Privacy policy

Who we are

Geovoya is run as a sole proprietorship in the United States, and is the “data controller” for the information described here.

• Business name: Geovoya (United States)
• Owner’s legal name: a sole proprietor trading as Geovoya (full legal name on request)
• Postal address: not published; request it at [email protected]
• Contact: [email protected]

The short version

• The desktop app has no telemetry and no analytics. It never reports your usage to us.
• We never collect your real location. Geovoya has no code that reads where your computer or your phone actually is. Every location it handles is one you chose.
• You can use Geovoya without an account. Then nothing of yours reaches us at all.
• An account holds your email address, the computers you sign in on and your subscription status. With Pro, cloud sync also stores the places and routes you save — including the places you’ve applied to a phone.
• Payments go through Stripe. We never see your card number.
• This website has no analytics, advertising or third-party scripts, and no tracking cookies.
• You can export your data, delete your cloud data and delete your account yourself, at any time.

1. The desktop app

What stays on your computer

Geovoya writes everything to a folder on your own computer (on Windows, %APPDATA%\Geovoya). None of it reaches us unless you sign in and cloud sync runs. That folder holds:

• settings.json — your saved places, recent places, preferences and setup choices.
• route-library.json — your route library, including route notes, and your play history.
• A per-phone record of each simulation session: the phone’s name, its serial number or UDID, the platform, how it was connected, and the last coordinates applied to it. This lets the app reconnect and restore a phone.It is never synced and never sent to us.
• Wi-Fi pairing records, so a phone can be reconnected without a cable.
• If you sign in: account.bin, holding your sign-in token and email, encrypted by your operating system (Windows DPAPI or the macOS Keychain). If your system offers no secure storage, it isn’t written to disk at all and you stay signed in only for that session.
• If cloud sync runs: sync-state.json (sync bookkeeping, and any edits still waiting to upload), and a copy of your synced records under sync-backups/ written before switching accounts replaces your local data.

Uninstalling the app and deleting that folder removes all of it.

What the app does not do

• No telemetry, analytics, crash reporting or usage tracking. None of that code exists in the app.
• No automatic update check. The app never contacts us to look for a new version.
• No reading of your real location. There is no geolocation code, and the app denies every location, camera and microphone permission outright. The map opens on a fixed default view, not on you.
• No reading of your phone’s true position. The app only checks that the phone accepted the location it just set.
• Geovoya doesn’t touch your contacts, messages, photos or any other personal content on your phone.
• Your Wi-Fi network names and passwords are not read.

Services the app contacts

These are run by other people, under their own privacy policies. Nothing about you comes back to us from them.

If you’d rather your searches didn’t go to a public server, point the app at your own Photon instance in Settings.

Your phone

On Android, Geovoya installs the Appium Settings helper app and makes it the mock-location app. On iPhone it uses Apple’s developer services through a bundled helper. These changes happen on your phone, not on our servers.

2. Your Geovoya account

An account is only needed for Pro. If you have one, Geovoya Cloud stores exactly the following. This is the complete list of fields, not a summary.

There is no field for your name, your country, your IP address at sign-up, or your browser. We simply don’t have them.

Server logs and IP addresses

Our server writes one line per request with the method, the path without the query string, the status and how long it took. It does not log IP addresses, email addresses or user-agents. Some lines record an account id next to an action — a sign-in, a deletion — so we can answer support questions and investigate abuse.

Your IP address is used for rate limiting, to stop someone hammering the sign-in form. It is held in memory only, for minutes up to about an hour, is never written to the database or to any log file, and is gone when the server restarts. Our hosting provider and CDN keep their own short-lived operational logs, which we don’t control.

3. Cloud sync (Pro)

Cloud sync keeps your library the same on every computer where you turn it on. It is off until you do: a computer that has not been switched on uploads nothing at all. Once on, it stores only these record types:

• Saved places — latitude, longitude and the label you gave them.
• Recent places — your twelve most recent locations and when you used them.These are the coordinates you actually applied to a phone, so if you use sync, a short history of the positions you simulated is stored on our server. If you don’t want that, don’t turn sync on (or turn it off again).
• Routes — name, collection, favourite flag, your notes, timestamps and the full route geometry.
• Play history — the ten most recent routes you played, and when.
• Shared preferences — speed, realistic movement, restore-on-quit, keyboard-shortcut choice, and your place-search server address.

Each record also carries a version, an ordering stamp, its size and the id of the computer that last wrote it.

Never synced: phone sessions and journals, phone names, serial numbers and UDIDs, live locations, connection modes, your computer and phone platform, onboarding state and your account token. The server refuses these outright.

