A camera app that uploads nothing by default

The short version

• No tracking. No advertising identifier, no third-party analytics SDK, no linkage to identity, no data sold or shared with data brokers. The app declares no tracking domains because it contacts none.
• No account. There is nothing to sign up for.
• Perception stays on the device. During normal navigation, camera frames and depth are processed locally and are not uploaded.
• Sensor data leaves only with consent. Research Mode and active trials are the sole path, both off by default.
• No iCloud. Research uploads do not use iCloud or CloudKit.

Normal navigation

Camera and depth

The camera and, on supported devices, the LiDAR scanner run continuously while you navigate. Frames and depth maps are processed on the device to build the world model and plan the corridor. They are held in memory for as long as the perception pipeline needs them and are not written to a server.

Location

Precise location is used to place you on a route and to align the corridor with map data. It is used for the app to function, not for profiling, and it is not retained beyond the walk except where Research Mode is on.

Network requests

Destination search and routing require the network. When you search for a destination or request a route, the search text and an approximate location are sent to the mapping service that supplies routing, which handles that request under its own privacy policy. Once a route is active it is cached, so temporary network loss does not end the walk.

to confirm: name the mapping and routing provider here, and link its policy

On-device storage

Settings, feature flags, and saved preferences are kept in standard app storage on the device. The app reads file timestamps to manage report retention and staleness, and checks available disk space before preparing an upload. Both uses are declared in the privacy manifest with Apple’s required reason codes.

Research Mode

Research Mode is off by default. Turning it on is an explicit, revocable choice, and it is scoped to a trial rather than switched on indefinitely. While it is on, NaviGuider assembles a bundle around a reported or flagged moment and uploads it.

What a bundle contains

Camera and depth capture

Short clips around the moment under study, not the whole walk.

Precise location

The track for that segment, so a report can be tied to a real curb, crossing, or obstruction.

Diagnostic data

System state — confidence values, which utterance was selected and which were dropped, corridor width, thermal and battery state.

Research identifier

A per-install pseudonymous identifier. It groups your bundles across a trial. It is not an account, not the advertising identifier, and not connected to your name.

Why some of it is declared “linked”

The app’s privacy manifest declares camera capture, precise location, and diagnostic data as linked to the research identifier. That is deliberate and it is the honest declaration: a research bundle ties those pieces together by design, so calling them unlinked would be false. What they are not linked to is your identity, and none of it is used for tracking.

Where bundles go

Uploads are stored in a Supabase project controlled by NaviGuider, not in iCloud and not with an analytics vendor. to confirm: hosting region, retention period, and deletion schedule for research bundles

What we never do

• Sell or rent your data.
• Share it with advertisers or data brokers.
• Use it to build a profile of you or your movements.
• Upload camera, depth, or location data outside Research Mode or an active trial.
• Embed a third-party analytics or attribution SDK. There are none in the app.

Your choices

• Camera and location permissions are managed in iOS Settings. Revoking them stops the corresponding capability; NaviGuider will say what it can no longer do rather than degrading silently.
• Research Mode can be turned off at any time in the app. Turning it off stops all future uploads immediately.
• Deleting past bundles — email us with your research identifier, which the app shows in the Research Mode settings, and we will delete the bundles associated with it. to confirm: response time commitment
• Deleting the app removes all on-device data, including settings and the research identifier.

Children

NaviGuider is not directed at children and does not knowingly collect data from them.

Changes

If what the app collects changes, this page changes with it and the date below moves. Material changes to Research Mode will be surfaced in the app, not only here.

Contact

Privacy questions, access requests, and deletion requests go to nhellyer6@gmail.com. Related reading: the research program explains why the data in a bundle is what it is.

Last updated 27 July 2026.