Privacy Policy

1. Summary

• Pathtale uses your location to let you share it with friends you choose and, if you turn it on, to build your Life History: places you visit, time with friends, trips, and recaps.
• We don't sell your personal information, share it for targeted advertising, or use your location or history for ads. We don't show ads based on your places or activity.
• You choose how long we keep your history, and you can delete it or export it at any time, on any plan.

2. Information we collect

Precise location is sensitive personal information. We use it only to provide the features you request.

Signing in. You can sign in with Apple, with a one-time code sent to your email, or with a one-time code sent by text message. You can also add an email address or phone number you don't sign in with, so you have a second way back in; adding one is optional, and we confirm it with a code first. We use your email address or phone number only to send sign-in codes and to identify your account, never for marketing unless you separately agree. Text messages are delivered by our SMS provider (§7), and your carrier's rates may apply. If you use Sign in with Apple, we store an encrypted Apple token only so we can disconnect Pathtale from your Apple ID when you delete your account.

Photos. You can add photos to a memory from your photo library (you pick each photo; we don't get access to the rest of your library) or take one with the camera, if you allow camera access. Before a photo leaves your device, Pathtale makes a new copy that removes its location and other hidden details (such as the camera model and the time it was taken) and reduces its size. Photos are stored privately with our hosting provider (§7). Only the people who can see that memory can see them, and access is checked each time a photo is opened; links to a photo work for a few minutes at most. We don't analyze the content of your photos.

Who sees your memories. Each memory has an audience you choose: Only me, Tagged friends (only the friends you tag), or Friends (all your current friends). The first time, nothing is preselected; after that we start with your last choice, which you can change for each memory. We check the audience every time someone opens your memory, so people you unfriend, block or untag lose access at once, and we never widen a memory's audience without you. Friends see the name of the place you added, never its location, and never the name of your Home or other private or sensitive places. Your friends feed is in time order; we don't rank it.

Reactions and comments. Everyone who can see a memory can see its reactions and comments, and who left them (except people they've blocked or who've blocked them). You can edit or delete your comments, and delete any comment on your own memories or turn comments off. An @mention only works for someone who can see the memory. To keep comments safe, we check new comments against a list of banned terms, and may refuse a comment or hold it for review.

Your profile. Every account has a username, which you choose when you set up Pathtale. A display name, a short bio and a profile photo are optional. Your photo is made into a new square copy on your device that removes its location and other hidden details before it's uploaded, and it's stored privately (§7). Your photo, name and bio are shown to you, your friends, and people you have a pending friend request with. If you choose to appear in search and suggestions, other signed-in members also see your photo, name and username there (never your bio). If either of you blocks the other, neither sees the other's profile. When you change or remove your photo, the old one is deleted. You can change everything in Settings > Profile. Others can report a profile photo, bio or name that breaks our Community Guidelines.

Setting up Pathtale. After you sign in, a short setup asks you about your profile, location and notification permissions, how long to keep your history, Life History, whether you appear in search and suggestions, and your app preferences, then offers a short tour. Nothing about your privacy is chosen for you in advance, saying "Not now" never stops you from using the app, and you can change every answer later in Settings.

Friends. You choose whether you appear when people search by name or username and in "People you may know". Nothing is chosen for you, and you can change it at any time in Settings > Who can find me. If you already let people find you by your exact username before this choice existed, you stay shown and we ask you to confirm, because search now also matches the start of names and usernames. Search needs at least two letters, is limited to prevent browsing everyone, and we don't keep what you type. Blocked people, people with a pending account deletion and anyone who hasn't passed the age check never appear. If you change your username, your old one is held for a while so no one else can take it straight away. If you decline a friend request, it's deleted and the sender isn't told. When you send a request you can choose what the other person will see if they accept (a location level, and drives if you already share drives); it starts at "Nothing yet". The person you asked sees that choice with your request. It's applied only when they accept and only as far as your settings still allow at that moment, and it's deleted when the request is accepted, declined or cancelled. After you accept someone, we ask what you want to share with them; "Decide later" shares nothing.

