Last updated: October 20, 2026
How It Went turns a multi-day trip into a short film, and is published by CodeUX.design e.U., Wenhartgasse 23/3/6, 1210 Vienna, Austria (the full details are in the imprint). This policy covers the iOS, Android and macOS apps and this website at howitwent.app.
The app works on your tracks, your photographs and your video. All of it is the kind of thing a privacy policy usually exists to explain the sharing of. None of it is shared. Your files are read on your device, the film is rendered on your device, and neither your material nor the film is ever sent to us or to anyone else. What the app does send is listed here and described below, each with what it carries:
Apart from the app, this website sends your email address to us and to the service that mails our news, if you sign up for news by email.
You pick three kinds of file, through your device's own file picker:
The app keeps its own copy of these inside its private storage, so that a tour is still there when you reopen it. Those copies stay on the device. Your originals are left where they are.
Everything the app works out from them — which day was which, where a photograph belongs on the track, what the film cuts to and when — is worked out on the device and written to a project file beside the copies.
There is no analytics SDK, no crash reporting and no advertising, and you don't need an account to use the app. Nothing sends your activity files, your photographs, your video or your finished film to us or to anyone else. We cannot see any of it, and there is no code in the app that could send it to us. The one place a whole tour goes is another device of yours, when you send it there, as described below.
A film can be drawn over a map, and those map tiles are downloaded when you tap Load map. No tiles are fetched until you do. The tiles are kept afterwards, so opening the same route again draws its map without downloading it. If the kept copy turns out not to cover your route, the app fetches a newer one without asking a second time. Each time it sends the diagnostic counts below, the app also downloads the small list of which map builds are current, so it can warn you before a kept one expires; switching the counts off stops that too.
The app asks howitwent-api.codeux.dev which build to use and
downloads it from our storage at Hetzner,
cux-hiw.fsn1.your-objectstorage.com. If none of our builds can
be read, it falls back to build.protomaps.com. Elevation comes
from mapterhorn.com. Those last two are not us. A request for
tiles necessarily describes roughly which part of the world your
route crosses, because that is what selects the tiles, so every one
of these hosts, ours included, can infer the general area of a ride, at the
resolution of a map tile rather than of your track. Your activity file is
never sent, and neither is any position out of it.
To label a film, the app asks howitwent-api.codeux.dev what lies
near a handful of points on a trip: both ends of a train or ferry ride, the
high points the route crosses, and where the trip started and ended. Each
point is rounded to about a kilometer before it is sent, and nothing else
goes with it: no track, no times, no file names, no identifier. Taken
together, the points do sketch the rough shape of a route.
The answers come from our own copy of OpenStreetMap; no request goes to OpenStreetMap or anyone else. The server keeps nothing about you, only a count of requests per day. This is on unless you turn it off, with Name the trains you took in Settings. Pressing Look again on a trip asks once more even when it is off, because you asked.
Connecting Strava opens Strava's own sign-in, where you grant How It Went
read access to your activities, including private ones. Strava then gives
the app a key and your Strava athlete number, which stay in your device's
keychain (on Android, its Keystore). Getting and renewing that key goes
through howitwent-api.codeux.dev, because it adds a secret of
ours that cannot be built into an app. It passes Strava's answer straight
back and keeps nothing but a count per day.
With the key, the app reads your list of activities from Strava directly, and for each one you pick, the activity's details (its name, description, equipment and totals) and its recorded data: positions, times, distance, elevation, and heart rate, cadence, power, temperature and speed where your device recorded them. These go from Strava to your device and are kept there; we never see them. The app's own log notes your athlete number and the numbers of the activities it fetched, so a log you choose to send us carries those numbers, never the activities. To disconnect, remove How It Went under My Apps in your Strava settings. Strava's own privacy policy covers what Strava does.
Connecting Intervals.icu means pasting a personal API key from your
Intervals.icu settings; it stays in your device's keychain (on Android, its
Keystore). With it the app reads your list of activities and downloads the
original file of each one you pick, straight from intervals.icu.
No server of ours is involved, and we never see the key or the activities.
The key is yours to change in your Intervals.icu settings, which cuts the
app off. Intervals.icu's own privacy policy covers what it does.
You can send a whole tour to another device of yours, such as from your phone to your Mac: the activity files, photographs and clips it holds and what the app worked out from them. A finished film can be sent back the same way. It travels over your own local network, encrypted, to a device you paired once by typing a six-digit code shown on the other one. Devices paired by an early version of the app still talk to each other unencrypted; pairing them again fixes that. No server of ours or of anyone else is involved. While a device is waiting to receive, it announces itself on your local network under its name, with a fingerprint the sending device uses to recognize it.
The app sends a small set of counters — how often each fallback ran, how exports finished, how long they took — to a collector we run. This is on unless you turn it off, and the switch is in Settings, under Diagnostics. Turning it off stops it immediately and for good.
