Verbocities Privacy Policy

Last updated: 6 October 2026

Verbocities ("we", "us") is an app and tour service run by its developer. It is being tested with friends and family. This Privacy Policy explains what information the Verbocities app and the Verbocities tour service collect, where that information goes, how long it is kept, and what you can do about it. You can reach us at [email protected].

Verbocities has no user accounts. We never ask for your name, email address or phone number. The app's main job is to use your phone's location, so most of this policy is about location: when it is used, what leaves your phone, and who receives it.

Summary

1. Who we are and what this policy covers

This policy covers:

• the Verbocities app for Android, including its Android Auto screen;
• the Verbocities tour service at api.verbocities.com, which the app uses to choose places and to write and voice stories; and
• the Verbocities website at verbocities.com, which is served by the tour service, sets no cookies and has no analytics.

It does not cover the websites and services that the app opens or contacts on your behalf, such as Wikipedia or OpenStreetMap. Their own privacy policies apply to what they receive. Section 8 lists them.

You can read this policy in the app, from the welcome screen, the location statement, the report screen, Settings → Privacy policy and Settings → Questions and answers, and on the web at verbocities.com/privacy.

People anywhere may use Verbocities. Section 19 adds what applies in the European Economic Area and the United Kingdom.

2. What the app keeps on your phone

Most of what the app knows stays on your phone. The app stores:

• Places it has found. For each place: its name, short description, the place's own coordinates, photo details and credits, and details from Wikipedia, from OpenStreetMap or, on food and drink tours, from the listings our search provider found (the business's type, address, number of ratings, price level and opening hours).
• Stories and audio. The text of each story, the date it was created, how the app scored each place, and the audio files it has downloaded or made.
• Your settings. Theme, narrator, story language, walking or driving, trigger distance, distance units, and whether you have seen the welcome guide.
• Your location consent. When you agreed to the location statement (see Section 4), and which version of it.
• Your device token (see Section 5.1), in Android's encrypted secure storage.
• The stories you heard on your last tour. A list of up to 30 places whose stories played, with the theme, narrator and language each was told in, so that you can find, replay or report them on the Stops tab afterwards. The first story of your next tour replaces it, and Delete my data clears it.
• The last text you shared to the app, for example a link from a maps app (see Section 6.1).
• Caches of map tiles and photos kept by the map and image components.
• Cookies. The app does not set cookies of its own. Its network component does store any cookie that a service it contacts sends back, and returns that cookie to the same service on later requests. Whether a service sends cookies is up to that service.
• A registration for the background location task. This tells Android that a tour is tracking location. It holds no positions, and the app removes it when no tour is running.

Places and stories carry dates, and places carry coordinates, so together they form a rough history of where and when you have toured. That history stays on your phone. The app does not delete it automatically, and Delete my data keeps it, because it is what lets a saved area play with no signal. Clearing the app's storage in Android removes it (see Section 13). The one exception is audio: at the start of each tour, if the audio folder is larger than about 300 MB, the app deletes the oldest files until it is about 240 MB.

The app keeps your current position, route and city in memory only. They are gone when the app closes. Your destination is also kept in memory, and cleared by Delete my data.

Android backup. If Android backup is turned on, two items can be copied to your Google account backup and to a new phone: the last text you shared to the app and the background task registration. The place history, stories, audio, settings, the list of stories heard on your last tour, consent and device token are excluded from backup.

3. Location: how it is used and where it goes

3.1 When the app uses location

• On the Map tab. This is the first screen when you open the app. Once you have agreed to the location statement and allowed location, the map shows your position and follows it while the Map tab is on screen, whether or not a tour is running.
• During a tour. The app follows your position continuously so that it can play each place's story as you reach it and look for places ahead of you. If you allow location "All the time", this continues with the screen off, while you use other apps, and on tours started from Android Auto.
• While a tour started from the phone is tracking location, Android shows a "Verbocities tour is running" notification.
• A tour started from Android Auto while the app is closed runs without that notification, because Android does not let the app show it at that moment.
• A tour ends when you tap Stop tour on the Map tab or on Android Auto's Tour tab, and when you close Verbocities from your recent apps.
• When a tour starts. The app looks up the city you are in.
• When you set a destination. Once you have agreed to the location statement, the app plans a route from where you are, whether you set it by searching or by sharing a link. It does this even if no tour is running.
• When you save an area for offline use. Once you have agreed to the location statement, the app uses your position to choose the area to download.

