Applies to the Walkabout app for Android and iOS (com.ubiquicore.walkabout) and to this website.
Version 2.2 · effective 9 October 2026. What changed.
Walkabout reads your location on your phone, uses it on your phone, and stores it on your phone. We do not hold your walk history or a record of where you have been. There are no adverts and no third-party trackers. Anonymous usage statistics and crash reports are optional and off until you switch them on. In this version neither sends anything, even when switched on (section 5). Every feature works the same without them.
The app makes a small number of network requests. It downloads offline map packs from our own server. If you use the weather and stargazing features, it asks a forecast service what the weather is doing near you. If you use the safety flags, it asks a few public bodies — the Environment Agency, MeteoAlarm and one or two others — what warnings are in force in an area, never at a point. If you plan a route — on foot or, with sat-nav mode on, by car — it asks our own router for one. None of these requests carries an account, a device identifier or an advertising ID.
A few things you can turn on send more, and each is off until you do. Connections sends where you are, all the time, to the people you choose, for as long as it is on. The community sends what you choose to share with other walkers, under an account you make when you join. Contributing to OpenStreetMap sends a shortened line of one walk, when you tap to send it. Sharing a walk’s live position is not available yet. Section 4 says what each one sends, to whom, and how long it is kept.
The app can also work with your phone's own health store — steps, distance, heart rate, and saving your walks there — if you switch it on. None of it reaches us.
The app can keep a backup copy of your walk history, scrambled with a passcode you choose. It is off unless you switch it on, and in this version the copy stays on your phone. We never hold a copy, a key, or any record that you use it at all. Section 5.1.
Walkabout is made and published by UbiquiCore Limited, based in the United Kingdom. For anything in this policy, including any request about your data, write to hello@walkabout.fit.
Where this policy uses "we", it means UbiquiCore Limited. Where it uses "the app", it means Walkabout installed on your phone.
Walkabout asks for location permission the first time you tap the locate-me button or start a walk. On Android it asks to use your location while you are using the app. Connections (section 4.10) is the one feature that asks to use your location all the time, and it asks only when you turn it on. On iOS it asks only for "While Using the App". Recording a walk continues with the screen off because the app runs a visible foreground service (Android) or a background activity session started while you were looking at it (iOS).
Readings from the phone's GPS and barometer are processed on the device: filtered, turned into distance, speed and climb, drawn on the map and written to a database in the app's private storage. A coordinate leaves your phone only in the ways section 4 lists.
The app uses a third-party location library (tracelet, Apache-2.0) to talk to the operating system's location services. Its own network sync, its address lookup, its separate location database and its logging are all switched off. While Connections is on, the same library runs a second, lower-power setting, configured the same way: a reading about every two minutes, precise to about 100 metres, with its own notification.
The app also reads the accelerometer while a walk is recording. If you switch on the optional fall check-in described in section 5.2, the app watches for the shape of a heavy impact so that it can ask whether you are all right. That reading happens on the device, is never stored and is never sent anywhere, and it stops the moment the walk stops. While Connections is on, the location library reads the same sensor to tell whether you are moving, so that it can rest when you are still; nothing it reads there is stored or sent either. If you switch on crash detection or the fall check all day (4.10), the app also reads it while you are sharing your location — for crash detection, only while you are moving faster than 30 km/h — and nothing it reads for them is stored or sent. Outside a walk, outside Connections and outside those two checks, the app reads no sensor in the background.
All of the following lives in Walkabout's private app storage on your device. Apart from the notification token, none of it is uploaded as it stands; what is sent from it, when and to whom, is section 4.
| What | Why |
|---|---|
| Recorded walks and their GPS track points | So a walk exists after you finish it |
| Saved and planned routes | So you can walk them again |
| Downloaded region packs | The offline map, terrain, paths and place-name index |
| Progress: points, badges, streaks, explored areas | The app's gamification, computed on device |
| Your settings and preferences | Theme, units, text size, Wi-Fi-only downloads and, if you marked places for somebody, which of them you have muted |
| An optional profile: body weight and a fitness answer | Better time and effort estimates. Both optional, both stay on the device |
| Whether the trial has started, and whether you have bought the unlock | So the app knows what to show you. It is a date and a yes-or-no, on your phone and in your phone's keystore, and it is never sent to us. Section 5.3 |
| Whether you switched the optional statistics, crash reports or backup on, and when a backup last ran | So the app can tell you what it is doing. Every one of them is off until you switch it on. Section 5.1 |
| A record of which walks were saved to your phone's health app | So the app can tell you what was saved and what was not. Section 4.5 |
| Walks you imported — from a file, or from your phone's health history | They are your walks, marked as imported |
| Which health readings you have turned on | Your choices, one per kind of reading, so nothing is read or written that you did not switch on |
| Heart rate recorded during a walk, when your phone or watch measured it | So a walk can show your heart-rate zones afterwards. It is read from your phone's health store, with your permission, and stays on the phone. Section 4.5 |
| Passive tracking’s switches | Whether it is on, and whether steps, distance and the map are. The figures themselves are read when you look and are not kept. Section 4.5 |
| If you join the community: which account this phone is signed in to, and the token that keeps it signed in | So that what you share is yours, and so you can delete it. The token is held in your phone's own keystore, never in the app's database. Section 4.7 |
| If you join the community: whether the date of birth you gave was 18 or over | Connections is for people aged 18 and over. Only a yes or no is kept, not the date. Signing out, deleting your community account and Delete everything clear it. Section 4.10 |
| Community routes you have looked at | So a route you looked at is still there with no signal. Each one shows how old its copy is |
| Things you shared or reported that have not been sent yet | So nothing is lost if you tap with no signal. They wait while your sharing switch is off; signing out, Delete everything and deleting your community account delete them |
| If you turn Connections on: your own phone number, and which version of its terms you accepted and when | So an invite can carry a code made from your number (section 4.10). Both are deleted when you turn Connections off |
| If you turn Connections on and allow Walkabout’s notifications: a notification token | A code from Google’s push service that lets an alert from the people you connected with reach this phone, even when Walkabout is closed. It is kept on your phone and on our community server, and deleted when you turn Connections off, sign out of the community or use Delete everything. Section 4.10 |
| If you sign in to OpenStreetMap: a note that you did, and its sign-in token | So a walk you choose to contribute lands in your account. The token is held in your phone's keystore, never in the app's database. Signing out deletes both. Section 4.6 |
| A backup copy of your walk history, if you switch the backup on | Scrambled with a passcode you set. Section 5.1 |
You hold this data, on your phone, for as long as you keep the app; deleting the app removes all of it. Downloaded map packs can also be deleted one at a time in the app.
