Where your location goes.

Heretofore is made by Corvie, LLC. This page says, in plain words, what the Heretofore app for iOS and this website do with information about you: which services see what, what is kept, and what you can delete. The ⓘ button on the map opens the app’s own Location & Privacy page.

• There is no account. The app knows you by a random identifier made on your phone. Our server keeps a one-way hash of it, never your name, your email or your Apple account.
• Your location goes to our own server when you press Find a Story and while a road trip is on. On a road trip, and only then, a map-data provider also receives it, to name the road and the town.
• Explore as you go keeps the ground you have walked on your phone, and your route never leaves it. A road trip is the one exception: a few points of the road go to the host, as described below.
• Nothing about you is sold or used for advertising. The app and this site carry no analytics or tracking software.

• What identifies you
• Find a Story
• The map
• Explore as you go
• Road trip mode
• Audiobook mode
• Narration
• Your Library and iCloud
• Story locations
• What our server keeps
• Who sees what
• Children
• This website
• Changes, and writing to us

What identifies you

• When the app first runs it makes a random identifier and keeps it in your phone’s Keychain. That identifier goes with the requests that concern your Library: finding a story, canceling a search, collecting a story, opening its telling, asking for narration or for its cost card, and keeping your Library in step with our server each time you open the app, which sends the identifiers of the stories you hold and have hidden, never their text. Our server stores only a one-way hash of it, under a record we call a reader.
• The identifier does not travel to another phone with a backup. A new phone is a new reader to our server; your Library comes back through iCloud instead, as described below.
• We never ask for, and the app never sends, your name, email address, phone number, Apple ID or advertising identifier. There is nothing to sign up for.
• Every request to our server carries a token from Firebase App Check, a Google service, backed by Apple’s App Attest, which proves it came from a genuine copy of the app on a genuine iPhone. Most tokens are good for one request only; browsing the map reuses one. The token identifies the app, not you. Everything the app sends travels over HTTPS.
• A signed-in iCloud account is needed, because that is where your Library lives. Until the app can verify one, the Library, the Passport, search, Find a Story, collecting, road trips and audiobook mode stay locked.

Find a Story

A search starts from your phone’s current location or, with Find a Story anywhere, from the pin you placed on the map. What goes to our server is that coordinate, its accuracy and the moment it was taken (for a current location only), whether it was your location or a pin, the radius you set, the genres you chose, your installation identifier, and the identifiers of the stories you already hold, so that none of them is handed to you twice.

• Our server measures how far that coordinate lies from the stories it already holds and hands you the nearest. The search is answered from our own database. No map, search or AI company receives your coordinate, and no outside service is called.
• When a story is handed to you, our server keeps a receipt: the story, the coordinate and its accuracy, when it was taken, whether it was your location or a pin, the radius, and the distance to the story. The receipt is what lets this phone get back a story it was handed but never saved, and keeps the same story from being offered to you again. A new phone cannot use it; your Library comes back through iCloud, as described below. The coordinate is yours to see: it is in the story’s small print, under Request.
• When nothing is found, our server keeps nothing about the search.
• If you cancel a search, our server records the cancellation: the hash of your installation identifier, the search’s own identifier and the time.
• On your phone, the request is written to disk until the story is saved or the search is abandoned, and the saved story keeps the coordinate it was found from. Your phone also remembers the area, radius and theme of a search that came up empty, so the map can show where the catalog has nothing left for you; that stays on the phone and in its backups.

