Privacy policy

As of 23 October 2026

Adventures and invitations

When you start an adventure, we store its content, checked steps and start, update and completion times in your account. Checking a step is your own report, not GPS verification. Your device can keep encrypted offline copies of the last six opened adventures with progress. Companion invitations connect an adventure with the inviting account and, if accepted, the accepting account. Their links are valid for 14 days; expired invitations are deleted by the daily cleanup. Share an invitation link only with your intended companion. Public previews show none of your account or location data. Optional discovery notes, selected details and photos stay on your device and are removed on sign-out or account change. They are not part of the server export or cloud backup. You can export notes through the share menu. A memory card can include a photo you select, its title, date and public adventure link; notes and precise coordinates are excluded. Photos can contain visible location landmarks. The adventure and invitation records stored in your account provide the requested feature (Art. 6(1)(b) GDPR), are included in your export and are deleted with your account.

Usage and payment overview

For internal totals on usage and payment, we count existing task, session and adventure records. Starting an adventure can also store the general source of its link, such as “first-discovery” or a campaign name, without an advertising identifier. We keep an updated summary of the first and latest payment confirmed by Stripe, payments during the last 28 complete days after refunds, and the trial period and contract status. Granted access does not automatically count as a purchase. The purpose is to understand use of the service and its economics; the legal basis is our legitimate interest under Art. 6(1)(f) GDPR. You can object to this analysis by contacting privacy@glenby.de. It adds no advertising cookies, movement profiles or access to private messages. Account summaries are exportable and removed on account deletion; legally required payment records at the payment provider are unaffected.

Controller

The controller is Senorit (see legal notice), reachable at privacy@glenby.de.

Account

Glenby requires an account. The app cannot be used without signing in; there is no local-only mode. For this we process your email address and password. You send your password to our server over an encrypted connection when you sign in. We store it there only as a bcrypt hash, not in plain text. To restore your chat history we also keep a copy of your key encrypted with your password or your recovery code. While your password or code reaches our server, nothing technically stops us from opening that copy. We do not do so. Accounts created before version 0.56.0 are converted only once the conversion is switched on; that is not the case at the moment. Until the conversion, when you sign in with an older app version, and on the first sign-in on a newly installed device, your password may still be transmitted to our server (over an encrypted connection only, stored only as a bcrypt hash). This transition ends no later than 13 April 2027. If you sign in with Google, an identifier for your Google account takes the place of the password. The account also holds your display name, your friend code and your progress (XP, level, streak, completed tasks). To keep streak protection consistent across devices, we also store protection credits earned and spent, and protected days. These records are included in your data export. At sign-up we store, with a timestamp, your declaration that you are at least 18. Your date of birth stays on your device.

Username

If you choose a username we store it together with the time it was last changed and your setting for whether you want to be findable by it. With that setting off, nobody can find you by name. Previous names are kept only for as long as they stay reserved after a change, so that someone else cannot take one over immediately.

Profile details

If you fill in your profile we store your answers on pace, terrain, distance, experience and availability, your chosen avatar motif, your short intro and your answers to the profile prompts. They are used to suggest something you and a friend would both enjoy. All of it is optional and can be changed or cleared at any time.

My outing

When you use My outing, we store your current plan with its time budget, focus, selected tasks and visited stops in your account. It remains available after reinstalling the app or changing devices. Your device also holds an encrypted copy for offline reading. Changes are saved online. A new plan replaces the previous one; deleting your account deletes the saved plan. It is included in your data export.

Home region

So the app can tell when you are travelling, we store a coarse home region along with when you set or changed it. That is a region, not a precise place, and it is no substitute for continuous tracking.

Location

When you complete a task, your approximate location (GPS) is captured once as proof and stored with the completion. Outside live sharing there is no background tracking and no movement profile. If you share your location live, the app collects it for as long as the share runs and the app is open. The app sends it end to end encrypted to the friends you chose. Our server relays it and does not store it. A single location pin from a chat's attach menu is something you send yourself, as an end-to-end encrypted message.

Photos

Task photos stay local on your device. Whether a photo fits its task is checked by image-recognition models only on your device (general image labelling plus models for birds, insects and plants); nothing is transmitted or stored for this. If you share a photo with friends, it is first checked on-device for harmful content, stripped of location metadata (EXIF/GPS) and transmitted end-to-end encrypted. We store only the encrypted content and cannot read it.

Safe-return check-in

If you arm a safe-return check-in, we store until it expires: the time you chose, the contact you chose, and your last position, that position only end-to-end encrypted for that one person. We cannot read it. It is released to your contact only once the deadline has passed, never before. Checking in or cancelling deletes the record (within seven days at the latest; triggered check-ins after 30 days). The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. The feature is not an emergency service.

