Privacy Policy

Strell is a map you grow by going outside. This policy says, in plain English, what the app keeps on your phone, what it sends and to whom, and how to get a copy of your data or delete it. It covers Strell for iPhone, including Strellows, the optional way to grow your map alongside people you know.

The short version

Your map, your outings and your stats stay on your phone. You don't need an account to use Strell.
Strellows is optional. If you sign in with Apple to use it, your Strellows see a card of how your places are growing: place names with how much of each you've grown in, your streak, today's plant and a few counts. They see it an hour later, dated by day. They never see your map, your routes or where you are.
To show water on the map, Strell asks our server about the map cells around you. Those requests carry no name, account or device ID, but they do show where you are to within about 100 m.
To show neighborhoods, Strell downloads a map of the area you're in, about 100 km across, from our server, and keeps it on your phone. The request names only that area, not where you are in it.
Mapbox draws the map. We have turned off Mapbox's telemetry.
If you choose "Report a problem", that report is sent to us with its location, a random ID and your note.
Crash reports go to Sentry, with the locations, map cells, account IDs and invite codes Strell finds in them taken out.
Share cards, pictures of your map, are made on your phone and go only where you send them. They leave out your home area unless you turn that off.
We don't sell your data, show ads, or track you across other companies' apps and websites.

What stays on your phone

Everything you make in Strell is stored only on your phone, whether or not you sign in:

Your map. The map cells you have grown in, each with when it was first grown in, how you were travelling (walking, biking or driving), how close your path came, and whether you explored it or imported it.
Your outings. For each outing you save: when it started and ended, the map cell it started in, the distance, the new cells, the places that grew and the milestones you earned. Strell keeps your last 1,000 outings.
Your stats. Ground covered, streaks and milestones.
Imported routes. GPX and Google Timeline files are read on your phone. The files are not uploaded.
Your settings, saved offline map areas, and a copy of each report you sent. If you set a home area for share cards, it is one of your settings. If you use Strellows, the places you've hidden from your card and your coin balance are settings too.
Counts for testing. How many share cards you've previewed and shared, when Strell first opened and when it last asked for a rating. They are shown only in a developer screen and never sent.

Strell uses your phone's location to grow the map: while the app is open, and while an outing you started is running, also when the phone is locked. Your positions are used on the phone and are not sent anywhere except as described below. Neighborhood names come from neighborhood maps kept on your phone (some built into the app, others downloaded the first time you're in an area; see below), so your position is not sent anywhere to look them up. Strellows never receive your positions.

What leaves your phone

1. Map-cell lookups (our server). Strell divides the world into hexagonal cells about 130 metres across (the H3 grid). To show water correctly, it reads cached water and land data for the cells around you from our database, which is hosted by Supabase. Each lookup sends the IDs of up to about 1,261 cells, a patch about 5 km across centred on you, in batches of 100. The request leaves out cells near places you've already explored and cells already known to be land. These requests only read data: nothing is written, and no name, account or device ID is sent. Because the patch is centred on you, the cell IDs show where you are to within about 100 m.

2. Water reads (our server). When your area isn't saved on your phone yet, Strell downloads the water cells in a box a few degrees across around you (at most about 6 degrees of latitude by 4 of longitude, roughly 650 by 330 km). Only the edges of the box are sent, and the box is centred on the nearest half degree (about 55 km) rather than on you, so it shows only roughly where you are.

3. Neighborhood maps (our server). Strell divides the world into about 41,000 large hexagons, each about 100 km across. The first time you are in one that isn't on your phone yet, Strell downloads that hexagon's neighborhood map from our storage at Supabase, and again when an updated map of that hexagon is published. When you're on Wi-Fi, it also downloads the six hexagons around it, whatever part of the hexagon you're in. The request names only the hexagon: no position, cell, name, account or device ID. It shows roughly which part of the world you're in, to within about 100 km, and if you travel, which of these large areas you pass through. Maps are kept on your phone until you clear them in Settings or delete the app. Strell also checks for updated maps about once a day; that request contains nothing about where you are.

