Privacy Policy

This Privacy Policy explains what information the Global Friends iOS application ("the App") collects, how it is used, and the choices available to you. The App is published by Vagabonder ("we", "us", "our"), operating from Belgium.

The short version: we do not operate a server that stores your friend network. Friend data stays on your device and, optionally, in your own iCloud private database. If you explicitly opt in, the App sends limited product-usage analytics to our EU PostHog project. That analytics service receives a pseudonymous installation identifier, fixed event names and values, and limited technical metadata; it never receives names, contact contents, friend data, or location. We do not use advertising or cross-site tracking, and the App does not record sessions or use automatic event capture.

1. Data controller and contact

The data controller for any personal information processed by the App is Vagabonder, operating from Belgium. For privacy questions, requests, or complaints, contact [email protected].

2. What the App accesses on your device

Location (foreground and background)

With your permission, the App reads your device location to:

• Show you the distance from where you are to each friend's home on the map;
• Detect when you arrive somewhere a friend lives, so the App can send a local notification suggesting you reach out.

Location data is processed on your device. The App uses Apple's significant-location-change monitoring, which is energy-efficient and does not provide continuous tracking. Your location is not sent to Vagabonder or PostHog and is not broadcast to your friends. Apple system services may process location and geocoding requests under Apple's privacy policy. You can revoke location access at any time in Settings → Privacy & Security → Location Services on your device; the App will continue to work, but distance and arrival-notification features will be disabled.

Contacts

With your permission, the App can read entries from your Apple Contacts so you can quickly add friends without retyping their names, addresses, contact details, or photos. Only information you choose to add is copied into the App's friend database. If iCloud sync is available, that copied information may then sync through your private CloudKit database to your Apple devices. We do not receive a copy on any server we operate, and Contacts contents are not sent to PostHog. When linked Contacts change, the App can update the copied details while Contacts access remains available. Apple geocoding services may process city and country information to place imported addresses on the map. You can revoke Contacts access at any time in Settings → Privacy & Security → Contacts.

Optional product analytics

Product analytics is optional and is off until you choose Allow analytics in the App. The App works normally if you choose No thanks. Until you opt in, the analytics SDK is not initialized, no analytics identifier is created, and no analytics request or local analytics queue is made. You can change your choice at any time through the usage-analytics setting in Settings.

If you opt in, the App uses the SDK-generated pseudonymous installation identifier for analytics. It does not identify you by name, email address, Apple Account, CloudKit identity, advertising identifier, vendor identifier, or Contacts identifier. The App sends only this fixed event contract:

• app_opened;
• friend_added, with a source of manual, share_card, or contacts_import;
• contacts_import_completed, with bucketed new and updated counts (each 0, 1, 2-5, 6-20, or 21+);
• interaction_logged and globe_viewed;
• paywall_viewed and paywall_dismissed, with a trigger of settings, pin_styles, advanced_filters, export, onboarding, contacts_import, or friend_limit;
• capacity_review, with an outcome of viewed, reduced, upgrade, or confirmed; and
• purchase_started and purchase_completed, with the fixed plan value weekly, annual, or lifetime, and, when known, an offer value of introductory or standard.

Analytics events may include the event timestamp, app version and build, operating-system version, device category or model, the environment, and the analytics schema version. The App removes URLs, deep links, query strings, locale and time-zone values, arbitrary text, feature-flag payloads, receipts, transaction identifiers, and IP properties before sending an event. PostHog necessarily handles network IP addresses for request delivery and security; the App does not use that address as an event property or for geolocation, and EU hosting does not by itself eliminate every possible international transfer.

Analytics events are retained for up to one year in our EU PostHog project under the current Free plan. We will update this Policy before applying a different retention period. Turning analytics off stops new capture, opts the SDK out, and removes locally queued events. Events already transmitted cannot be recalled automatically; withdrawal does not delete server history. While analytics is enabled, Settings lets you copy the pseudonymous installation ID so we can locate an access or deletion request sent to [email protected]. After withdrawal, include any ID you saved with your request.

We do not record your screen, record sessions, or automatically capture screen views, taps, or crash reports. These features are disabled in the App.

Friend data you enter

You can add friends to the App along with details such as name, address or home city, relationship, notes, and recorded interactions. This information is stored:

• In your iCloud private database if you are signed into iCloud — synced across your Apple devices through Apple's CloudKit service;
• Locally on the device only (in SwiftData), if you are not signed into iCloud.

The private database is scoped to your Apple Account and its data is not visible to us in the CloudKit developer portal. Apple operates iCloud and processes the data under Apple's privacy and security terms. Deleting a friend in the App removes that entry locally and CloudKit propagates the deletion to your other synced devices.

Subscription and purchase information

Paid features ("Pro") are handled entirely by Apple through StoreKit. We do not see your payment method, billing address, or full transaction details. We receive only the minimum entitlement information needed to know whether your subscription is active, which is provided to the App by Apple. For details on how Apple processes payments, see Apple's privacy policy.

