name, and we store up to 40 characters. You choose a colour and can add a profile photo.

While you are signed in, all your projects are stored in your account on our server at Hetzner in Helsinki, Finland, so you can use them in the app and on the web page: routes, points, drawings, recordings (GPS tracks with timestamps, speed and elevation, and the type of mobile network along the track if you turned on «Registrer mobildekning»), photos, documents, folder structure, account settings and the last 20 places you searched for (name and position, so the app and the web page show the same recent searches). Before the projects already on your phone are uploaded the first time, the app asks you. If you answer «Ikke nå» (Not now), you stay signed in and the question returns next time.

Projects can be shared with others («Sammen») using an invite code. Invitation codes are valid for as long as the owner chooses – 30 days by default, one year at most – and can be extended. An expired code is kept until it is extended or the project is deleted; a code replaced by a new one is deleted at once. Members see your name, colour and profile photo, the items shared in the project, and the change log – who changed what, when, and the name the item had at the time. Recordings are private until you share them, and you can keep routes, points, drawings, photos and documents private. Private items are stored on the server but visible only to you. If you share a recording with the members, they also see the timestamps in the track – and the heart rate, if «Lagre puls i kontoen» is on. Members who are removed from a project keep what is already on their phone.

Live position: if you turn on «Del min posisjon live» (Share my position live), your last position is sent to the members of the project. Only the last position is shared. It is visible to the members until you turn sharing off or pause it, and is deleted from the server after 24 hours regardless. New members do not see positions sent before they joined.

Garmin inReach: if you have a Garmin inReach with MapShare turned on, you can add it as your own under Innstillinger › Posisjonsdeling (Settings › Position sharing; requires a subscription). You enter the MapShare address (the web page asks for no password – if the MapShare page is password-protected, you turn the password off in Garmin Explore; older app versions also accept a MapShare password), and confirm «Dette er min inReach, og jeg har lov til å dele posisjonen fra den.» (This is my inReach, and I may share its position.) Our server then fetches the positions from Garmin's MapShare feed (share.garmin.com) – only while you or someone you share with has the app or the web page open, from every five minutes to every hour, and no longer after 14 days without new positions. You see your own trail. Members see your inReach position, as you, only in the projects where you share your position and only while «Del også inReach-posisjonen» (Also share the inReach position) is on – and only positions from after you turned sharing on in that project. When you turn sharing off in a project, the inReach disappears from it at once. Messages from the device are shown only if you turn on «Vis meldinger» (Show messages; off by default); when you turn it off again, the message texts are deleted from the server. Only you see the MapShare name and password; the password is stored encrypted, never shown again, never logged and sent only to Garmin. Positions are deleted after 30 days, and everything about the device is deleted when you remove it, turn on Ultra Privacy or delete the account. This is not an emergency service: SOS messages are not in Garmin's feed and are not shown here.

Garmin inReach in a project: the owner of a project can also add a Garmin inReach that is not their own – the guide's, for example – in the project's sharing settings («Legg til Garmin inReach», Add Garmin inReach device; requires a subscription). The owner enters the MapShare address, optionally gives it a name on the map, and confirms «Jeg har lov til å dele posisjonen fra denne inReach-en med alle i prosjektet.» (I am allowed to share the position from this inReach with everyone in the project.) All members then see it on the map as a device – the name, the position, elevation, speed and the trail – but only positions from after it was added, for the last seven days, and never from before they joined the project themselves. Our server fetches the positions from Garmin only while someone in the project has it open, from every five minutes to every hour. Only the owner sees the MapShare address. If the owner has no subscription, nothing is fetched or shown. Positions are deleted after 30 days, and the device with all its positions is deleted when the owner removes it, leaves the project, turns on Ultra Privacy or deletes the account, and when the project is deleted. This is not an emergency service either. If you carry an inReach that was added to a project against your wishes, you can turn MapShare off or set a password at Garmin – then nothing more is fetched – and ask us to delete it (section 7).

Share pages: any member can create a public, read-only page for selected items in a project. The page lives at an unguessable address that works for anyone with the link, is marked not to be indexed by search engines, and never contains heart rate, per-point timestamps, mobile network data from recordings, private items or documents. Photos are shown downscaled and without metadata. If you delete an item or make it private, it is removed from every share page in the project.