People you may know. We suggest people using only your friends (people your friends are friends with, and friends of friends who joined recently) and, if you checked your contacts, members found that way. We never use your location, places, history, hangouts or who you've been near to suggest anyone. Suggestions show the real reason, for example "Friends with Maya and 2 others". This means your name can appear to your friends as a mutual friend when we suggest someone else to them, and in search results they see. Only people who chose to appear in suggestions are suggested. You can remove a suggestion and we won't show that person again.

Finding friends from your contacts. This is optional and off unless you turn it on.

• Being found. You choose separately whether people who have your email address, or your phone number, can find you. Both are off until you turn them on, and only an email or number you've verified counts. If you signed in with Apple and hid your email, people can't find you by that address. While a choice is on, we keep only a scrambled code (a keyed hash) of that email or number, not the email or number itself. Turning it off, changing it, or deleting your account removes the code straight away.
• Finding others. If you tap "Find friends from contacts" and allow access, your iPhone reads the email addresses and phone numbers in your contacts and turns each one into a scrambled code before sending it. Names, photos and other details are never sent. We compare the codes once with the codes of people who chose to be findable, and then discard them. If a match also chose to appear in search, we remember only that you and they matched, for 30 days, to suggest them to you. We don't keep your contacts or build any list of people who don't use Pathtale, and we never contact anyone in your address book. You see only findable people who aren't already your friends and haven't blocked you (or been blocked by you); we see only how many codes you checked and when, to limit misuse. Someone who finds you sees your name and username, never your email or number.

Your invite link. In Me or Friends you can share a personal link (pathtale.app/i/ followed by a random code) or its QR code. The code doesn't contain your name, username or anything else about you, and the website that opens it doesn't look anyone up. When a signed-in member opens your link, the app shows them your name, username and, if they could already see it (you appear in search, or you're already connected), your photo, with a button to send you a friend request; a request is never sent, and nothing is shared, until they confirm, and you still choose whether to accept. People you've blocked, or who blocked you, only see that the link isn't active. If someone opens your link before they have an account, the code is kept only on their device, for up to 14 days, and shown after they sign up; we don't use device fingerprinting, the clipboard or any other way to follow someone from the website into the app. When a new account (up to 14 days old) opens a link or enters a code at sign-up, we record who invited them, once. You see only how many people joined from your link, never who. You can reset your link (the old one stops working) or turn it off at any time. Your link, the number of people who joined from it and who invited you are in your data download, and are deleted with your account; if either account is deleted, the record that one invited the other is deleted too. We limit how many links one account can open per hour to prevent people guessing codes.

Live sharing. Becoming friends doesn't share anything. For each friend you choose not sharing, precise, an approximate area (a few kilometres wide), or delayed by 1 to 24 hours. Near your home, work, and places you've marked private or sensitive, friends never see where you are. By default they see only that your location is hidden; you can instead show "At home" or "At a private place" with the time, or a much wider area. For as long as you pick (15 minutes up to until you resume), you can pause for one friend or for everyone (pausing for everyone also deletes your last shared location), or show a friend or everyone "At home" with no time, the spot you're at now while you move on (up to 24 hours), a location 15 to 60 minutes old, or only an approximate area. These never show more than you already share, and end on their own on our servers. A change applies the next time a friend's app checks, usually within 30 seconds. "Who can see me" lists everyone you share with. With your shared location your app also sends your phone's time zone (such as "Asia/Tokyo"), so a friend who can see that location, and is in a different time zone, sees your local time. They get the time zone of the location they're shown (the older or frozen one while you delay or stay at a spot), never while you're paused, hidden or shown "At home". We keep only the current and previous time zone with your last live location and delete them with it.