Your phone’s own backup system — Android Backup to your Google account, or iCloud Backup on iOS — leaves Walkabout’s walk history out. On Android the app declares allowBackup="false", so its storage is not included in a backup to your Google account at all; on iOS the app’s database is excluded from iCloud Backup. What a phone backup can still carry is what your phone’s own health store holds, which is Google’s or Apple’s and covered by their terms rather than ours. We never see a phone backup.
A new phone restored from a phone backup therefore does not bring your Walkabout history with it. To move it, use the export in the privacy screen.
If you would rather your walk history were not backed up at all, turn off backup for Walkabout in your phone's settings.
Your phone’s own backup is separate from the backup in section 5.1, which is a Walkabout feature you switch on: it writes a scrambled copy of your walk history, on a schedule you choose, to your phone’s own storage in this version. Neither of them reaches us.
Region packs — the offline maps — are files we host. The app fetches a catalogue of them from our pack host when you open the offline maps screen, when you choose your area the first time you open the app, when you open the Drive tab with a map downloaded, and when the map shows an area your downloaded maps do not cover. When you download a region it fetches the pack files, resuming partial downloads where needed. Where no downloaded map covers the area on your screen, the map reads that area from the same files while you look at it, so our pack host can tell which part of the map was asked for. These are ordinary HTTPS requests for files at fixed addresses, and they carry nothing that identifies you, your device or your walks: no account, no device ID, no advertising ID, no analytics token and no query parameters about you.
Our pack host is packs.walkabout.fit. Like any web server it necessarily sees, for each request: your IP address, the file you asked for, the time, and standard connection details your device sends to fetch a file. We have configured that host to keep no request logs at all, so these details exist only for as long as it takes to send you the file.
An IP address can be personal data under UK data protection law. We do not use it to identify you, do not link it to any other data, do not build a profile from it and do not share it with anyone for their own purposes.
The weather, the walking-window scores and Tonight Mode need a forecast. When those features are switched on, the app asks a forecast service what the weather is doing near you.
It sends an approximate location, not your position. Before anything leaves your phone, your coordinates are rounded onto a grid of roughly two to three kilometres. The forecast service receives only that grid square, which is the same for everybody in it and too coarse to say where you are.
The request also carries the list of weather measurements the app wants and the name of the forecast model. It carries no account, no device identifier, no advertising ID and nothing about your walks. Like any web server, the forecast service necessarily sees the IP address the request came from.
The forecast service is Open-Meteo’s software, running on a server of ours (section 4.9).
None of the astronomy leaves your phone. Sunrise, sunset, twilight, the moon, the meteor calendar — all of it is worked out on the device from the date and your position, with no request to anybody.
If you turn the conditions features off in Settings, the app makes no forecast request at all.
The safety flags need to know what warnings are in force where you are walking — flood warnings, severe-weather alerts, and one or two others. So when those features are switched on, the app asks the public bodies that publish them.
It sends a bounding box, not a position. What the app sends is a box around your route, snapped outwards onto a grid before it leaves the phone — the same box for anyone walking the same hill.
The organisations are the Environment Agency (flood warnings in England), Natural Resources Wales (flood warnings in Wales, not in use yet), MeteoAlarm (severe-weather alerts), the UK Health Security Agency (heat and cold alerts, off by default) and a small proxy of our own for fire detections from NASA and park closures from the US National Park Service (not in use yet). None of these requests carries an account, a device identifier, an advertising ID or anything about your walks.
Crime data is never requested by the app at all. The optional crime layer is built into the map pack before you download it, from published police data. The safety flag on a route is about weather, water, terrain, daylight and light; the crime layer never affects it, even when you switch the layer on.
If you turn the safety features off in Settings, the app makes none of these requests.
This is one of two features that send your precise, live position away from your phone. The other is Connections, in section 4.10.
It is not switched on yet and cannot be started in this version. Once it is, it works as described below.
It happens only when you ask for it, from inside a walk you are already recording, and it sends your position only while that walk is running.
What happens when you do start it: the app creates a link with a long random token in it, and while the walk is running it publishes your position so that anyone holding that link can see where you are on a plain web page. They need no account and no app.
It has these limits:
Anyone who has the link can open it while the walk is running. Send it only to people you want to see where you are, and revoke it if you change your mind.
For all of them, the app needs no permission to know where you are while it is closed; Connections, in section 4.10, is the one feature that asks for it. The daily weather notification, if you turn it on, is worked out for the area you were last in — or a home area you choose — and the notification says which.
