Not the Wrong WayPrivacy policy
Last updated: 4 October 2026
This policy explains how the Not the Wrong Way app and this website use personal data. Not the Wrong Way is made by Ikibiko Ltd (“we”, “us”), a company registered in England and Wales (company number 13833535), registered office 8 Beech Close, Faversham, Kent, ME13 7SL, United Kingdom. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. If you are in the European Economic Area, the EU GDPR also applies.
Questions or requests: privacy@notthewrongway.com.
The short version
- The app uses your location only during a journey, or when you search or drop a pin. Your journeys are stored on your phone.
- You don’t need an account. If you create one, your journeys, saved places and settings sync to our cloud database in the EU so they’re on all your devices.
- We never sell your data, and we never give your location or journeys to advertisers.
- The app shows ads unless you buy “Remove ads”. Personalised ads and usage analytics only run if you agree. You can change your mind at any time in Settings → Privacy and ads.
- You can delete your journeys, or your whole account, from inside the app.
1. What we collect and why
Data protection law requires a “lawful basis” for each use of personal data. Ours are shown in the last column.
| Data | What we use it for | Lawful basis |
|---|---|---|
| Location during an active journey, including when the app is in the background | Checking you’re not heading the wrong way, warning you about your arrival time, drawing where you can wander, and recording the route you took | Contract (providing the app you asked for) |
| Journey history: destination, start and end times, route trail, stops, settings used | Showing your past journeys. Kept on your phone; synced to your account if you have one and history sync is on | Contract |
| Saved places and settings: home, work, favourites, recent destinations, preferences | Making the app work the way you’ve set it up; synced to your account if you have one | Contract |
| Account details: email address, password (stored only as a secure hash by our authentication provider), account ID | Signing you in and syncing your data between devices | Contract |
| Search text and your approximate location while searching; the position of a dropped pin | Finding places near you and naming a pin you drop on the map | Contract |
| Route requests: start point, destination, travel mode and route preferences | Calculating routes and the area you can wander in | Contract |
| Advertising data: advertising identifier (where allowed), IP address, device and app information, ad interactions | Showing ads, and personalised ads if you agree | Consent (personalised ads, and storing or reading identifiers on your device where consent is required); legitimate interests (non-personalised ads, fraud prevention) |
| Usage analytics: app instance ID, device model, operating system, approximate country, and events such as “journey started” with the travel mode, preference and a rounded duration | Understanding which features are used so we can improve the app | Consent |
| Crash reports: technical details of the crash, device model, operating system, app version, installation ID | Finding and fixing bugs | Legitimate interests (keeping the app working). You can switch this off |
| Purchase status: whether you’ve bought “Remove ads” | Hiding ads. Payment is handled entirely by Apple or Google; we never see your card details | Contract |
| Journey logs (only if you turn on Developer mode) | Kept on your phone only. If you choose to send them to us, we use them to investigate the problem you reported | Consent (you choose to send them) |
| Messages you send us: your email address and what you write | Answering you | Legitimate interests |
We don’t use your data for automated decisions that have legal or similarly significant effects on you.
2. Your location
Not the Wrong Way is a navigation app, so location is central to it. We keep its use as narrow as we can:
- Location is used only during an active journey, or at the moment you search, drop a pin, or ask the map to show where you are. When a journey ends, tracking stops.
- We ask for “Always” (background) location so the app can keep warning you while your phone is locked or in your pocket during a journey. It isn’t used in the background at any other time. You can change the permission in your phone’s settings; the app will still work, but warnings may stop when the screen is off.
- Your recorded route is stored on your phone. It only leaves your phone if you create an account and history sync is on (you can switch sync off in the app).
- When you search, your search text and your approximate position are sent to a place-search service (Photon, run by komoot) so nearby results come first. When you plan a route, the start and destination are sent to our routing server, which asks Stadia Maps for the route. Stadia Maps receives the points but not your IP address or any account details.
- We never send your location or journeys to advertisers or analytics providers.
