Privacy Policy

Name: NavGPS
Author: TEMBN.LLC

Last updated 4 October 2026

NavGPS is an iOS app published by TEMBN.LLC. It records GPS tracks, shows offline maps, reads live data from a vehicle's OBD adapter, and can share your live location with a Family Circle. This page describes what the app keeps on your phone, what it sends to navgps.app, who else can see it, and which outside services the app contacts on your behalf.

NavGPS works without an account. There is no sign-up, no password, and the app never asks for your name, email address, phone number or date of birth.

Permissions the app asks for

iOS shows you each of these the first time it is needed, and you can change any of them later in iOS Settings.

Location, while using the app	Shows your position on the map and records your GPS track.
Location, always	Keeps recording your full track when the screen is off, and shares your live location with your Family Circle while the app is closed.
Camera	Takes photos while recording; each one is pinned to your track at the spot where you took it.
Photo library (add only)	Also saves photos taken while recording into your photo library. The app can add photos; it cannot read your library.
Motion and fitness	The barometer smooths recorded elevation. The accelerometer is also used for crash detection while a drive is recording — see below.
Bluetooth accessory	Talks to an OBDLink adapter over Apple's MFi accessory framework, so the app can read live engine data.

The app contains no advertising, analytics, attribution or crash-reporting library, and it does not read the device advertising identifier.

What stays on your device

Recording is local first: the app's own database on your phone is the original copy, and everything below works with cloud sync switched off.

Tracks — each recorded point's latitude, longitude, altitude, horizontal accuracy, speed and timestamp, plus the track's name, distance, duration, moving time, ascent and descent.
Waypoints and saved places — name, coordinate, altitude, your note, and whether you starred it.
Photos — stored as JPEG files in the app's own folder.
Engine samples — readings from your OBD adapter logged against the track being recorded, at most one per parameter per second.
Vehicle profiles — the year, make, model and VIN held against each adapter you have used, your fuel profile, any custom parameters you have added, and your dashboard layout.
Offline data you download — map tiles, vector map areas, the routing graph, offline place packs, elevation tiles and mapped licence-plate-reader locations.
A cache of place details — opening hours, cuisine, phone and website for places you have opened.
Your settings, and the random device token described in the next section, which is kept in the iOS Keychain.
The breadcrumb trail, when enabled — a passive trail recorded only while the app is open, kept for 12 hours unless you save it as a track.

Deleting the app removes all of it: the database, the photos, the offline maps and the Keychain token.

Your navgps.app device identity

The first time the app contacts navgps.app it asks for a device token: a random string, stored in your device's Keychain, which the server uses to tell your data from everyone else's. The server stores the token and the moment it was created, and nothing else about you.

The app makes that first request when it launches, because Family Circle has to check whether you belong to a circle before it can know whether to share anything. This means a device registration exists from first launch, before you switch on cloud sync or join a circle. The registration on its own holds no location, no track and no identifying detail.

The Keychain token is marked available after first unlock and is not synced to iCloud Keychain, so it stays on the one device.

You may optionally set a display name. It is shown to the members of groups and circles you join, and appears as the author on any trail you publish. Without one, those places show "Unnamed" or "Anonymous".

Cloud sync — off unless you turn it on

Cloud sync lives in Settings, under "Sync tracks to navgps.app", and is off by default. While it is off, no track, point, photo, waypoint, place or engine reading is uploaded.

When you switch it on, the app uploads, for each track:

the track's name, creation time, activity type and whether it is still recording;
every recorded point — latitude, longitude, altitude, horizontal accuracy, speed and timestamp;
its waypoints, with name, coordinate, note, time, and the photo attached to each (JPEG, up to 1.5 MB);
its engine samples — parameter, value, unit and timestamp;
and, when the track is finished, its distance, duration, moving time, ascent and descent.

Your saved places sync too: name, coordinate, altitude, note, starred flag and attached photo.

