What Groundtrack knows about you

Your position

With your permission, Groundtrack reads your location from the device so it can work out which places are visible from the aircraft, which side of it they are on, and how far away they are. iOS states the same thing in the permission dialog: “Your position is used to work out what is visible from the aircraft. It never leaves the device.”

That is literal. The position is used in the calculation and then discarded. It is not uploaded, not logged to a server, not stored between sessions and not shared with anybody. There is no route history, no flight log and no backup of where you have been, because none of it is ever recorded.

Declining the location permission leaves every other part of the app working. The map, the catalogue, the route downloads and the crossings all work; the app simply cannot tell you what is out of the window until you tell it where you are.

What the app does count

Groundtrack uses Google Firebase Analytics to count how the app is used. This is the one place where data leaves the device, so it is worth being exact about what is in it.

The app can send five events, and only five:

Every event Groundtrack is able to send, with everything it carries.

Event	When	What it carries
view_screen	A screen was shown	Which screen, from a fixed list of nine names
begin_checkout	A buy button was tapped	Which product
purchase	A purchase completed	Which product, the currency and the amount
registration	An account was created	Whether by Apple or by email
login	An account was signed into	Whether by Apple or by email

None of this is in the build you can install today. Build 5, uploaded on 16 September, has no analytics in it whatever — it sends nothing at all, because the code that would was written after it was uploaded. This page describes the build that comes next, which is the safer way round: you are told what will be collected before it is, rather than afterwards.

Of the five, view_screen is the one that will actually fire. begin_checkout and purchase wait on a subscription that is written but has nothing to sell yet; registration and login wait on Sign in with Apple, which is optional, never required to use the app, and asks for a name rather than an email address.

None of these events can carry a position. Not as a policy, but as a property of the program: the events are defined as a closed set in the app's own source, none of the cases has a field that could hold a latitude, a longitude, an altitude or a heading, and an automated check refuses a build in which any file other than the single analytics file speaks to the SDK directly. Screen names come from a fixed list of nine, so a place name or a search term cannot be assembled into one either.

What Google receives with it

Alongside those events, Firebase collects a standard set of information about the app and the device. In the terms Apple uses on the App Store listing, and in the app's own privacy manifest, this is:

• Product interaction — the events above.
• Device ID — an app instance identifier that Firebase generates for this installation. It is not your Apple ID, not your phone number, and not the advertising identifier. Deleting the app discards it; reinstalling produces a new one.
• Other diagnostic data — app version, device model, operating system version and similar.

All three are declared as not linked to your identity and not used for tracking, because the app has no identity to link them to and does not follow anyone anywhere.

The one thing worth saying plainly about IP addresses

When the app sends an event, Google's servers see the IP address the request came from, as any server does for any request from any app or browser. Google uses it to derive an approximate location — typically a country or a region — and, per its own documentation, to discard the full address afterwards.

That is not the position the app reads from the device. It is the coarse location of whatever network you are on, which for a phone on the ground is the city you are in and for a phone on aircraft wi-fi is wherever the satellite link terminates. It is not a track, it is not a flight path, and it is not a thing the app sends. It is the unavoidable by-product of talking to a server at all, and Groundtrack talks to one only for these five counters and when you download a sector.

No advertising identifier, and no tracking

Firebase can be built with a companion library that links the device's advertising identifier. Groundtrack deliberately does not include it. The consequences are checkable:

• The app does not link Apple's AdSupport or AppTrackingTransparency frameworks, which is why you never see the “Allow app to track you?” prompt — it is unnecessary here rather than skipped.
• The privacy manifest sets NSPrivacyTracking to false and declares no tracking domains.
• Ad personalisation is switched off explicitly when the app starts, and the Firebase project is not linked to any advertising account.

There is no advertising in Groundtrack, and no data goes to any advertising network.

Turning it off

As the app stands today there is no in-app switch to disable the counters. Saying otherwise would be inventing a feature. Deleting the app stops all of it immediately and discards the instance identifier with it. If a setting is added, this page will say so.

What the app fetches, and from where

The world map and the whole catalogue of places are installed with the app. In the air it needs nothing at all. Three things do reach the internet, all of them on the ground and all at your instruction:

Everywhere Groundtrack connects, and why.

