Privacy
tally.place is a game about counting ground, and counting ground means knowing where you have covered. This page says exactly what that involves: what is collected, what is published, what is never collected at all, and how to remove it.
Last updated 31 August 2026
The short version
- Your coordinates never leave your phone. The app turns each position into the identifier of a pentagon and throws the coordinate away. There is no field in anything we send or store that could hold a latitude.
- Nobody can look up where you have been. No page, link or interface lists one person's pentagons. Not for other players, not for us, not for anyone. This is a property of what was built, not a setting.
- No times are ever published. Not for you, not for anyone. Time of day is the most identifying thing in this kind of data.
- We do not know your name. You can sign in with Apple, with Google, or by an email link. We ask Apple and Google for no personal details and receive none. If you use an email link we send one message to the address you give and keep only a one-way hash of it — which means we cannot read it back, cannot email you again, and cannot tell anyone whether a particular address has an account.
- The website collects nothing. No analytics, no tracking, no cookies.
- You can take everything with you, or delete all of it, from Settings in the app, without asking us. Deleting takes it off our side and off your phone.
1. Who is responsible for your data
tally.place is operated by an individual sole trader in the United Kingdom, who is the data controller for the purposes of UK GDPR. Write toprivacy@tally.place for the controller's full legal name and postal address, to exercise any of the rights in §9, or about anything else on this page.
There is no Data Protection Officer. One is not required for a service of this kind and scale, and saying so is more useful than leaving you to guess.
2. What the app collects
While you are recording, your phone samples its position every second or so on iOS and every few seconds on Android, and only when you have moved about ten metres. Each position, and each line between two positions, is converted on your phone into the identifiers of the pentagons it falls in.The coordinates are then discarded.
What leaves your phone is a list of entries, each of which is:
- a pentagon identifier, a cell of the world about 56 metres across;
- a timestamp rounded to the minute;
- two flags: whether the entry came from a line between two fixes rather than a fix, and whether the journey was fast enough to have been a train or a plane.
That is the whole payload. It is sent over an encrypted connection, in batches, and your phone applies every rule (the thirty-minute cooldown, private places, journey-tail suppression) before anything is sent, not after it arrives.
Recording sessions, and recording with the screen locked
Recording happens in sessions of a set length — 30 minutes, 1 hour, 2 hours or 4 hours — and a session stops by itself at the end of it. During one the app keeps recording with your phone locked and in your pocket, so that you are not obliged to travel holding an unlocked phone. On Android, opening the app starts a session, because opening the app is nearly always the act of setting out; it is the first switch under “Recording” in Settings, and turned off, sessions begin only when you choose one. On iOS you always choose.
While a session is running, all of the following are true:
- your phone says so, and we cannot suppress it: on iOS the location indicator in the status bar, on Android a notification that stays for as long as the session runs;
- that notification, and the iOS lock screen, show a countdown and the pentagons collected so far;
- the end time was fixed when you started and cannot be extended without you doing it;
- the app has only foreground location permission. On iOS that is “While Using” rather than “Always”; on Android the app never asks for background location at all.Nothing is recorded while the app is not running, and closing it ends the session. A session can begin when you open the app; none can begin when you have not.
There is no way to make the app record indefinitely in the background, deliberately.
3. What never leaves your phone
- Coordinates. Converted to pentagons and discarded, always, before anything is stored or sent.
- Anything inside a private place. It is filtered out on the phone, along with the first and last 200 metres of any journey that starts or ends inside one, so that the edge of a private place is not drawn by the traffic around it.
3a. Private places
If you tell the app somewhere is your home, or anywhere else you would rather not count, that definition — a point and a distance around it — is stored on your device and on your account, so that it is still there when you change phone. Nothing recorded inside it is ever counted or sent, which is the part that does the work.
It is held against your account and nobody else’s, and no part of this service shows one person’s private places to another. It is removed when you delete your account, and deleting a private place removes the location from our records and leaves only the fact that something was deleted, so your other devices know to remove it too.