Uploads continue in the background while you record, and resume where they left off after a dead zone. Track metadata, waypoints, places and photos are stored in a Cloudflare D1 database; once a track is finished, its point stream is compressed into a single object in Cloudflare R2 storage and the individual point rows are deleted from the database.

Vehicle and engine data

With an OBDLink adapter connected, the app reads engine RPM, vehicle speed, coolant temperature, engine load, intake air temperature, throttle position, short and long-term fuel trim, battery voltage, mass air flow, manifold pressure, fuel level and transmission temperatures, along with any custom parameters you add yourself. Those readings drive the live gauges and are logged to the local database against the track being recorded. They leave the phone only if cloud sync is on.

Two things are different, and are sent whether or not cloud sync is on:

When the adapter reports a VIN, or when you choose a vehicle by hand, the app sends the adapter's identifier and the vehicle's year, make, model and VIN to navgps.app, where they are stored against your device.
The VIN is also sent to the US National Highway Traffic Safety Administration's vPIC service to be turned into a year, make and model. The resulting year, make and model — not the VIN — is sent to the US Department of Energy's fueleconomy.gov to look up EPA figures and tank size.

Family Circle — live location sharing

A Family Circle shares every approved member's live location with every other approved member, continuously, for as long as sharing is on.

Joining

You either create a circle or join one with its six-character invite code. Joining by code makes you a pending member: the circle's owner has to approve you, and until they do, no member sees your location and you do not see the roster. Only the owner can see who is waiting.

What is shared, and how often

While you are sharing to at least one circle, the app sends your position to navgps.app in the background. This keeps working with the app closed, and resumes after a force-quit or a reboot, using background location updates, a 150-metre geofence around your last position, and significant-location-change wakes. Each send is throttled: it needs either about 40 metres of movement since the last one, or 25 seconds to have passed — so a parked phone still reports in, and a moving one is not reporting continuously.

Each send stores one row for your device holding your latitude, longitude, speed, battery level, whether you are moving, and the time. It overwrites the previous one — the server keeps your latest position, not a history of where you have been. Presence is recorded at roughly neighbourhood accuracy rather than the best fix your phone can manage.

Who can see it

Approved members of the circles you belong to, and only while your sharing is switched on for that circle.
A position older than 24 hours is reported to them as "no location".
An approved co-member can also see your recent completed drives — the last 25, each with its name, date, distance and duration — and, from there, that drive's recorded GPS points. Both of you must be approved in the same circle for this to work.

The "show family on map" switch only controls whether their pins are drawn on your map. It does not change what you share, and it does not change what they share.

How sharing stops

Pause sharing for a circle, in Family Circle, and your location is withheld from that circle's members immediately.
Leave a circle and you are removed from it. If you own the circle, leaving deletes the circle and everyone's membership of it.
The circle's owner can remove any member; any member can remove themselves.
Once you are not sharing to any circle and are not waiting for approval anywhere, the app shuts its background location engine down and sends no further positions.

The last position you sent before stopping stays in the database. Pausing and leaving stop it being shown and stop new positions being sent; neither erases the stored row. There is no control in the app or on this site that deletes it.

Crash detection and emergency alerts

Crash detection is on by default and can be switched off in Settings, under Safety. It runs only while a drive is being recorded: the accelerometer samples at 50 Hz and is combined with your GPS speed.

If it believes you have crashed, your phone asks you, full screen and with repeating haptics, whether you are all right, and gives you 30 seconds. If you answer, nothing is sent to anyone. If nobody answers, or you press "Get help now", or you raise an alert by hand, the app posts an alert to every circle you are approved in, carrying:

whether it was detected or raised by hand;
your latitude and longitude;
your speed at the moment of impact and the peak force measured, for a detected event;
the time, and a note if one was added.

Your circle members see the alert, and get a notification that breaks through Focus. It stays visible to them for 24 hours while unresolved. Pressing "I'm safe" marks your alerts resolved and they stop being shown.