The map

• The Atlas is Apple Maps with Heretofore’s watercolor painted over it. Apple’s map is drawn underneath either look, plain Apple Maps or the watercolor atlas, so moving the map reaches Apple as it does in any app that shows Apple’s maps. Typing in the search box sends what you type, and the region you are looking at, to Apple’s local search. A place you choose becomes where the lantern stands; it goes to our server only when you press Find a Story.
• While the watercolor is showing, its tiles come from Heretofore’s own map host as you move. Each request names only the map squares in view. It carries no installation identifier and no story data, and reaches our host through Cloudflare, with your IP address as any web request does.
• To draw the pins, your phone downloads the catalog’s pin list, which is the same for every phone: each story’s place, genre, title and identifier, never its telling. To find stories in the areas you view or have walked, it asks our server for stories by map square. To show how many stories the catalog holds for each place on your Library’s shelves, it sends our server those place names. None of these requests carries an installation identifier, though they reveal the areas you are looking at and the places your Library spans.

Explore as you go

Explore as you go is off until you turn it on from the Atlas. Turning it on asks iOS for location in the background, with precise accuracy, and for permission to notify you if “Tell me when I pass a story” is on. To stop it, turn it off from the same place on the Atlas, or take the permission back in iPhone Settings › Privacy & Security › Location Services › Heretofore; anything short of Always with Precise Location pauses it. “Tell me when I pass a story” stays on until you turn it off, there or in iPhone Settings › Notifications.

• Your phone notes the ground you cover as map squares about a city block across, with no times and no order, in the app’s own storage, and so in your phone’s backups. The clouds lift for 500 meters around you, and any story inside that ground is matched to it on your phone. Your route never leaves your phone.
• Two things do leave it. As you enter new ground, the phone fetches the catalog for broad map areas a few kilometers across, so our server can see which areas were requested and when, without an installation identifier. And the stories you collect are reported with your installation identifier: at once if the app is open, otherwise the next time you open it. Our server records which story was collected and when your phone reported it, never where you were. A story’s pin is public, so that record does imply you were near it around that time.
• You can collect up to 500 stories a day; the rest wait for tomorrow.
• A notification that names a story you have passed is made by your phone itself; nothing is pushed to it from our server. On the Lock Screen it says a story is waiting along your way and shows the story’s title with the town and county the Library files it under, or the site’s name when it has neither; several stories found at once are listed by title.
• Forget Walked Ground, in Settings, erases the squares and returns the clouds. The stories you collected are kept, each with the story’s own place and the moment your phone noticed it; that list stays on the phone and in its backups, even for stories you later delete, so walked ground does not hand them back.
• An outing log, off unless you turn it on in Settings, keeps your fixes with their times, and on a road trip or in audiobook mode the words the host and narrator spoke, with the road and town named for them, on this phone and so in its backups, until you clear it. iOS’s own daily reports on the app’s battery and location use are saved the same way. Neither is sent anywhere.

Road trip mode

A road trip uses your location in the background while the trip is on, whatever the Explore switch says, and stops when you end it. The line of the way you have driven is drawn on your phone from the point where you began and erased when the trip ends. The ground you drove over stays as walked squares, exactly as in Explore as you go, until you use Forget Walked Ground. Each story you reach is collected and reported as above, and its telling and narration are brought down.

• The host’s words are written on our server. For an opening or a hinge, your phone sends your current position (the coordinate, your heading and speed, and the time of day as morning, evening and the like, never the clock), the destination you typed, how long and how far you have driven, the stories heard and passed, and, before a hinge, up to eight points of the road since the host last spoke, at least a kilometer apart, so the host can name the towns you crossed.
• Our server sends your position, and up to four of those road points, to LocationIQ, a map-data provider, which returns the road, town, county and state. Those names, never the coordinate, go to OpenAI with the facts of the trip. OpenAI writes the host’s words and, for the opening, may run one web search about the town. We ask OpenAI not to keep what it is sent. Inworld, a speech provider, voices the words and receives only the text.
• The host’s requests carry no installation identifier. Nothing about your trip is stored in our database. Our logs record the web searches the host ran, which can name the town, along with ordinary service measurements, without a coordinate or an identifier.