4. Correction reports (our server, only when you choose "Report a problem"). If you long-press the map and send a report, Strell sends: the cell and its precise latitude and longitude, the kind of problem, the neighborhood name shown there, your suggested name or note if you typed one, and a random ID that the app made on your phone. That ID is not your name, your Apple ID or an advertising ID, nothing else is sent with it, and it isn't linked to a Strellows account. We use reports to fix the map.

5. Mapbox (map tiles). The map is drawn by Mapbox. Your phone downloads map tiles, the map style and fonts from Mapbox for the area on screen and for any offline areas you save, so Mapbox can see which part of the map you're viewing. We have turned off Mapbox's telemetry, the usage and location events its software can send. Mapbox's software still sends Mapbox a count of active map users for billing, with a random ID it creates and your device model and system version. See Mapbox's privacy policy at https://www.mapbox.com/legal/privacy.

6. Crash reports (Sentry). When Strell crashes, or hits an error it recovers from, it sends a report to Sentry: what went wrong and where in the code, the app and system versions, the device model, and a short list of what the app did just before. For some sessions it also sends how long the app took to start and to draw its screens. Before a report leaves your phone, Strell takes out latitudes, longitudes and map-cell IDs it finds, and Mapbox keys, and attaches no user. It also takes out account IDs and invite codes it finds, and signing in doesn't attach your account to crash reports. Network requests, screenshots and screen recordings are not recorded, and Sentry is set not to store IP addresses. A crash in native code (Strell's iOS or Android code, or Mapbox's) is reported by Sentry's software directly, and Sentry also sends session counts (how many app sessions ended normally); both may carry a random installation ID that Sentry's software creates on your phone. It isn't your name, Apple ID or an advertising ID. Sentry keeps session counts only as totals, and we have set Sentry to remove the ID from the crash reports it stores. Crash reports are kept for up to 90 days.

7. Strellows (our server, only if you sign in). Your account, your profile and your Strellow card, and the invites, requests, waves, blocks and reports you make. The next section says exactly what that is, who sees it and how long we keep it.

Like any internet service, our server and Mapbox see your phone's IP address when it connects. We don't use it to identify you, and it is kept only in short-lived server logs.

Our service providers are Supabase (our database provider, which also runs Strellows accounts), Mapbox (maps) and Sentry (crash reports). They process this data for us and may do so in the United States and other countries. If you sign in, Apple handles Sign in with Apple under its own privacy policy.

Strellows lets you add people you know, so you can see how each other's places are growing. It's optional: the map, outings, the Field guide, share cards and Export my map all work without an account. Strell offers sign-in only in Strellows. Strellows is for ages 13 and up.

Signing in

Strellows uses Sign in with Apple, and nothing else. Apple gives us an identifier for your Apple Account that is used only by Strell's developer. Strell asks Apple for your name but not your email address. If Apple shares your first name, Strell suggests it as your Strellows name; it stays on your phone unless you save it as your name. Our database provider keeps your account with that identifier, an account ID, and when the account was made and last signed in.

What we keep for your account

Your name and badge. The name your Strellows see, up to 20 characters, which you choose. It is checked against a list of words that aren't allowed. Your initials are made from it. Your badge is drawn by the app from parts in Strell's catalog (a mark, two colours, a pattern and a frame), so we keep only which parts you've equipped, and which parts you've unlocked with coins.
Your Strellow card, and the highlights made from it (below).
Your Strellows, the requests you've sent and received, the invite codes you've made (and, for a QR code, who scanned it), and the people you've blocked.
Waves you send and receive: who waved at whom, the highlight it was for if any, the sender's local date, and when it was sent and seen.
Reports you make about a Strellow's name: who you reported, the reason you picked (the name, impersonation or something else), the name as it was, and when. There is no text box.
Rate-limit records: which action (for example, entering a code or sending a wave) and when, so we can limit how often each can be done.

There is no chat, no messages, no photos and no free text between people. The only thing you write is your name.