The app also checks whether your connection is Wi-Fi or mobile data. That check asks the operating system and involves no network request; it exists solely so the "download over Wi-Fi only" preference can work.
Every reading from your phone's health store happens while you are looking at the app — opening a walk, checking a goal, looking at Passive tracking — and never on a schedule while the app is closed. The permission that would allow background health reading is not requested, and it is not in the app at all (section 6).
Walkabout can connect to your phone's own health store — Apple Health on iPhone, Health Connect on Android — if you turn it on in Me → Health. Nothing is read or written until you do, each kind of data is a separate switch, and turning a switch off stops the reading and the writing.
Reading from, and writing to, your health store is not a transfer to us or to anyone. It happens on your phone, under a permission you granted and can withdraw. We never see any of it.
There are exactly two ways anything health-related can leave Walkabout, and both need you to act:
Sending a walk to your own Strava account is switched off for good (section 4.6). Outside those two ways, anything from your health store never leaves your phone: no heart rate, no step count, no energy figure and no health-store record is sent anywhere by this app — not by Connections, not by the community, not to OpenStreetMap, and not in the optional statistics or crash reports in section 5.1.
Passive tracking, opened from the headline card on the Walk tab, shows the steps and distance your health store recorded today, this week, this month and this year. It is off until you switch it on, and steps, distance and its map each have their own switch. It reads your health store’s daily totals for the past year while you are looking at it, and neither stores nor sends them. Its map draws walks you recorded, which are already on your phone.
Sharing one walk as a file — from the walk’s own page, or from the screen a walk ends on — hands your phone’s share sheet a GPX file of that walk: its line, its times, its title and your notes, and no health figure. Where it goes is your choice; it does not come to us.
A walk we did not record is never sent anywhere by the app itself. If you let Walkabout add a walk it found in your health history, or import one from a file, that walk cannot be sent to Strava, to OpenStreetMap or to the community.
OpenStreetMap. Where the app offers it, in Settings → Sync and sharing, you can switch on contributing to OpenStreetMap and sign in to your own OpenStreetMap account — on OpenStreetMap’s own page, in your browser. We never see your password. What comes back is a sign-in token, kept in your phone’s keystore and never in the app’s database. Signing out, or switching OpenStreetMap off, deletes it; you can also remove Walkabout in your OpenStreetMap account’s own settings.
Then, on a walk you recorded on this phone, you can contribute its line to the map everyone uses, one walk at a time. This one is permanent: a trace OpenStreetMap accepts becomes part of an open database under the Open Database Licence, a share-alike licence, and cannot be taken back — not by you, not by us and not by OpenStreetMap. So before anything is sent, Walkabout removes the start and the end of the walk by a distance that changes every time, and sends the shortened line, the heights along it, and a description and tags that are the same on every trace. Nothing else goes: no times, no heart rate, no cadence, no energy, no walk name and none of your notes. You see exactly what will be sent, and nothing is sent until you tap to send it. OpenStreetMap lists it at the level it calls trackable, which adds the line to the map without listing the trace publicly under your name. What OpenStreetMap does with what you send is covered by OpenStreetMap’s own terms and privacy policy, not by this one.
On a route’s safety sheet, Help map this stretch opens OpenStreetMap’s page for a new note, in your browser, at the middle of your route. Anything you write there goes to OpenStreetMap, under their terms.
Strava. Sending a walk to your own Strava account is switched off in every version of the app. If that ever changes, this policy will say so first, and say exactly what it sends.
The hosts involved are www.openstreetmap.org (signing in), api.openstreetmap.org (sending a walk) and, for Strava, www.strava.com.
It is off until you join. Once you join, our community server holds what you choose to share with other people, and deleting the app does not take it back.
Before you join, the only request the app makes to the community server is to ask which community features are switched on — when the app starts, when you come back to it, and when it finds a connection again. That request carries no account and nothing about you; like any web request, it shows the server the network address it came from. Everything else in this section happens only after you join.
Joining (Me → Community account → Join the community). You are asked your date of birth, because the community is for people aged 13 and over. The date is checked on your phone and then forgotten: it is never stored and never sent. One tap then makes an account on our community server — an account number, and a sign-in token that keeps this phone signed in. The token is held in your phone’s own keystore, never in the app’s database. Other walkers never see your account number or your name: they see a name made up for you.
Adding an email address, or signing in with Google, Apple or Microsoft. You can add an email address to your account — we send a one-time code to it — or, where the app offers them, sign in with Google, Apple or Microsoft. Sharing a route or a report needs one of these; joining and looking at routes do not. If you choose one of the three companies, it tells our sign-in service an identifier for you at that company and the email address it holds for you; Apple may give a private relay address instead of your own. The company may also send the name on your account, and Google may send a link to your profile picture. Our sign-in service keeps what it is sent, with your account. Walkabout does not show it, and other walkers never see it. We never see your password at Google, Apple or Microsoft: you sign in on their own page, in your browser. If you remove Walkabout from your Google, Apple or Microsoft account, you can no longer sign in to the community through it.
Your two switches, in Settings → Community once you have joined: Show community routes, which joining turns on, and Share routes and reports, which is off until you turn it on.
Show community routes. While it is on, Explore asks our community server for routes other walkers have shared near you. That request carries your position, how far to look, and your sign-in. Our server answers it and keeps nothing of it beyond the short request records section 9 describes. Routes you look at are kept on your phone for reading with no signal, each showing how old its copy is.