This is not an emergency service. No call is placed, and nothing is sent to emergency services or to any responder — an alert reaches your circle members' phones and nowhere else.

Sharing that is public by link

Several features work by handing out a link. Anyone who has the link can open it, with no sign-in — the secrecy of the link is the only protection, so treat these links as the secret they are.

A track's live page at navgps.app/live/… shows that track's route as it is recorded, along with its waypoints, their notes, and their photos.
Your My Tracks page at navgps.app/my/… lists your synced tracks. That URL contains your device token, so anyone you send the link to can open the list.
A convoy feed at navgps.app/v1/convoy/… shows the name, latest position and recent trail of everyone currently live in that group, to anyone holding the group's invite code.
Group and circle invite pages show the group or circle's name to anyone holding its code.

Sharing a track to a group or to a person lets them see its name, distance, duration and ascent, and read its recorded points.

The Trail Library is fully public

Publishing a track to the Trail Library puts it on the open web: its title, your description, the activity, its distance and ascent, the area it covers, your display name (or "Anonymous" if you have not set one), the complete GPX file, and any photos attached to its waypoints. Downloads are counted. Unpublishing removes the listing.

Signing in on the web

navgps.app shows a six-digit code; you type it into the app to approve it. Your browser then holds a session cookie — ngs, the only cookie the site sets — which is HttpOnly, Secure, SameSite=Lax, and lasts 30 days. The server stores that session's token, which device it belongs to, when it was created, when it expires and when it was last used. Your device token is never given to the browser.

Signing out from the website deletes the session. Sessions also expire 30 days after sign-in, and an expired one is deleted the next time it is presented. Sign-in codes last 10 minutes, are deleted the moment the browser collects the session, and expired ones are swept away.

A signed-in browser can see and edit what that device owns: its tracks, their routes and elevation profiles, waypoints, photos, saved places, engine logs, group and circle memberships, and tracks others shared with it.

Outside services the app contacts

Maps, weather, tides, searches and vehicle lookups come from the services below. A request to any of them carries your device's IP address, together with whatever that particular request is about — the map tile being drawn, the coordinate being asked about, or the text you typed. NavGPS sends no device token, display name or account identifier to any of them.

Service	What it is for, and what it receives
USGS The National Map `basemap.nationalmap.gov`	Topographic, imagery and shaded-relief map tiles. Receives the tile coordinates being drawn.
OpenFreeMap `tiles.openfreemap.org`	The vector map style and its tiles. Receives the tile coordinates.
Esri `server.arcgisonline.com`	Satellite imagery for the 3D terrain view. Receives the tile coordinates.
AWS Open Data `s3.amazonaws.com`	Terrarium elevation tiles, used for 3D terrain and elevation lookups. Receives the tile coordinates.
Macrostrat and USGS Mineral Resources `macrostrat.org`, `tiles.macrostrat.org`, `mrdata.usgs.gov`	The geology layer, and tap-to-identify. Identifying a unit sends the coordinate you tapped.
Iowa State Mesonet `mesonet.agron.iastate.edu`	Animated weather radar tiles. Receives the tile coordinates.
US National Weather Service `api.weather.gov`	Forecasts. Receives the coordinate you asked about.
NOAA CO-OPS `api.tidesandcurrents.noaa.gov`	Tide stations and predictions. Receives the station or area asked about.
OpenStreetMap Overpass mirrors `overpass-api.de`, `overpass.kumi.systems`, `overpass.private.coffee`	Builds the offline routing graph and the mapped-camera layer. Receives a query describing the area you asked for. The app identifies itself as "NavGPS", as Overpass's usage policy requires.
Wikimedia Commons `commons.wikimedia.org`	Photographs of a place. Receives the place name or coordinate being searched.
NHTSA vPIC `vpic.nhtsa.dot.gov`	Turns a VIN into a year, make and model. Receives the VIN read from your vehicle.
US DOE `fueleconomy.gov`	EPA economy figures and tank size. Receives the year, make and model — not the VIN.
Apple	The Apple Maps base layer, address and place search, and road navigation directions use Apple's own services under Apple's terms, and receive what you type and the area you are looking at. Results from Apple's place search are shown but never written to disk. Opening a coordinate in Maps hands it to the Maps app.