Road weather and webcams from the Norwegian Public Roads Administration are fetched via our server and require an account. They see only our server.

Subscription: the first week after the account was created is free; after that you need a subscription to create anything new in the app and on the web page – without one you can view and export what you have (see the terms). Our server counts the week from when the account was created. You buy the subscription in the app through the App Store. Apple is the seller and takes the payment – we never see card details, your name or the e-mail address of your Apple Account. To tie the purchase to the account, the app sends our internal account id (a random number) to Apple with the purchase. Apple sends our server signed information about the subscription, both through the app and directly, and the server can ask Apple for its status. We store only what is needed to know whether the account has access (section 4). Some accounts have free access for a period; we then store the end date and a short note on why.

Ultra Privacy: if you turn on «Ultra Privacy» under Settings › Account, the app first fetches everything to the phone. Then your projects, recordings, photos, documents, folders, settings, recent searches and profile photo are deleted from the server, and you leave projects you share with others – what you shared with them stays for them, without your name, the same way as when an account is deleted (section 7). While it is on, nothing is synced and the server accepts no content from the account; live position, share pages and the web page are off. The account is kept only for sign-in and the subscription, with a timestamp of when Ultra Privacy was turned on. Your data then exists only on the phone and in the phone's own backup (iCloud or computer) – if you lose the phone without a backup, it is gone. Meta's SDK (section 5) is not started while Ultra Privacy is on either. If you turn it off, the app asks whether the projects should be uploaded to the account again.

The app remembers the server's last answer about access on the phone, so it works without a network. If you have allowed the app to show notifications, it schedules a notification on the phone two days before the free week ends. The notification is created on the phone and does not go through any server.

4. Purposes, data, legal basis and retention

«Contract» refers to Article 6(1)(b) of the GDPR: the processing is necessary to provide the service you asked for by using the app and the account.

If you delete an item in the app or on the web page, its content is removed from the server immediately and from the members' devices at their next sync. Only the item's id and the time of deletion remain, so the deletion reaches everyone.

5. Recipients and services the app and the web page contact

One processor handles data on our behalf: Hetzner Online GmbH, Gunzenhausen, Germany, which operates the server in its data centre in Helsinki, Finland. Every other service below is an independent controller with its own privacy policy. They receive only what the table says, and only when you use the feature in question. The web page and the share pages fetch maps, heights and point lookups from the same services directly from your browser, see section 9.

Links you tap yourself – Apple Maps, Google Maps, Norgeskart, Toposvalbard, Varsom, Se eiendom, adsb.lol and status.kartverket.no – open in another app or in the browser and are not part of TrackNavigator. The web page and the share pages load code only from our own server, with the two exceptions in the table: Apple's sign-in script when the sign-in card is shown and when you delete the account, and jsPDF when you export a PDF. Share pages never load Apple's script.

We do not sell data, use no advertising or analytics services, and do not share data with anyone not listed here – unless the law requires it.

6. Transfers outside the EEA

Your account, the backups and everything we store ourselves is in the EEA (Finland and Norway). Some services the app and the web page contact directly are in the USA:

• Apple, Esri and Amazon Web Services are certified under the EU–US Data Privacy Framework, which the European Commission has approved (Art. 45). They receive your IP address and map areas, or – for Apple – the fact that you sign in, and our internal account id tied to a subscription you buy.
• Strava receives a recording only when you tap «Last opp til Strava» yourself after being told that it is sent to the USA (Art. 49(1)(a)). Strava processes it further under its own privacy policy.
• iNaturalist and adsb.lol receive your IP address and a scientific name or a rounded map centre when you use the feature (Art. 49(1)(b)). We cannot vouch for where these services keep their logs. You can avoid both features: the air-traffic layer is off by default, and species photos are shown only when you open the species list.
• Meta (Meta Platforms, Inc., USA) is certified under the EU–US Data Privacy Framework (Art. 45) and receives only the anonymous app events and SKAdNetwork counts in section 5 – without an advertising identifier and without anything about your account.
• Garmin (MapShare, USA): when you have added your inReach, or the project owner an inReach in the project, our server asks Garmin for the positions with the MapShare name and the password if any – data you entered at Garmin yourself. Nothing else about you is sent.