Sharing a route. With Share routes and reports on, a walk you recorded on this phone has Share with the community on its page. What is sent is much less than the walk:
You see what will be sent before you send it, and before you share, the app tells you three things, which are also the rules: anyone can read a shared route, with no account; anyone can download it and keep it; and you can delete it later, which removes our copy but cannot take back copies people have already taken. Shared routes are licensed CC BY-SA 4.0: other people may use and adapt what you shared if they credit you and share alike. Something you shared waits on your phone until there is a signal, and it waits while your sharing switch is off.
Reports and blocks. On a route you shared, its safety sheet lets you report a problem with the route by choosing a category, such as flooding or a fallen tree. Where the app offers them, you can also report what another walker wrote, by choosing a reason, and block that walker, which hides what they share from you and can be undone. These are fixed choices: there is no box to type in. A report is kept with your account so that it can be followed up; section 7.7 says for how long.
“Did you walk this route?” After a walk that follows a route someone shared, the app may ask. If you answer Yes, the line of that walk — all of it, as you recorded it, its start and its end included — is sent to our server, which compares it with the route. The server keeps the route, your account, the date you walked it (never the time) and how closely the two matched, and anyone can see that the name made up for you walked that route on that date. It does not keep your line. If you answer No, nothing is sent; if you discard the walk before the answer is sent, the answer goes with it.
Signing out, and deleting your account. Signing out removes the account from this phone; the account stays on our server until you delete it. You can delete it in the app, in Me → Community account, and choose what happens to what you shared: delete it, or keep it with your name removed. Section 7.4 says what that means and what is kept. Deleting the app does not delete your community account.
Where it is. The community server — a database and a sign-in service — is run for us by Supabase, in its London region, at mdcsdwvsqjxeabwhifpv.supabase.co; section 9 says what that means. Your walk history, your saved routes, your progress and your settings are not sent to it: only what this section and section 4.10 describe.
Both are off, and neither is running yet. They exist to receive something about the app rather than to answer a question. In this version the app has no address for either of them and there is no service at the other end, so nothing reaches either one, whatever the switches say. Section 5.1 describes them in full.
| What | Whose server | When your phone contacts it |
|---|---|---|
| Usage statistics (a self-hosted Aptabase) | Ours | Never in this version: the service is not running. In a later version: only if you switched statistics on |
| Crash reports (a self-hosted GlitchTip) | Ours | Never in this version, for the same reason. In a later version: only if you switched crash reports on, and only when the app has actually crashed |
| Your own cloud backup (Google Drive or iCloud) | Yours, not ours | Not available in this version: the backup keeps its copy on your phone (5.1.2). Nothing about it reaches us |
The router. When you ask Walkabout to plan a route — a walking route, one that avoids steps or suits a wheelchair, or, with sat-nav mode switched on in Settings, a driving route — the request goes to a routing service we run ourselves at routing.walkabout.fit. What it receives is the points you asked to route between and the kind of route you asked for, including, if you set one, your accessibility profile. For a driving route, the points are where you are and where you are going. When Walkabout finds you a new route during a drive, the router also receives the direction you are travelling in. It receives no account, no device identifier, no advertising ID and no record of any walk you have recorded. There is nothing on that server that says which requests were yours.
Your accessibility profile. If you tell Walkabout you use a wheelchair, or need to avoid steps, that preference is stored on your phone and is sent with each route request. It is sent to our server and to no one else, it is not stored against you there, and there is no profile of you on our side for it to be added to. If you never set one, nothing about it is ever sent.
The forecast. A forecast request (section 4.1: a coordinate rounded onto a grid of roughly two to three kilometres, and nothing about you) goes to an Open-Meteo instance we run ourselves at weather.walkabout.fit, not to a third party, and this policy covers it.
Like any web server, both of ours see the IP address a request came from, what was asked for and when. As with the pack host in section 4, we do not use it to identify you, do not link it to anything else, do not build a profile from it and do not share it.
This is the second feature that sends your precise position away from your phone, and the only one that keeps working when you are not walking. It is off until you turn it on, in Me → Connections, and that screen tells you what it does before you agree to anything. It has its own terms, which you read and accept in the app. It uses your community account (section 4.7).
While Connections is on, this phone sends where you are to the people you connected with, all the time, whether or not you are walking and whether or not the app is on your screen. You see where they are in the same way, in the Connections list and on Explore’s map. Everywhere else in Walkabout, your walks stay on your phone.
# in the link, the part a browser never sends to a website, so your number never reaches us in any form. Send an invite only to the person it is for: somebody else who got hold of the link could work your number out from it.On iPhones, iOS itself hands the app occasional battery and performance reports (Apple's MetricKit). Those reports are delivered by the operating system, stay in the app's storage, and are not uploaded.
Everything in this table is off in a fresh install and stays off until you switch it on. Refusing any of them withholds no feature, and you will not be asked again.
Two of the three are not running yet. We do not yet run the service the statistics switch or the crash-report switch would send to, so in this version switching either one on sends nothing anywhere.
