Privacy Policy

Last updated: October 16, 2026

The Human-Readable Version

WikiHunt is a GPS hunting map app for discovering public land, tracking hunts, and planning trips, on iPhone and on the web at wikihunt.app/app. We respect your privacy and handle your data responsibly.

Without an Account

You can browse the map, view public land boundaries, weather conditions, and use basic features without creating an account. No personal information is collected from non-registered users, though anonymous usage analytics may be gathered to help us improve the app.

With a WikiHunt Account

Account information stored:

• Email address and display name
• Authentication handled by Firebase Authentication (Apple, Google, or email/password)
• All data transmission encrypted using industry best practices

User data:

• Waypoints — name, location, category, notes, and photos
• GPS tracks — route, distance, duration, and elevation
• Hunts — the named groupings you organize waypoints into
• Areas — outlines you draw or import, such as property lines or food plots
• Harvest log entries
• Saved locations and app preferences

When you are signed in, this data is synced to our servers (Google Firebase) so it survives a lost phone and appears on your other devices. It is stored under your account and is private to you by default. If you are not signed in, it stays on your device. The same account works in the app and on the web map, which reads and writes the same data.

Sharing — Hunt Groups

WikiHunt has an opt-in sharing feature. You are never placed in a group without joining one.

• Hunt groups: when you create or join a group, your display name and group membership are visible to the other members of that group.
• Shared waypoints: waypoints you explicitly share with a group are visible to its members. Your other waypoints are not.
• Live location: if you turn on location sharing inside a group, your current position is sent to our servers and shown to that group's members. This is off unless you enable it, and you can turn it off at any time, which stops the sharing.
• Safety check-in: if you miss a check-in deadline and you are in a group, that group is alerted along with your last shared location.

Emergency contacts you add for safety check-in are stored on your device only. The app does not contact them for you. They are a list for you to reach yourself.

How we use your data:

We will not share your data with third parties beyond what is necessary to operate the service. Your data is never sold. Third-party services we use include:

• Google Cloud / Firebase — storage, authentication, and crash reporting
• Mixpanel — usage analytics
• RevenueCat — subscription analytics; receives your purchase history along with your analytics identifier, subscription tier, and the states you have purchased
• Apple MapKit — mapping services
• Apple — payment processing for subscriptions bought in the app, and App Store ad attribution (AdServices) when you install from an Apple Search Ads campaign
• Stripe — payment processing for plans bought on the website. Stripe is the seller of record for those purchases: it collects your payment details, email and billing address to take payment, calculate tax and prevent fraud, under Stripe's privacy policy. We never see your full card number; we receive your Stripe customer ID, the plan, and its renewal and end dates
• Google reCAPTCHA Enterprise (Firebase App Check) — on the web map, checks that requests come from a genuine browser and not an automated script. In the app, Apple's App Attest and DeviceCheck do the same job
• U.S. Geological Survey (USGS) — topo map tiles (The National Map) in the app (from version 1.5.7), on the website and web map, and public land boundaries (PAD-US) in the app, on the website and web map. Public land and many state hunting-unit layers are hosted on Esri's ArcGIS Online, so Esri receives those requests as the host
• Government map servers (the Bureau of Land Management and state wildlife agencies) — public land, Game Management Unit and survey-grid layers; your device requests these directly
• Amazon Web Services — elevation tiles for the 3D view on the web map; your browser requests them directly, so AWS sees your IP address and the map area you are viewing
• geojs.io — coarse IP-based location guess, website map only
• Open-Meteo — weather and conditions; it receives the coordinates of your location or of the map area you are viewing, and your IP address, but no account information
• Resend — sends the email with your free-month code if you request one on the website
• State and county GIS agencies — the source of the parcel boundary data, which we host ourselves (no user data is sent to them)

Usage and Diagnostic Data

• We use analytics to understand how the app is used and to improve it. While you are signed out this data is tied only to a random device identifier; once you sign in it is tied to your account identifier, so it is pseudonymous rather than anonymous
• Apple MapKit may collect anonymous mapping data
• Crash and error reporting (Firebase Crashlytics) includes device information and, when you are signed in, your account identifier, so that a fault can be traced to the session that produced it

Location Data

• Location access is used for map positioning, fetching local weather conditions, GPS track recording, and determining which state's data to show you
• By default, location is used only while the app is in use, and your position is not transmitted to our servers
• Background location is used in one case only: when you turn on live location sharing inside a hunt group. Doing so asks for "Always" location permission and sends your position to our servers periodically, including while the app is in the background, so your group can see you on the map. Turning sharing off stops both the background updates and the transmission
• GPS tracks you record are stored on your device and, when you are signed in, synced to your private account storage

Photos

• Waypoint photos are stored on your device
• If you are signed in and have a Pro subscription, waypoint photos are also backed up to your private account storage on Google Firebase, so they survive a lost phone. Free accounts keep photos on the device only
• Backed-up photos are private to your account unless you share the waypoint with a hunt group
• The app requires your explicit permission to access your photo library or camera

This Website

Separate from the app: the interactive map on the wikihunt.app home page makes two third-party requests while you use it, plus one you can opt into.

