Mote · Privacy Policy

Your map is a file on your phone.

Mote draws where you have walked. That drawing lives in the app's own storage, and nothing leaves it unless you join a shared canvas — and then only sealed, with no time and no order in it. Not as a policy I promise to keep — as a fact about how it is built.

Last updated 3 September 2026.

What I collect

Nothing. There is no account in Mote, no sign-in, no email address, no phone number, no contacts, no advertising identifier, no analytics and no crash reporter. I do not have a copy of your map and there is no request the app makes that could give me one.

The App Store label for Mote is Data Not Collected. That is the answer because of how the app is built, not because of a rule I decided to follow.

If Mote ever sells anything, the purchase happens between your phone and Apple. Mote asks the App Store whether this Apple ID owns the item and reads back nothing else — no name, no payment detail, and no identifier it could attach to your map. There is no server of mine in that conversation, and no price has been set yet.

Where your map actually lives

Your location is read by iOS, turned immediately into hexagonal cells about twenty-five metres on a side, and written to a file inside the app's own container. What is stored is which ground, not a route — a set of places with no path through them.

Also on the device, and nowhere else:

• Your notes. What each place was like. They are never part of a shared canvas.
• Your journal. Journeys, and any flight or train number you add to one. A flight number with a date identifies one person on one aircraft, so it is treated as the sharpest thing in the app: device-local, and in nothing that leaves.
• Your settings and your private zones.

Deleting the app deletes all of it. There is nothing to request from me, because there is nowhere else a copy exists.

One thing you would find if you went looking: the app carries an iCloud entitlement, for syncing your own map between your own devices later on. Nothing calls it. The code that would do it has no caller anywhere in the app, so nothing of yours has ever been written to iCloud. When it is built it will be a switch, and this page will describe it before it ships.

What leaves this phone, in full

On a fresh install that turns nothing on: nothing about where you have been. The boundary data that names your districts is in the app, not fetched, so the map works with the radio off and in a country you have never opened it in.

One thing does happen without you asking, and it is between your phone and Apple rather than with me: when the app starts, iOS checks with the App Store whether this Apple ID has bought Mote Complete. That is a StoreKit call on a system framework, it carries your Apple ID and no location, it happens whether or not you ever open the purchase screen, and I never see it. I am listing it because this section says in full and it would otherwise be the omission you found later.

Three things of yours can leave, and each needs you to do something first.

• A shared canvas, if you create or join one. Described in full below. If you never join one, nothing about your map has ever left.
• One coordinate to Apple, when you ask for a picture of a place. Tapping for a photograph of somewhere on your map asks Apple Maps for one still image of that spot. It is one request, on one tap, and it never happens on its own. If the place is inside a private zone, Mote refuses instead of asking — the zone is checked before the request is built, so the coordinate does not leave and then get filtered.
• One coordinate to Apple, if you turn on station lookup. Naming the station you boarded at needs Apple to be asked what is nearby. There is no offline table of the world's stations worth carrying, so this is a switch that is off until you turn it on, explained on the screen that needs it. One coordinate, one lookup, nothing kept.

The two coordinate requests go to Apple, not to me and not to a third party. That is worth saying and it is not the same as saying it costs nothing, which is why they are a tap and a switch rather than something the app does quietly.

The shared canvas

A canvas is one map shared between up to eight people who hold the same invite code. Everyone sees where everyone has walked — and nothing about when, in what order, or how fast.

The code is the key. Mote derives two things from it on your device: an identifier, by a one-way hash, and an encryption key, which never leaves the phone. Your cells are sealed with AES-GCM under that key before anything is sent. The server holds an identifier it cannot reverse and a block of ciphertext it cannot read. Anyone with the code can read the canvas, so it should be sent the way you would send a key.

Private zones are applied before the sealing, not after. Your densest clusters — home, work — are dropped on the device, so they are absent from what is sent rather than hidden by a query. A server that is asked to hide something is a server that could be asked not to.

What is in a canvas payload: which cells, how solid, and a colour. What is not, and cannot be: timestamps, ordering, routes, speeds, notes, photos and journeys. Route reconstruction is not forbidden by a rule — it is absent from the data.

Leaving deletes your block. Leaving a canvas stops you sending or receiving anything new, immediately, and nobody has to agree to it. It also deletes your sealed block from the server — the app asks for that deletion first, before it clears anything on your phone, because clearing the phone first would destroy the two things the request needs. It does not remove what other members already downloaded onto their own phones; nothing can.

Two honest edges to that. If the network is down when you leave, you still leave — being stuck in a canvas because of a dead connection would be the worse bug — and your block stays on the server until it is removed some other way. And if someone simply deletes Mote without leaving first, nothing has told the server, so their block stays too. There is a routine written to sweep up blocks nobody has touched in ninety days and it is not scheduled to run, so I am not going to describe it to you as a retention window. In both cases what sits there is ciphertext filed under an identifier nobody can reverse, and the key never reached the server — so it is a promise I have not fully kept rather than something anyone can read. If you want a block gone now, email me and I will remove it by hand.

You can also shrink a private zone at any time, and nobody in the canvas is told. A canvas never claimed to be complete, so that is honest rather than deceptive — and it is the quiet way to share less without having a conversation about it.

Photos

If you let Mote read your photo library, it reads when and where each photograph was taken and nothing else. It never asks for the image, so no pixel of any photograph is ever read, decoded, copied or uploaded — the app is built so that it could not, and a check in the build fails if that changes.

When a photograph gives a region its colour, Mote keeps a reference to it in your own library — never a copy.

Health

If you allow it, Mote reads three things from Health: your step count, which it shows beside your map, and your average heart rate and active energy across a journey, which it shows on that journey. It never asks for more than the last thirty days.

It is read-only by construction: the app requests no permission to write, so it cannot put anything into Health even by mistake, and the permission sheet iOS shows you says read rather than read and write. It runs no background query — it reads when there is a screen to put the number on and not otherwise.

Nothing read from Health is transmitted anywhere. None of it can reach a shared canvas, and steps unlock nothing, score nothing and appear on nothing.

Location, and why the answer is still "not collected"

Mote is a map of where you have walked, so it is reasonable to expect the App Store label to say location is collected. It does not, and the difference is architectural rather than verbal.

Apple's definition of collected is data transmitted off the device in a form linked to the user. Your cells are never transmitted at all unless you join a canvas; if you do, they are sealed with a key no server holds, carry no time and no order, and have had your private zones removed before the payload existed. There is no identity anywhere to link them to.

Tracking and advertising

None. Mote contains no advertising identifier, no attribution SDK, no crash-reporting service and no third-party code of any kind. Its privacy manifest declares no tracking, no tracking domains and no collected data types.

Your data, in a file you can take away

Everything Mote knows about where you have been exports as JSON and GeoJSON, complete, free, from the day it ships. GeoJSON opens in map software that is not Mote — a file only this app can read would be a trap with extra steps.

The export is your whole map, including your private zones. Those are left out of a shared canvas, never out of your own copy, and the app says so on the screen before it writes the file.

Children

Mote has no accounts, no messaging and no content that anyone else can see, and it collects nothing — so there is no children's data for it to handle differently.

Changes, and how you would know

If a future version ever sends something this page does not list, this page changes before that version ships, and it will say plainly what is sent and why. A public profile is planned for a later release; it would make location genuinely collected and linked to an identity, and it will arrive with a full-screen explanation before any of it is reachable, with every switch off. Your map staying on your phone is not a legacy state — it is what you get forever if you never turn anything on.

Contact

Mote is made by CharlX Studio, a one-person studio in Taiwan. Email reaches a person.

charlx.studio@gmail.com