When a later version does run those services, a usage event and a crash report will each be deleted thirty days after it arrives, and this policy will be updated, with a new version line and a new date, and published on this page before that version reaches anyone. The third switch, the backup, works in this version and keeps its copy on your phone; backing up to your own Google Drive or iCloud is not available yet (5.1.2).
| Usage statistics | Crash reports | Backup | |
|---|---|---|---|
| Default | Off | Off | Off |
| Collecting in this version? | No. We are not running the service, so switching this on sends nothing | No. The same | Yes, if you switch it on — a copy kept on your phone, never sent to us |
| Who turns it on | You, in Settings | You, in Settings | You, in Settings |
| Our lawful basis | Your consent (UK GDPR Article 6(1)(a)), withdrawable at any time in Settings | Your consent, withdrawable the same way | None: we are not a party to it (5.1.2) |
| What is held | Which screens were opened, whether a feature was completed, the app version, and a coarse platform | What went wrong, where in the code, the app version, the device model and the OS version | Your walk history, scrambled with your passcode |
| Where it is held | Nowhere in this version. When one runs, a service we run ourselves | Nowhere in this version. The same | On your phone, in this version. Your own Google Drive or iCloud are not available yet |
| How long | Not collected in this version | Not collected in this version | As long as you keep it. Only you can delete it |
| Does it identify you? | No. No account, no device ID, no advertising ID, and no session identifier that survives closing the app | No. The same list | Not to us. It is on your phone |
| Coordinates? | None. 5.1.1 | None. 5.1.1 | Yes: it is your walk history, and it stays with you |
| Health figures? | None | None | Whatever is in your own history |
| How to ask about it | hello@walkabout.fit — and see the limit in 7.4 | The same | Nothing to ask us: we never had it |
No coordinate, no health value, no route identifier tied to a person and no device identifier is in any statistics event or any crash report. One filter in the app removes them from every text field, and it is tested against what actually arrives.
In this version the backup writes its copy to the app’s own storage on your phone; backing up to your own Google Drive or iCloud is not available yet. No copy, no key and no record of it reaches us: we do not know whether you use it, when it last ran, or what is in it. It has three limits:
Your walk history lives on your phone, and always will. A backup is optional, and every feature of the app works the same without one.
Two separate things have to be true before a single statistic or crash report can leave your phone. The first is ours and the second is yours, and neither can substitute for the other.
We cannot switch either one off remotely. To stop collecting something for everybody, we would have to release an update; we cannot switch it off on phones that already have the app. Your own switch works at once and needs nobody’s help.
This is not a medical device, it is not a medical service, and it does not monitor your health. It watches the accelerometer for the shape of a heavy impact, while a walk is recording — or, if you switch on the fall check all day, while you are sharing your location in Connections — and nothing else.
If you switch it on and the phone detects an impact, it asks whether you are all right and starts a countdown. If you say you are fine, nothing happens. If the countdown finishes:
The message is written for you: it says that you may have fallen, with the time, where you were and a Google Maps link to that place. Your messaging app lets you change it before you send it.
Walkabout is free to download and fully featured for thirty days. After that, a one-off purchase unlocks it for good, on the store you bought it from. There is no subscription, and there never will be.
Nothing about your trial or your purchase is sent to us. The trial's start date lives on your phone and in your phone's keystore, and the app makes no call to any server of ours about your trial.
The purchase itself is handled entirely by Google Play or the App Store. They take the payment and they hold your payment details; we never see a card number, and what reaches us is the anonymised sales reporting the stores provide. Restoring a purchase asks the store, not us.
Whatever state the app is in, these always work: viewing your history, browsing your walks, and exporting everything you have.
| Permission | Used for |
|---|---|
| Location (precise or approximate, while using the app) | Showing where you are and recording a walk. Approximate is enough for the blue dot if that is all you grant. |
| Location all the time — Android, Connections only | Sending where you are to the people you connected with while Walkabout is not on your screen. Asked only when you turn Connections on, after a screen that says what it is for. Nothing else in the app uses it. |
| Contacts (read) — Connections only | Checking, on your phone, that an invite came from somebody whose number you have saved. Asked only when you accept an invite; read once, and nothing is kept or sent. You can type the number instead. |
| Notifications | The notifications that keep a recording, or Connections, running with the screen off; a fall alert from somebody you are connected with; and the ones you turn on. |
| Foreground service (location) — Android | Recording a walk while the phone is in your pocket, and, while Connections is on, sending where you are. Its notification is always shown. |
| Run at start-up | After your phone restarts: putting back the notifications you turned on, and, if Connections was on, the notice that it is off until you open Walkabout. It starts nothing else. |
| Internet and network state | The requests in section 4, and knowing whether you are on Wi-Fi. |
| Motion / barometer | Measuring climb from air pressure; watching for an impact while a walk is recording, if you switch the fall check-in on; and, while Connections is on, telling whether you are moving and, if you switch them on, watching for a crash or a fall while you are sharing. Optional; the app works without it. |
| Health — steps (read) | Learning your usual week so a goal is built from what you actually do, finding walks the app missed, and Passive tracking’s figures. Optional. |
| Health — distance (read and write) | Reading how far a walk went when your phone measured it, and Passive tracking’s figures; writing the distance of a walk we record. Optional. |
| Health — heart rate (read only) | Showing the heart rate your watch recorded during a walk. Walkabout never writes a heart rate to your health store. Optional. |
| Health — workouts (read and write) | Reading which workouts another app already recorded, so the same walk is never offered twice; writing a walk we record. Optional. |
| Health — route (write only) | Saving the walk's route with the workout. Write only: the app cannot read a route back, not even one it wrote. Optional. |
| Health — energy (write only) | Adding the energy the app estimates for a walk, and only when it has a figure. Optional. |
| Billing — Android | Buying the one-off unlock through Google Play, and restoring it on a new phone. It grants no access to your account and reads nothing about you. |
Every health permission is asked for separately, is explained before you are asked, and can be switched off in Walkabout as well as in your phone's settings. Switching one off in Walkabout stops the reading and the writing.