7. Your choices and rights

Access

Everything you have stored in the account is visible in the app and on the web page. For a complete export, including what is not shown there (for example log rows concerning you), ask via support@tracknavigator.app. We answer within one month and may ask you to confirm your identity with a sign-in.

Rectification

You edit your own content. Name, colour and profile photo are changed under Innstillinger › Konto (Settings › Account) in the app or in the account settings on the web page.

Deleting individual items

If you delete a route, a point, a recording, a photo or a document, its content is removed from the server immediately, from share pages, and from the members' devices at their next sync. The change log shows the deleted item's name for another 30 days; the log row itself is deleted after 365 days.

Deleting the account

Choose Innstillinger › Konto › Slett konto (Settings › Account › Delete account) in the app, or Delete account in the account settings on the web page. You confirm with your Apple ID. This is deleted from the server:

• the account and profile photo, sign-in keys, folder structure, account settings, recent searches and last position
• projects where you are the only member, with all files
• all your recordings, shared or not, with files
• everything you kept private, with files
• share pages and invite codes you created
• the data about the subscription and the free week
• the Garmin inReach you added, with positions, messages and MapShare password
• Garmin inReach devices you added to projects, with positions

Routes, points, drawings, photos and documents you added to projects shared with other members remain for the members, without your name: they are attributed to «Slettet bruker» (Deleted user), as are your entries in the change log. The members' projects thus do not lose content they used together with you. If you want that gone too, delete the items in the app before deleting the account.

At the same time we ask Apple to revoke the access the app was given with your Apple ID, so TrackNavigator disappears from the list of apps under your Apple ID. Your projects remain on your phone after deletion. Backups are deleted within 30 days. A subscription with Apple does not stop by itself when you delete the account; you cancel it with Apple.

Data portability

Every route, point and recording can be exported as GPX from the app. A complete export of the whole account in a machine-readable format is available on request.

Withdrawing consent

• Heart rate: turn off «Lagre puls i kontoen» under Innstillinger › Opptak (Settings › Recording) in the app or in the account settings on the web page. Heart rate already on the server is then deleted, also from share pages. It stays in the recordings on your phone.
• Live position: turn off «Del min posisjon live» or pause it. The last position is deleted from the server immediately.
• Garmin inReach: turn off sharing in the project, or «Del også inReach-posisjonen» under Settings › Position sharing – it disappears from the project at once. «Fjern inReach» (Remove inReach) deletes the positions, messages and password from the server.
• Strava: «Koble fra Strava» (Disconnect Strava) in the app removes the access on the phone and asks Strava to revoke it. What you have already uploaded you delete at Strava.

Objection

You can object to the processing based on legitimate interest – technical logs, the usage statistics, the change log, backups and positions from a Garmin inReach added to a project – via support@tracknavigator.app. We then assess whether the interest still outweighs yours in your case.

If someone added your Garmin inReach as their own or to a project, you can ask for access or deletion, or object, via support@tracknavigator.app – give the MapShare name and show that it is yours (for example with the MapShare password or a recent position). You can also stop the fetching yourself by turning MapShare off or setting a password at Garmin.

Complaints

If you disagree with how we handle your data, you can complain to the Norwegian Data Protection Authority, datatilsynet.no. We would appreciate hearing from you first.

8. Children

TrackNavigator is for people aged 13 and over. We do not collect age, but delete the account of a younger child when we learn of it. Parents and guardians can contact us via support@tracknavigator.app.

9. The web page and browser storage

The web page tracknavigator.app shows the same projects as the app. You sign in with the same Apple ID; new accounts are created in the app. The web page uses no cookies and no third-party analytics; it reports named events to our own usage statistics (section 4). It stores the following in the browser's local storage (localStorage), which only the web page itself can read:

At sign-out every other key the web page has stored under the tn prefix is removed as well; only the map and display preferences in the two rows above remain.

