Privacy Policy

Last updated July 30, 2026

The short version: Cologra has no accounts, and nothing about your runs is sent to us. Your runs — routes, times, fitness data, treasures — are stored on your phone and nowhere else, unless you explicitly turn on cloud backup to your own storage.

We do now run one server: a map-tile service. It exists so the app can stop asking a public map API for data around your exact position. It never receives your route, your times, or anything about your run — only which map squares to send. That is spelled out below, because a privacy page that says “no servers” while one exists is worth less than one that explains the server.

The rest of this page is that promise spelled out.

What the app collects, and where it stays

• Location. Used during runs to track your route, place treasures on nearby paths, and guide you back to your start. Processed on your phone. Your route is never transmitted to us. Fetching map data does reveal roughly where you are, at about one-kilometre resolution — see below.
• Motion & fitness. Step cadence from your phone's pedometer, and heart rate if you connect a Bluetooth sensor. Used on-device for coaching and your fitness model.
• Run history, fitness profile, treasures. Stored in a local database on your phone. Deleting the app deletes all of it.

The only network traffic

• Map data. To place treasures on real walkable paths, the app downloads pre-built map tiles from our tile service at tiles.walktiles.xyz. The world is divided into a fixed grid of roughly one-kilometre squares, and the app asks for a block of squares around the square you are in — never around your exact position. Everyone standing anywhere in the same square asks for exactly the same thing, so the request cannot narrow you down within it. The request carries no account, name, or identifier — Cologra has no such thing to send. Like any web request it does reveal your IP address, which is how the internet works and not something an app can avoid. The CDN in front of the tile service (Cloudflare) may keep standard access logs — an IP address and which map squares were requested — for a short period, the way any web server does. We are confirming the exact retention setting and will state it here when we have.
• Map data, fallback. If a square has not been built yet, the app falls back to OpenStreetMap's public Overpass API. That request asks for an area, and the area it asks for is derived from which one-kilometre square you are in — never from where you are inside it. Everyone anywhere in the same square sends a byte-for-byte identical request, so repeated queries as you run cannot be joined into a track. We are steadily building tiles to shrink this fallback further. If you download an area for offline use in Settings, no map requests happen during your runs there at all.
• Voice packs. If you install one of the neural voices, the app downloads the language pack you chose — a file of about 61 MB — from the same map-tile server described above (tiles.walktiles.xyz), so there is still only one server of ours in the picture. This happens only when you tap download, never on its own. The server sees your IP address and which language's pack you fetched — nothing about you or your runs, because the request carries nothing else. (Older versions of the app, before August 2026, fetched these packs from our GitHub releases instead.)
• Purchases. If you buy the app, payment happens inside Apple's or Google's own billing on your phone, under their privacy policies. We never see your card, your name, or your address — the store only tells the app that the purchase happened.
• Place search. When you type a place to download maps for, that text is sent to your phone's built-in place lookup — Apple's on iPhone, Google's on Android — which answers over the network. It is not a service of ours: the request carries no API key of ours, is not attributed to Cologra, and is handled under your phone maker's privacy policy. Nothing is sent unless you search.

One more, for completeness: the notification library we use on Android ships Google's Firebase Cloud Messaging code inside it. Cologra only ever schedules reminders locally and never asks for a push token, and the app carries no Firebase configuration — so no registration happens and nothing is sent to Google. Our build now goes further: it strips Firebase's entries from the app manifest, and code shrinking removes the unused classes from the shipped app, so what you install carries neither the configuration nor the code. We would rather state that plainly than have someone find the library in our dependency list and assume the worst.

That is the complete list. The app contains no advertising SDKs, no trackers, and — as currently shipped — sends no analytics of any kind. If a future version adds anonymous usage statistics, this policy will say so first, and the app will include a switch to turn them off.

Cloud backup — off by default

Settings → Backup offers an optional cloud backup. It is off by default and only turns on after you agree to a dialog explaining exactly what it does: one file, containing your runs (including route maps), copied to storage you control — your iCloud Drive on iPhone, or a folder you choose on Android (a Google Drive folder works). We never receive it and cannot read it. Apple's or Google's handling of your storage is governed by their privacy policies. Turn it off anytime; the file remains in your storage until you delete it. Manual "Export backup" works the same way — the file goes wherever you send it, and to no one else.

With cloud backup off, Cologra also opts its data out of automatic device backups — on Android today; on iPhone, once the App Store build ships — so "off" means off.

Siri

If you ask Siri about your runs or control a run by voice, your question and the spoken answer pass through Apple's Siri on your device, governed by Apple's privacy policy — the same as any app you use with Siri. Cologra hands Siri only the sentence it speaks; nothing is sent to us, because there is still no us to send it to.

Health app sync — off by default

If you enable it, finished runs are written to Apple Health or Health Connect on your device. That data then lives in your health store under Apple's or Google's rules and your control. Cologra only writes; it does not read your health records.

Deleting your data

Delete the app and everything it stored on the phone is gone. If you used cloud backup or exports, delete those files from your own storage — we couldn't delete them for you even if asked, because we never had them.

Your rights

Privacy laws like the GDPR and the CCPA give you rights to access, export, and delete your data. Here, you exercise them yourself: export everything from Settings → Backup, and delete everything by deleting the app (and any backup files you made — those sit in your storage, not ours). We can't hand over or erase what we never received. For anything beyond that — a question, a complaint, something this page doesn't cover — email support@vortas.io and a human will answer.

Children

Cologra is not directed at children under 13 and collects no personal information from anyone.

Changes & contact

If this policy changes, the date above changes with it, and material changes will be called out in the app's release notes. Cologra is made by Vortas. Questions: support@vortas.io.