Audiobook mode

• When the narrator takes you through a set, your phone names the town from your Library’s shelves and sends the identifiers of your unplayed stories there, which of them you have heard, and the themes already used. No coordinate leaves your phone.
• OpenAI plans the set and writes the narrator’s words from our catalog, and may look the town up on the web for the opening: up to two searches, and twice that if the opening has to be written again. We ask OpenAI not to keep what it is sent. Inworld voices the words. Nothing about the set is stored in our database; as with the host, our logs keep the web searches run, which can name the town and the theme. The words come back signed, and only the narrator’s own words can be voiced.

Narration

• When a story is voiced, its text goes to Inworld. Nothing about you goes with it. One recording is made for each story and shared by everyone who plays it; stories already voiced for someone else play without a new recording.
• Recordings are served through Cloudflare from storage at Backblaze with a short-lived link that names the recording, not you. Your IP address reaches Cloudflare as with any download, and Backblaze only if a download falls back to the storage itself. The recording is kept on your phone, up to 500 MB of the most recent, and Clear Audio Data in Settings removes it.
• Our server keeps a daily count of the new recordings made at your request and a record of which story versions were voiced for you, to account for the cost. It keeps no record of what you play or when.
• While a story plays, your phone’s Lock Screen and Control Center, and a car display it is connected to, show the story’s title and the place it is filed under, as they would for any audio. That stays on the phone.

Your Library and iCloud

• Your Library is kept in your own iCloud account’s private database, which we cannot read, and that is how it reaches your other devices. It holds the identifier and first-heard date of each story you have heard, a copy of each saved story, and a marker for each story you have hidden or deleted. The copy omits the coordinate you searched from, though it keeps how far that was from the story.
• On your phone, the Library file keeps the stories with their search coordinates, and the app keeps your favorites, listening marks, Passport badges and recent place searches. Those stay on the phone and do not sync. All of it is in your phone’s backups.
• Deleting a story, or your whole Library, removes the copy from your phone and from iCloud. A marker that you heard it stays, so it is not handed to you again. Our server’s records of what was handed to or collected by your installation stay too; deleting your Library does not reach them. The shared catalog is not affected.

Story locations

A story’s location comes from its sources. Heretofore never turns your search origin, a model’s guess, or the middle of an area into a story location. A story with only broad geography stays available as a narrative without a map marker, labeled an approximate area. A location may identify a business or a private residence; it is context, not an invitation to visit. If a story names you, or points at your home, and you want it corrected or taken down, write to us and we will look.

What our server keeps, and for how long

Tied to the hash of your installation identifier, our server keeps: the reader record and when it was last seen; the Find a Story receipts described above, with their coordinates; which stories your installation collected and when; canceled searches; the daily count of new narrations and which story versions were voiced for you; and the acknowledgments your phone sends when it saves or hides a story. We keep these for as long as we run Heretofore, and in our database backups. They cannot be deleted from inside the app, and today we cannot delete them on request either: we hold only a hash of an identifier the app never shows, so we have no sure way to tell which records are yours. If that changes, this page will say so. Write to us with any question about them.

Our operational logs hold no coordinates, no installation identifiers and no Library contents. They record the host’s and the narrator’s web searches, which can name a town or a theme, and the usual measurements of each service. Credentials for every provider stay on our server; the app holds none. Our server and database run on Google Cloud in the United States; recordings and map tiles are stored at Backblaze and served through Cloudflare.

Who sees what

Children

Heretofore is not made for children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the app in a way that concerns you, write to us.

This website

• This site is a set of static pages. It has no accounts, no forms, no cookies and no analytics. Your choice of Paper or Lamplight is kept in your browser’s local storage and nowhere else.
• The demonstration maps load watercolor tiles from our map host, so your browser’s IP address reaches that host as well as the host serving these pages. The map library, fonts and sample recordings are served with this site. Recordings load only when you use a player. The site cannot use your location, and the map says so.
• Write to us opens your own mail app with our address. Nothing is sent through the site.

Changes, and writing to us

When what the app does with information changes, this page changes with it, with the date below. Questions about any of it: write to us.

Updated October 14, 2026

← Back to the Atlas