Legal

Privacy Policy

Strollie · last updated 4 October 2026

Strollie works without an account, and most of it never touches a server at all. The atlas — every building, architect and movement, and the search index over them — ships inside the app, so browsing, searching and filtering happen on your device. There is no advertising, no analytics, no tracking, and no third-party SDK of any kind in the app.

If you choose to sign in, a small amount of data is stored on our server so that your saved lists appear on your other devices. This policy says exactly what that is, how long it is kept, and how to delete it. You can use the whole atlas without ever signing in, and nothing in the app is hidden behind a sign-in prompt.

What stays on your device

The building, architect, and movement data ships inside the app itself. The following is written to your device only, and is never uploaded unless you sign in and ask for it to sync:

• Buildings you save or mark as visited.
• Lists and tours you create.
• Your filter and map preferences.
• A temporary cache of photographs and descriptions you have viewed.

Deleting the app removes all of it. You can clear the photo cache at any time from About → Storage → Clear cached photos.

If you sign in

Sign in with Apple is the only way to sign in. There is no password to create, no email-and-password form, and no sign-in through Google, Facebook or anyone else. We never see an Apple ID password, and there is no password of ours for anyone to steal or reuse.

When you sign in, Apple sends the app a signed identity token. The app passes it to our server, which verifies Apple's signature before trusting anything in it. After that, these are the only things we store about you:

• An identifier from Apple. Apple issues a stable identifier for your Apple ID, specific to this developer account, called the sub. It is the primary key of your account on our server and the only identity we trust — we never accept an identifier the app merely claims. It is not your Apple ID, not your name, and not usable to look you up anywhere else.
• An email address, only if Apple gives us one. Apple sends an address only on your first sign-in, and only if you allow it. If you choose Hide My Email, what arrives is an Apple private relay address rather than your real one, and that is all we ever hold. The field is optional: your account works perfectly well with it empty, nothing looks you up by it, and we send no mail to it. We do not use it to contact you, market to you, or match you against anything.
• An encrypted token from Apple, kept for one specific purpose. Apple's rules for Sign in with Apple require that when you delete your account, we tell Apple to revoke this app's access to your Apple ID. The only way to do that is to call Apple's /auth/revoke endpoint with a token Apple issued at sign-in, so we store that token, encrypted, for as long as your account exists. It is stored so that deletion can be complete, and it is used for nothing else.
• Your lists and tours. A tour is a title you typed, an order you chose, and the public Wikidata identifiers of the buildings in it — nothing more. They are stored against your account so that a second device can see them.

We store no password, because there is none. We store no payment information, because the app is free and sells nothing. We store no location, no advertising identifier, and no record of what you searched for or looked at. There is one device-specific value involved in signing in — an App Attest key identifier — and the next section says exactly what it is, why it exists, and why it is not part of your account.

Tours are private by default. The only other setting is a shared link, which you choose per tour; there is no public setting, no directory, no feed and no way for anyone to browse other people's tours. Nothing you create is shown to another person unless you send them a link yourself.

Checking that the app is the real app

Signing in is the one thing a stranger could usefully automate — creating accounts in bulk, or hammering the sign-in route — so those two requests, and only those two, carry a proof that they came from a genuine, unmodified copy of Strollie on a real Apple device. The proof is Apple's App Attest. Nothing else in the app uses it: browsing, searching, the map, your lists and every other request do not.

Here is what that involves, in order.

• The first time you tap Sign in with Apple, the app asks the Secure Enclave — the separate security chip in your device — to create a key that only that chip can use. The private half of the key never leaves the chip, and not even the app can read it.
• iOS asks Apple to certify that the key came from genuine hardware running this app. This happens once per installation, and it is handled by iOS talking to Apple, under Apple's own privacy policy.
• The app sends us the key's identifier and the certificate, and we check Apple's signature chain. Each later sign-in sends the identifier again, with a one-time signature over that exact request.

