Privacy policy

Gander is operated by Aiden Forrest trading as forresTech (“we”, “us” or “our”), based in the United Kingdom. We are the controller responsible for personal data used to operate the Gander app, its supporting services and this website.

For privacy questions or requests, email hello@gander.fyi. This policy covers Free Walk, Guided Walk, accounts, purchases and support.

Our correspondence address is Grove House, West Sleekburn, Choppington, NE62 5XE, United Kingdom.

• Account and sign-in details: your email address, display name if provided, account identifier, account status, sign-in records and authentication credentials or tokens. Security records can include your IP address, browser or device information, timestamps and unsuccessful sign-in attempts.
• Location and movement: precise coordinates, altitude, location accuracy, heading, device and compatible headphone orientation, motion readings and gestures. These help identify places, interpret what you are looking at and follow a route. Location can continue during an active walk while the app is in the background or your screen is locked, subject to your permissions.
• Walks and conversations: walk times, selected places, route and progress, questions you type or speak, recognised words, Gander’s replies and the location and direction associated with an interaction.
• Saved trips: titles, destinations, dates and notes you enter. Trip details are stored with your account. See below for photographs.
• Purchases: account and purchase identifiers, products, transaction events, subscription status, renewals, refunds, entitlements and pass purchases or activation. Apple processes your App Store payment; we do not receive your full payment-card details.
• Notifications: account and device subscription identifiers, push tokens, email address, notification permissions and delivery or interaction information.
• Diagnostics: app and operating-system versions, device model, session identifiers, network and service errors, response timings, audio-route categories, playback events and interaction records. Walk logs can include a detailed sequence of locations, orientations, motion readings, questions and responses. Completed or interrupted walk logs are uploaded automatically when you are signed in and a connection is available, including by background transfer.
• Analytics: app usage events, screen names, errors, app and operating-system versions, device information and account/session identifiers. Our servers separately record service requests, purchase and access events, background-job outcomes and AI performance metadata, such as model names, timings and token counts. These records can be linked to your account. See Analytics and choices.
• Support and website use: your name, email address, message and attachments you send us, together with ordinary server records such as IP address, requested pages, browser information, timestamps and errors.

We receive data from you and your device, and purchase and delivery updates from Apple, RevenueCat and OneSignal. We also use public mapping and place information to provide guides; this is separate from your private account and conversations.

Voice replies use Apple’s on-device speech recognition on supported devices and languages. Gander requires on-device recognition for this feature; if it is unavailable, voice replies may not work. Raw microphone audio is not uploaded to our servers for replies. Recognised text is sent to our services to answer you and can be stored in conversations and diagnostic logs.

Gander does not use your camera to identify what you are looking at. Where visual context is used, it comes from third-party street imagery of the area. Photos you select for trips are stored locally by the app rather than uploaded to Gander’s trip service. Your own device backup settings may separately affect local files.

Avoid including sensitive personal information about yourself or others in questions, trip notes or support attachments unless it is necessary for your request.

Where UK or European data-protection law applies, we use these legal bases:

• Providing the service you request (contract): creating and securing your account, identifying nearby places, answering questions, generating speech, delivering and saving walks and trips, managing purchases and responding to service requests. This uses the relevant account, walk, location, conversation and purchase data.
• Legitimate interests: investigating faults, reviewing diagnostic logs, improving accuracy and reliability, preventing misuse, protecting accounts and handling general enquiries. This includes the app analytics and limited server-side telemetry described below. Our interests are running a dependable, secure service, monitoring service performance and costs, and understanding problems encountered during walks. We consider the impact on your privacy, particularly where logs contain location or conversation data.
• Consent: optional marketing communications where consent is required, and access to device features where applicable. Device permissions control access to location, microphone, speech recognition, motion and notifications; allowing a device permission does not mean all subsequent processing relies on consent.
• Legal obligations: retaining necessary financial records and responding to legally binding requests.

You do not have a general legal obligation to give us data. Account details are needed for account features; location and direction are needed for live place identification; question text is needed for answers. Declining a permission or withholding required information can limit the corresponding feature.

AI helps identify places and generate narration and answers. We do not use it to make decisions about you that have legal or similarly significant effects.