Notably absent: sending text messages, photos, microphone, phone, calendar, exact alarms, the advertising ID, step counting from the phone's own motion sensor (the step figures come from your health store, if you allow it, and not from a separate activity-recognition permission), background health reading, and Bluetooth. Location all the time and contacts are there for Connections alone, as the table says. Permissions that a bundled library declares and the app does not use are removed.
We act as a controller for four things, and for a fifth once it starts. Each has its own lawful basis.
The first is the request data our servers necessarily receive — when your phone downloads a map file, asks our router for a route or our forecast server for the weather (section 4), or asks the community server which features are switched on (4.7): your IP address and what you asked for. Our lawful basis for that is legitimate interests (UK GDPR Article 6(1)(f)) — we cannot answer a device without its address, and being able to tell abuse from normal traffic keeps the service running for everyone. We have weighed this: the data is the minimum a web request cannot function without, it is not combined with anything else, it is not used to profile or to identify anybody, and it is held for no longer than stated in section 4.
The second is your community account, if you join (4.7) — its account number, the name made up for you, and an email address or what Google, Apple or Microsoft send if you add one — and what you share under it: routes, reports, blocks, and the routes you said you walked. Our lawful basis is contract (Article 6(1)(b)): you asked us to hold an account so that what you share can be yours. For keeping a record of a report, and of what we did about it, after the content has gone, it is legitimate interests: the record lets a report be followed up and an appeal be answered. The line of a walk you send to be compared with a route is used for that comparison and not kept.
The third is Connections, if you turn it on (4.10): your last position, who you are connected with, open invites, which version of its terms you accepted, your phone’s notification token, the time of the last alert your phone raised, when each person you connected with last looked at you, the places marked for you or by you, with when you last arrived at or left each, and your join codes. Our lawful basis is your consent (Article 6(1)(a)), given when you turn Connections on and accept each connection, and withdrawn by stopping a connection or turning Connections off — which deletes your last position straight away. For an hour after you make a join code or type a wrong one, we keep that you did, even if you turn Connections off, so that codes cannot be guessed; our lawful basis for that hour is legitimate interests (Article 6(1)(f)), keeping other people’s codes safe.
The fourth is your position when you ask the community for routes near you (4.7), used to answer that one request: contract, because you asked for it.
The fifth is the usage statistics and the crash reports in section 5.1, which we do not hold in this version. When a later version does send them, our lawful basis will be your consent (Article 6(1)(a)), given by moving a switch that starts off and withdrawn by moving it back — withdrawing it costs you nothing and we will not ask why. Each event and report will carry no identifier for you and will be deleted on the schedule section 5.1 names, and section 5.1 says what we publish before that version reaches you.
When those two start, we will run both services on our own server: nothing will go to an analytics company, and we will be responsible for them as controller.
Your location history, your walks, your saved routes and your progress are personal data — and, because they say something about your physical activity, health-related data too. Where a walk carries a heart rate, or where the app has read something from your phone's health store, that is special-category health data under UK GDPR Article 9. We do not hold any of it. It is created on your device, used on your device and stored on your device, under your control. There is no copy of your walk history, your location history or anything from your health store on our side to disclose, to correct or to delete, and no third party we could have passed it to.
What reaches us is what you turned on, and section 4 says exactly what that is.
What can be on our side: if you turn Connections on, your last position, one point, never a trail, your phone’s notification token, the time of your last alert, when each person you connected with last looked at you, the places marked for you or by you, with when you last arrived at or left each, your join codes, and, for an hour, when you made a code or typed a wrong one (4.10); if you join the community, your account and what you choose to share (4.7); if you answer Yes to “Did you walk this route?”, the line of that one walk, used for the comparison and not kept; if you look for community routes near you, your position, used to answer that request. None of those carries anything from your health store. Usage events and crash reports would be here too once a later version sends them (section 5.1): they will carry no coordinates, no health figures and no identifier for you, and section 7.4 explains that we would usually be unable to find “yours”.
The backup copy is not ours. It is on your phone; we cannot read it, cannot delete it and do not know it exists.
Rules on storing information on your equipment (the Privacy and Electronic Communications Regulations in the UK, and their equivalents elsewhere) also apply to apps, not only to website cookies. Almost everything Walkabout stores on your phone — your walks, your settings, your downloaded maps — is strictly necessary to provide the service you explicitly asked for. So are your community sign-in and your Connections record, which exist only once you have asked for those features.
Two things are not strictly necessary: the usage-statistics switch and the crash-report switch (section 5.1). Both are off until you choose them, and in this version neither sends anything even when switched on. Choosing is a switch in Settings that you can move back at any moment, and refusing costs you nothing. That switch is how you give or withdraw your consent, so the app shows no consent banner. There is no advertising storage of any kind.
Health access is not strictly necessary either, and it does not rest on the operating system’s prompt alone: every kind of reading and writing has its own switch inside Walkabout, in Me → Health, all off until you switch them on. Turning one off stops the reading and the writing, so withdrawing is as easy as giving, in the app as well as in your phone’s settings, and the app links you to those settings.
You have the rights to access, rectification, erasure, restriction, objection and portability, and the right not to be subject to automated decision-making. Walkabout makes no automated decisions about you and does no profiling.
In practice: for everything on your phone, you exercise those rights directly — the data is in your hands, and uninstalling the app erases it. The export in the privacy screen is your portability right, working without asking anybody; if you have joined the community, it also asks our server for what you shared, and says so if it could not reach it.