Sharing your places. Your saved places (Home, Work, School, Gym, a partner's place, or your own) are only yours unless you share one. For each place you can separately choose to let friends see a label such as "At Home" while you're there, and, with a second, separate consent, to show the place itself as a pin on their map, which tells them where it is. You choose all friends who see your precise location, or specific ones among them; no one else can be chosen. It stops as soon as you stop sharing your precise location with that friend, block or unfriend them, pause sharing for them or for everyone, move or delete the place, or withdraw either consent in Places. Private places and sensitive places can't be shared. Your visits, routines and home insights are never shared this way. Friends' places they shared with you aren't included in your data export.

Waves and quick pings. You can wave at a friend or send "Heading home?" or "On my way". There's no free text and no location in them. We keep who sent which one to whom, and when, for 30 days, then delete them. Only you know whether you've opened a wave; the sender is never told. You can turn off wave notifications in Settings. When you look at a friend who shares their precise location with you, your iPhone may ask Apple for the name of that place to show it; we don't receive or keep it.

Battery level. Off unless you turn it on. You choose which friends see it: turning it on in Settings includes your current friends, and you can turn it off for anyone on their page; new friends see it only if you choose them. Those friends, while they can see your location (precise or approximate, not delayed), see your battery percentage, rounded to 5%, and whether it's charging or in Low Power Mode. Turning it off in Settings stops it for everyone and forgets who you chose. We keep only the latest value, with no history. While your location is shared it is updated in the background too. If it hasn't updated for a while, friends see the last value with how old it is. It is deleted after 2 hours without an update, or at once when you turn it off, pause sharing, or stop sharing.

Drives and driving speed. Off unless you turn it on in Me › Privacy › Drives. If you do, your iPhone notices when you start and stop driving, using the location Pathtale already collects and, if you allow it, Motion & Fitness. Motion & Fitness is used only on your iPhone to tell a car from a bike or a train; we never receive your motion activity, only whether you allowed it. With Life History on, we keep a summary of each drive: when it started and ended, distance, duration, average and top speed, time moving, and whether you marked yourself as a passenger. For you alone, we also keep each drive's speed chart (your speed over the drive, in short intervals) and how long you spent in a few speed ranges. Unless you turn off Keep drive routes, we also keep a simplified route of the drive with the speed on each part of it, leaving off the first and last 150 m so the exact start and end, such as your home, aren't stored. Until the route is uploaded it waits encrypted on your iPhone (at most 72 hours). You can delete one route or all routes and keep the drives. Without a saved route, you can still see the route while your raw location detail is kept (§4), rebuilt from those points. Where a drive started and ended is shown as your own place name if you have one, otherwise "Near" a city, worked out each time you look, so if you mark a place private or delete a visit, older drives change too. On your route map, parts at or above a speed you choose are marked "Fast"; we have no speed-limit data, so this is not a judgement about the law.

If you turned on drives before speed charts and routes were added, your drives keep only their summary until you accept the updated terms in Me › Privacy › Drives.

Two further choices are separate and off by default, each with its own consent:

• Driving status and speed: friends you choose see that you're driving and your current speed (for example "Driving · 34 mph"). For this we keep only your latest speed, never a history; it stops showing after 2 minutes without an update and is deleted within 30 minutes, or at once when the drive ends. (Each drive's own speed stats, above, are kept for you only.)
• Drive reports: friends you choose see your drives and weekly and monthly totals. Home, work, private and sensitive places are shown to them only as "Private place". They see each drive's average and top speed, never its speed chart or route.

Either works only for friends who can currently see your precise or approximate location (not delayed), never while you're paused, and stops as soon as you stop sharing your location with them, block or unfriend them, pause sharing, or turn it off. Speed can be used against you. A friend could screenshot it or pass it on, for example to an insurer, an employer or in a court case. Speeds come from phone GPS and are estimates. We never sell drive data, never give it to insurers, data brokers or consumer reporting agencies, and never use it to score how you drive.

