Footprints 1.3.1 Privacy Policy

Privacy Policy This policy explains the information processed by the Footprints iOS app and your rights. Footprints is operated by individual developer Shin Dongnyeok (the “Developer”). Footprints records are processed primarily on your device and are not transmitted to a separate server operated by the developer. However, if the user turns on iCloud backup, some records will be stored in Apple's CloudKit in accordance with Paragraph 5, and if anonymous usage analysis is selected, minimal app usage analysis information will be sent to Google Analytics for Firebase. 1. Operator and inquiries • Operator: Individual developer Shin Dongnyeok • Personal information manager: Shin Dongnyeok • Inquiry email: contact@nyeok.co • Public address: https://footprints.nyeok.co/us/legals/policy 2. Age requirement Footprints is for users aged 14 and up. 3. Information processed and purposes • Location and travel route: Excluded points classified by accurate latitude/longitude, time, accuracy, altitude, speed, direction of movement, and means of movement are used to create routes, calculate distances, maps/statistics, and check visited areas and badge progress. • Motion information: The type of walking, running, bicycle, vehicle, stopping, etc. found during recording and changes in the number of steps are used to distinguish between actual walking and transportation. It is not saved as a separate history or transmitted to iCloud. • Records and settings: Record identifier, date and start/end time, distance, score, completion/delete status, color, daily summary, visited administrative district/map cell, badge and map progress information, random installation identifier, and screen, backup, and notification settings are used for record inquiry, recovery, and function status display. • Walk Note (optional): The text attached to saved walks, the connection to the location selected by the user, and the creation/modification time are used to create, view, edit, and delete memories for each location. The saved Walk Note and place connection will first be saved to SQLite on your device, and the draft you are writing will only be temporarily saved on your device. • Photo visit, world map visit, and representative photo (optional): If the user selects to import photos and allows full access, domestic visit information and map cells are created with the photo date and location. The global scope of checking overseas photos will be processed only if you are informed separately and consent is obtained. An existing user's consent to import domestic photos does not automatically include the global scope, and will only be processed if the global scope is explicitly consented again and the import is initiated. The world map uses the national sub-level 1 administrative district (ADM1) as the unit of visit and representative photo in all countries, and the United States uses the 50 states and Washington D.C. Basic indexing does not store the original photo preview or raw coordinates; only one-way identifiers and derived visit units are stored on the device. The originals in the photo library (PhotoKit) will not be changed or deleted. When a representative photo is selected automatically or manually, the photo connection information and dot color value are encrypted with a device-specific key and the cropping range is also saved. Representative photos and colors are linked and applied only to the corresponding ADM1, and the original and preview files are not kept. • App Lock (optional): Use a 4-digit passcode and enable Face ID to restrict access on the device. Face ID authentication is performed by iOS, and the developer does not collect or store facial or biometric information. • Saved images (optional): When the user taps Save, the app creates a PNG on the device containing the state of a Badge map, neighborhood dot map, or World map; area names; visited areas or neighborhoods; and progress, then adds it to Photos. It does not include routes, raw coordinates, original photos, or recording identifiers. • iCloud Backup (optional): Undeleted records, exact routes and excluded transport points, saved Walk Notes and selected-place links, capture-time portable place evidence, and the portable Cloud identifier or one-way fingerprint, crop, dot palette, selected/cleared intent, pending payload, and user/source quarantine for representative photos explicitly chosen for L1/L2/L3 places are used for restore. Walk Note drafts, PhotoKit-derived photo-visit indexes and exclusions, PhotoKit local identifiers, originals and thumbnails, device realization state, and place-pack runtime state are excluded. • App usage analysis (Google Analytics for Firebase, optional): Random app instance identifier, app life cycle events such as first launch, session, and usage time, app/OS/device information, approximate region derived from masked IP, onboarding and permission results, screen exposure, recording start/completion/discard/auto-pause/auto-pause setting changes, widget commands, first recording creation, photo import start/completion, representative-photo saves, Walk Note open/save/delete, feature entry/completion, tab transitions, primary UI actions, sharing, iCloud backup settings, app lock settings, data migration outcomes, and 1.2.0 feature use are processed only when the user selects ‘Help improve Footprints’ after ‘Start’ in onboarding or turns on anonymous usage analysis in settings. Fixed codes are used for telemetry_schema, result, failure_reason, migration_phase, migration_target, schema_baseline, feature_action, feature_result, and