• Map tiles and public land boundaries come from the U.S. Geological Survey (public land is hosted on Esri's ArcGIS Online). Your browser requests them directly, so USGS and Esri see your IP address and which part of the map you are looking at, exactly as with any embedded map.
• A coarse location guess. On load, the page asks geojs.io to estimate a rough location from your IP address, and uses it only to choose which of twelve preset views to open on. The result is not stored, not sent anywhere else, and not tied to any account. If the lookup fails, or you are far from a state we cover, the map simply opens on Montana.
• “Use my current location” is opt-in. Your browser asks before sharing anything, the coordinates stay in the page to centre the map, and they are never transmitted to us or to anyone else.

The Web Map (wikihunt.app/app)

• It requires signing in, and works with the same account and data as the app. Your sign-in session is kept in your browser's storage by Firebase Authentication, and a few display preferences (such as 3D on or off) in its local storage.
• Map tiles and public-land, GMU and survey layers are requested by your browser directly from USGS, Esri's ArcGIS Online hosting and the government map servers listed above, so they see your IP address and the map area you are viewing.
• reCAPTCHA Enterprise runs in the background to block automated abuse; Google receives browser and interaction signals for that purpose.
• If you buy a plan, you are sent to Stripe's checkout page, and later to Stripe's customer portal to manage it.
• Weather, wind and moon conditions are requested from Open-Meteo for the map area you are viewing.
• The web map uses no third-party analytics tools and sets no tracking cookies; its visits are counted in our own page-view totals (see Visit Counts below). When you open it signed in, our server notes the date of your first and latest visit and how many times you've opened it, stored with your account, so we can tell whether the web map is used. If it hits an error, it sends us an error report (the error message and technical trace, the page address, your browser's user agent and, when signed in, your account identifier) so we can fix it.

Visit Counts

To know how many people visit, each page of wikihunt.app sends our server one small note when it loads: the page address, the site you came from (for example google.com), any campaign tag in the link, whether the screen is phone-sized, and your browser's time zone. We keep only daily totals. To count unique visitors without cookies, the server combines your IP address and browser type with a random key that is replaced every day and keeps a one-way code of the result for two days; the IP address itself is not stored, and once a day's key is replaced its codes can't be linked to anyone. Separately, our hosting provider (Google Cloud) keeps standard request logs, including IP addresses, for 30 days.

Free-Month Offer

If you ask for a free-month code on the home page, we store your email address so each address gets one code, and send the code to it through Resend. We don't use it for anything else and don't share it. Email us to have it removed.

The website sets no advertising or tracking cookies of its own. Signing in to the web map stores a session in your browser, and Stripe's checkout and Google's reCAPTCHA may set their own cookies for security and fraud prevention.

Legal Version

Operator: Tall Poppy Studio

Core Principles

• Personal information is only collected when necessary to provide the service
• Data is not shared with third parties except as described above, to comply with the law, or to protect rights. Sharing with other users happens only through features you switch on yourself
• Personal information is stored only as long as required for service operation

Information Collected

• Account details (display name, email address)
• Location data (optional; in use only, unless you enable hunt-group location sharing, which adds background collection)
• User-generated content (waypoints, GPS tracks, hunts, harvest log entries, photos)
• Content and live location you choose to share with a hunt group
• Subscription status. When you are signed in, the app sends Apple's signed purchase records to our server so your plan can be confirmed on the web and on your other devices
• For purchases on the website: billing details, collected and held by Stripe
• Anonymous usage analytics and crash reports

Third-Party Services

Firebase (Google Cloud, including reCAPTCHA Enterprise and App Check), Mixpanel, RevenueCat, Stripe, Resend, Apple (MapKit, App Store, AdServices, App Attest), Open-Meteo, U.S. Geological Survey, Esri (ArcGIS Online hosting), Amazon Web Services, government map servers (BLM and state wildlife agencies), and geojs.io on the website only

Data Security

All data transmission is encrypted using SSL/TLS. Authentication is handled by Firebase Authentication with industry-standard security practices.

Children

We do not knowingly collect personal data from users under the age of 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

Your Rights

• Delete waypoints, tracks, and photos at any time from within the app
• Delete your account at any time: in the app under Settings, or on the web map from the account menu. This removes your account and everything stored under it, including waypoints, tracks, hunts, areas and photos. Messages and waypoints you shared in a hunt group stay with that group, and Stripe keeps the payment records it is legally required to hold. A website subscription must be cancelled first; an App Store subscription is managed in your Apple ID settings
• Leave a hunt group at any time, which stops any sharing with its members
• All user data is private by default. There is no public profile, and nothing is shared with other users unless you share it

Policy Updates

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

If you have questions about this privacy policy or your data, contact us at akos@tallpoppystudio.com.