Flights and trip plans. With Life History on, we work out likely flights from the same location history (long gaps, high speeds and nearby airports) and show them in your timeline with the airports or cities, times and how sure we are. We don't collect anything extra for this, and we store airports and cities, not the points along the way. You can add plans (a flight, road trip, stay or something else, with times, airports or a place, a flight number and notes); we use them only to recognise your trips and flights. Plans are only for you: they are never shared with friends, even if you share your trips or location. A place you pick for a plan is kept only to about 1 km. You can edit a flight, mark it "Wasn't a flight", or delete a plan at any time; flights and plans are kept for as long as your Life History setting keeps history, are included in your data export, and are deleted with your Life History or your account. Airport names and positions come from OurAirports, a public reference dataset.

You and a friend. A friend's page shows memories you're both in that you can already see. If you both have Life History and "Detect time with friends" on, and you share your location with each other, it also shows a summary of the time you've spent together: when you last hung out and where, how often, total and longest time, weekly streaks, your usual day and time, and the places you spend the most time together. Only the two of you can see it. It is worked out each time from hangouts you both still keep; we don't store it separately. Home, work, private and sensitive places show only as "Private place", with no map pin, and we never show either of you the other's exact positions. It stops showing as soon as either of you pauses, uses Ghost Mode, stops sharing, blocks or unfriends the other. "Show hangout insights with friends" is on by default and you can turn it off in Privacy › Life History; turning it off hides it for both of you. Separately, "Include how far apart you usually are" is off unless you both turn it on; it shows a rounded typical distance between you over the last 30 days (for example "about 3 mi apart"), using only time after you both turned it on and never your private or sensitive places.

Notifications. If you allow notifications, we store a push token for your device (a code Apple gives your iPhone so notifications can reach it), whether it's a test or App Store build, an identifier for Pathtale on that device, the app version and your language setting. We use them only to send you the notifications you've chosen: waves and pings, friend requests, and activity on your memories. Apple's push notification service (APNs) delivers them, so Apple receives the token and the notification text (§7). The text is short, for example "Ben waved 👋", and never includes your location, a friend's location, places, comments or photos. In Settings you can choose to hide names on your lock screen ("New wave 👋" instead), turn off each type, or mute a person for a while or until you turn it back on; they aren't told. We also send some notifications that show nothing and only wake the app to refresh, for example to refresh your location in the background. We delete this device's token when you sign out or turn notifications off, as soon as Apple tells us it no longer works, or after 180 days without the app checking in. Records of notifications we sent are deleted 7 days later. Deleting your account removes all of it straight away. Your download includes your notification settings, the devices you've registered (without their tokens) and your mutes.

Fresh location when a friend looks. When a friend who already sees your precise or approximate location opens your pin or refreshes, the app may ask your phone, with one of those silent notifications, for one up-to-date location. Your phone sends it the same way it sends your location anyway, at the precision you chose for that friend. Nothing is shown to you, and it never happens while you're paused for that friend or everyone, sharing a delayed location with that friend, or at a place you've hidden. Requests are limited (at most once every 2 minutes per friend, and 12 an hour in total). We keep a record of who asked whom and when, with no location, for 24 hours. [When Apple approves it, your phone may answer through a small location extension even if the app is closed; it uses a random key for your device and updates only the location your friends already see.] Friends can also see how long you've been at your current spot ("Here since 3:40 PM") for up to 12 hours, unless the location is delayed or hidden.