That key identifier is the only device-specific thing we receive, and we treat it as narrowly as it can be treated:

• We do not keep the identifier itself. We store a one-way keyed hash of it, so we can recognise the same installation again without holding the value and without any way to read it back out.
• It is not attached to your account. The table it lives in has no account column and no link to your account row — not an omission, a decision: a record of which device belongs to which account is a different and more revealing thing to hold than a list of keys that passed a check, and we do not want it. Nothing joins the two.
• It is never logged. No log line contains the identifier, the hash, or the challenge.
• It is specific to Strollie. Apple scopes an App Attest key to a single app, so this value is meaningless to anyone else, matches nothing in any other app, and cannot be used to recognise you anywhere but here. It is not an advertising identifier and it is not your device's serial number — neither of those is something we ever see.
• It does not survive the app. The key is created on your device and Apple invalidates it when the app is reinstalled, the device is migrated, or the device is restored from a backup; the app then starts over with a new one.

Apple's privacy label calls this a Device ID, and that is how it is declared: a Device ID used for app functionality, not linked to your identity, and not used for tracking. If you never sign in, none of this ever happens — no key is created and nothing is sent.

Staying signed in

Being signed in means your device holds a session token. It is a long random value with no personal information in it, and on your device it is kept in the iOS Keychain rather than in ordinary app storage.

Our server does not keep a copy of that token. It stores only a one-way hash of it, in Cloudflare Workers KV, alongside the account it belongs to and an expiry time — so even we cannot read your session token back out, and a copy of that store would not be a set of usable sessions.

Sessions are short-lived and are renewed as you use the app: one expires on its own an hour after it was last used, and no chain of renewals lasts longer than thirty days before you sign in again. Signing out deletes the session on the server immediately rather than merely forgetting it on your device.

How long we keep things

• Your account, your email relay address if we have one, your lists and your tours are kept for as long as your account exists, and are deleted when you delete it.
• The encrypted Apple token is kept for as long as your account exists, because deletion needs it, and is destroyed with the account.
• Sessions expire by themselves and are removed when they do, or sooner if you sign out.
• The hashed App Attest key record is kept for as long as that installation of the app keeps using the key, and we do not expire it on a timer — a key that passed the check once goes on working, and deleting the row would simply force your device to do the whole check again. The row is a hash, a public key, a counter and two timestamps; there is no name, no account and no way to work backwards from it to a person. It is not deleted when you delete your account, and that is a consequence of the design rather than an exception to it: nothing links the row to your account, so there is nothing for the deletion to find. If you want it gone, deleting the app invalidates the key itself at Apple's end, which leaves the row inert.
• The one-time challenges used by sign-in and attestation are deleted as soon as they are used, and in any case expire within hours.
• Nothing is kept as a backup copy of a deleted account, and nothing is archived for analytics, because there is no analytics.

If you never sign in, there is nothing on our server about you to keep.

Deleting your account

You can delete your account from inside the app, under Settings → Account → Delete Account. It takes effect immediately, it deletes rather than deactivates, and you do not have to email anyone to ask for it.

Deleting your account:

• Removes your account row, including the Apple identifier, the email relay address if one was stored, and the encrypted Apple token.
• Removes every list and tour you own, and every building in them, from our database.
• Ends every session, on every device, by deleting them from the session store.
• Tells Apple to revoke this app's access to your Apple ID, by calling Apple's Sign in with Apple /auth/revoke endpoint. After that, Strollie no longer appears as an app you have used Sign in with Apple with.

If that last step cannot be completed — Apple unreachable, or no usable token to present — your data is deleted anyway: we do not make deletion conditional on a third party being available. The app then tells you how to finish it yourself, in iOS Settings → your name → Sign in with Apple → Strollie → Stop Using Apple Account.

Lists and tours that are also saved on your own device stay on your device, because they are yours and we are not in a position to reach them. Delete them in the app, or delete the app, to remove those too.

