App privacy

This policy covers the Adrift app for iPhone. The tryadrift.com website is covered by its own privacy policy, which is a shorter document about an email address and a server log. The app is the thing that handles where you were standing, and this is the policy for it.

The short version

• Your position is read only while a screen is asking for it, and only to answer one question: are you beside open water.
• Nobody is ever shown a coordinate of yours. A person who finds your bottle sees a place name — Brighton, United Kingdom — and nothing more precise, ever.
• Adrift never reads your position in the background. It cannot: it does not ask for it.
• There are no profiles. No name, no photograph of you, no handle, no birthday, no friends, no followers. An email address is the only thing about you that Adrift holds.
• No advertising, no analytics, no tracking, no data sold or shared with anybody for their own purposes.

Who is responsible

The controller for the processing described here, in the sense of the General Data Protection Regulation (GDPR), is:

Simon Berriman
sole trader (freelance)
Karl-Rothe-Str. 4
04105 Leipzig
Germany

Email: hello@tryadrift.com
Telephone: +49 15207075439

Adrift is operated from Germany, so German and EU data protection law applies wherever you are. Full provider details are on the Impressum. There is no statutory obligation to appoint a data protection officer at this size and none has been appointed; the address above reaches the person responsible.

What the app collects, and why

Your email address

Signing in asks for an email address and sends a six-digit code to it. There is no password and no third-party login. The address exists for two reasons: so your collection survives a lost phone, and so there is somewhere to send the one notification Adrift sends. It is stored by Supabase Auth, it is never shown to another person, and it is deleted when you delete your account.

Legal basis: Art. 6(1)(b) GDPR — performing the contract you entered into by creating an account. Without an identifier there is no way to give you back the bottles that are yours.

Where you are

Adrift asks iOS for your position when you open a screen that needs one, and stops as soon as you leave it. It asks for When In Use access only. It does not ask for Always, it declares no background location mode, and there is no code in it that could read your position while it is in your pocket. This is the point of the product rather than a setting: the reward for using Adrift is walking to the water yourself.

Your position is used for exactly three things:

• Deciding whether you are close enough. The app sends the reading to our server, which measures it against the coastline and answers yes or no. You have to be within about 120 metres of open sea.
• Placing a bottle you release, and finding one near you. A released bottle starts where you let it go. A bottle in the water is found by measuring how far it is from where you are standing.
• Working out a place name. Your position is rounded to a grid cell of roughly 5.5 kilometres, and the name of the nearest settlement in that cell is what other people eventually see. The rounding happens before the lookup, so even our own place lookup never works from your real position.

The accuracy of the reading travels with it and is stored alongside it, because a coastline is where GPS is worst and Adrift would rather tell you it is not sure than tell you something wrong.

What is stored: the coordinate where a bottle was released, and the coordinate where one was found. Both are attached to the bottle rather than to a feed of your movements, and neither is ever returned to another user by any part of the system. Positions from readings that did not result in a release or a find are not stored at all.

Legal basis: Art. 6(1)(b) GDPR for the processing, and your permission on the device for the access itself, which you give in the iOS dialog and can withdraw at any time in Settings. Withdrawing it stops the app working, because there is no version of Adrift that does not need to know whether you are at the sea.

What you write

The text you put in a bottle is stored so it can be read by the person who finds it. That is the product. Up to 500 characters, and once you have sealed a bottle and let it go you cannot get it back, edit it or delete it — it is held by other people by then. Do not put anything in a bottle that you would mind a stranger reading.

What you wrote is shown without your name attached, because there is no name. It is not anonymous to us: the account that wrote each contribution is recorded, precisely so that a report about something abusive can lead somewhere.

Photographs

You can put one photograph in a bottle. Before anything leaves your phone the image is re-encoded, which resizes it and strips its metadata: no GPS coordinates, no timestamp, no camera or device information survives. That happens on the device rather than on our server, so the original never reaches us.

Photographs live in a private store with no public read access. There is no URL anybody can guess or share. When a photograph is shown, the server first asks the database whether the person asking is holding that bottle, kept it, or wrote in it, and only then issues a link that expires shortly afterwards.

The journey of a bottle

Each leg of a bottle records where it went in, where it came out, and when. What is published from that is the place names and the drift between them. The coordinates behind those names are not sent to any app, ever, and the app has no screen that could display one.

Notifications

If you allow notifications, the app registers a push token so we can send exactly one kind of message: your bottle was found. Nothing about where it was found, nothing about where it has been, nothing else at all — a notification that told you where your bottle was would be a way of following a bottle Adrift promises you cannot follow.

The token is a device address rather than anything about you. It is deleted when you sign out, and when you delete your account. Declining notifications costs you nothing except having to open the app to find out.

Legal basis: your consent, Art. 6(1)(a) GDPR, given in the iOS dialog and withdrawn by turning notifications off.

Reports

Reporting a bottle stores what you reported, the reason you gave, anything you added, and which account made the report. We need the last of those to tell a genuine report from somebody attacking a bottle they simply disliked. If you delete your account, your identity is removed from reports you made and the report itself is kept, because a moderation decision that can no longer be explained is worse than one that can.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest, and every other user's, in a product where the first piece of abuse has somewhere to go.

Writers you have blocked

Tapping Never show me this writer again stores a pair: you, and the internal identifier of whoever wrote that. Neither of you is ever shown the other. You are not told who you blocked, because there is no name to tell you, and they are not told it happened. The pair exists only to leave their writing out of what you are shown, and it is deleted when you unblock everyone or delete your account.

Legal basis: Art. 6(1)(b) GDPR — it is part of the service you asked for.

