The short version
Pilgrim is anonymous. There are no accounts, and we never ask for your name, your email, or anything else that says who you are. Your walks, recordings, transcriptions, photos and reflections live on your device.
A few features do need the network: finding whispers and cairns near you, the weather, the map, and anything you choose to share or send. Each one is listed below with exactly what it carries and where it goes. This policy covers Pilgrim on iPhone, iPad and Android; where they differ, it says so.
Data that stays on your device
The following is created and kept on your device. It leaves only in the ways described on this page, each of which you start yourself.
- Walking routes — GPS coordinates recorded during your walks
- Voice recordings — Audio captured when you record thoughts during a walk
- Transcriptions — Speech-to-text runs on your device (WhisperKit on iOS, whisper.cpp on Android). No audio is ever sent anywhere to be transcribed.
- Photos — Pilgrim stores only a reference to each photo; the image stays in your photo library.
- Walk statistics — Distance, duration, steps, elevation, pace
- Intentions and reflections — Text you enter before or after a walk
- Your answers on an Honor walk — Recordings you make in reply to a shared walk are kept on your device and never uploaded.
- Preferences — Your settings and customizations
The anonymous app ID
The first time a feature needs to talk to our server, the app makes up a random ID on your device. It is not derived from your phone, your name or your Apple or Google account, and it stays the same until you delete the app or clear its data. It travels with shares, whispers, stones, feedback, podcast submissions and the collective counter, so we can limit abuse. Our server stores it only as a one-way hash, except for the collective counter, described below.
During every walk
- Whispers and cairns nearby — When a walk begins, and again if you travel more than 10 km, the app sends your location to our server (walk.pilgrimapp.org) to find the whispers and cairns around you. No ID goes with it, and our server uses the location to answer without saving it.
- Weather — At the start of each walk your location is sent to a weather service: Apple WeatherKit on iOS, Open-Meteo on Android. On iPhone it is also sent when you open an Honor walk's overview.
- Maps — Map tiles load from Mapbox, which sees your IP address and the area being drawn. Mapbox's own usage telemetry is turned off on Android; on iPhone it is on in version 2.0.0 and is turned off in the next update.
Pilgrim uses location in the background only while a walk you started is being recorded.
Catalogs and downloads
When it opens, or when they are first needed, the app downloads its catalogs of soundscapes, voice guides and whispers, the collective's pilgrimage routes, and the collective's running total from cdn.pilgrimapp.org and walk.pilgrimapp.org. These are plain downloads: nothing about you is sent, and like any website our servers see the IP address the request comes from. Voice guide packs download when you choose them. The transcription model downloads once: on iPhone from Hugging Face the first time you transcribe, on Android from our CDN shortly after the first launch.
Whispers and stones
- Placing a whisper sends your location, which whisper you chose, how long it should linger, and the anonymous app ID. Anyone walking nearby can find it until it expires (you choose a day, a week or a month on iPhone; a week on Android), and it is deleted within a day after that.
- Placing a stone sends your location and the anonymous app ID. The stone joins a cairn at that spot. Cairns are public and permanent, and nothing stored with a cairn says who added to it.
Sharing a walk
When you share a walk, a web page is made on our server and anyone with its link can open it. It contains your route (up to 200 points, with times, including where it started and ended), your distance, durations and weather, the times you meditated and spoke, the names of the places where it started and ended (looked up through Apple on iPhone), and, if you add them, a short note, elevation and steps, waypoints and small photos with where they were taken. Transcriptions are never included.
An interactive share ("Walk with me") also uploads the voice recordings you select and full-size photos with where they were taken, and on iPhone where each recording was made. Anyone with the link can see the walk data behind the page. Trim start & end, on by default for interactive shares, leaves off the first and last 150 m and anything recorded there, so your doorstep is not on the page. Walks shorter than 600 m are not trimmed.
To make the page, our server sends the route to Mapbox to draw a map image, sends the place names, weather and distance (never your note) to DeepSeek to write the page's haiku, and, for interactive shares, asks Mapbox for the name of the place where each recording was made.
A page and everything on it is deleted when it expires (after one moon, one season or one cycle: 30, 90 or 365 days, as you choose), within a day of that date. To remove a page sooner, email us its link. Visitors to a walk page can leave a stone on it; to allow one stone each, our server remembers a one-way hash of the visitor's IP address for a day.
Honor (iPhone)
Opening a shared walk downloads it, with its recordings and photos, from walk.pilgrimapp.org. Pilgrimage routes download from the public open-pilgrimages dataset through jsDelivr, which sees your IP address and which route you opened. Saving a pilgrimage's maps downloads Mapbox tiles for the route itself, not for where you are. None of these requests carries anything about you.
Feedback
A Trail Note (Settings → Connect) sends your message, the anonymous app ID and, unless you switch it off, your device model, system version and app version. It becomes a public issue in our open-source repository on GitHub, where it is kept. Please leave out anything personal. To have one removed, email us.
Pilgrim on the Path (iPhone podcast)
Submitting a walk to the podcast is anonymous and entirely your choice. It sends the walk's voice recordings and their transcriptions, your intention and reflection, the weather, the date, where the walk began, its share link, and the anonymous app ID. The recordings are kept in private storage for 30 days; the rest is kept privately (in a private GitHub repository) so we can prepare episodes. A walk chosen for an episode stays published. To withdraw a submission, email us.
Walk with the collective
When you turn this on in Settings (it is off by default), the app sends totals after each walk: one walk, its distance, meditation time and talk time, with the anonymous app ID. No location or walk details are included. The ID is kept as-is only to count how many pilgrims walked in the last hour, and entries older than two hours are cleared as new walks come in. The totals appear on pilgrimapp.org and in the app.
Other lookups on your phone
- Writing prompts — Opening a walk's prompts looks up the names of the places where it started and ended, through your phone's built-in geocoder (Apple on iPhone; usually Google on Android). The prompts themselves are made on your device and go wherever you copy them.
- My Journey — The journey viewer and editor open as web pages inside the app. Your walks are handed to the page on your device and are not uploaded; the page loads its fonts from Google and its maps from Mapbox.
- Dictating an intention (Android) — This uses your phone's speech recognizer, which on some phones processes audio on Google's servers.
Who else is involved
Everything above that reaches a company other than us: Apple (weather, place names), Open-Meteo (weather on Android), Mapbox (maps, map images, place names), Google (place names and speech on Android, fonts), jsDelivr (pilgrimage routes), Hugging Face (the iPhone transcription model), DeepSeek (the share haiku), and GitHub (feedback and podcast submissions). Our server and CDN run on Cloudflare.
What we never do
- We never create accounts or profiles, or ask who you are
- The apps include no analytics or advertising SDKs, and use no advertising identifiers
- We never sell your data, and it is shared only as this page describes
- This website counts page visits with a self-hosted, cookie-free tool; it counts visits to pages and never records who you are
Data export and deletion
You can export your walk data at any time in the Pilgrim format, and as GPX files where supported. You can delete any or all walks from within the app; deleted walks are removed from your device permanently. Shared pages and whispers delete themselves when they expire. For anything on our server you would like removed sooner, email us.
Children's privacy
Pilgrim does not ask anyone, including children, for personal information, and there are no accounts. Everything the app itself sends is described on this page.
Changes to this policy
If we make changes to this policy, we will update the date at the top of this page. Because Pilgrim does not collect contact information, we encourage you to review this page periodically.
Contact
If you have questions about this privacy policy, or want something removed, you can reach us at privacy@pilgrimapp.org.