Share pages (?share=…) require no sign-in, store nothing beyond the map choices, do not load Apple's script, and are marked «noindex» so search engines should not index them. Our server logs page views with a masked IP address for 14 days.

When you are not signed in and not on a share page, the web page shows only the sign-in card. It creates no map and fetches no map tiles, heights, weather, searches or other data – only Apple's sign-in script (section 5). Place search, the weather forecast, waves and the tide on the web page go through our server and answer signed-in users only; on share pages place search works with the share link, and no forecast, waves or tide are shown.

Signed in, and on share pages, the web page fetches maps, heights and point lookups directly from your browser, from the same services as the app (section 5): map tiles from Kartverket, NVE, DSB, the Norwegian Environment Agency and the Norwegian Polar Institute, heights from Kartverket and Amazon Web Services (on Svalbard from our server), and – when you open a point or create a route or track analysis (signed-in web app only; share pages offer no analysis) – the coordinate to Kartverket, NVE and Artsdatabanken. Those services then see your IP address and what is asked for. This also applies to visitors of share pages without an account. Satellite imagery from Esri, sea charts, contour lines, the OpenTopoMap world map and the other countries' maps are fetched by the web page through our server; those services see only our server.

This page and the product page tracknavigator.app/om/ run no scripts, but load the Cabinet Grotesk typeface from Fontshare, which then sees your IP address.

10. Changes

If we change what is stored, for how long, or who receives it, we update this page and the date at the top before the change takes effect. Changes that require new consent are asked for in the app. The Norwegian text is the authoritative version; this English version is a translation.