Location

If you tap the locate button, the app asks for permission to use your location while you are using it. Your location is used only to move the map — it is never stored, never logged, and never leaves your device. No request the app makes contains a coordinate, including requests to our own server, and that is true whether or not you are signed in. You can decline, and every other feature continues to work. Permission can be withdrawn at any time in iOS Settings → Privacy & Security → Location Services.

Connections the app makes

As with any internet request, each of these receives your device's IP address.

• Strollie's account and sync service (api.strollie.app) — contacted only if you sign in, and then only to verify your sign-in, keep your session alive, and sync your lists and tours. Signed out, the app never contacts it. It is our own service, running on Cloudflare, who process the request as our infrastructure provider.
• Strollie's content layer (content.strollie.app) — longer building descriptions and photo credits are fetched as you open a building, and a small version file is checked so the app knows which set of descriptions to ask for. The request contains the public Wikidata identifier of the building you opened and nothing else. It carries no account and no session: this host does not know who you are even when you are signed in. Also our own service on Cloudflare, with no analytics kept over it.
• Wikimedia Foundation (upload.wikimedia.org, commons.wikimedia.org) — photographs and their credits are downloaded as you view buildings. See the Wikimedia privacy policy.
• Apple — the base map is Apple Maps, so map tiles are requested as you pan and zoom. See Apple's privacy policy.
• Apple — when you type in the search field, the text you type is sent to Apple's geocoding service so it can suggest places to fly to. Searches of the atlas itself (buildings, architects, movements) are answered on your device and are not sent anywhere.
• Apple — Sign in with Apple itself is handled by iOS and talks to Apple directly, under Apple's own privacy policy, before anything reaches us. At the same moment, on your first sign-in only, iOS contacts Apple's App Attest service to certify the device key described above. Both are iOS talking to Apple on the app's behalf, and we see only the result.

Every one of these is HTTPS. The app makes no exception to iOS App Transport Security, and there are no other hosts.

Who else sees your data

Nobody. We do not sell your data, share it for advertising, or hand it to a data broker. There is no analytics provider, no crash reporter, no attribution SDK and no advertising network in the app — it has no third-party SDKs at all.

The only companies involved are the ones named above, in the roles described: Cloudflare, who host our server and database and process data on our instructions as our infrastructure provider; Apple, who operate Sign in with Apple, App Attest, the base map and the geocoding service; and the Wikimedia Foundation, who serve the photographs. We do not track you across apps or websites, and the app contains nothing that could.

Sharing a list without an account

When you share a list without signing in, the app creates a link containing the list's name and the public Wikidata identifiers of the buildings in it. That payload sits in the fragment of the link — the part after the # — which browsers never send to a server, so opening a shared link does not transmit the list to us. The link is handed to whichever app you choose to share it with. This still works exactly as it always has, and it still needs no account.

A tour you own and share while signed in is different: that one is stored on our server, so that the link keeps working and the tour survives reinstalling the app. It stays private to you unless you set it to be shared by link, and even then only the people you send the link to can open it.

Children

The app is suitable for all ages. It collects nothing from anyone who does not sign in, and nothing from anyone who does beyond what is listed above. It contains no advertising and no tracking, and it is not directed at children in a way that would involve collecting more.

Your rights

Because the data we hold is so small, the controls are simple and they are all in the app.

• See what we hold: everything on our server about you is your account identifier, an optional relay email address, and the lists and tours shown in the app. There is nothing held that the app does not already show you. The hashed App Attest key record is the one thing we hold that is not shown to you, and it is not held about you — it is not linked to your account, so we could not tell you which row was yours even if you asked.
• Correct it: rename or reorder a list or tour in the app and the server copy changes with it.
• Delete it: use Delete Account in the app, as described above. That is deletion, not deactivation, and it needs no request to us.
• Withdraw consent: sign out, or delete the account. Everything in the app except sync keeps working.
• Ask us anything: info@strollie.app.

Changes

If this policy ever changes, the revised version will be posted here with a new date, and the change will be described in the app's release notes.

Contact

Questions about privacy, or anything else: info@strollie.app.