Account identifier

Every account has an internal identifier, which is what the bottles, claims, contributions and tokens above are attached to. It is not shown to anybody.

What other people can see

This is the part worth being exact about, so here is the complete list.

• The text of a bottle you released, to whoever finds it.
• The photograph in it, if you added one, to the same people.
• Place names on its journey — Brighton, United Kingdom — at a resolution of about 5.5 kilometres.
• How long it has been in the water, and roughly how far it has travelled.

And that is all. Not your email address, not your coordinates, not the time you were standing there, not how many bottles you have written, not a name, because there is not one. Nobody can look you up, follow you, message you, or find anything else you have written.

What Adrift deliberately does not do

• No advertising and no advertising identifiers. The app does not read the IDFA and does not show the App Tracking Transparency prompt, because it has nothing to ask for.
• No analytics or crash-reporting SDK. There is no Firebase, no Amplitude, no Sentry, no attribution service, nothing counting screens.
• No tracking, in Apple's sense or any other. Nothing about you is combined with data from other companies' apps or websites, and nothing is passed to a data broker.
• No third-party sign-in, so no social network learns that you use Adrift.
• No contacts, no calendar, no microphone, no health data, no photo library browsing — the camera opens only when you choose to add a photograph.
• Nothing bought or sold. Adrift is free, has no subscription and no in-app purchases, so there is no payment data anywhere in it.

Who else processes this data

• Supabase — the database, the sign-in service, and the private store for photographs. The database runs in Supabase's Ireland region, so it is inside the European Economic Area.
• Expo — delivers push notifications. Receives your push token and the words Your bottle was found, which is the whole of what a notification contains. It never receives a position, a bottle's text, or a photograph.
• Apple — operates the notification service the message is finally delivered through, and distributes the app itself. What Apple tells us about a download is a number, never a person.
• Resend — sends the sign-in code to your address, and any moderation correspondence.

That is the complete list of processors. We disclose data to nobody else, except where we are legally required to.

One third party is not a processor and should still be named. The map is drawn from tiles your phone fetches directly from OpenFreeMap, an OpenStreetMap-based service. They therefore see your device's network address and which tiles you asked for, which indicates roughly the area you are looking at — not your position, and not who you are. We chose it precisely because it needs no account and no key, so there is nothing for it to tie a request to.

Transfers outside the EEA

The database and the photographs sit in Ireland. Supabase, Expo, Apple and Resend are US companies, and a US parent can reach its own infrastructure for support and administration. Where personal data does leave the EEA, the transfer is covered by the European Commission's standard contractual clauses or another mechanism permitted by Chapter V GDPR, including the EU-US Data Privacy Framework where the provider is certified under it. Ask us which applies to a given provider and we will tell you.

How long we keep it

• Your email address and account: until you delete your account.
• Push tokens: until you sign out, turn notifications off, or delete your account.
• A bottle and what is written in it: for as long as the bottle exists. Bottles are not deleted when the person who wrote them leaves, because other people are carrying them.
• The coordinates attached to a release or a find: for the life of the bottle. We have not yet set a shorter period for these and will not pretend we have. They are already invisible to every other user, and account deletion detaches them from you; a rule that ages them out of the database entirely is work still to be done, and this page will say so until it is.
• Reports: longer than the content they are about, so a decision can be defended. The reporter's identity is removed if that person deletes their account.

Deleting your account

Settings → Delete account, inside the app, with no email to us required. Here is exactly what it does, because "we delete everything" would not be true and the truth is more interesting:

• Your sign-in record and email address are removed.
• Your push tokens are deleted, along with any notification not yet sent.
• Bottles you wrote but never released are retired. Drafts you never released are deleted.
• A bottle you had claimed but not opened goes straight back into the water for somebody else.
• Bottles already in the water carry on without you. They stop being linked to you — every record of authorship, release, find and keeping is detached — but the bottle keeps drifting and the words stay in it. Once a bottle is in the water it belongs to the water, and one person leaving must not reach into somebody else's collection and empty it.

If you want the words themselves gone as well as your link to them, write to hello@tryadrift.com and say so. We will weigh your Art. 17 request against the people holding that bottle, and we will tell you what we did either way.

Moderation

Every bottle has a Report control. A report reaches us immediately, and we act on reported content within 24 hours: content that breaks the app terms is hidden from every reader, and accounts that do it repeatedly are removed. Blocked content is hidden rather than destroyed, because the question after somebody reports that a person might be in danger is one only the original writing can answer.

Separately from that, you can block a writer for yourself, and some things are refused as they are written — an email address, a phone number, a link, a username, and a short list of terms. None of what is refused is stored: a bottle that is refused is never written down.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable form (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw a consent you gave, at any time (Art. 7(3))

Deletion is in the app. For anything else, write to hello@tryadrift.com from the address you signed in with and we will do it. You do not have to explain why.

Complaining about us

If you think we have handled your data wrongly, please tell us first, at hello@tryadrift.com. You do not have to. You have the right under Art. 77 GDPR to complain to a data protection supervisory authority, either the one where you live or work, or ours, which is:

Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
Maternistraße 17
01067 Dresden
Germany
www.datenschutz.sachsen.de

Automated decisions and children

Nothing here makes an automated decision with legal effect about you and nothing profiles you. Adrift is not directed at children and is rated accordingly on the App Store, because it shows writing by strangers that nobody reads before you do. If you believe a child is using it, tell us and we will close the account.

Changes to this policy

The date at the top says when this version was written. If we change something material we will change that date, and if the change affects what other people can see we will say so in the app rather than quietly editing this page.

Contact

hello@tryadrift.com, for anything on this page.

This policy describes what the app actually does, written by the person who built it. It is not a lawyer's work and has not been reviewed by one.