Smart reminders. If you turn them on (they're off until you do, and need Life History), your iPhone looks at your own Life History to learn places you go regularly, like work on weekdays or church on Sundays, and sends you friendly reminders: a heads-up before you usually arrive, or the evening before an early plan. This happens on your iPhone; we don't work out or store your routines on our servers. The reminders are only for you and never go to anyone else. Places like a place of worship or a clinic are never named in a reminder unless you named the place yourself, and those reminders start off. If you hide names on your lock screen, no place is named. If you turn on Time to leave for a routine, your iPhone asks Apple Maps shortly before you usually head out how long the trip will take from where you are, so Apple receives your current location and the place's location for that request (§7). To wake your iPhone at the right moments, we keep a few times (to the minute) with your device's notification record, with no place or reason attached, and delete them 24 hours later. If you also turn on Use my calendar, your iPhone reads upcoming events on the device to adjust a reminder for an event at one of your routine places; nothing from your calendar is sent to us or stored. Turning Smart reminders off, turning Life History off or signing out deletes what your iPhone learned and the wake times we kept. Your download includes any wake times we still have.

Get home safe. When your iPhone notices you've been at a bar, pub or club for a while in the evening, it asks whether you'd like your friends told when you get home. It works this out on your iPhone by asking Apple Maps what places are near you (§7); we never learn that you were out, where, or at which place. It asks each night, and nothing happens unless you say yes that night. If you do, we keep a note that you asked, and which friends you picked, with no place or time of night, and when your iPhone sees you're back at the Home place you saved, each of those friends gets one notification: "<Name> got home safe 🏠". It is not an emergency or safety-monitoring service, and no one is told if you don't get home.

Check-ins. You can post "I'm at <Venue>" to friends you choose, with an optional photo and caption. The app may suggest it after you've been at a place for a while, but never posts on its own, and never suggests or allows your home, work, private places or places like hospitals or schools. We store the venue's name, type and its public map position (not your own location), and your friends get a notification that names the venue unless they hide names on their lock screen. Before you post, the app tells you if anyone in the audience normally can't see where you are (for example, you're hidden from them), so you can hide the check-in from them. A check-in is a memory and is kept and deleted like one.

Crossed paths. When you and someone become friends, you may each be asked whether you'd like to see if you crossed paths before you met. This is off unless you both say yes, and neither of you is told if the other says no. If you both say yes, our servers compare the visits in each of your Life Histories from before you became friends (only as far back as you both still keep Life History, at most [2 years], and not the last day before the friend request) to find times you were both at the same public place, like a restaurant, bar, park, stadium or airport, for at least [20 minutes]. We never use homes, workplaces, schools, hotels, health, religious or government places, other sensitive places, places either of you saved or named, or places we can't identify. Neither of you receives the other's history. You each choose which of the times found to share, and a time is shown to both of you only if you both chose it: the place's name, the date and a rough time of day, never exact times, routes or locations. We store the matches found (which of each person's visits overlapped, the place and the hour) and each person's answers and choices. You can turn it off in Settings or on a friend's page, which deletes your answers and the matches for both of you. Unfriending or blocking also deletes them.

Your devices. Your account can be signed in on one iPhone and one iPad. For each, we keep its name (which you can change), model (for example "iPhone 16 Pro"), iOS and app version, when it was added and last used, and a random code the app creates for that installation (not your phone's serial number or advertising identifier). Only one of them sends your location, and you choose which one; you can change it once a week. The other one shows your friends, history and settings but doesn't collect location. If you sign in on a new iPhone, you can move your account to it (you may be asked to confirm it's you); the old one is signed out. You can do this 3 times in 30 days, then contact us. We keep a record of device sign-ins, replacements and changes of location device, without any location, to enforce these limits and protect your account. You can see, rename and remove your devices in Settings. A signed-out device's details are deleted 90 days later and the record after a year; deleting your account removes all of it. Your download includes your devices and that record, without the installation codes.

Beta feedback. If we've invited you to test Pathtale, you can shake your phone (or use Me › Help) to send us a bug report, a feature idea or a design note. The app takes a screenshot of the screen you were on, including any menu or pop-up that was open, before the report form appears. That screenshot can show other people's information, such as friends' names, photos, places or messages. You see it before anything is sent and can draw on it, blur any part of it, or remove it; nothing is sent until you tap Send. With the report we include, unless you turn it off, technical details about your device and the app (app and iOS version, device model, language, light or dark mode, which screen you were on, network type, text size and similar settings, and the time), never your location. Only you and the Pathtale team can see your reports and screenshots, and we use them only to fix the problem or consider the idea. You can read our replies, answer them, and delete a report at any time in Me › Help › My reports. We delete reports, replies and screenshots [180 days] after we've resolved the report (or [2 years] after you sent it if we never do), and when you delete your account. Your download includes your reports and screenshots.