Your Strellow card: what your Strellows see

Your card is made on your phone and sent to our server after you save an outing, the first time you open Strell each day, and when you change your name, your badge or what Strellows see. Our server checks every value and stores only these:

your name, initials and badge
your places, up to 24: each place's name and how much of it you've grown in at each Level, and whether it's new today or yesterday
how many of your places are in bloom
the Level milestones you've earned
your streak in days, and today's plant (sprout, seedling, sapling or in bloom)
your new ground this week, your ground in all, and how many outings you've saved
the card's date

A place is a neighborhood or other area from Strell's neighborhood maps. Outside them, a place can be a "Meadow": a broad area code, covering about 5 km², never a precise location. Place names and area codes do show roughly where you spend time, so you can hide any of them (below).

Highlights are short lines our server makes by comparing your new card with your last one, such as "Sam grew Lincoln Park to 50%" or "Sam is on a 7-day streak". They use fixed wording and can only say what your card says.

An hour later, and dates only. Your Strellows see your card, and its highlights, at least 1 hour after it changes, so it never shows that you've just finished an outing. The card and highlights carry only a date, never a time of day. (Our server notes when each card arrives, to apply the delay; Strellows don't see that time.) Your Strellows' app may keep showing a card it already has for up to 15 minutes before it checks again.

Never shared with Strellows: your map or any map cells, your position, routes, where an outing started or ended, the time of day, how you were travelling, distances, outing times and lengths, imported routes, saved offline areas, your coin balance, the random ID on correction reports, and your home area.

Waves are the one thing that isn't delayed: a wave reaches your Strellow straight away, so a Strellow who has Strell open can tell you're using it at about that time. You can send one wave to each Strellow a day.

Who sees what

Your Strellows see your name, badge, card and highlights, and the waves you send them.
Someone you give a code to sees your name, initials and badge when they enter it, and sends you a request. They become your Strellow only if you accept. "Not now" is silent: they are never told no.
A QR code you show makes you Strellows with whoever scans it, straight away. It works once and lasts 10 minutes.
People you remove or block aren't told. Someone you block can't send you requests or waves.
Nobody else. There is no search, no public profile, no leaderboard, no contact upload and no "people near you".
Us. We review reports, usually within 48 hours, and can reset a reported name to "Strellow".

In Strellows › What Strellows see:

Switch off any place and it is never sent. As soon as your phone sends the change, the place is removed from every card we hold, and highlights about it are deleted.
Show place names off sends no places at all, only how many are in bloom.
Pause sharing deletes your card and highlights from our server. Your Strellows see you as "Resting", and no new card is sent until you turn it off.

Signing out (Settings › Account › Sign out) keeps your map on your phone. Your last card stays visible to your Strellows, with its date, until you sign in again and it changes, or you pause sharing or delete your account.

How long we keep it

Your account, name, badge, Strellows, blocks and unlocked badge parts: until you change or remove them, or delete your account.
Your card: only the card your Strellows see and any newer ones, about an hour's worth. Older cards are deleted as new ones arrive, so no history of your card is kept. Pausing sharing deletes them all.
Highlights: your Strellows see those from the last 14 days. They are kept while your account exists and deleted with it. Pausing sharing deletes all of them, and hiding a place deletes the ones about it.
Waves: shown for the last 14 days. They are kept while both your accounts exist, and deleted when either of you deletes theirs.
Requests: deleted when they're accepted, or when either of you blocks the other. A request that was answered "Not now", or that expired after 14 days, stops working but is kept until one of your accounts is deleted.
Invite codes: a typed code works for 14 days and a QR code for 10 minutes. After that they stop working, but they are kept until you delete your account.
Rate-limit records: deleted once their window (an hour or a day) has passed and that limit is next checked, or when you delete your account.
Reports: kept after we've reviewed them, with no set end date yet. A report is deleted if the person it's about deletes their account. If you delete yours, reports you made are kept with nothing linking them to you.