Signed out, on the free plan, or on a computer where you never turned sync on, nothing syncs. When Pro ends, nothing is deleted: your computers can still download for 30 days, you can export at any time, and the data stays until you delete it.

4. Payments

Checkout and the billing portal are run by Stripe. Card details are entered on Stripe’s own pages and never reach our server — we have nowhere to put them. We send Stripe your email address and our internal account id when your customer record is created, and we get back your subscription status, plan, billing period and renewal date.

5. Email

We send email through Resend. In practice the only message we send is your sign-in link, so Resend sees your email address and that one-time link. Stripe sends receipts and payment-failure notices directly.

There is a “product emails” switch in Security settings. It is off unless you turn it on, and we store your choice — though we don’t currently run a product mailing list at all.

6. This website

geovoya.com loads no analytics, no advertising and no third-party scripts. Even the fonts are served from our own domain.

Cookies

Both are strictly necessary, are set only when you sign in, and are never used for tracking or advertising. There’s no cookie banner because there’s nothing to consent to.

Your browser also keeps two small values locally: gv.theme (light or dark) and gv.signedIn (a hint so a page knows whether to ask the server who you are). They stay in your browser and are never sent to us.

7. Who else handles your data

These are the only companies involved, and all of them are in the United States.

We don’t sell your data, share it for advertising, or hand it to data brokers. No such arrangement exists, and we’re not planning one.

8. Why we’re allowed to hold it

In plain language rather than legal citation:

• Because you asked for the service. Your email address, sessions, computers and synced records exist so the account and sync you signed up for can work. Without them there’s no product.
• Because we have to. Payment and subscription records are needed to take your money lawfully and to keep tax records.
• Because it keeps the service standing. Rate limiting by IP address and the minimal action logs protect the service and other users from abuse. We’ve kept both to the least we could manage.
• Because you said yes. Product emails, and only those. You can withdraw that at any time.

9. How long we keep things

An honest note about backups. When you delete something it leaves the live database immediately, but it can survive in those backups for up to 14 days — and in our host’s volume snapshots for up to 5 — before ageing out. We don’t mine backups; they exist so the service can be restored after a failure.

10. Your rights, and how to use them

Depending on where you live — under the GDPR, the UK GDPR, the CCPA/CPRA or similar laws — you have rights to access, correct, export and delete your data, and to object to how it’s used. We’ve made the important ones self-service, so you don’t have to ask us and wait:

• Export your data — Cloud data → Download. You get a JSON file of your synced places, recent places, routes, play history and preferences, along with your email address. Your plan, your computers and your session count are shown on the account pages themselves.
• Delete your cloud data — Cloud data → Delete cloud data. This immediately and permanently removes every synced record for your account, with no grace period. Your account and the data on your computers stay. One catch: a computer with sync still on will upload its copy again, so turn sync off on each computer first if you want the cloud to stay empty.
• Delete your account — Security → Delete account. This cancels any subscription immediately, signs out every computer, and deletes every row we hold for you in a single step. It is instant and cannot be undone. The app keeps working on the free plan with the data already on your computers.
• Correct your data — there’s very little to correct, but write to us and we’ll fix anything that’s wrong.

Two things deletion doesn’t reach: your Stripe customer record, which Stripe keeps under its own retention rules for financial and tax reasons, and the backups described above. Ask us and we’ll request the Stripe record be removed too.

We don’t charge for any of this, and we won’t ask you why.

11. Where your data lives

Everything is stored in the United States: our server and its database run in Ashburn, Virginia, and Stripe, Resend and Cloudflare are US companies. If you use Geovoya from outside the US — including the UK and the EEA — your data is transferred to and processed in the US. We rely on our processors’ standard contractual clauses for those transfers. There is no EU-hosted option today.

12. Children

Geovoya isn’t intended for children under 13, and we don’t knowingly collect their personal data. If you believe a child has created an account, tell us and we’ll delete it.

13. Security

All traffic is HTTPS. Sign-in links, session ids, device codes and app tokens are stored only as one-way hashes, never in a form we could read back. On your computer, your sign-in token is encrypted by your operating system. Secrets are compared in constant time, all input is validated, and the account API requires both a matching origin and a CSRF token on every change. As said above, synced content itself is not end-to-end encrypted. No system is perfect — if you find a problem, please tell us.

14. Changes to this policy

If we change it, we’ll update the date at the top. If a change materially affects what we collect or how we use it, we’ll email account holders before it takes effect.

15. Contact and complaints

Email [email protected] with any privacy question or request. We aim to reply within a few business days and to resolve requests within 30 days.

If you’re in the UK or the EEA and our answer doesn’t satisfy you, you can complain to your national data protection authority — in the UK, the Information Commissioner’s Office. We’d appreciate the chance to put it right first.

See also our terms of use and refund policy.