• 27 September 2026 – first version, together with app version 2.0.
• 28 September 2026 – Invite codes: validity is chosen by the owner (30 days by default, one year at most) and can be extended; an expired code is kept until it is extended or the project is deleted, and a code replaced by a new one is deleted at once (sections 3 and 5). Together with app version 2.0.2.
• 28 September 2026 – Route analysis: point lookups also run for up to 24 stops along a route when you ask for it (sections 2, 5 and 9). Together with app version 2.0.2.
• 29 September 2026 – Place search outside Norway: the search text and the map centre go to our server, which searches stadnamn.no and our own place index from OpenStreetMap; nothing is stored (sections 2 and 5). Applies to the web page now and to the app from the version after 2.0.4. Section 1 no longer describes TrackNavigator as a hobby project.
• 29 September 2026 – The web page requires sign-in for everything except share pages: signed out, it shows only the sign-in card and fetches no maps or data. Place search and the weather forecast through our server answer signed-in users and share pages only. The app searches through our server only when you are signed in, otherwise directly at stadnamn.no (sections 2, 5 and 9).
• 29 September 2026 – Mobile coverage in recordings: with «Registrer mobildekning» on, a recording stores the type of mobile network the phone had along the track (5G, 4G, 3G, 2G, none or flight mode) – never signal strength, operator, IP address or cell ID. It follows the recording, is private like it and never appears on share pages. The analysis routes had now exists for recordings too, with the same lookups (sections 2, 3, 4, 5 and 9). Applies to the app from the version after 2.0.6 and to the web page.
• 29 September 2026 – «Sol og måne» with the camera: the camera image is used locally on the phone only, and a picture is saved only when you ask for it (section 2). Applies to the app from the version after 2.0.6.
• 29 September 2026 – New address: the web page, share links and these pages move to tracknavigator.app. The server and where data is stored are unchanged (sections 2 and 4); the old addresses forward you.
• 29 September 2026 – New contact address: support@tracknavigator.app. The old address still works.
• 30 September 2026 – Paid app: you need an account to use the app (from app version 2.0.5), and after a free week a subscription is needed, bought in the app through the App Store. New: what stays on the phone only, what we store about the subscription and the free week, and Apple as a recipient for purchases (sections 2, 3, 4, 5, 6 and 7). Corrected: the server is in Helsinki, Finland, not in Germany (sections 3, 5 and 6). Weather goes through our server from the app too, so MET no longer sees your IP address; air traffic comes from adsb.lol only; the web page's satellite imagery goes through our server; Finnish and Icelandic maps come through our server, and OpenTopoMap is the world map under the other maps and is never downloaded for offline use (sections 2, 5, 6 and 9). Applies to the web page and to the app from the version after 2.0.8; Finnish and Icelandic maps and the world map from 2.0.8.
• 3 October 2026 – Ultra Privacy: an option that deletes everything the account holds on the server and keeps your data on the phone only; the account is kept for sign-in and the subscription (section 3). Applies to the app from version 2.1.0.
• 4 October 2026 – Place search in the weather box: the search text and the weather box's place, rounded to about 50 km, go to our server, which also searches a worldwide list of places from GeoNames kept on our own server; no new recipient, nothing is stored (section 2). Applies to the web page and to the app from the version after 2.1.0.
• 6 October 2026 – Waves in the weather box's new «Sea» tab: the rounded position goes to our server, which asks the Norwegian Meteorological Institute (Northern Europe) and BarentsWatch (the Norwegian coast), and otherwise uses its own wave files from DWD. New recipient: BarentsWatch, which sees only our server. Place name in the weather box: the position, rounded to about 100 m, is looked up in a place list on our server (sections 2 and 5).
• 6 October 2026 – More weather: the place's height (rounded to 10 m) goes along to MET; wind aloft and freezing level from ECMWF files on our server; measured wind from the Roads Administration's stations; mountain weather from Varsom asked per region. No new recipients of the position.
• 4 October 2026 – Tide in the weather box: the rounded position goes to our server, which asks Kartverket (Norway) or NOAA (US waters), or computes the tide itself from a global model; the services see only our server (sections 2 and 5). Applies to the web page and to the app from the version after 2.1.0.
• 5 October 2026 – Tour: the web page remembers that the tour has been shown for your account in this browser (tnTourSeen:<user id>, section 9), also after you sign out. Nothing is sent to the server.
• 5 October 2026 – Version check: the app asks our server once a day which version is the newest and what is new, and the web page asks the same when it opens; only the version number and language go with it (section 2). The web page remembers which version you last saw the news for (tnWhatsNewSeen, section 9). Applies to the web page and to the app from the version after 2.1.1.
• 5 October 2026 – Garmin inReach in projects: the project owner can add an inReach with MapShare (requires a subscription) after confirming they own the device or have consent; our server fetches the positions from Garmin and shows the trail and the latest position to the members for 30 days; messages only when the owner turns them on; the MapShare password is stored encrypted; not an emergency service (sections 3, 4, 5, 6 and 7). Applies to the web page and to the app from the version after 2.1.1.
• 6 October 2026 – Garmin inReach is now your own device, not the project's: you add it once under Settings › Position sharing and confirm that it is yours. It shows as you in the same projects where the phone shares its position (and only while «Del også inReach-posisjonen» is on), with positions from after sharing was turned on there; turning it off removes it at once. The server fetches from Garmin only while someone is looking. Nobody can add someone else's inReach to a project any more (sections 3, 4, 5, 6 and 7). Applies to the web page and to the app from the version after 2.1.4.
• 7 October 2026 – Garmin inReach: the web page asks only for the MapShare address, not the password (if the MapShare page is password-protected, you turn the password off in Garmin Explore). The project owner can again add an inReach to the project – the guide's, for example – after confirming being allowed to share its position; all members see it on the map with positions from when it was added (the last seven days, never from before they joined); requires a subscription; deleted when the owner removes it or leaves the project (sections 3, 4, 5, 6 and 7). Applies to the web page and to the app from the version after 2.1.6.
• 5 October 2026 – Language: the web page is available in Norwegian and English and follows the browser's language. If you choose another under Settings › General, the choice is remembered in this browser (tnLanguage, section 9). Nothing is sent to the server beyond the language that already goes with searches and the version check.
• 12 October 2026 – Ad measurement: the app contains Meta's SDK and Apple's SKAdNetwork identifiers for Facebook and Instagram, so we can measure in aggregate and anonymously whether ads for the app lead to installs and subscriptions. No advertising identifier, no tracking permission, nothing about your account, your position or your content; off while Ultra Privacy is on (sections 3, 4, 5 and 6). Applies to the app from the version after 2.2.2.