Tours need precise location. If you allow only approximate location, the app cannot start a tour. The app uses location in the background only while a tour is running. If Android delivers a position when no tour is running, for example after the app was closed mid-tour or after the phone restarted, the app discards it and tells Android to stop. It does not use location for advertising, analytics or anything not listed in this section.

3.2 Where location leaves your phone

We treat everything in this table as precise geolocation, even where some items are coarser. Several state laws define precise geolocation as a location within a radius of 1,750 or 1,850 feet.

A single search reveals an area. A series of searches over a tour can also reveal your route and direction of travel.

Location services on your phone. Android works out your position with its own location services (Google Play services location on most phones), following your phone's location settings. Those services handle it under their own privacy policy. The app itself sends nothing to them.

3.3 Your IP address and device details

Every service the app contacts directly receives your phone's IP address, as with any internet connection. An IP address can show roughly where you are. We do not control how these services keep their own logs.

Each request also carries an identifier (a "user agent"):

• Requests to Wikipedia, the OpenStreetMap search servers, the route planner and shared links carry Verbocities/1.0 (https://verbocities.com).
• Photo requests to Wikimedia's image servers carry Android's standard identifier. It includes your phone model, your Android version and your phone's software build number.
• Map requests to OpenFreeMap carry the map component's identifier. It includes the app's name and version, your Android version and your phone's processor type.
• Requests to our tour service carry a generic identifier of the network component that names no device.

The app does not send your advertising ID or any hardware serial number or other hardware identifier to anyone.

4. Your consent to precise location

Precise geolocation is sensitive data under several state privacy laws. We use it only with your consent, and only to provide the features you choose: the map, tours, destinations and saved areas.

How you give consent.

• Before Android asks for location permission, the app shows the first statement below, with Not now and Continue. It does this on the welcome screen, when you start a tour and when you search for a destination, whenever you have not yet agreed or location has not yet been allowed.
• You consent by choosing Continue and then allowing location in Android's own prompt. The app records on your phone when you agreed, and to which version of the statement. If the statement changes, the app asks again before your next tour.
• The app asks for location "All the time" separately, after showing the second statement.
• Notifications are asked for separately.
• Tours, including tours started from Android Auto, do not start until you have agreed on your phone. You can choose Not now and still open the app, but it cannot run tours.

First statement: "Location for your tours" (before Android's location prompt):

Verbocities collects location data to play the story of each place as you reach it, to find places near you, to show where you are on the map, and to plan a route when you choose a destination. To do that, the app sends: your exact position to your phone's address lookup service, to name the city you are in; your exact position and your destination to a public route planner (OSRM), when you choose a destination and again if you leave the route; your position, rounded to about 100 metres, to Wikipedia and to public OpenStreetMap search servers in Germany and Austria, to find places; the part of the map on your screen to OpenFreeMap, to draw the map; your city and the places near you (on food and drink tours, also the map squares about 1 km across that you pass) to the Verbocities tour service, which writes and speaks the stories. It never receives your coordinates; if our service can't be reached, the tour's opening line, which names your city, to your phone's text-to-speech engine. Verbocities does not sell your location or use it for ads. You can turn location off at any time in Android Settings → Apps → Verbocities → Permissions, and end a tour at any time with Stop tour.