4. What we hold about you
| What | Detail |
|---|---|
| Your account | A handle you choose, an account identifier, and one opaque identifier for the way you signed in: what Apple or Google gives us, or — for an email link — a one-way hash of your address that cannot be turned back into it. Not your name, and never a readable email address. Signing in a second way makes a second account rather than joining them, because there is nothing held that could match the two. |
| Whether you are 18 or over | A yes or no. We do not collect your date of birth. |
| Your pentagons | For each pentagon you have been in: how many visits, when the first was, and when the most recent was. Taken together this is a record of where you have been, and it is the most sensitive thing we hold. |
| Your private places | For each one you set: a point, a distance around it, and the name you gave it if you gave it one. Held so that they are still there when you change phone. Nothing recorded inside one is ever counted or sent. |
| Your scores | Reach, Rarity and Depth, and the counts behind them. |
| Consent record | Whether you agreed to your data contributing to anonymous statistics, when, and which version of this page you were shown. |
| Invites | Your invite code, and who invited you if anyone did. |
| Device integrity | On iOS, a public key from Apple’s App Attest, used to check that syncs come from a real copy of the app on a real device rather than a script inventing journeys. Android has no equivalent that does not require a commercial account, so the Android app sends none. |
| A sign-in link, while it is in flight | If you sign in by email: a hash of the link, the four-character code the app shows you to compare against the message, and the times it was made, expires and was used. Fifteen minutes, one use. Your address is not part of it. |
| Reports you make | If you report a pentagon as somewhere people live, we record that your account did so. It is never shown to anyone but the controller, and never to the person whose pentagon it is. |
| Sponsorships | If you submit one: the name, the message, any offer code, and the domain if you proved one. |
5. What is public, and what never is
Public, on this website and in the app:
- each pentagon’s count of distinct people and its total number of visits;
- handles and scores on the leaderboards;
- whoever was first in a pentagon, but only if they chose to be named there. It is off by default;
- area summaries, and approved sponsorships.
Never public, for anybody:
- the list of pentagons any particular person has been in. No endpoint returns it, no map layer carries it, and no feature has been built that would need it;
- any timestamp of anybody’s activity, including yours;
- any coordinate, because none is held;
- private places, which are never shown to anyone but you.
Counts are shown in full, at whatever size they happen to be. Between March and August 2026 visit counts were capped at “20+” on pentagons only one or two people had been in; that cap was removed. If a count on a pentagon where you live looks like it says too much, you can remove your visits from it (see §9), or report it and it will be looked at by a person.
6. This website
The site sets no cookies, runs no analytics and containsno tracking of any kind. There is nothing to accept and no banner to dismiss, which is why you have not seen one.
The map is drawn from map data we fetch on your behalf, rather than your browser fetching it directly, so that the map provider never learns your IP address or which streets you are looking at. Place searches work the same way: the search term goes through our server, which forwards it and keeps no record of the term, the result, or who asked.
The one other page you might reach from us is the sign-in link sent by email. It sets no cookies, loads nothing from anywhere else, asks search engines not to index it, and exists only to let you approve a sign-in you started in the app.
You cannot record a journey from this website, and never will be able to. The reasons are on the about page.
7. How long we keep it
| What | How long |
|---|---|
| Your pentagon records | For as long as your account exists. They are what your scores are made of. Delete your account, or mark an area private, and the records go immediately. Your phone keeps its own copy, which is what draws your map; deleting your account empties that too. |
| A sign-in link | Fifteen minutes, or until you use it, whichever comes first. Then deleted. |
| Records of your contribution to statistics | 730 days, then deleted automatically. |
| Pentagon counts | Indefinitely. Once no record connects a count to a person, it is no longer about anybody. |
| Anonymous aggregate statistics | Indefinitely. Once published they cannot be recalled, which is why consent is asked for separately and why they are coarsened before release. |
8. Who else is involved
We use as few third parties as we can, and none of them is paid to profile you.