feature_context; button text and continuous gestures such as scrolling and dragging are not collected. Exact location, travel route, Walk Note text, note/record identifier, place name/place code, photos and PhotoKit identifiers, passwords, account/user IDs, IDFA, and IDFV are not transmitted as analysis events. This selection is off by default and has no effect on the app's features. If you don't grant location permission or don't start recording, the app does not record a walking route. If you do not grant motion permission, records will be processed by location quality only. Photo import, world photo coverage, iCloud backup, photo album storage and app usage analysis will only be performed if you select each. Notification payload does not include Walk Note body, note/record identifier, place name/location code. 4. Storage location and retention period • On-device history, saved Walk Notes·selected location connections and settings are stored in SQLite or UserDefaults until the app data is deleted. If you delete an individual record, the associated Walk Note and location connection will also be deleted and excluded from the screen and future backups. Deleted history rows may not be physically removed from the current database immediately. • Walk Note drafts are only temporarily stored on your device to continue writing and are not included in iCloud personal backups. Saving a Walk Note removes its draft. Drafts belonging to deleted walks may also be cleaned up. • Motion information is used only to determine recording quality. The location points classified by motion information and the reason for classification may be recorded in the route record. • Photo visits, visit evidence derived from photos for the world map, import and exclusion settings, PhotoKit local identifiers, and the status of finding and displaying representative photos on each device are stored only in SQLite on the device. They are not included in private iCloud backups or restored. Raw world coordinates, original and preview photos, and raw PhotoKit identifiers are not stored. On a new installation, an onboarding choice that explicitly includes worldwide visits, or confirmation to enable Photo Sync, is saved as consent on this device for future automatic syncing. When sync is off, each manual import asks you to confirm the current scope again. Earlier consent for domestic photos does not automatically extend to worldwide visits. However, private backups include the iCloud identifiers or one-way fingerprints needed to find representative photos you directly selected for regions, areas, and neighborhoods within a country on another device, along with cropping settings, dot colors, and explicitly cleared selections. The original photos are not included. Route associations are backed up as place evidence captured when a record was saved, which can be restored on another device, rather than as photo-visit information. If you delete only a representative photo, its restorable selection information, device-specific photo references, and dot colors are deleted, but visits remain. The photo will not be automatically assigned again during later photo imports. In Settings, Delete photo visit history removes visits confirmed only through Photo Sync and the representative photos for those places. Representative photos for places also confirmed by recorded walks remain. Recorded walks, routes, Walk Notes, and original photos always remain. The photo-visit areas and one-way identifiers of related photos remain on the device as exclusion markers to prevent reimporting. You can allow imports again by removing the exclusions in Settings. • The App Lock passcode is stored in device-specific iOS Keychain, and the lock status is stored in UserDefaults, which is deleted when App Lock is turned off. • iCloud backups are stored in the user's private CloudKit database as the current backup and up to two previous backups. Saved Walk Notes and selected-place links, capture-time place evidence, and portable L1/L2/L3 representative-photo metadata, explicit cleared state, and pending restore payload are backed up with recordings and routes. Turning backup off does not automatically delete existing backups, and deleted data may remain until a later successful backup replaces the affected backup. • Saved images are not kept in the app database, UserDefaults or CloudKit. Images added to the photo album may remain until the user deletes them from the Photos app. • Temporary backup and restore files and photos for screen display are cleaned up after work or display is finished. • Firebase Analytics event/user level data sent after consent is set to be stored for 2 months in Google Analytics properties. They are deleted on a monthly basis after that period; standard aggregate reports may not be subject to this retention setting. If you turn off analysis in the settings, future collection will immediately stop and the device's analysis data will be reset, but data already transmitted may remain for the retention period or until separate deletion. 