Second statement: "Stories with the screen off" (before Android's "All the time" setting):

Verbocities collects location data to play the story of each place as you reach it, to find places ahead of you and along your route, to re-plan your route if you leave it, and to run tours started from Android Auto, even when the app is closed or not in use: with the screen off, with the phone in your pocket, or with the phone mounted in the car. This happens only while a tour is running. Stop tour, on your phone or on Android Auto's Tour tab, ends it, and so does closing Verbocities from your recent apps. While a tour runs, your location goes to the same places as when the app is open: the address lookup service and the route planner (your exact position), Wikipedia and the OpenStreetMap search servers (rounded to about 100 metres), and the Verbocities tour service (your city and the places near you, never your coordinates). On the next screen, choose "Allow all the time". If you don't, tours still work, but only while Verbocities is open on your screen, and they can't be started from Android Auto. Verbocities does not sell your location or use it for ads.

How to withdraw consent.

• Go to Android Settings → Apps → Verbocities → Permissions → Location.
• Choose Don't allow to stop all location use.
• Choose Allow only while using the app to stop background use.
• Stopping a tour also stops background use.
• Delete my data also removes your recorded consent, so the app asks again before any tour.

Withdrawal takes effect on your phone at once. Our tour service stores no coordinates, so there is nothing more for us to stop.

5. What our tour service receives and keeps

5.1 Your device token

The first time the app needs the tour service, it asks the service for a device token. This is a random 256-bit value that the service generates. The app keeps it in encrypted secure storage and sends it with every request to the service.

Our service does not store the token itself. It stores:

• a one-way hash of the token;
• a random record ID;
• the time the record was created;
• the time it was last used, which is updated on every request;
• a monthly-limit override and a block flag, both of which we set by hand; and
• a free-text label field, which the app leaves empty.

The record contains no name, email address, phone number, IP address, hardware or advertising identifier, or location.

Your device code. Settings shows a short device code: the first eight characters of the same one-way hash. It lets us find your record when you email us, without you sending the token itself.

If the service rejects a token, the app discards it and registers a new one. Reinstalling the app, clearing its storage or choosing Delete my data also creates a new token and a new record the next time the app needs the service.

5.2 What the app sends to the service

The app never sends the tour service your coordinates, location accuracy, speed or heading, your destination or route, or your device model, operating system or advertising ID. Together, though, these requests show roughly where a device is (a city, and places or squares within a few kilometres) and when.

5.3 What the service keeps

We use the usage history to enforce per-device monthly limits and an overall monthly budget, and to spot abuse. While a request is being processed, the service holds a spending reservation in memory. That reservation is lost when the service restarts.

The shared records above are not linked to any device, but they carry timestamps, and so does each device's usage history. In principle, comparing the two could suggest which device first asked for a particular place or map square, and when. We do not use our records to follow where individual devices go.

5.4 Logs

Service logs. The service writes operational messages to its logs: start-up, maintenance, requests, story reports and errors. A request's line holds its method, the kind of request (never which story or place), the result and how long it took. Some other messages include a map-square ID, a place ID, a cache key or a place name, together with the time. No log line contains a device token, device record ID, IP address or coordinates. The logs are rotated by size, up to about 30 MB for each of the service and its database. How long a line lasts therefore depends on how busy the service is.

Reverse proxy logs. Connections to the service pass through a reverse proxy that we operate. It may record the IP address, time, requested address and app identifier of each request in its access logs. We use these logs to keep the service secure and to investigate abuse, and keep them for [N days]. Story audio files have addresses that correspond to places, so these logs could show which stories were fetched from an IP address, and when.

6. Other information

6.1 Destinations and shared links

• Searching for a destination. The text you type goes to your phone's address lookup service. It turns your results into readable names by looking up their coordinates.
• Sharing text to Verbocities (for example a link from a maps app). The app reads the text on your phone and looks for coordinates in it. If there are none, it opens the first web link in the text to see where it leads. That link can point to any website, and that website receives your IP address. The app may then send the rest of the text to your phone's address lookup service.
• After you set a destination, your exact position and the destination go to the route planner straight away (see Section 3.2). The app keeps the last shared text in its storage until Delete my data or the next share, and Android backup may include it (see Section 2).
• "Navigate there" passes only the destination's coordinates to your phone's navigation app, or to a maps website in your browser.

6.2 Android Auto, the lock screen and Bluetooth

When your phone connects to Android Auto, the app learns only that it is connected, and switches to driving mode. It reads no data from the car.

