Effective 27 October 2026

Privacy policy

WithinReach Places is provided by Pedro Carena. Contact pcarena@paginar.com for support and privacy requests.

This policy covers the iPhone beta and this support website. You do not need a WithinReach account to use local lists. Location, notifications and WithinReach usage analytics are optional.

Lists and personal information

The app stores settled lists, source-item outcomes, saved place identities, personal labels, notes, tags and reminder choices on your iPhone. Importing a shared Google Maps list opens its page on the phone; Google receives that page request. Google Places receives references or search inputs used for matching. List sharing does not transfer ownership or provider rights.

When available and provisioned, settled collection archives sync through your Apple account’s private CloudKit database. Local saves do not wait for CloudKit. Apple processes these archives; this is separate from an app-managed WithinReach collection server. Device backups and exported files can create additional copies under the destination’s settings.

Maps, searches and routes

Google Maps and Places provide the main map and Google lookups. Requests can include the viewed map area, place references, search inputs and authorized location. Their SDKs also process installation/device identifiers, usage interactions, performance and diagnostic information under Google’s privacy policy. This SDK processing is separate from the optional WithinReach analytics switch.

Explicit Geoapify searches send the typed query, language and selected area. Near me uses your current location. Explicit Google walking previews send current and destination coordinates and, where applicable, a destination place ID. These two services use WithinReach’s Cloudflare gateway, which forwards the required inputs to the selected provider. Existing Apple-only saved places use Apple Maps on a separate map; external map handoffs disclose their destination to that map service.

Providers and hosting services receive connection information such as IP addresses. Their processing may occur outside your country. See Geoapify, Cloudflare and Apple for their policies.

App integrity and service protection

Apple App Attest verifies installations using a hardware-backed app key. The gateway retains attestation public keys and replay counters, expiring challenges and request/quota counters, including temporary hashed IP counters. Its application storage does not retain queries, coordinates, route geometry, provider responses or your collections. Gateway request logging is disabled in the supplied deployment; ordinary hosting/network processing still occurs.

Challenges expire after two minutes. Expiring quota/security records are pruned during periodic maintenance. Registered public keys/counters are retained for the service’s lifetime to prevent replay and enforce limits. A dedicated installation-erasure control is not currently available. Contact us about these records; we may need information from your installation to locate them. Firebase Core/App Check may provide separate Google Places integrity protection when configured; Firebase Analytics is not included.

Location and nearby reminders

Foreground location supports map centering, Near me and explicitly chosen routes. Nearby reminders use area monitoring and bounded precise checks near selected places, including while the app is inactive when permitted by iOS. The app does not record a continuous sampled GPS route.

Reminder state retains selected place identities, cooldowns, accepted alert destinations and event times. Optional local diagnostics can retain more detailed timestamped place events that may reveal visits. Permission to send notifications and use background location is requested separately. You can change those permissions in iOS Settings.

Optional diagnostics and analytics

Diagnostic recording stays on until you turn it off. Its local rolling history is bounded to seven days, 5 MB or 20,000 events when maintained; inactive files may remain until the next maintenance. Turning recording off preserves retained history. Clear history removes the current app history; recording can create fresh events if still enabled. Exports are sent only to a destination you select and are not erased by clearing the app’s copy.

WithinReach usage analytics require a separate opt-in and use TelemetryDeck. They can include fixed action/screen names, grouped outcomes/counts, durations, timestamps, app version/build and salted installation/session identifiers. They exclude your saved places, list content, notes, searches, area text, coordinates and routes. Turning sharing off discards unsent events and resets the local identifier. Previously delivered events remain subject to TelemetryDeck’s policy; the switch does not delete that history.

Retention and deletion

Personal list data remains until you remove it or the installation’s data. Hiding a list is not deletion. Deleting a list retains terminal deletion markers and may retain source history and places shared with other lists; it does not erase all related records, backups, diagnostics or provider data. Google-derived cached coordinates have expiry rules of up to 30 days; place IDs and personal information have separate retention rules.

Uninstalling can remove local app data but does not guarantee erasure of CloudKit archives, exported copies, device backups or provider-held data. Do not reinstall to test erasure or recovery. For access, correction, deletion or other applicable privacy requests, contact us first; we will explain the data we control, any verification needed and remaining copies or legal/security retention. Contacting support shares your email and message with us and our email service for responding and maintaining the support conversation.

Choices and changes

You can use saved lists without location or notifications, turn optional analytics/diagnostics off, clear local diagnostic history and change system permissions. We do not sell personal data or use the app for cross-company advertising tracking. Apple’s TestFlight service separately processes invitations, feedback and beta diagnostics under its terms.

We will update this page when relevant processing changes. This page describes the beta’s actual boundaries; it does not promise guaranteed notification delivery, synchronization or deletion of copies controlled by another provider.