Our supporting services handle data on our behalf. We use the following providers or categories of provider for the relevant features:

• Railway and infrastructure/storage providers: hosting the website, application services, databases, caches and stored diagnostic files. They process service data and technical logs.
• Groq: processing question text, relevant conversation history and place, location or direction context to identify places and generate answers. Guide generation also uses submitted destinations and preferences. Saving or updating trips, activating access or subscription updates can automatically trigger guide preparation from saved destinations. Public street images may also be analysed to help identify a place.
• ElevenLabs: turning generated narration and answer text into speech. That text can contain information from your question; this is different from uploading your microphone recording.
• PostHog: app analytics and server-side service telemetry, sent to our European PostHog project. This includes the identifiers and technical event information described in Analytics and choices. We do not send question or answer text, microphone audio, photos or precise coordinates to PostHog as analytics content. See PostHog’s privacy policy.
• Apple and RevenueCat: processing App Store purchases and maintaining purchase status and access linked to your account or an anonymous purchase identifier. Apple also provides device services, including maps and push delivery.
• OneSignal: account emails and push notifications, using your email, account identifier, device subscription details and message or delivery information.
• Mapping, routing and imagery services: Apple Maps, OpenStreetMap-based services including Nominatim and openrouteservice, and Mapillary where used. They may receive search terms, relevant coordinates, route endpoints or area queries to provide maps, routes and place context.
• Email and support providers: delivering and storing correspondence. The website contact form sends your name, email and message through the forresTech email service to Aiden Forrest.

Authorised people operating Gander may review conversations and logs to investigate problems and improve the service. Providers’ handling of data is also governed by the service arrangements and privacy terms applicable to them; Apple’s handling of its own services is described in Apple’s privacy policy.

We do not sell personal data or use it for cross-app targeted advertising. We may disclose necessary information to professional advisers, authorities where legally required, or to protect legal rights. If Gander is transferred to another operator, relevant data may transfer with it, subject to applicable law and notice of material changes.

Our providers operate internationally, including in the United States, so your data may be processed outside the United Kingdom or European Economic Area. Local privacy laws may differ.

Where required, transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as approved standard contractual clauses and the UK International Data Transfer Addendum or Agreement. Contact hello@gander.fyi for information about the arrangements relevant to your data and a copy of applicable safeguards.

We keep account, trip and conversation records while your account is active and they are needed to provide the service. Walk diagnostics are retained for troubleshooting and are also subject to storage limits and periodic cleanup.

Use Delete account in the app’s Settings to permanently remove your account and its associated records from our active databases. This includes your profile, sign-in credentials and records, saved trips and notes, conversations, walk history, personal guide requests and field-test records, trial and pass records, and account-linked purchase and webhook records.

The app clears its saved account identity, personal trip details, trip-photo copies and owned walk recordings on the phone where you delete the account, and cancels pending log uploads. It does not delete original photographs from Apple Photos or copies you have exported. An offline device cannot be remotely wiped; contact us if you need help removing personal files from another device.

We automatically queue deletion of uploaded walk recordings, associated server diagnostic traces, and your OneSignal and RevenueCat user profiles, and account-linked PostHog data. PostHog cleanup is queued with a delay to allow in-flight event batches to arrive before erasure is requested. Temporary storage or provider failures are retried. Only the identifiers required to complete those requests are retained in the cleanup queue, and those entries are removed when processing succeeds. Providers may complete an accepted deletion request asynchronously.

Account deletion does not clear reusable content caches: cached generated audio, public place research and answers, mapping data, generated guides and downloaded reusable guide packages remain available. General device preferences are also retained.

Infrastructure logs, backups and records independently retained by providers follow their separate retention cycles or applicable obligations. Support emails and attachments are handled separately; contact hello@gander.fyi to request their deletion or help with any other retained personal data. If a legal requirement prevents deletion of particular records, we will explain the restriction.

Deleting your account or uninstalling Gander does not cancel an Apple subscription or erase Apple’s purchase records. Cancel your subscription separately in your Apple subscription settings. Deleting your account removes its remaining Gander trial access and passes.

Analytics and choices

Analytics are part of the Gander service. The app sends limited onboarding and funnel events to PostHog from first use, including before you check the agreement box or sign in. These include onboarding steps, screen names, technical errors, app and device information, and a generated analytics identifier. After sign-in, usage events are associated with your Gander account identifier and subscription status to help us monitor and improve the product. There is no separate in-app analytics opt-out. Session replay and automatic recording of taps are disabled. We do not send names, email addresses or sign-in codes as analytics properties, but account and device identifiers can still constitute personal data. PostHog also receives network connection information necessary to receive events; IP-based geolocation enrichment is disabled. We do not send question or answer text, microphone audio, photos or precise coordinates to PostHog as analytics content.