Voice searches such as "play … on Verbocities" are first handled by your phone's voice assistant (Google Assistant or Gemini), under its own privacy policy. The app receives only the words and matches them on your phone.

Like other media apps, Verbocities publishes the current story and the list of nearby stops to Android's media system. This includes stop names and descriptions, which side of the road they are on and how far away, the city, the narrator and your destination's name.

• Android Auto and Android's own system components use this to show the tour and to let you start one. At present, other apps on your phone that connect to media apps can also read the stop list and start a tour. We are limiting this to Android Auto and Android itself.
• The car display, the lock screen and connected Bluetooth devices show the story that is playing.
• Apps you have allowed to read your notifications can see the story that is playing and control playback.
• A car or Bluetooth device may keep what it is shown under its own settings.

6.3 Stories written and read by AI

Stories and the choice of stops are produced by AI models, and each place's screen says so ("Written and read aloud by AI"). Our tour service sends the AI models the city and information about places:

• names, descriptions and facts;
• Wikipedia text; and
• for restaurants and bars, up to 10 short snippets from diners' online reviews, found by our search provider, without reviewers' names.

Speech is produced from the finished story text. None of these requests includes your device token, your IP address or your coordinates.

If our service can't provide a story's audio but its text is already on your phone, or can't speak the tour's opening line, the app asks your phone's text-to-speech engine to read it. Depending on the engine you have installed and its settings, the engine may send the text to its provider. The text is the story or greeting, which can include the city name. It contains nothing else about you.

6.4 Reporting a story

If a story is offensive, unsuitable, harmful or wrong, you can report it: tap the flag on the story that is playing, or open the place and choose Report this story. Reporting is on the phone only, not in Android Auto.

• The report sends what Section 5.2 lists. The note is optional, and the report screen asks you not to include personal details.
• Our service normally stops serving that story to anyone at once, and the next person to reach the place hears a newly written one. To stop one person or program from having every story rewritten, each phone's first 10 reports a day do this, and no more than 60 an hour across the service; later reports are kept for us to review.
• We keep the report, with no device, token or IP address, for 12 months, to review it and improve how stories are written.
• If you choose "Don't play this story again on this phone", the app also deletes its own copy.

6.5 Help and emails you send us

Contact us in Settings, and in Questions and answers, opens your email app with a message to [email protected]. The message is filled in with the app version, your Android version, your phone's make and model, and your story language, so that we can help. It never includes your location or your device token. You can see, change or delete any of it before sending.

If you email us, we receive your email address and whatever you write. We use it only to reply and to handle your request. Our email provider stores it for us, and we keep it for up to 24 months.

6.6 Android permissions

7. How we use information

We do not use information for any other purpose unless we first update this policy and, where the law requires it, ask for your consent.

8. Who receives information

The independent services below receive information directly from your phone so that the app can do what you ask. Service providers receive information from our tour service and work on our instructions. No recipient receives your device token.

The text our service sends to OpenRouter describes places. It does not include your token, your IP address or your coordinates. OpenRouter and the model providers handle it under their own policies.

We may also disclose information:

• when the law requires it, or to respond to valid legal process;
• to protect the safety, rights or property of our users, the public or Verbocities;
• to professional advisers under a duty of confidentiality; or
• to a company formed to run Verbocities, or a buyer or successor of it. This policy would continue to apply to information it received.

When you tap a link in the app (for example to a Wikipedia article, an OpenStreetMap page or a licence), it opens in a browser tab. That site receives what your browser normally sends.

9. No sale, no targeted advertising, no profiling

• We do not sell personal data, including precise geolocation, for money or anything else of value.
• We do not share personal data for cross-context behavioural advertising and do not use it for targeted advertising. The app shows no ads.
• We do not profile you. The AI scores places, not people. The service automatically pauses new stories for a device that reaches a usage limit. That is not a decision with legal or similarly significant effects.
• We do not use personal data to train AI models, and we do not sell or give it to anyone to train models. What we send to the AI providers describes places, not you (see Section 8).
• We use no analytics, advertising or crash-reporting tools, and the app does not read the Android advertising ID.