SOS, emergency card and impact detection

If you trigger SOS, your chosen contact receives the same end-to-end encrypted location report as an expired check-in, only immediately. We cannot read it, and nobody is called: the feature is not an emergency service and does not replace 112 or 911. Your emergency card (blood group, allergies, conditions, contacts) is health data under Art. 9 GDPR. It is stored encrypted on your device, is in no backup, and is deleted with the app. If you have card sharing switched on, it travels end-to-end encrypted with your position while a check-in is running. We cannot read it, and your contact can only open it once an alert fires. The legal basis is your explicit consent under Art. 9(2)(a) GDPR. Impact detection reads your device's motion sensors on the device only, only while a check-in is running, and only if you switched it on; sensor data never leaves your phone.

Subscriptions and payment

For paid plans, our payment provider Stripe handles the payment. We do not store full payment details, only the identifier needed to manage the contract and your plan status. If you buy in the Android app through the external payment link, we report the transaction to Google Play. We report the amount before tax, tax amount, currency, time, country, our own transaction identifier (derived from the invoice number) and the token Google Play issued for the purchase. This also applies to renewals and refunds. We do not report your name or email address.

Video calls

1:1 video calls are transmitted directly between devices (WebRTC, encrypted) and are not recorded. A relay service (Cloudflare) only brokers the connection.

Voice commands and voice notes as text

Voice commands ("Glen") are processed entirely on your device. Speech recognition is done by your Android system's offline recogniser (Google, Android 12 and later) or, where that is missing, by a local speech model inside the app; understanding the command is done by a small model inside the app. Neither the audio nor the recognised text nor the command leaves your device, and we store none of it. Only what you confirm on the device is carried out; a command that touches safe-return, SOS or your location always waits for your confirmation. The same local speech model turns voice notes into text on request (Glenby+). If the offline recogniser is missing or you request transcription, the app downloads a speech model (about 57 MB) once from Hugging Face, Inc. (USA), only after you agree; Hugging Face receives your IP address but no content or account data. In versions you install through Google Play, Google Play delivers the speech model as part of the app delivery (Play Asset Delivery); there is no separate consent dialog there and no download from Hugging Face. If your Android system fetches a language pack, that happens through Google's services under Google's terms. Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).

Offline routing

On Android, Glenby can calculate routes on your device. Your device contacts brouter.de only when you check download size, download path data or update it. This sends your IP address and the requested region (5 × 5 degrees), without account data or precise start and destination coordinates. Path data stays on your device until removed; it contains no personal routes. Routes using downloaded path data are calculated locally. If local routing is unavailable, online routing through our server may be used when connected. Map imagery is loaded separately through the map SDK.

Friends and notifications

For the friends feature we process your friend code and connections. If you pick a name or message colour, we store the chosen colour identifiers (no content) so your friends can display them. If you enable reminders while signed in, we store a device push token and deliver notifications via Firebase Cloud Messaging (Google). The notifications pass through Google's servers and, depending on their type, contain, for example, the display name of the sender, the conversation identifier, for calls the type of call, for safe-return the due time, for outing invitations the group code, and for chat messages the end-to-end-encrypted message (the encrypted envelope, not the plain text). If you set in the privacy settings who may call you, invite you to outings, see your profile photo or see your name on forwarded messages, we store the chosen level and your exceptions (the identifiers of the friends concerned) in your account so our server can enforce the rule. For the device list we store, per sign-in, the device name, platform, app version and the time of last activity, but no IP address and no location. Both are part of your data export.

Chats and messages

Messages, photos and voice notes in one-to-one chats are end-to-end encrypted. We cannot read them. The encrypted content and the related photo and voice files currently stay on our servers until the sender deletes their account (so messages you sent until you delete your account, messages you received until the other person deletes theirs); exceptions are view-once photos, which disappear when they expire, and reported messages (see below). Deletion by age is not running yet. We are introducing it. Once it is active: when all of your signed-in devices have safely stored a message, we delete our copy after 7 days at the latest. A message we cannot deliver, for example because your device has been offline for a long time, we delete 30 days after it reached us at the latest. The same applies to the related photo and voice files. We will announce the start of automatic deletion beforehand in the app and at senorit.app/glenby/privacy. For messages that were already with us before the start, a transition period of 60 days from the day we switched on the deletion replaces the 30 days. After that, your chat history exists only on your devices and, if you turn it on, in your own Google Drive backup. If you set up a new device or reinstall the app, older history can then only be restored from that backup. If you delete your account, we delete the messages and files you sent. If you delete a message for everyone, that removes it on the devices and from real-time delivery; our encrypted copy is not removed early by this, only by the deletion by age. Short-lived technical buffers: real-time delivery on our servers currently keeps messages for up to 30 days; we are shortening that to 3 days. Push notifications are gone at Google after 24 hours at most. If you report a message, we keep it until the report is closed, 30 days at the longest. Technical backups of our database expire after 30 days. Deleted content can remain there for up to 30 more days.