Signing out ends access to signed-in features and resets the app’s analytics identity. It does not stop analytics: subsequent onboarding events use a new generated identifier. It does not erase events already received or prevent completion of in-flight transmissions. Our servers also record service requests, account and purchase events, background-job outcomes, errors, and AI model performance and cost metadata. These events may carry account, request, guide or walk identifiers where relevant. Server telemetry excludes request bodies, question and answer text, precise coordinates and authentication secrets. Gander’s own walk logs can contain the more detailed information described in section 2.

We use analytics for service operation, reliability, cost monitoring and product improvement on the legitimate-interests basis described above. You can stop using the app or delete your account in Settings, and you retain your legal rights to object to processing or request erasure. Accepting these terms does not waive those rights.

PostHog data is subject to our project’s retention settings and provider deletion processes. Account deletion queues removal of account-linked PostHog data. Generated identifiers are pseudonymous, not a guarantee of anonymity. Earlier onboarding events may become linked to your account when you sign in. Events that cannot be linked back to your account may remain until their retention period expires. Contact us to request access, erasure or details of the retention applicable to your records.

AI features and your agreement

The AI section of our terms explains the information sent to Groq and ElevenLabs. During sign-up, you must read and agree to the terms and this policy before requesting a sign-in code. The same checkbox appears when requesting a code to sign back into an existing account. An already signed-in session is not automatically sent through this screen again. AI processing is required for Gander’s walks and answers; if you do not agree, do not sign in or use these features.

If you change your mind, sign out to stop using the app, or delete your account in Settings. This does not undo completed processing or automatically erase previously stored data; you can request erasure separately at hello@gander.fyi.

Reusable guide generation and public-place research are internal service processes. They can continue after sign-out or account deletion and remain available to other walkers. The guide compiler receives a destination, route coordinates, duration and theme rather than your account identity or private conversations. Account-linked purchase and security records are handled separately under the purposes and retention rules above.

Device permissions and the website

You can change location, microphone, speech-recognition, motion and notification permissions in iOS Settings. Stop an active walk to stop that walk’s ongoing location use. Revoking permission does not automatically delete data already stored.

The website stores a local preference to remember that you have seen the introduction. You can clear it through your browser’s site-data settings. The website does not include advertising cookies or third-party analytics trackers. Hosting and contact services still process the technical and message data described above.

You can turn off push notifications in iOS Settings and unsubscribe from marketing emails through the message or by contacting us. Essential account and purchase communications may still be sent when needed to provide the service.

When you finish a free or guided walk, the app can send a compact recap to Gander: the actual recorded route, duration, places visited and questions with answer context. A background worker prepares an email using this information, existing place photographs and a short introduction written through Groq. We send selected place and conversation text to Groq for that introduction, without your email address or GPS route.

OneSignal delivers the email. Images use private, unguessable links so your email app can display them; anyone you forward the email to may also view those images. Recap records and hosted images are deleted with your account, although copies already delivered to mailboxes or cached by email providers cannot be recalled. Turn off walk recap emails in the app’s Settings or use the email’s unsubscribe link. Delivery is best effort; we do not automatically retry failed recaps or send recaps for historical walks.

Depending on your location and the applicable law, you can request access to your personal data, correction, deletion, restriction of processing and a portable copy of data. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.

Your right to object: you can object to processing based on legitimate interests because of your particular circumstances. You can object to direct marketing at any time.

Email hello@gander.fyi to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month under UK/EU law; if a permitted extension or exception applies, we will explain it. You will not be penalised for exercising your rights.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113, or to your local data-protection authority. You do not have to contact us first.

Gander is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has supplied personal information, contact us so we can investigate and arrange appropriate deletion. Older children should use Gander with a parent or guardian’s involvement where required by law and should not share sensitive personal details.

We use measures such as encrypted connections, authenticated access and restricted administrative access to protect data. No system is completely secure.

We may update this policy as Gander or legal requirements change. We will publish the revised date here and bring material changes to your attention through the app or another appropriate channel. Where a change requires consent, we will ask for it.