Grid90 · Effective date: 29 July 2026
Grid90 is an offline-first mapping and navigation app for walkers and hillwalkers. This policy explains what personal data we collect, why, who else receives it, and the rights you have over it.
Grid90 is operated by GRID90 Ltd, which is the data controller for the personal data described in this policy.
We are subject to the UK GDPR and the Data Protection Act 2018.
With your permission, Grid90 uses your device's location to show your position on the map, record tracks, provide navigation and live statistics, and calculate route information. Location is used while the app is in use and, if you enable track recording, in the background so that a walk continues to be recorded with the screen off.
Recorded tracks are stored on your device. They are only uploaded to our cloud storage if you are signed in and use sync features. We do not use your location for advertising or profiling.
If you choose to create an account or sign in with Google, we process your email address, a unique account identifier, and basic profile information supplied by the sign-in provider. Signing in is optional — the core mapping and navigation features work without an account.
Tracks, routes, waypoints, notes, timestamps, elevation and distance data, and any photos you capture or attach. This content is stored on your device. If you are signed in, it may also be stored in our cloud services so it can sync across your devices.
With your permission, Grid90 can access your camera and photo library so you can capture and attach images to tracks and routes. Photos you attach may include location metadata. Photos are only uploaded to our cloud storage if you are signed in and use sync features.
We collect crash reports and stability diagnostics through Firebase Crashlytics. These include device model, operating system version, app version, and technical details of the crash. This is used solely to fix bugs — particularly important for an app people rely on in the outdoors.
If you contact support from inside the app, we receive the message you write, your reply address, and — so we can reproduce the problem — your account identifier, platform, OS version, app version and build number, device model, and a recent excerpt of the app's diagnostic logs. You can see what is being sent before you send it.
Where paid features are offered, purchases are processed by the Apple App Store or Google Play. We receive confirmation of entitlement status. We never receive or store your payment card details.
| Purpose | Data | Legal basis (UK GDPR) |
|---|---|---|
| Showing your position, recording tracks, navigation | Location, activity data | Consent (Art. 6(1)(a)) — given via the device permission prompt, withdrawable at any time |
| Capturing and attaching photos | Photos, camera | Consent (Art. 6(1)(a)) |
| Providing accounts and syncing your data | Account data, content | Performance of a contract (Art. 6(1)(b)) |
| Serving map tiles, offline packs, weather and terrain data | IP address, approximate or precise coordinates | Performance of a contract (Art. 6(1)(b)) |
| Fixing crashes and improving stability | Diagnostic data | Legitimate interests (Art. 6(1)(f)) — keeping a safety-relevant app reliable |
| Responding to support requests | Support request data | Legitimate interests (Art. 6(1)(f)) |
| Processing purchases | Entitlement status | Performance of a contract (Art. 6(1)(b)) |
We do not sell your personal data. We share data only with the service providers below, each acting under their own privacy terms.
Map tiles, offline map packs and support messages are served from infrastructure operated by GRID90 Ltd (tiles.grid90.com, offline.grid90.com). These receive your IP address and the map areas you request.
We use Firebase Authentication (sign-in), Cloud Firestore and Cloud Storage (syncing your routes, tracks and photos when signed in), and Crashlytics (crash reporting). Provided by Google Ireland Limited / Google LLC.
Depending on which map layer or feature you use, the app requests data directly from third-party services. These providers receive your device's IP address, and in some cases location-derived information:
| Provider | Used for | What they receive |
|---|---|---|
| Open-Meteo | Weather forecasts and place search | IP address and the coordinates you request a forecast for, which is typically your position |
Overpass API (overpass-api.de, overpass.kumi.systems) | Nearby peak identification (Sky View) | IP address and a bounding box around your location |
| MapTiler | Optional online vector map layers | IP address and the map tiles you view |
| Thunderforest | Optional Landscape / Outdoors map layers | IP address and the map tiles you view |
| OpenTopoMap, CyclOSM / OpenStreetMap France | Optional community map layers | IP address and the map tiles you view |
| Esri ArcGIS Online | Optional satellite imagery layer | IP address and the map tiles you view |
The map tiles you request reveal which part of the world you are looking at. If you prefer to minimise this, use Grid90's downloaded offline maps, which are served from your device and require no network requests while you walk.
Apple and Google process purchases and subscription entitlements where paid features are offered.
Some providers above, including Google Firebase, process data outside the UK, including in the United States. Where that happens, transfers are covered by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision.
| Data | Retention |
|---|---|
| Tracks, routes and photos stored on your device | Until you delete them or uninstall the app — under your control |
| Cloud-synced content (signed-in users) | Until you delete the item, or until 30 days after you delete your account |
| Account data | Until you delete your account, then removed within 30 days |
| Crash reports | Up to 90 days |
| Support correspondence | Up to 24 months |
| Server logs | Up to 30 days |
You can permanently delete your Grid90 account and its associated cloud data at any time. Write to support@grid90.com from the address associated with your account, and we will delete your sign-in record and the routes, tracks and photos held in our cloud services within 30 days.
Deleting your account does not remove data held only on your device; uninstalling the app removes that.
Under the UK GDPR you have the right to:
To exercise any of these, contact support@grid90.com. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to address your concern first.
Grid90 is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.
Data in transit is encrypted using industry-standard TLS. Cloud data is held in access-controlled Firebase services with rules restricting each user's data to their own account. No system is completely secure, but we take reasonable and proportionate steps to protect your information.
We may update this policy from time to time. The effective date at the top will change, and significant changes will be communicated in the app.
GRID90 Ltd · support@grid90.com