Navigate to YES

Privacy Policy

Navigate to YES is an offline-first companion app for the Burning Man festival. This policy explains what the app collects, what it does with that information, and what control you have over it.

What we collect

Stored only on your device. None of the following ever leaves your phone unless you actively share it:

• A randomly-generated device id (8 characters, no PII).
• The name and status you type in on the People tab.
• The crew codes / names you create or join.
• Your preferences (vibe tags, things to avoid, YES picks, home address) and your starred items.
• A photo cache (URLs, no images themselves) of pictures we've resolved for camp / art / event cards.

Used in-the-moment, never sent anywhere:

• Your GPS location and compass heading are read while the app is open so the arrow can point at your destination. Unless you share it with a crew, your location never leaves the phone. Your location is shared with a crew only if you turn on location sharing (off by default) and then check in — see below.

Sent off your device only when you opt in and check in:

• Crew location sharing (lat/lng + your typed name + your status + your device id). Location sharing is off by default: your position is never sent to anyone until you turn it on. Once on, you can share your position once (a single check-in), or start a time-limited live session — e.g. 15 minutes, 1 hour, or until you stop — during which your position updates automatically, including while your phone is locked, for as long as that session lasts. Background tracking is never on outside of a live session you explicitly started — it stops the moment the session ends (or when you stop it, or turn sharing off). You can also block any crew member, which hides them from your map and list. Positions travel over the internet through a relay server we run ourselves (an ntfy instance at n2y-ntfy.fly.dev — not the public ntfy.sh service). They can also travel directly phone-to-phone over Bluetooth Low Energy / Multipeer when you're near another crew member, but only if you've separately turned on Bluetooth crew finding, which is off until you do (see Permissions below). Before anything leaves your phone it's encrypted with a key derived from your crew code, so the relay stores an unreadable blob: we operate that server and it does receive and hold your encrypted messages, but neither we nor anyone else can read the name and coordinates inside without the crew code. The relay addresses messages by a channel name derived from your crew code, so treat the code like a passphrase and don't use a guessable word — anyone who has it can both find and decrypt your crew's messages. Messages sit in the relay's cache for up to 14 days and are then deleted automatically. That means a position you've already shared can still reach your crew for a while after you stop sharing (the app itself discards anything older than 15 minutes); stopping prevents any further updates from going out.
• Photo lookups. When you open a card we hash the entity's id and ask a Vercel-hosted API endpoint for a thumbnail URL. The endpoint searches Wikimedia Commons. We don't log who asked for what.
• Contact discovery, only if you opt in during setup. If you add your own phone number, it's sent once to register you, converted immediately to a one-way hash before anything is stored — your actual number is never retained. Checking your OWN contacts against that directory happens entirely on your device: the app downloads the current list of registered hashes and compares your contacts against it locally. Your contacts — their names, their numbers, hashed or otherwise — are never sent anywhere; only the one-time hash-list download and your own optional number touch the network. Both the phone number field and the Contacts permission can be skipped entirely, and exist only so you can share your camp with people you already know who use the app.

What we don't collect

• We don't have traditional user accounts — no login, no password, no profile page. The only thing ever tied to your phone number, if you choose to add one, is a one-way hash (see Contact discovery above) — we can't reverse it back to your number, and nothing else is attached to it.
• We don't have analytics. No Google Analytics, no Sentry, no Mixpanel, no third-party trackers of any kind.
• We don't read your contacts, photos, calendar, or any other phone resource that isn't explicitly listed above.
• We don't sell, trade, or rent any of your data. The only things our servers ever hold are the encrypted crew-position messages described above (which auto-delete) and the one-way phone-number hashes described above (which can't be reversed); there's no profile, no history, and nothing tied to a name or an account.

Permissions and why we ask

• Location (foreground and background) — the arrow points at your destination, and — only when you check in or during a live session you start — shares your current position with your crew. Background location is used only while a live session you started is active, so sharing keeps working while your phone is locked; it stops the moment the session ends or you stop it, and the app never tracks or broadcasts your position outside of a session you explicitly started.
• Bluetooth scan / connect / advertise — the cell-free crew finder, for when you're on the playa with no signal. This is off by default: the app uses Bluetooth for crew finding only if you turn on Bluetooth crew finding, which we ask for on its own screen when you first set up a crew (declining is offered just as plainly) and which you can switch off again at any time in Settings. With it on, Bluetooth is used only during a sharing session you started: for as long as that session lasts the app looks for nearby crewmates over Bluetooth — in short on/off bursts to save battery, and continuing while your phone is locked, which is the point of asking, since without a network that's the only way to keep finding each other. It also broadcasts your own encrypted position over Bluetooth during that session (on Android the app both advertises and scans; on iOS it only scans, it never advertises). Ending the session, turning sharing off, or turning Bluetooth crew finding off stops the scanning and broadcasting immediately, and sharing then works only where you have a data connection. While Bluetooth crew finding is on, the app also passes along packets of the open BitChat Bluetooth mesh between nearby BitChat devices, to extend the range of the mesh; those packets belong to other people, aren't read or stored by this app, and contain nothing of yours. The relay server described above needs a data connection and is not affected by this setting.
• Motion sensors — the compass heading inside the arrow.
• Contacts — only if you opt in during setup, to check which of your contacts already use the app so you can share your camp with them directly. This check happens entirely on your device (see Contact discovery above) — your contacts are never sent anywhere, hashed or otherwise. You can decline this permission — offered just as plainly as any other — and every other part of the app works exactly the same.
• Battery optimization exemption (Android only) — some phones (Samsung, Xiaomi, Huawei, OnePlus, and Oppo especially) aggressively stop background apps to save battery, even with location permission set to "Allow all the time" — which can quietly end a live sharing session after your phone's been locked for a while. We ask, once, right after you start sharing, whether we can exempt the app from this so a session you started keeps running until you end it. This doesn't collect or change anything about your data — it's purely a request not to be shut down. Declining is offered just as plainly, and you can revisit this any time in Settings.

You can revoke any of these in your device's Settings at any time. The app still works (less well) without them — the arrow just shows a static bearing instead of one you can rotate around.

Children

The app targets adults and is not intended for children under 13.

Contact

Questions: n2y@dewhirst.net

If we change this policy we'll update the date at the top of this page. Changes are tracked in the public repository at github.com/harrydewhirst/nav2yes.