3. Ads, analytics and crash reports
Ads
The free app shows ads from Google AdMob on the Past Journeys, Places and journey-finished screens. Ads are never shown on the map or during a journey. If you’re in the UK, EEA or Switzerland, the app asks for your consent before personalised ads are shown, using Google’s consent tool. On iPhone, Apple’s “Allow tracking” prompt also applies. If you decline, Google may still show non-personalised or limited ads, which use less data. You can change your choices at any time in Settings → Privacy and ads → Ad privacy choices, or remove ads entirely by buying Remove ads.
Google uses the data it receives under its own policies: see how Google uses information from apps that use its services.
Usage analytics
We use Google Analytics for Firebase to count how features are used. It only runs if the toggle in Settings → Privacy and ads is on and, where consent is required, you agreed to it. The events we send never include your location, place names, routes or account details.
Crash reports
We use Firebase Crashlytics to receive reports when the app crashes. Reports contain technical information only. You can switch them off in Settings → Privacy and ads.
4. Who we share data with
We share personal data only with service providers that help us run the app. They act on our instructions, except where noted as independent controllers.
| Provider | What they do | Where |
|---|---|---|
| Google (Firebase Authentication) | Account sign-in | USA and other Google locations |
| Google (Cloud Firestore) | Storing synced journeys, places and settings for account holders | European Union (Belgium and the Netherlands) |
| Google (Cloud Functions) | Our routing server | United Kingdom (London) |
| Google (Analytics for Firebase, Crashlytics) | Usage analytics and crash reports | USA and other Google locations |
| Google (AdMob) | Showing ads. Google acts as an independent controller for some advertising purposes | USA and other Google locations |
| Stadia Maps, Inc. | Calculating routes and travel-time areas (receives route points only, via our server) | USA |
| komoot GmbH (Photon) | Place search and naming dropped pins (receives your search text, approximate location and IP address) | Germany |
| OpenFreeMap | Map images (receives your IP address and the map area being viewed, as with any web request) | European Union |
| Apple and Google | App distribution and in-app purchases, under their own privacy policies | Worldwide |
| DreamHost | Hosting this website and our email | USA |
We may also disclose data if the law requires it, to protect our rights or someone’s safety, or to a buyer if our business is sold (in which case this policy would continue to apply).
5. International transfers
Some providers process data outside the UK and EEA, mainly in the USA. Where they do, the transfer is protected by the UK Extension to the EU–US Data Privacy Framework (for certified companies such as Google), or by the standard contractual clauses and the UK International Data Transfer Addendum included in the provider’s data processing terms. Contact us for more details.
6. How long we keep data
- On your phone: journeys, places and settings stay until you delete them or uninstall the app. Developer-mode journey logs are kept for 7 days.
- Your account: synced data is kept until you delete it or your account. When you delete your account in the app, your cloud data is deleted straight away and removed from our systems within 30 days.
- Routing server logs: 30 days.
- Analytics: event-level data is kept for 2 months; aggregated reports (which don’t identify anyone) for longer.
- Crash reports: 90 days.
- Emails and journey logs you send us: up to 2 years after the conversation ends; logs are deleted once the problem is resolved.
- Advertising data is kept by Google under its own retention policies.
7. Your rights
You have the right to access, correct, delete, restrict or object to the use of your personal data, to receive a copy of it in a portable format, and to withdraw consent at any time (this doesn’t affect anything done before you withdrew it). Many of these you can do directly in the app; for the rest, email us. See Your data rights for how, and Delete your account.
8. Children
The app is not intended for children under 13, and we don’t knowingly collect their data. If you think a child under 13 has given us personal data, contact us and we’ll delete it.
9. Security
All data sent between the app and our services is encrypted in transit. Cloud data is encrypted at rest, and access rules ensure each account can read and write only its own data. No system is perfectly secure, but we take reasonable measures to protect your data and will tell you and the regulator if a breach puts you at risk.
10. This website
This website doesn’t use cookies, analytics or any third-party services; fonts and images are served from our own server. Our host keeps standard server logs (including IP addresses) for security and troubleshooting. See Cookies and identifiers.
11. Changes to this policy
We’ll update this page when our practices change and change the date at the top. If a change is significant, we’ll tell you in the app before it takes effect.
12. Complaints
Please contact us first at privacy@notthewrongway.com so we can try to put things right. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113), or to the data protection authority where you live or work in the EEA.