Your community account, and what you shared under it. You can delete the account in the app, in Me → Community account. You choose what happens to what you shared: delete it, or keep it with your name removed — neither is chosen for you — and you are shown a certificate afterwards saying what was deleted, what was kept without your name, and what could not be recalled. Deleting the account also ends Connections on our side. If you no longer have the app, write to hello@walkabout.fit from the email address on the account, or tell us the title of a route you shared, and we will delete it. Deleting the app, or using Delete everything in Settings, does not delete your community account; Delete everything turns Connections off first and signs this phone out of the account.
For anything you have shared, three things are true. Anyone can read a shared route, with no account. Anyone can download it, and keep it. You can delete it, which removes our copy; it cannot take back copies people have already taken, and the licence it was shared under lets them keep and adapt what they took.
Removing your name from what you shared makes it pseudonymous, not anonymous, and under UK GDPR pseudonymous data is still personal data. Some records are kept after you leave — a report, and the record of what we did about it — so that an appeal can be answered. Section 7.7 says which, for how long, and why.
Connections: turning it off deletes your last position, your connections, your record of its terms, your notification token, the time of your last alert, when anybody last looked at you, the places marked for you or by you, and your join codes on our side straight away (4.10). A place is also deleted when either of you removes it, and when the connection ends; a join code when it is used, declined, cancelled or 24 hours pass. The record of when you made a code or typed a wrong one is kept for its hour, even after you turn Connections off, so that codes cannot be guessed. Signing out of the community turns Connections off first.
Usage events and crash reports (section 5.1) are not sent in this version. When a later version does send them, uninstalling the app will stop anything further being sent, though it will not reach back for what was already sent, and each event and report will be deleted on our side on the schedule section 5.1 names. To ask about anything we hold, or to ask for it to be deleted sooner, write to hello@walkabout.fit. These events and reports carry no identifier for you, so we would usually not be able to find "yours", and we will not ask you for extra personal data in order to try. Turning the switch off in Settings stops anything further being sent, at once.
The backup in section 5.1 is on your phone, and only you can delete it.
For the request data at our servers, write to the same address. Be aware that we usually cannot connect an IP address to a person, so we may not be able to find "your" records without more information than it would be sensible for you to give us — and we will not ask you for extra personal data just to run a search.
Nothing about you is transferred by us beyond what sections 4 and 5.1 describe. The community server, which holds your community account, what you share and Connections (4.7, 4.10), is in London, in Supabase’s UK region, and what it holds stays there, apart from what each Connections alert, each place notification and each look sends to Google’s push service (4.10): the receiving phone’s notification token, the kind of message and which connection it is about. Supabase acts for us under its data processing terms. Google’s push service runs on Google’s own servers, which may be outside the UK. Our router and our forecast server run on a server we rent in the European Union, which UK law recognises as protecting personal data to the same standard. Map packs are served through a content-delivery network, which means the request may be answered by a server outside the UK, whichever is nearest to you. That is a file being sent to you rather than data about you being sent abroad. The two services in section 5.1 are not running in this version; when they are, they will run on a server we operate in Europe, and nothing from them will be passed to anybody.
If you think we have handled your data badly, please tell us first at hello@walkabout.fit. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by phone on 0303 123 1113. If you are in the EU or EEA, you may complain to your own national supervisory authority.
Every period below is a deletion that runs on the server.
| What | How long | Why that long |
|---|---|---|
| Your last position, while Connections is on | Six hours after your phone last sent one; straight away when you turn Connections off, or when nobody is left who can see you | So the people you connected with can see where you were last if your phone goes quiet — and no longer. Section 4.10 |
| Your connections, their pauses, and the version of the Connections terms you accepted | Until either of you stops the connection, or you turn Connections off | They are what Connections is |
| A Connections invite | 24 hours, answered or not, then deleted | Long enough to be accepted, and no longer |
| Your phone’s notification token, while Connections is on | Until you turn Connections off, sign out of the community, delete your community account or use Delete everything; or until Google’s push service tells us it no longer reaches your phone | So that an alert can reach your phone. Section 4.10 |
| The time of the last alert your phone raised, while Connections is on | Until you turn Connections off, sign out of the community, delete your community account or use Delete everything | So that the same alert is not sent twice. Section 4.10 |
| When each person you connected with last looked at you | Two minutes, then until anybody next looks at somebody; at once when the connection ends, when you turn Connections off or delete your community account | So that one person’s looks within two minutes start one burst. Section 4.10 |
| A place marked for you or by you | Until either of you removes it; at once when the connection ends, when you turn Connections off or delete your community account | So that you can be told when someone arrives or leaves. Section 4.10 |
| The last place you arrived at or left, and when | Six hours at most, replaced by the next; at once when you stop sharing | So that the person who marked it can be told. Section 4.10 |
| When you arrived at or left a place while the person who marked it could not see you, for example during a pause | The time only, for six hours at most, replaced by the next | So that it is never told to them later. Section 4.10 |
| A join code you made | Until it is used, you cancel it or 24 hours pass; at once when you turn Connections off or delete your community account | So that the person you give it to can connect with you. Section 4.10 |
| When you made a join code or typed a wrong one | One hour | So that codes cannot be guessed. Section 4.10 |
| Your community account | Until you delete it | So what you share stays yours. Section 4.7 |
| A route you shared | Until you delete it, or delete your account | It is there for other people to walk |
| That you walked a shared route: the route, your account, the date and how closely it matched | Until you delete your account, or the route is deleted | It is part of what the community shows about a route |
| The line of a walk sent to be compared with a shared route | Not kept | It is compared with the route and dropped |
| Content removed after a report | 90 days, then deleted | Long enough for an appeal |
| A report of a problem on a route | Until its kind expires: 7 days for a flooded path, 14 for livestock, 30 for a fallen tree or a blocked path, 90 for lighting or terrain | Conditions change, and a stale warning is its own kind of wrong |
| A report about what somebody wrote | 90 days after it is dealt with | So a repeated pattern is visible and an appeal has a record |
| The record of a moderation decision | Two years; after 90 days it no longer says whose content it was | The record of a takedown has to outlive the content, or the decision cannot be explained or appealed |
| Community routes kept on your phone for reading with no signal | Your phone’s own limit; each shows how old it is | It is on your phone; deleting the app removes it |
| Anything kept after you ask to be erased | The same periods as above | These records are pseudonymous, not anonymous (section 7.4) |
| An anonymous usage event, if you switched statistics on | Not collected in this version | The service it would go to is not running, so no event exists to keep. Section 5.1 says what happens before that changes |
| A crash report, if you switched crash reports on | Not collected in this version | The same. Section 5.1 |
| Request records at the pack host, the router and the forecast server | None kept | All three are configured to keep no request logs. Sections 4 and 4.9 |
| A backup copy of your walk history | As long as you keep it | It is on your phone. We never had a copy to keep or to delete |
| Everything on your phone | As long as you keep the app | You hold it. Section 3 |
Walkabout is not aimed at children and is rated for ages 13 and over. The community is for people aged 13 and over: before an account is made you are asked your date of birth, which is checked on your phone and then forgotten — it is never stored and never sent. Connections is for adults, 18 and over, as its terms say. We do not knowingly hold personal data about anyone under 13.