5. Third party provision, processing entrustment, and overseas processing The developer does not sell personal information. Google may process limited advertising data for eligible users as described in the advertising addendum below. Location history, motion data, photo-visit indexes, derived world-photo area codes, representative-photo originals, and saved images are not sent to a developer-operated server or Firebase Analytics. Portable representative-photo metadata is sent only to Apple CloudKit when the user enables private iCloud backup. When the user turns on iCloud backup, the information listed in Section 3 is transmitted to and stored in Apple's iCloud and CloudKit infrastructure. This includes saved Walk Notes and selected-place links, capture-time place evidence, and portable metadata and pending restore information for L1/L2/L3 representative photos that the user selected or explicitly cleared. It excludes Walk Note drafts, PhotoKit-derived photo-visit indexes and local identifiers, original and thumbnail image bytes, device-specific representative-photo realization state, and place-pack runtime state. • Service Provider: Apple Inc. and Apple's iCloud service provider • Purpose: Saving and restoring personal backups. • When and method: Turn on the backup function and transfer via encrypted network communication • Retention period: iCloud backup retention period in Paragraph 4 • Optional: You can use the on-device recording feature even if you do not use backup. The processing country and protection measures for CloudKit and iCloud photos depend on the user's Apple account, device settings, and Apple's current terms and privacy policy. Images added to the photo album can be synchronized to Apple services depending on the user's iCloud photo settings. If the user has turned on anonymous usage analysis, Google LLC and its affiliates and sub-processors will process the app usage analysis information under Section 3. • Purpose: Analyzing app usage status, feature use and return visits • Time/method: After the user turns on analysis, runs the app and transmits it via encrypted network communication when the corresponding action occurs. • Processing country: Countries where Google or its subprocessors operate facilities, such as the United States. • Retention period: Firebase Analytics retention period in Paragraph 4 • Restrictions: No use of advertising identifiers, IDFV, ad personalization, automatic screen reporting and tracking across other apps and websites. 6. User rights and how to exercise them Users can view/correct the text of Walk Note and the connection to the selected location in Map, or delete only Walk Note. If you delete only Walk Note, the corresponding record, route, and visit evidence will be maintained, but if you delete the record, the connected Walk Note and location connection will also be deleted. Users can delete records from the record details screen and delete representative photos or local visits taken from photos in Map. In ‘Photo Management’ in Settings, ‘Delete photo visit history’ removes visits created only by Photo Sync and their place representative photos. Representative photos for places with direct-walk evidence, recorded walks, routes, Walk Notes, and originals in your photo library remain. Deleted photo visit areas will be excluded from future photo imports and can be allowed again in ‘Manage photo import exclusions’ in Settings. This action does not delete the originals from your photo library. You can turn off app lock, iCloud backup and anonymous usage analysis in settings, and change photo access in iOS settings. If you withdraw consent for analytics, future collections will stop immediately, analytics data on your device will be reset, and other features of the app will remain available. To remove all SQLite and UserDefaults data and photo-visit information from this device, delete the Footprints app data. App Lock passcodes are deleted by turning off App Lock in Settings before deleting the app. Existing iCloud backups can be deleted from iOS's iCloud storage space management, and saved images can be deleted from the Photos app. Requests for viewing, correction, deletion, suspension of processing, withdrawal of consent, physical deletion of individual records, or Firebase Analytics data can be made to the personal information manager at contact@nyeok.co. Since account/user ID is not sent for analysis, it may be difficult to identify a specific user's server data, and we will inform you of the possible scope and processing results. 7. Safety assurance and automatic collection Footprints applies protection measures such as device-only Keychain, device-only encryption with reference to representative photo and dot color, Apple app sandbox and private CloudKit database, backup integrity check, encryption during transmission, temporary file cleaning, and prohibition of logging sensitive information. Walk Note body, note/record identifier, place name/location code are not included in the log, error description, Firebase Analytics, or notification payload. Firebase analytics uses Analytics Core without advertising-identifier support. Google Mobile Ads remains separate from Firebase analytics. Analytics collection is turned off by default and will only be turned on after you choose to do so. The app disables automatic screen reporting, IDFV, ad personalization, SKAdNetwork ad attribution registration, and on-device conversion measurement. It sends only the defined events and properties and does not send sensitive information. Firebase can automatically process app instance identifiers, app lifecycle/session information, app/OS/device information, approximate region, and SDK performance metadata while analytics are turned on. We do not track across other companies’ apps or websites. Non-personalized AdMob ads may use device or local-storage technology for frequency capping and aggregate reporting. 