Disappearing messages

Optional, per chat: You and your contact can set a chat so that new messages are deleted after 24 hours, 7 days or 90 days. Deletion happens on devices running a current version of Glenby, not on our servers. On devices running an older version, messages stay. The content of the setting is end-to-end encrypted. We do see that and when an encrypted reaction or control message is sent, and we cannot tell it apart from an emoji reaction. On your device we remove expired messages from the database and overwrite the freed storage. We cannot promise complete forensic erasure. How long encrypted messages stay on our servers is described in the section "Chats and messages". This setting does not shorten it. A backup created earlier can still contain an expired message until the next backup. We cannot prevent your contact from taking a screenshot or a photo of the screen, or from copying or forwarding a message before it expires. The legal basis is Art. 6(1)(b) GDPR (providing the feature you chose). The short retention supports Art. 5(1)(e) GDPR.

Decrypted media on your device

We keep decrypted photos and voice notes in your device's app-private cache so they display quickly. There is no fixed retention period. When the cache exceeds a size limit, the app removes the files unused for the longest time. The app deletes them when you switch accounts, and Android removes them when you uninstall. Android backups do not include this storage.

Reports

When you report a single message, we store the report with the reason, category, your account and the reported account. Our team receives the content of the message only if you yourself attach it as evidence (at most 4,000 characters; the text for text messages, only basic details for photos and voice messages). Without evidence, we store no readable message content with the report. We do not automatically notify the reported person. For one-to-one chats we also keep the message in encrypted form, which we cannot read, until the report is closed, for 30 days at most, and then delete it. This also applies if the sender then deletes the message for everyone or a view-once photo expires. We keep the report and your evidence as a record: closed reports for up to 24 months after receipt, open ones until they are closed.

Data export

The data export contains your saved season-ring places, call diagnostic logs (latest 200) and your registered devices list. It also contains the reports you filed, with reason, category, status, timestamps and the evidence you attached. Under Settings > Your data you can also export your chats as a readable file (JSON). Your device builds it from the local history. The server holds only encrypted messages.

Message translation

On Android you can have single messages, or the latest messages of a chat, translated. Language detection and translation run entirely on your device (Google ML Kit, the "Language Identification" and "On-device Translation" features). The text of the message and the translation never leave your device; neither we nor Google receive them. The first time you use a language, your device downloads a language pack (about 30 MB) from Google, by default on Wi-Fi only, on mobile data only if you allow it or confirm it at that moment. As is technically unavoidable, Google receives your IP address and the identifier of the language pack. ML Kit itself also sends diagnostic and usage data to Google, encrypted: device data (manufacturer, model, Android version), package name and app version, performance values, event and error codes, an installation identifier, and the configured source and target language and the detected language. According to Google, it uses this data only for diagnostics and usage statistics and does not pass it to third parties. No message content or account data is included. Your settings for this (Translate button, languages you do not want translated, translate bar per chat) are stored with your other app settings in your account so they survive a reinstall; they contain no message content. Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).

Chat folders

If you create chat folders, we store each folder's name, its rule settings and the identifiers of the friends you picked in it together with your app settings in your account, so the folders are the same on all your devices. The folder names are not end-to-end encrypted there; no message content is included.

Chat backup in your own Google cloud

If you choose to, you can back up your chat history into a hidden app folder (appDataFolder) of your own Google account. The feature is off by default and only starts once you switch it on and grant Google access. We use solely the "drive.appdata" permission, which fits only this single folder created by Glenby: we have no access to your other Google Drive files and can neither see nor change them. The folder is invisible in the Drive interface and counts towards your Google account's storage, not ours. The backup is encrypted on your device before it is uploaded; the key is derived from your identity key. Google therefore stores nothing but an unreadable block of data, and we cannot open it either as long as no password or code reaches us. You are the controller for the copy stored in your Google account; you can delete the backup at any time in the settings. The legal basis is your consent (Art. 6(1)(a) GDPR).

Legal bases

Performance of contract (Art. 6(1)(b) GDPR) for the account, core features and paid contracts; consent (Art. 6(1)(a) GDPR) for push notifications, location features, severe weather warnings and the safe-return check-in including SOS; your explicit consent (Art. 9(2)(a) GDPR) for the health data in the emergency card, which is only ever transmitted end-to-end encrypted; legitimate interest (lit. f) to prevent abuse and fraud; and legal obligations (lit. c) for reporting and retention duties.

