We collect the email you sign up with, the profile you create, and the spots you save, like, or contribute. That's it.
We run no analytics SDK, no advertising SDK, and no cross-app tracking. We have never sold or rented your data and we won't. Your device location is used on your phone to centre the map and is never sent to us.
You can delete your account and the data attached to it from Settings inside the app, at any time, without asking us.
Offpath is an independent travel app and website that maps hidden and lesser-known places. It is operated from New York, USA. In this policy "Offpath", "we" and "us" mean the operator of the Offpath app and offpath.app.
For anything in this policy, write to offpathcontact@gmail.com. For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the information described below.
We do not use analytics SDKs, advertising identifiers such as the IDFA, ad networks, tracking cookies, fingerprinting, or any form of cross-app or cross-site tracking. This is why the app never shows you an App Tracking Transparency prompt: there is nothing to track.
By default, the app asks for location only at the moment you tap the locate button on the map. Your coordinates are used on your device to centre the map and draw your position. They are not transmitted to Offpath, not stored, and not shared. Decline the permission and every other part of the app still works.
Nearby spots is a separate, optional feature, off unless you switch it on in Settings. Turning it on asks for "Always Allow", because it needs to work while the app is closed. Your phone then watches a small number of circular areas around the places on the map and tells the app when you enter one, so it can notify you. That check happens entirely on your device: your position is never sent to Offpath, never stored on our servers, and never shared. The app only keeps a list of which areas it is watching and when it last notified you, and that list lives on your phone. Switch it off at any time in Settings, or in iOS Settings under Offpath.
Note that the map itself is rendered by Mapbox, whose mobile SDK collects its own anonymised usage and approximate location telemetry under Mapbox's privacy policy. That collection is Mapbox's, not ours, and we receive none of it.
Requested only when a contributor attaches an image to a spot. Only the specific images you pick leave your device. We do not browse, scan or index your photo library.
Entirely optional, and declining them costs you nothing else in the app. There are three kinds.
The weekly reminder and nearby spot alerts are created on your own device and never involve a server. Each has its own switch in Settings.
We may also send you a push notification: when your contributor request is answered, when someone likes a spot you added, or occasionally when there is news about the map, such as new spots. Those are delivered through Expo using the token described above. The first two have their own switches in Settings. To stop every notification, turn notifications off for Offpath in your device settings.
The iOS app bundle lists camera and microphone permission strings because they are included by default by the framework Offpath is built on. The app does not use your camera or your microphone, and iOS will therefore never prompt you for either.
Where UK or EU law applies, our lawful bases are performance of our contract with you for running your account, your consent for notifications and photo access, and our legitimate interest in moderating content and keeping the service secure.
Public: spots you contribute. Their name, description, category, coordinates and photos are visible to every Offpath user, may appear on offpath.app, and may appear inside map embeds on other websites. Each spot you contribute is credited to you as “Found by @username”, together with the one link you choose to add in Settings (Instagram, TikTok, YouTube or a website), if any. Your display name and bio are not shown. Photos are held in public storage, which means anyone who has a photo’s link can open it.
Private: everything else. Apart from that credit on spots you contribute, your profile, including your display name and bio, is readable only by you. Your saved list, visited list and likes are readable only by you. There are no public profiles, no follower lists and no leaderboards. Reports you file are visible only to us as moderators.
We share personal data only with the service providers that make the app work, and only to the extent they need it. We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication and photo storage | Your email, profile, activity, contributions and photos |
| Expo | Push notification delivery and app updates | Your push token and the notification text |
| Mapbox | Map rendering | Map requests, plus its own anonymised SDK telemetry |
| Apple | Sign in with Apple and App Store distribution | Your Apple sign-in, under Apple's own policy |
| Sign in with Google, if you choose it | Your Google sign-in, under Google's own policy |
We may also disclose information if we are legally required to, or where it is necessary to protect someone's safety or our rights.
Our providers store data on servers in the United States. If you are in the UK or the European Economic Area, this means your data is transferred outside your country. Those transfers rely on the Standard Contractual Clauses and equivalent safeguards operated by the providers listed above.
We keep your account data while your account exists. To close your account, choose Delete account in the app. This deletes your sign-in record and, with it, your profile, your username, and your saved and visited lists. It happens immediately and you do not need to ask us.
The same deletion also removes your likes, any report you filed, any stored push token and any contributor request. If you want to be certain nothing else tied to your account remains, email us after deleting and we will check.
Spots you contributed that are already published, and photos attached to them, may remain on the map after you leave, because other travellers depend on them. Once your account is deleted they are no longer credited to you. If you want a spot you added taken down as well, email us and we will remove it.
Residual copies may persist in encrypted backups for a short period before those backups age out.
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or export it. You can object to a particular use or withdraw consent at any time. Email offpathcontact@gmail.com and we will respond within 30 days.
If you are in the UK or the EEA, you also have the right to complain to your national data protection authority.
If you are a California resident, you have the right to know what we collect, to delete it, and to opt out of its sale. We do not sell personal information and never have, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.
Offpath is not directed at children. You must be at least 13 to create an account, and at least 16 if you are in the EEA or the UK. We do not knowingly collect data from anyone younger. If you believe a child has created an account, email us and we will delete it.
Data is encrypted in transit with TLS and encrypted at rest by our database provider. Access to your rows is enforced at the database level, so one account cannot read another's profile or saved spots even if the app were modified. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify affected users without undue delay if a breach ever puts your data at risk.
If we change this policy we will update the date at the top of the page. If a change materially affects how we handle your data, we will tell you in the app before it takes effect.
Questions, requests or complaints: offpathcontact@gmail.com.