What Locatr collects, and what it doesn’t.

Seven things, and nothing else:

• —Your email address and a hashed password — so you can have an account and sign in.
• —Subscription status — which plan, whether it is active, and when it renews. No card details — those go straight to the payment processor and never reach Locatr.
• —A non-reversible identifier derived from your payment method — used only to detect and prevent abuse of trial offers. It cannot be used to recover your card number, and unlike the rate-limit records below it is kept indefinitely.
• —Page views — which pages are visited, the referring site, and your country, browser and device type. No cookies, and nothing that follows you to other sites.
• —Your IP address — and, when a login code is checked, a one-way hash of the email address it was sent to. The rate-limit records these go into are deleted within about seventy minutes; sign-in and security logs keep an IP address and browser type for longer.
• —Standard server logs — kept by the hosting provider, and by the content delivery network in front of it, as part of running the site.
• —A crash report, if the Mac app hits an error — the error and where in the code it happened, plus the app version and your operating system version. No account, no location, and not the name of any place you saved.

There is no advertising, no profiling, no selling of data to anyone, and no tracking across other websites. Each item is explained in full below.

Locations you save in the Mac app are not on that list because they never leave your Mac. What the app does send, and to whom, is under The Mac app below.

Locatr is the product described on this site — a Mac app for changing what location an iPhone reports. It is run by a single independent operator rather than a registered company, so “Locatr” throughout this page means that operator acting under the product name.

For any privacy question or request, email contact@mylocatr.com.

Creating an account stores your email address and a hashed password. Sign-in is handled by a third-party authentication provider; the password is hashed by them and is never visible to Locatr in readable form.

Staying signed in requires cookies. These are strictly necessary — they hold your session and nothing else. They are not used to profile you and not shared with anyone.

Subscriptions are handled by a third-party payment processor, on their own hosted checkout and billing pages. Card details never reach Locatr’s servers — the app redirects you to the processor, and they collect the details directly.

What is stored here is the minimum needed to know whether your subscription is active: the processor’s customer and subscription identifiers, the plan, its status, and the renewal date.

One further item is kept for abuse prevention: a non-reversible identifier derived from your payment method, supplied by the processor and used only to detect and prevent abuse of trial offers. It cannot be used to recover your card number — it is a one-way value, not an encrypted card. Unlike the rate-limit records described below, it is kept indefinitely, since an identifier that expired would not do its job.

An email delivery service sends account and billing email — for example, a notice that a payment failed. It receives your email address in order to deliver those messages. No marketing email is sent.

This site uses a cookieless analytics service, provided by our hosting platform, to count page views. It records the page path, the site that referred you, and coarse details about your device: country, browser, operating system and device type.

It sets no cookies and stores nothing on your device. Instead of a cookie, it identifies a visit using a short-lived hash derived from the incoming request, which is discarded after 24 hours. There is no identifier that follows you to other sites, and the results are aggregated rather than tied to you as an individual.

A second cookieless analytics service, run by the content delivery network in front of the site, also counts page views — path, referrer, country, browser, device type and page-load timing — and likewise sets no cookies, stores nothing on your device, and does not use your IP address to identify you.

Because there is no advertising or cross-site tracking on this site, there is no consent banner to click through.

The Recent and Favourite locations you save in the app — including a home location, if you set one — are stored only on your Mac. They are not synced to your account, not uploaded, and not visible to Locatr. Removing the app removes them.

The map itself comes from third-party mapping, routing and geocoding services, so using it means the app talks to them. Searching for a place sends what you type. Viewing the map, or building and following a route, sends the coordinates involved — never the name you gave a saved place, so a route to a favourite called “Home” goes out as a pair of numbers with no label attached.

Asking the app to find where you actually are uses macOS Location Services, which asks your permission the first time. If that is unavailable, the app falls back to estimating your position from your IP address, which means sending that address to a third-party lookup service.

These services receive the requests described above and handle them under their own terms. None of those requests carry your Locatr account, your email address, or your subscription — the app does not tell them who you are.

When the Mac app hits an error it sends a report to a third-party crash-reporting service, so the problem can be fixed. Nothing is sent while the app is working normally: a report exists only because something broke. This site does not do error reporting at all.

A report contains the error and where it happened — the error type and message, and the sequence of functions that led to it, with file names and line numbers. Your username is stripped out of those file paths. Alongside that it carries the app version, whether the build is a release or a development one, and your operating system and its version.

It does not carry your account, email address or subscription, any location or coordinates, the names you gave your saved places, your device’s identifiers or name, the name of your computer, a record of what you clicked or typed, or the contents of any other request the app made. There is no session recording and no performance monitoring.

IP addresses are not stored. The app attaches none, and the service is configured not to keep the address a report arrives from — so a crash report is not tied to you or to where you are.

Sign-in, sign-up, checkout, email confirmation and password reset are rate limited by IP address, so that an attacker cannot make unlimited attempts. Applying that limit means briefly recording the IP address a request came from, together with a counter.

Checking a 6-digit login code is limited per address as well as per IP, since an attacker picks both. That record holds a one-way SHA-256 hash of the email address, not the address itself — enough to count attempts against one recipient, and not something the address can be read back out of.

The longest rate-limit window is one hour, so these records stop being useful after that. Rate-limit records are deleted automatically once they are more than an hour old by a scheduled job that runs every ten minutes — meaning an entry exists for at most about seventy minutes. They are not used for anything else, and are not linked to your account.

That seventy-minute window covers the rate-limit records only. The authentication provider separately keeps sign-in session records and security audit logs, which include the IP address and browser a session was started from. These are ordinary security records — they are what makes it possible to tell where an account has been signed in from — and they are kept for longer, under that provider’s own retention terms.

The site runs on a third-party cloud hosting provider, which keeps standard server request logs as part of operating the service. The database is run by a third-party database provider. Both are established platform vendors operating under their own published security and privacy terms.

In front of the hosting provider sits a content delivery network, which receives each request first and passes it through. As with any CDN, it sees the IP address a request came from as part of handling it, and keeps its own operational logs under its own terms.

Email contact@mylocatr.com to ask what is held about you, to get a copy, or to have your account deleted. Cancelling a subscription can be done yourself at any time from the billing portal in your dashboard.

Deleting your account removes your account record and its subscription record. The abuse-prevention identifier described under Payment is retained — one that could be cleared on request would not do its job. It remains a one-way value that cannot be used to recover your card number.

This policy is governed by the laws of the State of Florida, United States, without regard to its conflict-of-law rules, and any dispute belongs in the courts located there. If what the site collects changes, this page changes with it and the date at the top is updated.