Processors

The database (Cloudflare D1) is hosted with Cloudflare with a Western Europe location hint and no read replicas in other regions; storage exclusively within the EU is not guaranteed. Cloudflare processes requests on its global network at the data centre nearest to you, and media (Cloudflare R2) is stored without an EU restriction; the contracting entity is Cloudflare, Inc. (USA), safeguarded by EU Standard Contractual Clauses. End-to-end-encrypted photos and voice notes are stored by Cloudflare as unreadable ciphertext; Cloudflare also delivers chat messages and brokers calls (TURN). Payments are handled by Stripe; push notifications run via Firebase Cloud Messaging (Google), maps via the Google Maps SDK, app integrity checks via Google Play Integrity. If you sign in with your Google account, Google (Google Sign-In) processes your email address, name and profile picture for authentication. Crash reports go to Firebase Crashlytics (Google), but only if you switch them on in settings (off by default); they carry the app version, device model, device state, the stack trace and a random installation ID, never messages, photos or voice notes. If you rate the app in the Play Store, Google itself displays the rating dialog; your stars and text go directly to Google and are neither collected nor stored by us. Your device requests weather data directly from the Norwegian Meteorological Institute (MET Norway, api.met.no), transmitting your IP address and a location rounded to two decimal places (about one kilometre). If you switch severe weather warnings on in the safety settings (off by default), your device additionally queries the national weather service responsible for your location when you open safe return: the Deutscher Wetterdienst (maps.dwd.de) in Germany, the National Weather Service (api.weather.gov) in the USA, MET Norway in Norway. That request likewise carries only your IP address and the rounded location (two decimal places, about one kilometre), never your identifier, your name or who you are checking in with. Place, online-route, place-info and species-sighting data (place data © OpenStreetMap contributors, ODbL; Overpass via the operators overpass-api.de (Germany) and overpass.private.coffee (Austria), openrouteservice/HeiGIT, Wikimedia; species records © GBIF.org and its listed data publishers, CC0 or CC BY only) is fetched by our server without passing on your identity; the offline transcription model is downloaded once from Hugging Face (no content data). Transactional e-mails are sent via Cloudflare Email Service (e-mail address, display name, message content). At sign-up our server checks whether the domain of your email address can receive email at all; for that it looks up only the part after the @ (not the full address) through DNS over HTTPS at Cloudflare (cloudflare-dns.com). Transfers to the USA rely on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses; Art. 28 GDPR processing agreements are in place with all processors.

Retention

We store account data until the account is deleted. Local data remains until you uninstall or reset within the app. Invoice and payment records are subject to statutory retention duties (Section 147 of the German Fiscal Code and Section 257 of the Commercial Code: eight years, counted from the end of the calendar year in which the document arose); the related billing record at our payment provider Stripe therefore survives account deletion for that period, while any active subscription is cancelled on deletion. We keep termination and withdrawal declarations for six years after receipt and then delete them. We also keep the report records for purchases made through the external payment link that we send to Google Play (amount, tax, time, country, transaction identifier, token) for tax and commercial-law reasons: when you delete your account we unlink them from your Stripe customer record, and we delete them nine years after the transaction. Diagnostic data about failed exports (app version, network status, error codes) and about chat-list performance (app version, device model, counts and timings, no content) is kept for 90 days and then deleted.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. You can export and delete your data directly in the app under “Your data”. You also have the right to lodge a complaint with a data protection authority.

Referrals

If you arrive through someone's invite link, we store who invited you and whether the referral has already been rewarded. That exists solely to grant the reward exactly once.

Automatic deletion

You can set your account to be deleted automatically after a period without signing in. For that we store the period you chose and, if we reminded you beforehand, when that was.

No advertising trackers

We use no advertising trackers and build no profiles for advertising. We also do not track you across other websites or apps.

Notice for users in the United States

Glenby is operated from Germany and follows the GDPR; we grant the rights described here to everyone, wherever they live. For California, additionally: we do not sell or share personal information within the meaning of the CCPA and receive nothing in return for it. We do not collect information about your activity on other websites or apps; because we do not carry out that kind of collection there is nothing for a browser “Do Not Track” signal to act on, and we allow no third party to carry it out through Glenby. You can review or delete your data yourself at any time in the app under “Your data”; questions go to privacy@glenby.de.

Changes to this policy

If anything in this policy changes we update the date above. The version in force is always here in the app and at senorit.app/glenby/privacy. The date tells you whether anything has moved since you last read it. We do not send a separate notification.