Where	When	Why
build.protomaps.com	When you download a sector	Detailed map tiles for the corridor along your route
s3.amazonaws.com	When you download a sector	Elevation data, for the shaded relief in that corridor
commons.wikimedia.org	When you download a sector	Full-size photographs for the places in that corridor. Small copies of all of them are already bundled; this fetches the sharp ones for the stretch you are about to fly

Those requests carry the departure and arrival you chose, in the sense that they ask for tiles along that line — a map server cannot send you a map of somewhere without being told where. They carry nothing else about you beyond what any web request carries, and no identifier from the app. All three are public community resources rather than servers we run.

A copy of every photograph and every description is bundled with the app. In the air it fetches nothing: it does not ask Wikipedia, Wikimedia or anyone else a question while you fly, and there is no request it could make that would say where you are.

The Apple Watch app

From the next build there is a watch app, and it is worth saying what crosses to it. The phone sends a short list of strings it has already finished with — a place name, “11 km”, “Left · 11 o'clock”, the next crossing and the time to run — together with a flag saying whether the phone knows where it is. There are no coordinates in it. The watch cannot work out a position from what it is given, because everything numeric has already been turned into a phrase.

That travels over Apple's own link between your phone and your watch. It does not go through a server of ours, because there is not one, and nothing about it is recorded on either device. The watch app holds one answer at a time and replaces it with the next.

What there is none of

• No account you have to make. Nothing to register, no password to lose, and no email address collected — including by Sign in with Apple when it arrives, which asks for a name and nothing else, keeps the identifier Apple returns in the device's keychain, and never stands between you and the app.
• No advertising and no advertising SDK.
• No third-party trackers beyond the Firebase counters described above, which are named rather than hidden.
• No contacts, photographs, microphone, camera, calendar, health or motion data. The app does not ask for any of it.
• No selling or sharing of anything to anyone, for advertising or otherwise.
• No profiling and no automated decisions about you.

Children

Groundtrack is rated 4+ and is suitable for anyone. It is not directed at children specifically, it has no messaging and no user content, and it does not knowingly collect personal information from anybody of any age. A subscription and an optional sign-in are coming; neither collects anything about a person beyond what the App Store already handles.

Your rights, and their honest limit

If you are in the UK, the EEA or another place with comparable law, you have rights to see, correct, export and erase personal data held about you, and to object to its processing.

Here is the awkward part, stated rather than buried: because nothing collected is linked to you, there is no way to find your records and hand them over. The instance identifier is not connected to a name, an email address or an account, and we cannot work backwards from any information you could give us to the rows it produced. Asking for more information from you in order to identify you would collect more about you than the app ever did, which is the wrong trade.

What you can do instead, immediately and without asking anyone:

• Delete the app. Collection stops and the instance identifier goes with it.
• Decline or revoke the location permission in Settings → Privacy & Security → Location Services. The position was never leaving the device, and after this it is not read at all.

Google keeps the event data for 12 months, which is the retention period set on the Firebase project. After that it is deleted automatically.

Who is responsible, and how to ask

Groundtrack is published by TO/GA Norbert Mazur, Władysława Pytlasińskiego 16/13, 00-777 Warszawa, which is the data controller for the counters described above. Google Ireland Limited and Google LLC act as processors for Firebase Analytics.

Apple handles Sign in with Apple and every purchase in its own right, under its own privacy policy. We never see a card number, a billing address or the email address behind an Apple ID.

Questions, corrections, or a sentence on this page you think is wrong: contact@flapps.cloud. Being told that something here overstates the case is genuinely useful, and it gets fixed.

Changes

If what the app collects changes, this page changes with it, and the date at the top moves.

The last substantive change was on 19 September 2026, in two parts. Analytics was added to the code — before that the app collected nothing at all, and this page said so. And the app gained an iPad layout, an Apple Watch app, an optional sign-in and a subscription, none of which is in the build currently on TestFlight. The photograph host was also added to the table above: it was always contacted during a sector download and the table had not said so, which was an omission rather than a change in behaviour.

This website

The page you are reading sets no cookies, runs no JavaScript, and loads nothing from any other domain — no font service, no analytics, no embedded anything. That is why there is no consent banner: there is nothing to consent to. The server keeps ordinary access logs, as every web server does.

A privacy policy served from a page that quietly tracks its readers is self-refuting, so this one does not.