8. Changes in policy If the contents of this policy change, the changes and enforcement date will be disclosed in https://footprints.nyeok.co/us/legals/policy before implementation. If there are significant changes to the user's rights, we will notify you separately in a reasonable manner. Effective date: August 26, 2026 Local Profile and Regional Badge Addendum The Me tab uses a local profile with a random user ID generated by the app, a temporary username beginning with user_, and the regional badge you choose. This is not a login or public account. It does not create an email address, credentials, followers, or a user ID on a developer server. The app stores the user ID, username, username source, current-user status, creation and update times, and the selected badge’s country and broad-region codes in SQLite on your device. It also retains the existing user-profile-v1 compatibility data. That data may contain a region name, dot positions, visit states, display colors, progress counts, and a saved time. The Me screen instead loads current badge progress and representative-photo colors. The compatibility data contains no images, original or preview photos, PhotoKit identifiers, coordinates, routes, or recording IDs. When personal iCloud backup is enabled, private CloudKit backup v7 includes the current user’s ID, username, username source, timestamps, selected profile region identifier, and compatibility data. Older v2–v6 backups contain no local-profile entry and do not delete an existing local user when restored. Deleting the app removes the on-device profile but does not automatically delete an existing iCloud backup. The user ID, username, selected region codes, and badge state are not included in Firebase Analytics, ad requests, logs, notifications, or widgets. This addendum applies when version 1.3.0 is released. External Record Import and Visit Timeline Video Addendum The Google Timeline JSON file you select is analyzed only on your device. The current version stores explicit visits in a separate SQLite area. Stored fields are normalized WGS84 E6 coordinates, UTC times, dwell intervals, the file format, the import adapter, a digest for preventing duplicates, and the relationship between each visit and its first-level region on the world map (World L1). The original file, its name or path, and account credentials are not stored. Movement paths, waypoints, and summaries are not converted into walks or visits. Other file formats may be supported in the future, but the current import screen does not support them. You can delete all imported records in Settings under External Record Import. This removes only imported visits and their entries on the world map. Recorded walks, photo visits, Walk Notes, representative photos, and original photos remain. When iCloud Backup is enabled, imported visits and their relationship metadata are included in private CloudKit backup v6. The original file is not included. A visit timeline video created from the world map uses indexed photo visits and other visit evidence to position visits on the map’s canonical world dots. It renders the moving dot map and illuminated dots as a 1-minute, 30-second, or 15-second H.264 MP4 on your device, then saves it to Photos with your permission. The video does not include original photos, previews, PhotoKit identifiers, or raw coordinates. It does not reconstruct an actual GPS route or create a public link. Temporary video files are cleaned up after success, failure, or cancellation. A video saved to Photos may remain until you delete it in the Photos app. Addendum effective date: August 30, 2026 Advertising and Ad Removal Addendum Footprints requests non-personalized Google AdMob banner ads only when the Recording screen is idle, the App Store-signed build from the user’s original download is greater than 122, the current App Store storefront is Japan, the United States, or Taiwan, and no Remove Ads purchase has been verified. Mobile Ads is not initialized and no ad is requested for existing customers, users outside these three storefronts, purchasers, or users whose eligibility cannot be verified. No ads are requested while recording is active, paused, recovered, or stopping; while results or completion are shown; while a discard alert or another modal is open; or during navigation transitions. For an ad request, Google may process approximate location, app/OS/device information, app- or developer-scoped device IDs, product interaction, advertising data, performance data, and other diagnostic data. This information is used for ad delivery, frequency capping, abuse prevention, and aggregate analytics. These six declared data types are not linked to your identity or used to track you across other companies’ apps or websites. Footprints does not request App Tracking Transparency permission or use the advertising identifier (IDFA). Ad personalization and publisher first-party ID are disabled. Precise locations and routes, places, photos, Walk Notes, recording IDs, the app’s installation ID, and CloudKit information are not included in ad requests. When required by Google’s User Messaging Platform, you can reopen ad privacy choices in Settings. The optional Remove Ads purchase is a one-time, non-consumable purchase in the Japan, United States, and Taiwan storefronts. Apple StoreKit handles payments and transactions. Footprints reads only App Store-signed purchase entitlements and sends no payment information or receipt to a developer server. Firebase/GA4 is not linked to AdMob. Addendum effective date: August 24, 2026