Requests that go through navgps.app instead

Some lookups are made by our server rather than by your phone, so the upstream service sees the request coming from Cloudflare and not from you:

Watershed and streamflow — the app sends a coordinate to navgps.app, which asks USGS NHDPlus and the Watershed Boundary Dataset for tiles, USGS StreamStats for a basin outline, USGS Water Services for live streamflow, and the FCC's area service to work out which state the point is in.
Opening hours for a place — the app sends the place's name, coordinate and category to navgps.app, which asks Geoapify. The answer is cached for a day at our edge and again on your device, so the same place is not looked up twice.
Offline place packs are downloaded from navgps.app. The request names the region or map cells you asked for.

The website

Pages on navgps.app load their mapping libraries from the unpkg.com CDN and their map tiles from the services listed above, so a browser visiting the site makes requests to those hosts. The site sets no analytics or advertising cookies — the only cookie is the sign-in session described earlier.

navgps.app and its API are hosted on Cloudflare, which necessarily sees the IP address each request comes from in order to serve it. Stored data lives in Cloudflare D1 and Cloudflare R2.

Children

NavGPS has no age gate and no separate kind of account for a child. Nothing in the app asks for or records a date of birth. A circle member is a circle member whatever their age: anyone who installs NavGPS and is approved into a Family Circle shares their live location on exactly the terms described above, and can see every other approved member's.

Keeping and deleting data

On your phone

Deleting a track in the app removes it, its points, its waypoints, their photos and its engine samples from the local database. Deleting the app removes everything the app stored, including the Keychain token.

On navgps.app

Deleting a track is done from a signed-in browser at navgps.app. It removes the track's metadata, its points, its waypoints and their photos, its engine samples, any share grants for it and its Trail Library listing from the database, and deletes its compressed route object from storage. A small record is kept — the track's id, your device and the time — so your phone learns the track is gone and removes its own copy.
Deleting a saved place works the same way, and can be done from either end: deleting it in the app also removes it from navgps.app, and deleting it on the web removes it from the app.
Unpublishing a trail removes its Trail Library listing.
Signing out deletes that browser's session.

Deleting a track in the app removes only your local copy. The app has no way to delete the server's copy of a track; use the website for that.

What has no deletion path today

These are stated plainly because no code removes them: your device registration and its token, your display name, the last location you shared to a Family Circle, emergency alerts you have raised, and the vehicle records held against your adapters — including the VIN. Nothing in the app or on this site deletes them, and nothing expires them on a timer. If you want them removed, ask through support.

Two things do age out of view without being deleted: a shared position older than 24 hours is reported as "no location", and an emergency alert stops being shown 24 hours after it was raised, or as soon as it is resolved.

Security

Everything the app sends and receives travels over HTTPS.
Your device token is the only credential. It is held in the iOS Keychain, readable only after the device has been unlocked once, and is not synced to iCloud Keychain.
The API will return or change your tracks, places, circles and vehicle records only when your device token is presented, and a track upload is accepted only for a track that token owns.
Browser sessions use an HttpOnly, Secure, SameSite=Lax cookie. Renaming or deleting from the web additionally requires a header that a cross-site form cannot set.
Web sign-in hands the session to whoever asked for the code, not to whoever knows the six digits — so knowing someone's code does not get an attacker into their account.
The live-track, My Tracks, convoy and invite links described above are protected only by being unguessable. Anyone you give one to can use it.

Changes to this policy

When this page changes, the "Last updated" date at the top changes with it. The current version always lives at navgps.app/privacy.

Contact

Questions about this policy, about what NavGPS holds, or a request to remove something, go through support.