These commitments apply to everyone.

10. Do Not Track, Global Privacy Control, and tracking by others

We do not track you across other companies' apps or websites, and we do not collect information about your activity over time for advertising. There is therefore nothing for a Do Not Track or Global Privacy Control signal to switch off, and the app does not change its behaviour in response to one. The app is not a web browser and does not receive these signals. If you send us an opt-out request by email, we will honour it, although we do not sell data or do targeted advertising in the first place.

The app contains no third-party advertising or analytics code that collects information about you across services. However, the independent services in Section 8 receive your IP address and your requests directly from your phone. Under their own policies they may keep that information, set cookies (which the app stores, see Section 2), and connect it with other activity from the same IP address or device.

11. How long we keep information

12. Security

We protect information with reasonable safeguards suited to what we hold:

• The token. Device tokens are 256-bit random values. The service stores only a one-way hash of each token and compares tokens in a way designed to resist timing attacks. On your phone, the token is kept in Android's encrypted secure storage.
• Encryption in transit. The app reaches our service and the services it calls over HTTPS. It does not open unencrypted http:// links, including in text you share to it.
• Keeping coordinates off our servers. Our service never receives your coordinates.
• Hardening the service.
• The service's application container has a read-only file system and runs without administrator privileges.
• Its database is not reachable from the internet.
• Its secret keys are kept in protected files and never logged.
• Every request is size-limited and checked.
• Our API keys. Our API keys never reach your phone, and the app has no way to take one.

No method of storage or transmission is completely secure, and we cannot guarantee security. If a breach affects your personal information, we will notify you and the authorities as the law requires.

13. Your choices and how to delete data

Delete my data, in the app. Go to Settings → Delete my data.

• The app first stops any tour and any area download.
• It then asks our service to delete your device record. The service removes the device from its usage history (see Section 5.3).
• Once the service confirms, the app deletes your device token, your settings and location consent, your destination, the list of stories heard on your last tour and the last text you shared, and returns to the welcome screen.
• If the app cannot reach our service, it tells you and deletes nothing, so that you can try again.
• What stays: the places, stories and audio saved on your phone, and the shared story cache on our service. They describe places, not you, and let a saved area play with no signal. To remove the ones on your phone, clear the app's storage (below).
• If you use the app again afterwards, it registers a new token and a new record.

On your phone only.

• Delete everything on your phone. Uninstall Verbocities, or go to Android Settings → Apps → Verbocities → Storage → Clear storage. This deletes the place history, stories, audio, settings, consent, device token, last shared text, caches and cookies. It does not delete your record on our service; use Delete my data first if you want that.
• Remove Android backups. To remove anything already copied to Android backup, manage backups in your Google account settings.
• Stop location use. See Section 4.

On our service.

• What stays. Stories, scores, listings and reports are not linked to any device, so they stay.
• If you have already uninstalled the app or cleared its storage, the token that linked the record to your phone is gone. The record left on our service holds only a random ID, dates and costs, and neither you nor we can tell which record was yours. It is deleted automatically 12 months after it was last used. We will not ask you for extra information, such as your name, just to link you to a record.

Other requests by email. To see what our service holds about your device, get a copy of it, or make any other request, email [email protected]. Include your device code, which the app shows under Settings → Privacy and your data.

Correcting information. You can change your settings in the app at any time. We hold no profile, name or contact details for you to correct. If you believe something we hold about your device is wrong, email us.

14. Your privacy rights in the United States

We give the rights in this section to every user in the United States, whatever state you live in, whether or not your state's law requires it.

Your rights. You can ask us to:

• confirm whether we process personal data about you, and give you access to it;
• correct inaccurate personal data;
• delete personal data about you;
• give you a copy of your data in a portable, machine-readable format;
• tell you the specific third parties we have disclosed your data to. Section 8 names them, and on request we will tell you which of them received data about your device;
• stop any sale of your data, targeted advertising, or profiling that leads to decisions with legal or similarly significant effects. We do none of these, but you may still make the request.

