Privacy at a Glance
- All your data is stored on your device only
- No user accounts or sign-up required
- No analytics, crash reporting, or telemetry
- No advertising or ad tracking
- No data sold or shared with third parties
- No cloud sync -- you own your data completely
- Face detection runs entirely on-device using on-device machine learning
- End-to-end encrypted sharing (decryption key never touches any server)
Introduction
Breadcrumbs ("the App") is developed by Slick Engineering & Consulting, Inc. ("we", "us", or "our"). We built Breadcrumbs with a privacy-first architecture: your personal data stays on your device and under your control. This Privacy Policy explains what data the App accesses, how it is used, and what limited information may be transmitted to external services.
Data Stored on Your Device
The following data is collected and stored exclusively on your device. None of this data is uploaded to our servers or any third party unless you explicitly choose to share it.
| Data Type | Purpose | Availability |
|---|---|---|
| Location | Detect venue visits in the background to build your timeline | On-Device |
| Photos | Match photos to venues by timestamp and GPS metadata | On-Device |
| Health Data | Show activity context (steps, walking distance, heart rate, walking steadiness) | On-Device |
| Motion & Fitness | Determine transit mode between venues (walking, driving, etc.) | On-Device |
| Face Detection | Cluster companion faces across your photos using on-device ML | On-Device |
| Bank Transactions | Match spending to venues and nights | Premium |
| Email Receipts | Parse rideshare and restaurant receipts on-device (full email content is never stored) | Premium |
| Music History | Show what you listened to at each venue | Premium |
| Calendar Events | Match calendar events to visits (read-only) | Premium |
| Phone Call Records | Show calls in your timeline | Optional |
System Permissions
The App requests the following permissions, each for a specific purpose:
- Location (Always): Detect venue visits in the background so your timeline builds automatically, even when the App is not open.
- Photos: Access your photo library to match photos to venues by time and GPS coordinates. Photos are never uploaded.
- Health (Read-Only): Read steps, walking distance, heart rate, and walking steadiness from HealthKit to display activity context alongside your timeline.
- Motion & Fitness: Access the motion coprocessor to determine how you traveled between venues (walking, driving, transit).
- Calendars (Premium, Read-Only): Read calendar events to match them to your visits.
- Apple Music (Premium): Read your listening history to show what you listened to at each venue.
- Notifications: Send morning recap alerts summarizing the previous night.
- Contacts (Optional): Look up names for phone calls displayed in your timeline. Contact data is never stored or transmitted.
Third-Party Services
Breadcrumbs communicates with a limited number of external services. We minimize the data sent to each service and never transmit personally identifiable information.
Our Proxy Server
The App sends venue lookup requests through our proxy server. This server receives GPS coordinates and returns venue information. Requests are authenticated using Apple App Attest to prevent unauthorized access. Our server does not log or store your coordinates.
Venue Lookup Services
GPS coordinates from your visits are sent (via our proxy server) to mapping and place-identification services to resolve venue names and details. Only coordinates are transmitted -- no personal information is included.
Weather Data Service
For each visit, the App sends the venue coordinates and date to a weather data provider (via our proxy server) to display weather conditions. No personal information is included in these requests.
Banking Data Provider (Premium)
If you connect a bank account, you authenticate directly with your financial institution through a secure third-party banking data provider. Your bank credentials are never seen or stored by Breadcrumbs. Transaction data is stored on your device only.
Email Providers (Premium)
If you connect an email account (Gmail, Outlook, or Yahoo), you authenticate directly with your email provider via OAuth. The App searches for rideshare and restaurant receipt emails and parses them on your device. Full email content is never stored -- only the extracted receipt details (amount, vendor, date) are kept on your device.
Encrypted Sharing Storage
When you share a night, the App uploads an encrypted binary blob to cloud storage. The data is encrypted with AES-256-GCM before leaving your device, and the decryption key is included only in the URL fragment (the part after the # symbol), which is never sent to any server. The storage provider cannot read your shared data.
Data Security
We employ multiple layers of security to protect your data:
- Database encryption: The on-device database is protected with iOS file protection, which encrypts data at rest and restricts access when the device is locked.
- Backup encryption: Local backups created within the App are encrypted with AES-256-GCM using a key derived through PBKDF2 with 600,000 iterations.
- Sharing encryption: Shared nights are encrypted with AES-256-GCM. The decryption key is embedded in the URL fragment and never transmitted to any server.
- App lock: Optional Face ID or Touch ID authentication using the Secure Enclave to prevent unauthorized access to the App.
- API authentication: All requests to our proxy server are authenticated via Apple App Attest to prevent abuse.
- No analytics or telemetry: The App does not include any analytics SDKs, crash reporting frameworks, or telemetry of any kind.
Data Retention and Deletion
Since all data is stored on your device, you have full control over its retention. You can delete individual nights, clear all data, or simply delete the App to remove all associated data from your device. We do not retain any copy of your data on our servers.
Children's Privacy
Breadcrumbs is not directed at children under the age of 13. We do not knowingly collect personal information from children. Since the App does not collect or transmit personal data to our servers, there is no server-side data to remove.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.
Contact Us
If you have questions or concerns about this Privacy Policy or the App's privacy practices, please contact us at:
Slick Engineering & Consulting, Inc.
ios-support@slick-engineering.com