Three kinds of organisation sit between us and you: the stores, the companies that run our servers for us, and services you choose to use with your own account.
Supabase, and Google when it delivers Connections alerts, act on our instructions, and what they hold is held for us. Signing in with Google, Apple or Microsoft, and contributing to OpenStreetMap, are services you send your own data to, under their policies; we do not instruct them.
Beyond those, Walkabout uses no third-party analytics or crash-reporting service, no data broker and no advertising network. The usage-statistics and crash-report services in section 5.1 are ours and, when they run, will run on our own server. Your health data is never shared with any of them.
An SOS, and a check-in timer that runs out, now reach the people you connected with as a fall does. When somebody you connected with opens your card or the map, your phone sends where you are every 20 seconds for two minutes, and our server keeps the time of that look for a short while. People you connected with can mark places for you; you can see and turn off each one, and the person who marked it is told when you arrive or leave. Two safety checks for Connections can be switched on in Settings: crash detection, and the fall check all day. Both are off until you switch them on. You can invite somebody with an eight-character join code as well as a link; you confirm before you are connected.
Connections is new (section 4.10). If you turn it on, your phone sends where you are, all the time, to the people you choose, and you see where they are. It is the one feature that asks to use your location all the time, and the one that reads your contacts — on your phone, when you accept an invite. Our server keeps one position for you, for at most six hours after your phone last sent it. An alert, such as a possible fall, can reach the people you connected with as a notification, through Google’s push service, even when Walkabout is closed; the message carries no position.
You can now join the community (section 4.7). The account is optional; your date of birth is asked and not kept; you can add an email address, or sign in with Google, Apple or Microsoft, and section 4.7 says what each of them sends us. You can share a route you walked, report a problem, block a walker, and say that you walked a route somebody shared.
Contributing a walk to OpenStreetMap can be switched on (section 4.6), and its sign-in token is kept in your phone’s keystore. Passive tracking shows your health store’s day figures on your phone and sends nothing (section 4.5). Driving routes, with sat-nav mode on, are asked of the same router as walking routes (section 4.9).
Corrected: the backup keeps its copy on your phone, and backing up to your own Google Drive or iCloud is not available yet (section 5.1); live walk-share is not switched on yet (section 4.3); sending a walk to Strava is switched off for good (section 4.6); and this website is more than two pages (section 11).
Sections 2, 3, 5, 6, 7, 8 and 9 were brought into line with all of the above, and section 7.7 now lists how long each thing on our server is kept.
Three optional switches were added, all off until you switch them on: anonymous usage statistics, crash reports and a backup of your walk history (sections 4.8, 5, 5.1 and 7.7). The statistics and crash reports send nothing until a later version, and section 5.1 says what we publish before then.
Section 5 describes the optional statistics and crash reports, in place of two lines that said the app had no analytics and no crash reporting.
Section 7.3 explains that the switches for those two are how you give consent, so the app shows no consent banner.
Walkabout became a paid app: free for thirty days, then a one-off unlock. Your trial and your purchase send nothing to us (section 5.3).
An optional fall check-in was added to Simple Mode (section 5.2). It writes a message to your emergency contact and waits for you to press send.
Route planning and the forecast moved to servers we run ourselves (section 4.9), from a public demo routing service and Open-Meteo’s public service. What is sent did not change.
Sections 3, 4.4 and 7.2 describe your phone’s health store, and section 7.2 names special-category health data. Walkabout’s storage was taken out of Android’s own phone backup, so a phone backup no longer carries your Walkabout history (section 3).
This policy describes the app as it is today. Some features we may add would change the answers — for example a map of where you went that keeps recording while the app is closed, or offering a photo for a route. If any of them ship, this policy will be updated and the change described before the release that contains them, and the Google Play data-safety declaration will be updated to match.
The current version and its date are at the top of this page. Material changes will be flagged in the app's release notes.
walkabout.fit is a few static pages. It sets no cookies, loads no fonts, scripts, images or anything else from other domains, and runs no analytics or tracking of any kind. Our host keeps standard web-server request records for security and abuse prevention, on the same terms as section 4.