Reports. If you report someone, we record the reason you chose, where it happened, and any details you add. The person you report isn't told who reported them and can't see the report. We use reports to enforce our Community Guidelines. [Report retention period: TBD, LR-023]

When our team reviews an account. A small, named Trust & Safety team reviews reports. They sign in with two-step verification and can see what was reported, plus your profile, your account details (such as your email and when you joined), memories and comments you've shared with other people, and your report and enforcement history. They open an account only to review a report about it, or for a specific written reason such as a support request. That access expires after a few hours, and every view and action is logged under the staff member's name. Our team never sees your location, live location, places, visits, trips, time with friends, recaps, statistics, contacts, or memories only you can see, unless you've reported one of those memories or someone has reported it to us.

Enforcement records. If we warn you, remove something you posted, or suspend or ban your account, we record what we did, which rule it was under, and when. We don't keep a copy of removed content in that record. You can see your own record in the app. We keep these records for [period TBD, LR-127]. A suspended or banned account can still download its data and delete itself at any time.

3. How we use information

• To show your location to friends you choose, in the way you choose (precise, approximate, delayed, or not at all with Ghost Mode).
• To detect places and trips and build your Life History and recaps, if you turn them on.
• To detect time spent with friends, only when both of you have turned this on, you're friends and share your location with each other, and neither of you is paused for everyone or has paused history.

How we work out your places: our servers group your location points into visits. For other visits, your device looks up the name of the place with Apple Maps and tells us only which place it is (its name and type), not your location. Visits at your home, your work, places you've saved as private or custom, and sensitive places are never looked up, so their location is never sent to Apple. Your device keeps an encrypted copy of where your private places are so it can skip them, and if that copy is missing or out of date, it doesn't look anything up. Visits are automatic estimates and can be wrong. You can rename, change, merge, split, or delete any of them. We never decide where your home or work is; only you can set them. Your home, work, private places and sensitive places never appear in your top-places lists. Visits to sensitive places (such as health care or places of worship) are kept only in your own history and are never added to category statistics.

• To keep the service secure, prevent abuse, and enforce our Community Guidelines.
• To comply with law (see our Legal Request Policy).

We don't use location or Life History data for advertising, profiling, or inferring sensitive characteristics (such as health, religion, or politics) for any purpose other than features you explicitly turn on.

4. Your Life History and how long we keep it

We keep two kinds of location information, each with its own setting:

When raw location detail expires, we delete the GPS points but keep the Life History records your Life History setting covers. For example, we might keep "Visited Restaurant X on September 14, 7:48–9:13 PM" but not the GPS points.

Before they're uploaded, location points wait on your device in encrypted storage for at most 72 hours. They aren't included in your device backups, and they're removed from the device once we've received them.

If you shorten a setting, we show you what will be deleted and how it affects recaps before you confirm. Deleted history can't be recovered.

Other retention:

• Deleted data leaves our backups within 7 days.
• Records proving your privacy choices (consent and deletion logs) and which versions of the Terms and this Privacy Policy you agreed to are kept in pseudonymized form for [3 years] after account deletion.
• Security logs are kept for 90 days.
• Your email address or phone number is kept while you have an account and deleted with it.
• Your last live location is replaced by each new one. It comes only from the device you chose to send your location; the app sends a random code for that installation (not your phone's serial number or advertising identifier) so we can tell your devices apart. Friends never see it. It's kept in your device's keychain (not in backups) so the same device is recognised when you sign in again. On our servers it's kept with your device list (§2 "Your devices"). Your live location is deleted at once when you pause for everyone, and within 24 hours once it's no longer shared or updated. If you use delayed sharing, location points are kept long enough to show the delayed location (up to 24 hours plus a short window), within your raw location setting.
• Copies of your data that you download are deleted from our servers [7 days] after they're ready (§8).
• Suggestions are recalculated as your friends change and dropped when you stop using them. Contact matches we remember are deleted after 30 days, or at once if either of you stops being findable. Dismissed suggestions are kept until you delete your account. Counts of recent friend actions (used for rate limits) are kept for at most a day.
• Reactions and comments are kept as long as the memory, until you delete them, or until you delete your account. If you delete a comment that has replies, we remove its text and your name and show "Comment deleted" so the replies still make sense.
• When someone reports a comment, we keep a copy of the comment's text with the report for review for 90 days, even if the comment is deleted in the meantime, and then delete it.
• Drive summaries, speed charts and saved routes follow your Life History setting and are deleted with any Life History you delete (a day, a range or everything), or on their own (one drive or all drives). You can delete saved routes alone (one or all) and keep the drives. Your latest live driving speed is deleted within 30 minutes.
• A device's push token is kept until you sign out on it, turn notifications off, Apple tells us it no longer works, or [180 days] pass without the app checking in. Records of notifications we sent (who and what they were about, never their text) are deleted [7 days] after sending.
• A signed-out device's details are deleted [90 days] after it was signed out, and the record of device sign-ins, replacements and location-device changes after [1 year].
• Beta feedback reports, replies and screenshots are deleted [180 days] after the report is resolved, or [2 years] after it was sent if it's never resolved.
• Smart reminder wake times are deleted [24 hours] after each time, or at once when you turn Smart reminders or Life History off. Your learned routines stay only on your iPhone and are deleted when you turn the feature off or sign out.
• Get home safe records (that you asked and which friends you picked) are deleted [7 days] after that night. Check-ins are kept and deleted like your other memories.
• Crossed paths: times found that you didn't both choose to share are deleted [30 days] after they were found. Times you both shared are kept while both visits are still in your Life Histories, you both keep the feature on and you're still friends. The record that a friendship was offered crossed paths (when, and whether it ran; never a place) is kept [180 days] so it isn't offered again if you unfriend and re-friend.

5. Sharing

• With friends you choose: your live location per your sharing settings. Memories go only to the audience you pick for each one; time-together records go only to the people involved. Driving status, speed and drive reports go only to friends you choose for each (§2).
• What friends can tell: location may be approximate, delayed, or intentionally obscured based on the user's privacy settings. Do not rely on location sharing for emergencies or personal safety. Friends see a "Live" badge only on a precise location reported in real time; when you pause or hide, they aren't told which. Before you see friends' locations you agree to this notice; we keep a record of the version, when you agreed, the app version and a fingerprint of the text, include it in your data export, and delete it with your account like your other legal acceptances.
• Your private home insights are never shared with anyone.
• With service providers that process data on our behalf under contract (§7).
• For legal reasons under our Legal Request Policy. For location data, we require a warrant.
• We never sell personal information or share it for cross-context behavioral advertising.

6. When relationships change

• If you and a friend stop being friends, each of you keeps your own history. No new time together is recorded.
• If you block someone, you stop being friends, location sharing stops both ways, and they can't find you or send you requests. They can no longer see you in their history; you appear as "Someone". Unblocking doesn't restore the friendship or sharing.
• You can remove yourself from any shared memory or time-together record.
• If you're removed from a friend's memory, remove yourself, or either of you blocks the other, the photos you added to that memory are deleted. The friend keeps the memory and their own photos. You can report a memory that's shared with you.
• If you stop being friends or either of you blocks the other, you stop seeing each other's memories, and each other's reactions and comments are hidden from you. You can report a comment.
• If someone deletes their account, they appear as "Former member" in others' history, and their reactions and comments are deleted (a comment others replied to stays as "Comment deleted", without its text or their name).

