Concepts

Privacy

TripLibre has no account, no server, no analytics SDK and no sync. Your travel history stays on your iPhone unless you export it yourself. This page lists every exception, and every statement on it can be checked in the code.

What is stored

One SQLite file inside the app's sandbox (Library/Application Support/HHT/travel.sqlite) holds raw GPS fixes, CoreMotion activity, inferred and corrected visits and trips, your places, flights, life phases, stamps you tapped, and the audit log. A stamp keeps only a coarse location (rounded to about 110 m) and doesn't need a precise fix to be saved.

Daily backups: a full copy of the database goes to Documents/Backups once a day (the last 7 are kept).
Exports go to Documents/Exports, one folder per export.
Widgets: a small summary file (widget-snapshot.json) sits in the app's App Group container. It holds counts, times and the names of places you named yourself: no GPS points, routes, coordinates or addresses.
Settings (switches like Look up addresses) are kept in the app's preferences.

Backups and exports are visible in the Files app under On My iPhone › TripLibre.

When TripLibre uses the network

Recording, inference, corrections, stats, widgets, backups and exports all work offline. The app goes online only in these cases:

What is sent	When	To
Nothing, by default	—	—
One place coordinate at a time	Only if Settings › Look up addresses is on (off by default)	Apple's geocoder (CLGeocoder)
Map tile requests for the visible area	Whenever a map is on screen	Apple Maps
Nothing about you (it downloads a public CSV)	Only when you tap Download airport list and confirm	The OurAirports data mirror on GitHub Pages (`davidmegginson.github.io`)
Whatever you choose to share	Export › Share	The destination you pick

Map tiles reveal the area you are looking at to Apple, like any map app. TripLibre has no server of its own, so the developer never receives anything.

Your iOS device backup (iCloud or Finder) includes the app's container, like any other app's data, and that includes the database and the daily backups. Turn off iCloud Backup for TripLibre if you don't want that.

What an export contains

An export is the main way data leaves your phone, so it is worth knowing exactly what is in one.

The Range picker (Everything or Last 30 days) limits trips, segments, visits and stamps in the CSV, JSON and GeoJSON files. Places, flights, life phases and the audit log are always complete.
The Include raw GPS points switch (on by default) controls raw_location_points.csv and motion_activities.csv.
Every export also contains travel.sqlite, a complete copy of the database, whatever the range and the raw-points switch say. It includes every GPS fix you have recorded.

To share less today, open the export folder in Files and delete travel.sqlite and any other files you don't want to send before you share it. The full file list is in the Data dictionary.

Planned Choosing specific dates, trips and a level of detail, with the database snapshot following the same choice (see the roadmap). Not available yet.

You're in control

Stop collection any time: Settings › Record location. Data already recorded is kept until you erase it.
Correct or delete any visit, trip or place. Deleted records are hidden everywhere and left out of CSV and GeoJSON exports, but stay in the database (and in data.json and travel.sqlite) for the audit trail until you erase.
Export everything at any time as CSV, JSON, GeoJSON or SQLite.
Erase all data (two confirmations) deletes every raw point, motion record, visit, trip, place, flight, stamp, life phase and audit entry from the database, and the widget summary is rewritten as empty. Backups and exports in Files are left for you to delete yourself.
Delete the app to remove everything in its container at once, including the database and the backups and exports stored in it. Copies you shared, and device backups, are not affected.

Erase removes the rows, but SQLite can leave fragments of deleted data in unused parts of the file until they are overwritten. If that matters for your threat model, delete the app as well.

Re-identification risk

Keeping data on the phone removes the server, not the sensitivity. A location history reveals where you sleep, work, worship, see a doctor and spend the night, and a handful of such places is often enough to identify a person even with the name removed.

Treat raw_location_points, visits, places, trip routes and trip ends as identifying.
Trips that start or end at home reveal home, even with the route removed.
Place names you type, notes and the audit log can contain personal details too.
Places you visit can reveal other people, such as a friend's home.

Sharing safely

If you publish anything, share aggregates only: cities, airports, flight routes, mode shares, trip counts. Never share raw_location_points, visits, or trip routes near home. If you give data to a research study, make sure you know who will hold it, for how long, and how to withdraw. See Research uses & limitations.

App Store privacy details

In progress The App Store version (see the roadmap) will be the same app with the same behaviour. Its App Store privacy details will be written from this page, and this page will be updated if anything about data handling changes.

Verifying it yourself

Because TripLibre is open source, you don't have to take this page's word for it. All network access is in three places:

App/Location/PlaceGeocoder.swift: optional reverse geocoding
The airport-list download in App/Screens/SettingsView.swift (URL in Importer.ourAirportsURL)
MapKit views (map tiles)

Export contents are defined in Packages/HHTCore/Sources/HHTCore/Export/Exporter.swift, and Erase in TravelStore.eraseAll(). To report a privacy or security problem, see SECURITY.md.