3. What product analytics does not collect

The optional analytics service does not receive:

• friend names, notes, relationship details, or interaction content;
• phone numbers, email addresses, social handles, or contact identifiers;
• contact entries, address-book size, photos, or exported files;
• friend addresses, coordinates, hometowns, or current location;
• search terms, URLs, deep-link values, query strings, or free text;
• payment methods, receipts, transaction identifiers, or revenue data;
• advertising identifiers, ad events, or cross-app tracking; or
• session recordings, screenshots, video, automatic screen views, or autocaptured interactions.

The App has no advertising network or analytics collection without consent. Any change to this collection boundary will be reflected in this Policy before it takes effect.

4. Where your data is stored

• On your device — in SwiftData, the local store managed by iOS;
• In your iCloud private database — managed by Apple, private to your Apple Account by default, and not visible to us through the CloudKit developer portal. The container identifier is iCloud.vagabonderapps.Global-Friends.

We do not maintain a copy of your friend network on any server we operate. Opted-in analytics events are stored in the EU PostHog project for the retention period described above. See PostHog's privacy policy for the provider's terms and practices.

5. Sharing

We do not sell, rent, lease, or share your friend network for advertising or marketing. If you opt in to product analytics, we share the limited event data described above with PostHog as our analytics service provider. Apple provides the device platform, iCloud sync, and App Store payment infrastructure and processes the data involved in those services in accordance with its own privacy policy.

Share My Card links and exports

If you use Share My Card, the App creates a link containing the name, home city, country when available, rounded home-city coordinates, and time-zone identifier that you chose to share. It does not include your friend network, notes, phone numbers, email addresses, social handles, or photos. When the recipient does not have the App, their browser reads the card locally from the part of the link after the # symbol. That fragment is not sent in the web request to Vagabonder. The link and card details may still appear in browser history and are visible to anyone who receives the link. Earlier links that put card details before the # symbol remain supported; their query parameters reach the website and may appear in hosting-provider logs. The website redirects these older links to fragment-based links before rendering the card. This does not remove the original request from infrastructure logs. The card fallback does not create or write a website session and disables caching and referrer transmission. Do not share information you want to keep private.

vCard and CSV exports are created locally and handed to the iOS share sheet. Any app or person you choose as a recipient may process the exported friend data under its own terms.

6. Your rights

If you are in the EEA, UK, or another jurisdiction with similar laws (including California under the CCPA/CPRA), you have rights over personal data we control. Because we do not store your friend data on our servers, most of these rights are exercised directly through your device:

• Access and portability: the App lets you export your friend list (vCard and CSV) from Settings;
• Deletion: delete friends inside the App, or uninstall the App to remove on-device data. Data in iCloud can additionally be removed at Settings → [your name] → iCloud → Manage Account Storage;
• Objection and restriction: revoke Location and Contacts permissions in iOS Settings, or turn off usage analytics in the App, at any time;
• Lodge a complaint: EU residents may complain to their national data-protection authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be).

For any other request, email [email protected] and we will respond within 30 days.

7. Legal bases (EEA / UK)

If you are in the EEA or UK, our legal bases for processing are:

• Performance of a contract for handling subscription entitlements;
• Your consent for accessing Location and Contacts (granted through iOS permission prompts; you can withdraw at any time);
• Your consent for optional product analytics (granted through the App's Allow analytics control; you can withdraw at any time in Settings);
• For friend data you choose to enter, the App acts as a tool under your control: the data remains on your device and in your private iCloud database, and is not available to us.

8. Children

The App is not directed at children under 16 in the EU or under 13 elsewhere. We do not knowingly process personal information from children below those ages. If you believe a child has provided us with personal data, contact us and we will help you remove it.

9. International transfers

Friend data is stored on your device or in Apple's iCloud private database. Opted-in analytics is sent to the EU PostHog project. PostHog and its infrastructure providers may process network data in other countries under their applicable transfer mechanisms; EU hosting does not guarantee that every processing activity remains in the EU. See PostHog's data-storage documentation for details. Apple processes iCloud data in the regions where it operates iCloud; see Apple's privacy policy for its data-residency information.

10. Retention

Friend and interaction data is retained for as long as you keep it in the App. Deleting the App removes on-device data; iCloud copies persist until you delete them through iCloud settings. We do not retain friend-network copies on our infrastructure. If you opt in, analytics events are retained in PostHog for up to one year under the current Free plan. Withdrawal stops future collection; you can request deletion of previously sent events using your analytics ID.

11. Changes to this Policy

We may update this Policy from time to time. The effective date at the top of this page reflects the most recent revision. Material changes will be announced through the App or on this page. Where a change requires your consent, we will ask for it. Continuing to use the App does not enable optional analytics.

12. Contact

For privacy questions, requests, or complaints, email [email protected].