| Who | What they do | What they see |
|---|---|---|
| Apple | Sign in with Apple, App Attest, and the App Store | That you signed into this app, if you chose Apple. We ask Apple for no personal details and receive none. |
| Sign in with Google, and Google Play | That you signed into this app, if you chose Google. We ask Google for no personal details — not your name, not your address — and receive none. The Android app also uses Google’s own components on the phone for signing in and for reading the phone’s location. | |
| Cloudflare | Hosting, the database, and email | They process everything in §4 on our behalf, as our processor, and are contractually barred from using it for anything else. If you sign in by email, they also carry that one message. |
| Whoever runs your email | Delivering a sign-in link, if you ask for one | The message we send, as they would see any message. You choose them, not us. |
| OpenFreeMap | The background map | On this website, requests from our server only — not your IP address, not your browser. In the apps, the phone fetches map tiles directly, so they see your IP address and which squares of map you asked for, as the provider behind any map app does. They never see your pentagons, your account or your handle. |
| postcodes.io and OpenStreetMap Nominatim | Turning a place name or postcode into a location | The search term, from our server. Not who searched, and we keep no record of it ourselves. |
There are no advertising networks, no data brokers and no analytics providers, in the apps or on this site, and nothing in either reports what you do to anybody. The Android app does include Google’s own sign-in and location components, because on Android that is how both of those are done; nothing they hand the app goes beyond what §4 lists.
9. Your rights, and how to use them
Most of these do not require you to contact anybody. They are in the app because a right you have to ask for is a right with a queue in front of it.
| Right | How |
|---|---|
| See everything we hold | Settings → Export. A file, straight away, machine-readable. |
| Take it elsewhere | The same export. |
| Delete everything | Settings → Delete account. It removes your records, decrements every public count you contributed to, and empties the record held on your phone, which signs you out. It is not a request; it happens. The steps, and what is kept. |
| Remove part of your record | Settings → Private places. Mark an area private and every pentagon you have recorded inside it is withdrawn; the counts go down. The app says how many before it does it. There is no way to withdraw a single pentagon on its own. |
| Stop contributing to statistics | Settings, one tap, whenever you like. Withdrawing is as easy as agreeing was. |
| Pause collection | Stop recording. Nothing is collected while you are not in a session, and on Android you can also turn off the session that starts when you open the app. Signing out stops anything reaching the server at all. |
| Correct something | Your handle is editable. Visit records are observations of what happened and cannot meaningfully be corrected, but they can be deleted. |
| Complain to us | privacy@tally.place |
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk. You do not have to raise it with us first, though we would rather you did.
10. Why we are allowed to do this
| What for | Legal basis |
|---|---|
| Recording, counting, scoring, showing you the map: the game itself | Performance of a contract with you |
| Publishing pentagon counts and leaderboards | Performance of a contract, because publishing the counts is the service |
| Invites and their statistics | Performance of a contract |
| Checking syncs come from a genuine device, where the platform offers a way to | Legitimate interests: without it the counts can be faked, which would make them worthless to everyone |
| Anonymous aggregate statistics that may one day be licensed | Your consent, asked separately, never bundled, never assumed, and refusable with no loss of anything |
| Answering rights requests, keeping records we must keep | Legal obligation |
11. Children
You are asked, once, whether you are 18 or over. If you say you are not:
- you do not appear on the public leaderboards, and there is no switch to turn that on;
- your data is excluded entirely from the aggregate statistics, and you are not asked to consent to them;
- being first in a pentagon is never publicly attributed to you.
An account that has not answered the question is treated as though the answer were “under 18”, because that is the safe direction to be wrong in.
This website itself publishes counts, leaderboards and a map to anyone who visits, with no account and no age check. Nothing on it identifies a person beyond a handle they chose and a score.
12. If a pentagon says too much
The thing this design worries about most is a pentagon with one visitor and a very large number of visits, because that describes somewhere a person lives. Several things work against it: private places you declare, automatic detection of a residential pattern with a one-tap fix, and retraction.
If you see a pentagon whose counts you think give away somewhere people live,including one that is not yours, report it in the app. Reports go to a person, not to an algorithm, and you do not need to explain yourself.
13. Security, and what happens if it goes wrong
Everything is encrypted in transit and at rest, access is least-privilege, and on iOS syncs carry a signature from the device that made them. The strongest protection is structural rather than procedural: the most sensitive data does not exist on our servers to be stolen.A complete breach of our database would not reveal a single coordinate, a single private place, or the time of day anybody travels.
If a breach did occur that put people at risk, we will report it to the ICO within 72 hours and tell the people affected.
14. Changes to this page
When the behaviour changes, this page changes with it, and the date at the top moves. If a change affects what you have consented to, you will be asked again rather than told afterwards.
Questions, corrections and complaints:privacy@tally.place