We'll add automatic clean-up of old highlights, waves, expired requests, codes and reviewed reports, and update this policy when we do.

What we don't do

We don't sell or rent your data, or share it with data brokers.
We don't show ads.
We don't track you across other companies' apps or websites, and Strell has no advertising identifier.
We don't use analytics tools. Crash reports are the only diagnostics we collect.
We never show your position, map or routes to your Strellows or anyone else.

Get a copy of your map: Export my map

Settings › Your data › Export my map makes a file of your whole map and opens the share sheet, so you can save it to Files or send it wherever you like. The file is GeoJSON, a standard map format. It holds every cell on your map, with its outline, when it was first grown in, whether you explored or imported it, how you were travelling and how close your path came, and also your outing history and stats. The file is made on your phone. Strell doesn't upload it; where it goes is up to you.

When you tap Share on an outing's summary, in the Field guide or on a neighborhood milestone, Strell draws a picture of your map on your phone. No map service is asked for it and nothing is uploaded to make it. The picture is sent only where you choose in the share sheet, and only if you choose. The image file holds no coordinates, map labels, dates or location data (it's always called strell-card.png), but the picture does show the shape of the places you've explored and the neighborhood or city name, and an outing card also shows the outing's date, so anyone you send it to can see roughly where you explore and when. Strell deletes its copy of the file once the share is done. Share cards are separate from your Strellow card: sharing one doesn't send it to your Strellows.

Hide my home area is on unless you turn it off (Settings › Your data, or the switch on each card). It leaves at least 300 m around your home off the card. The hidden area isn't centred on your home and is larger than it needs to be, but a card of the area around your home can still suggest roughly where you live. Keep Hide my home area on, or don't share cards of your home neighborhood, if that matters to you. Strell works out your home on your phone from where most of your outings start (and, until a few outings have started from the same place, also from where your map began, including an imported history), or you can set it under Settings › Home area. The share preview shows the area it assumes as a dashed circle, which is never part of the card. Your home area never leaves your phone.

Rating prompt. Strell may ask you to rate it, after an outing or a share and at most once every 90 days, using Apple's rating prompt. Apple handles the prompt and your rating; Strell doesn't learn whether or how you rated.

Delete your data

Delete account (Settings › Account › Delete account) deletes your Strellows account. You confirm with Apple first. Then we ask Apple to revoke Strell's Sign in with Apple access, and delete from our database at once your account, name, badge, unlocked badge parts, card, highlights, Strellows, requests, invite codes, blocks, waves and rate-limit records. Reports others made about you are deleted too. Reports you made are kept for review, with nothing linking them to you. Your map stays on your phone, and Export my map still works. You can also stop using Sign in with Apple with Strell in your Apple Account settings. If the app can't delete your account, email support@strell.app and we will.
Reset map (at the bottom of Settings) clears the map you explored on this phone. Imported routes, outings and stats stay.
Deleting the app deletes everything Strell stored on your phone: the map, imported routes, outings, stats and settings. It doesn't delete a Strellows account: use Delete account first.
Correction reports you sent are on our server. Email privacy@strell.app and tell us roughly when and where you sent them, and we will delete them within 30 days.
Map-cell lookups, water reads and neighborhood map downloads are not stored with anything that identifies you, so there is nothing of yours to delete there.

Deleted data can stay for a short time in our server logs and in the copies our database provider keeps for recovering from failures, until those are replaced.

Children's privacy

Strell is not directed to children under 13, and we don't knowingly collect personal information from them. Strellows is for ages 13 and up. Strell doesn't ask for your age or birthday, and without an account the app asks for no names or contact details. If you think a child under 13 has a Strellows account or has sent us a report, email privacy@strell.app and we will delete it.

Changes to this policy

When this policy changes, we will post the new version on this page with a new effective date, and mention the change in the App Store release notes of the version it applies to. We won't start sending a new kind of data until this policy says so.

Contact

Questions or requests about your data: privacy@strell.app. Help with the app, or with Strellows: support@strell.app.

Strell Privacy Policy