It used to be off until you switched it on. We changed that because the counters are how we find out that an export is failing on a phone we do not own, and almost nobody finds a switch that is off by default — so the app was effectively telling us about one device. What we send did not change when the default did: it is the same counters, to the same collector, shared with nobody.
What it sends is counts, how many trips the app holds, and an identifier we generate for your installation, which is not a device ID and is not connected to anything else. It carries no positions, no file names, no tour names and no paths. Nothing about a particular ride is recoverable from it.
The legal basis is our legitimate interest in finding out that the app is broken on hardware we do not own, and how much it is used (GDPR Article 6(1)(f)). The switch is how you object: turning it off stops the collection, and you do not have to give a reason or write to us first. We keep the counters for the twelve most recent versions that never reached production, plus any version that reached production, and delete older ones. For each installation identifier we also keep the days we first and last heard from it, and how many trips it last reported holding.
We do not sell or share any of it, and never have — not your material, not the counters, not to anyone, for any purpose.
Separately from the counters, Settings → App diagnostics has two buttons. One hands the app's log to your device's share sheet, so you can send it wherever you like. The other uploads it to the same collector, so you can give us a link instead of an attachment. Neither happens unless you press it — there is no timer, no send at launch, and no retry.
The log is what the app wrote about itself while it ran: what it loaded, how long things took, what failed. It is more than the counters, and the difference is worth stating plainly. It contains file paths from your device, and a file path often contains your name. It can also carry the name of a tour and the address a map was fetched from. It does not contain your rides, your photographs, your clips or your films.
Beside the log we keep the installation identifier described above, the app version, the platform and your device's name, which on a Mac is the computer's name and often contains yours. Uploading gives you a link to the log so you can pass it on, and anyone with that link can read it; we can also see it in our own list of uploads, which nobody else can. We do not keep an uploaded log longer than 90 days. If you want one gone sooner, write to the address below and say roughly when you sent it; we will find it and delete it.
You don't need an account to use the app, and nothing on this page about your rides, photographs or films changes if you make one. It exists so that something you unlock can follow you to your other devices. You sign in with your email address and a code we mail to it; there is no password.
What we keep about an account:
ios or android.To add a purchase to your account, or to keep it current, our server asks Apple or Google about it by the store's id for it, and they answer with what was bought, when, and whether it was refunded. We never see your payment details. If you buy while signed in, the app gives the store your account's number, a random string rather than your email address, so the purchase names the account it belongs to. Apple and Google sell the purchase and keep their own records of it under their own privacy policies.
Premium bought on this website is sold by Paddle.com, our online reseller and Merchant of Record. You give your payment details and billing address to Paddle, not to us, and Paddle keeps its own records of the order under its own privacy policy. We pass Paddle your account's number, the same random string the stores get, and your account's email address for the receipt. Our server then asks Paddle about the order by Paddle's id for it, and keeps what is listed above. Paddle's company is in the United Kingdom; data reaches it under the European Commission's adequacy decision for the UK.
All of this is kept in a database on a server we rent from Hetzner Online in Germany, which hosts it for us and has no other use for it. Sign-in mail goes out through our own mail server rather than a mail service. Beyond the purchase questions to Apple, Google and Paddle above, nobody else receives any of it.
We delete sign-in codes and address-change requests a day after they stop working, and a device's sign-in 30 days after it ends. The account itself stays until you delete it. Asking for a sign-in code saves the address as an account before the code is entered. If nobody ever signs in with it, as with an address typed by mistake, we delete it 14 days after its last code stopped working. A nightly encrypted backup of the database goes to a separate machine of ours and is kept for up to 12 months, so a deleted account is gone from the backups within a year.
Three logs touch an account in passing. Our server's own log notes requests by
path, and some events by account number, never by IP address, and is
overwritten as it fills. Our mail server logs each address it sends to, and
when, for about five weeks. And the proxy in front of the server,
my.howitwent.app, logs each request's IP address and time for 14
days — including the check the app makes when it opens, whether or not you
have an account.
The legal basis for the account is that you asked for it (GDPR Article 6(1)(b)); for the logs, our legitimate interest in running the service securely and finding out why a mail did not arrive (Article 6(1)(f)).
Settings → Email me my data mails everything above that belongs to your account to your account's own address, written out in the mail itself. Change email address moves the account to a new one once you enter a code sent there, tells the old address, and signs out your other devices.
Settings → Delete account deletes the account and everything above that belongs to it, at once, and signs out every device. Your trips, photos and films stay on your devices. Without the app, the same thing is at my.howitwent.app/delete-account: it mails a code to your address and deletes the account once you enter it. Deleting the account cancels a yearly plan bought on this website, at once and without a refund for the time already paid. It does not cancel one bought in the App Store or on Google Play: cancel that where you bought it.
The form on howitwent.app takes your
email address and the language you want the emails in. Nothing in the app
asks for either. Sending the form is a request to our account server at
my.howitwent.app, so the proxy in front of it logs your IP
address and the time for 14 days, as described above.