7. Service providers

[To be completed. Current plan:]

None may use your data for their own purposes.

8. Your choices and rights

On every plan, at any time, in the app:

• See what's stored (Life History > Your Life History)
• Change retention
• Pause Life History
• Delete individual items, date ranges, or everything
• Download a copy of your data (Settings > Download my data; see "Downloading your data" below)
• Turn off location sharing or use Ghost Mode
• Withdraw any consent. When you turn off Life History or detecting time with friends, we stop right away and ask whether to keep or delete what's already there. Deleting your time with friends removes it from your history only; your friends keep their own history.
• Delete your account (Settings > Account > Delete account). Sharing stops and you're signed out right away; your account and data are permanently deleted after 7 days. To cancel, sign back in within those 7 days and choose "Keep my account". If you used Sign in with Apple, we disconnect Pathtale from your Apple ID when you ask to delete. Deleting your account doesn't cancel an App Store subscription; manage that in your Apple account settings.

Downloading your data. Settings > Download my data prepares a copy of what we keep about you. It's free on every plan. It includes your account details, your profile (username, name, bio and your current profile photo), your app preferences, which "What's new" items you've seen, settings (including how long we keep each kind of data and your sharing choices), your consent history, the versions of the Terms and this Privacy Policy you agreed to, your places (including Home and other private places), your visits, trips and time with friends, daily stats, your memories and the photos you added, the reactions and comments you left, comments friends left on your memories (with their name, unless they've since blocked you or deleted their account), your friends, sharing settings and the people you blocked, reports you made, your plan history, and a record of the deletions carried out (what kind and when, never the deleted content). Raw location points are included unless you switch them off when you ask. The copy is a ZIP file with machine-readable JSON files, a README and a readable summary, and your location points also come as a GPX file.

• Other people appear only by the name you can see in the app today. Anyone who deleted their account, blocked you or was removed appears without a name. We never include other people's locations, places, homes, memory notes or photos.
• Preparing it usually takes a few minutes. You can close the app while it's prepared.
• Downloading works only from your signed-in app. Each download link lasts a few minutes.
• Deletion. The copy is deleted from our servers [7 days] after it's ready, or sooner if you delete it, delete the data it contains, or delete your account.
• Confirming it's you. To keep your copy safe, we ask you to sign in again before downloading if your last sign-in was more than [15 minutes] ago. You use the sign-in you already have, and you never need a recent sign-in to ask for a copy or to delete one. [Window pending legal review: LR-025.]
• Limits. You can ask for [3] copies a day. [State-specific limits and response times: TBD, LR-024, LR-025.]

Depending on where you live, you may also have rights to know, access, correct, delete, port, limit use of sensitive personal information, and opt out of sale/sharing (we don't sell or share). We don't discriminate against you for exercising your rights. [State-specific sections TBD, LR-014.]

9. Age

Pathtale is only for people 18 and older.

10. Security

Encryption in transit and at rest, access controls, restricted employee access with logging, and short raw-location retention to limit exposure. Staff tools require two-step verification, give each role only the access it needs, and have no way to view location data.

11. Changes

Every version of this policy is kept, with a summary of what changed, in Settings > Legal. For a material change we tell you in the app what changed and ask you to agree to the new version before you keep using Pathtale; you can instead sign out or delete your account. Until you decide, background features keep working under the previous version for up to [30 days]. Minor changes (for example typos or clearer wording) are shown as a notice. Where the law requires it, we'll also ask for your consent again for the specific feature affected.

New features and updated explanations. When we add a setting after you set up Pathtale, we may list it once in "New in Pathtale" (at most once a day, and never switched on for you). If we update how we explain a feature you already turned on, you'll see it there as "Updated" with a link to review it; your choice stays as it was until you change it. [Pending legal review: LR-099, LR-100.]

12. Contact

[Legal entity, address, privacy contact email: TBD]