Privacy policy
- Your location is processed entirely on your device. It is never sent to me or to anyone else.
- The app contacts exactly one server — lpk.gridreference.blerg.net — to download map-label packs. That is its only network traffic.
- No accounts. No analytics. No advertising. No trackers. I never sell data.
- This website sets no cookies and runs no analytics.
- Like any web server, my server sees your IP address when the app downloads a pack — and because which pack you receive depends on roughly where you are, that download can indicate a broad region (for example, “Great Britain”). Nothing more precise than that is ever visible to me.
1. Who I am
Grid Reference (“the app”) and this website are developed and operated by Arthur Embleton (“I”, “me”), based in the United Kingdom. I am the controller of the personal data described in this policy — which is, by design, very little. The app’s application ID is net.blerg.gridreference.
2. Permissions the app requests
- Android: ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION, to determine your position; and INTERNET, to download label packs.
- iOS: location access “while using the app” (NSLocationWhenInUseUsageDescription). The app requests no background-location permission and does not track you while closed.
Deny the permission and the app simply cannot work out a reference — nothing else about it changes. You can change your choice at any time in your device’s settings.
3. Location data: collected once, used locally, never transmitted
When you grant permission, your device’s operating system supplies your position to the app while you are using it. Everything the app does with that position happens on your device:
- the position is converted into an Ordnance Survey National Grid reference (WGS84 → OSGB36 datum shift, National Grid Transverse Mercator projection, grid letters and figures);
- it is matched against a cached, on-device label pack to produce the “where you are” phrase (“in Sheffield”, “on Church Street”, “120m south east of Pennine Way”).
No coordinates, grid references, place names or any other derivative of your position are ever included in any network request the app makes. The app does not keep a history of your positions and does not write your location to storage.
4. What the app sends over the network
The app’s only network traffic is a small set of HTTPS downloads from lpk.gridreference.blerg.net:
- /manifest.json — the index of available label packs; and
- a pack file such as /gb.lpk — static map-label data for a region.
These requests happen when: you first use the app in a region; a cached pack is more than a month old and is refreshed in the background (only when your battery is above 50% or the device is charging); or your position falls outside every known region, in which case the manifest is re-checked at most once an hour.
As with any HTTP request, my server sees your IP address, user agent and the time of the request. The app sends no cookies, no advertising identifiers and no device identifiers. The requested URLs are static file paths containing no coordinates, query parameters or personal data.
One nuance I disclose plainly: which pack your device downloads is chosen from the manifest by where you are, so the request itself can indicate a broad region — downloading gb.lpk, for example, tells the server that the device is somewhere within the Great Britain bounding box. No finer information than that is derivable, and the app never needs the network to show your grid reference: cached packs answer queries even with no connectivity at all.
5. Who I share data with
The categories of parties that may process data relating to the app or this website are:
- Hosting and infrastructure providers — lpk.gridreference.blerg.net is served by Cloudflare, which processes request logs on my behalf, solely to deliver the files and keep the service working.
- App platform providers — Google (Google Play) and, for the iOS build, Apple — handle distribution, updates and any crash or diagnostic reporting under their own privacy policies. I do not receive personally identifiable diagnostics from them.
- Operating system vendors (Google, Apple) — the location permission and the location services themselves are provided by your device’s OS; how that data is handled at OS level is governed by their policies.
- Legal disclosures — I may disclose information if the law requires it.
That is the whole list. I do not share data with advertisers, ad networks, analytics providers, data brokers or social media platforms, and I never sell personal data.
6. What the app stores on your device
The app’s only significant persistent files are the label-pack cache — the manifest and downloaded packs, kept in the app’s private storage. These contain open map data (feature names and locations), not personal data. Deleting the app deletes the cache. A cached pack older than a month is replaced in the background when battery conditions allow.
Nothing else is persisted: no account, no settings profile, no location history.
7. Device backups
On Android, the app opts in to the platform’s standard backup mechanism, so your device may include the label-pack cache in backups managed by Google, according to your device’s settings. That cache contains no personal data. On iOS, standard device backups may likewise include app data, under Apple’s policies.
8. Third-party content and licensing in the app
- “Where you are” data is derived from OpenStreetMap: © OpenStreetMap contributors, ODbL 1.0. The attribution is shown in the app’s footer.
- The app contains no third-party analytics, advertising or tracking SDKs.
9. This website
This site is static: it sets no cookies, runs no analytics, loads no third-party scripts, fonts or images, and stores nothing in your browser. My web server records standard access logs (IP address, user agent, timestamp, requested path) for security and troubleshooting. These logs are kept only for a short period and are accessible to my hosting provider, Cloudflare, as part of operating the service.
10. Security
All app-to-server traffic uses HTTPS. Pack downloads are verified against a SHA-256 digest published in the manifest before use. I deliberately minimise what exists to protect: there are no accounts and no personal records on my servers beyond the transient request logs described above.
11. Children
The app is a general-audience utility and nothing in it collects personal data from anyone, of any age. I do not knowingly collect data from children.
12. Changes to this policy
If the app’s behaviour changes, so will this policy. Material changes will be reflected in the effective date above; the app’s data-handling features are also described in its store listing.