We pass the address and the language to Brevo, a French email service that sends these emails for us under a data processing agreement. Brevo mails you a link to confirm, and your address is added to the list only once you click it. Brevo keeps the address, the language, and whether you confirmed or unsubscribed until we delete the contact there, which after an unsubscribe is what keeps you from being mailed again. It also records for each email whether it was delivered, opened and its links followed. Every email has a link at the bottom to unsubscribe.
Our own server keeps a record of each step: that the address asked to sign up, which confirmation email it was sent, and when it confirmed, unsubscribed or was deleted at Brevo. If an address never confirms, everything about it is deleted 30 days after the last step. For an address that did confirm, the record stays for three years after you unsubscribe or are deleted at Brevo (or after a later signup you never confirmed), because it is how we can show that you agreed and when you withdrew, and then it is deleted. If Brevo tells us about an address that never signed up through this form, that note is deleted after 14 days. If you also have an account with the same address, Email me my data includes this record, and deleting the account leaves it in place, because it is about the address rather than the account.
The legal basis for the emails is your consent (GDPR Article 6(1)(a)), which you withdraw by unsubscribing. For the record of it, it is our obligation to be able to show that you consented (Article 7(1), with Article 6(1)(c)).
It requests no location permission on any platform, and it does not use your device's location services. Every position it draws comes out of the files you chose to hand it — which is to say, out of a trip you already recorded, on purpose, on something else.
Photographs and clips arrive through the system file picker, which gives an app access to exactly the files you select and nothing else. The app never requests permission to browse your photo library, and cannot.
The one Photos permission it does ask for is permission to add — and only when you save a finished film to your camera roll. That is a deliberately narrower request than the read access it would need to look around, and the app is built so that it cannot be widened by accident.
Deleting a tour in the app deletes the project file and the copies of the activity files, photographs and clips it was holding. Deleting the app removes everything it ever stored. Neither touches your originals, and neither touches a film you already saved to your camera roll — those are yours, in your own storage, and the app does not reach back into them. An account, if you made one, is on our server rather than in the app, so deleting the app leaves it; deleting it is described above.
Visiting this site writes an ordinary web server access log entry: IP address,
browser user agent, the file requested and the time. So does every request
the app makes to howitwent-api.codeux.dev, the host behind the
map, place names, counters, uploaded logs and the Strava key. This is used only to
operate and secure the site, is not combined with anything else, is never used
to profile visitors, and is kept for a short period before being discarded.
The legal basis is our legitimate interest in running a working, secure
website (GDPR Article 6(1)(f)).
These pages load no third-party fonts, scripts or advertising.
Under the GDPR you may request access to, correction of, or erasure of your personal data, and may object to or request restriction of its processing. In practice this concerns these things and no others: your account, if you made one, and the logs that touch it; your address on the news list and our record of it, if you signed up; the server logs described above; the visit records our own analytics server holds for the front page; the counters and installation identifier held by our collector, unless you switched diagnostic counts off; and any app log you chose to upload. Your account you can see, change and delete yourself, as described above. For the rest, write to the address below and we will find and delete them. Everything else the app holds stays on your device, where we cannot reach it and you can delete it yourself by deleting the tour or the app. You also have the right to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde.
The app is not directed at children, and we do not knowingly collect personal data from anyone, of any age.
Until this update, this page said that the app made no network requests at all, and promised that map tile fetching would be described here before any version that did it was released. The map tile fetch shipped to testers before this page was updated, so that promise was not kept. It is described above now, and nothing about your rides, photographs or films was sent in the meantime — what changed is that the app can request map tiles and report counters.
Since then, diagnostic counts became on-by-default rather than off-by-default. Nothing about what they contain changed, and nothing about your rides, photographs or films is in them or ever has been. If you already have the app and had ever set this either way, your setting was left exactly as it was — the new default applies where there was nothing to keep, and an existing choice changes only when you change it.
And uploading a log became something you can do. The button was there before this update but only a developer could reach it; now anyone can, beside the one that shares the same file through your own share sheet. Nothing sends by itself, and what a log contains is described above — including that it carries file paths, which often carry your name.
This update adds accounts, and catches up on four things that shipped before the page described them. Accounts are optional and new; what one holds, how long, and how to see or delete it are above. The other four were already in the app: looking up place names by rounded position, reading your activities from Strava or from Intervals.icu once you connect them, and moving a tour between your own devices. This page said the app made three kinds of network request and no others, and had no account or sign-in; neither was still true, and it should have changed when each of them shipped. A lookup used to send, alongside each point, an identifier made from the activity's file name or Strava number and the time a train or ferry ride began; it no longer does.
This update adds news by email. It is a form on this website, not part of the app, and it is described above: what Brevo and our own server keep, and for how long.
This update adds buying Premium on this website. Paddle.com sells it as our reseller, and what Paddle receives, what we keep and what deleting the account does to a yearly plan bought here are above.
The commitment stands for anything else: if a future version collects or transmits something, we will update this page, and the date above will change.
Questions about this policy or your data: hello.howitwent@codeux.design