You can also withdraw your consent to precise location at any time (see Section 4).

How to make a request.

• To delete your data, use Delete my data in the app (see Section 13). The app proves the request is yours with your device token, so nothing else is needed.
• For any other request, or to delete by email, email [email protected] and include your device code (see Section 13). We do not need your name.
• Because your data is linked only to a random token, we check an emailed request by matching the device code. Opt-out requests do not need to be checked.
• If we cannot reasonably link a request to a device record, we will tell you. The law does not require us to collect more information about you in order to make that link.

Authorized agents. Someone you authorize may make a request for you. We may ask for proof that you gave them permission.

Timing and cost.

• We respond within 45 days. If we need more time, we may extend this once by another 45 days and will tell you why.
• Requests are free. If requests from the same person are clearly unfounded or excessive, we may charge a reasonable fee or decline, where the law allows.

Appeals.

• If we decline your request, you can appeal by replying to our decision with the subject "Appeal". We will decide within 60 days and explain our decision in writing.
• If we deny your appeal, you may contact your state attorney general. In Delaware, that is the Consumer Protection Unit of the Delaware Department of Justice (https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/).

No discrimination. We will not deny you the service, change its quality or treat you differently for exercising these rights.

State-specific notes.

• Delaware. This policy is intended to meet the Delaware Online Privacy and Protection Act and the Delaware Personal Data Privacy Act. Precise geolocation is sensitive data under the Delaware Personal Data Privacy Act, and we process it only with your consent (see Section 4).
• California. This policy is intended to meet the California Online Privacy Protection Act. We do not disclose personal information to third parties for their direct marketing purposes. We do not sell or share personal information as the California Consumer Privacy Act defines those terms.
• Connecticut, Maryland, Oregon, Virginia, Texas and other states with comprehensive privacy laws. We do not sell precise geolocation or any other personal data. We collect and use precise geolocation only to provide the features you request, and only with your consent.
• Nevada. We do not sell covered information. You may send a request to opt out of any sale to [email protected].

15. Children and teens

Verbocities is for people aged 18 and over. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

The "For your kids" narrator is for a parent or other adult touring with children: it tells stories in a way children listening along will enjoy, with something for them to spot. It changes only how stories are told. The app runs on the adult's phone and collects nothing from the children listening.

If you believe a child under 13 has used Verbocities, contact [email protected]. We will delete any service record we can link to that child's device (see Section 13) and explain how to delete the data on the phone.

We do not sell anyone's data or use it for targeted advertising.

16. Where information is processed

Our tour service runs on servers we operate in the United States. Some of the independent services the app contacts directly are run from other countries:

• router.project-osrm.org, the route planner, is run by FOSSGIS e.V. in Germany. It receives your exact position and destination when you set a destination.
• overpass-api.de is run from Germany.
• overpass.private.coffee is run by Private.coffee, an association in Austria.
• OpenFreeMap is run by Hyperknot Software Kft. in Hungary.

These services receive your IP address and what Section 3.2 says each one receives, under the laws of the country where they operate.

17. Changes to this policy

The app always shows the current version of this policy, and we update the "Last updated" date at the top when it changes. If we make a material change, for example collecting new kinds of information, using it for a new purpose, or sending it to a new kind of recipient, we will tell you before it applies. If what the app does with location changes, the app shows the new location statement and asks for your consent again before your next tour.

18. Contact us

Email [email protected] for anything about this policy or your data, and [email protected] for help with the app. We reply within two business days.

19. Supplement for the European Economic Area and the United Kingdom

This section applies when you use Verbocities in the European Economic Area (EEA) or the United Kingdom, or where the EU General Data Protection Regulation or the UK General Data Protection Regulation otherwise applies. It adds to the rest of this policy.

Controller. The developer of Verbocities, [name and postal address], [email protected].

Representatives.

• EU representative: [EU representative].
• UK representative: [UK representative].
• We have not appointed a data protection officer.

Purposes and legal bases.

You can object to processing based on legitimate interests. Email us and explain why, and we will stop unless we have compelling grounds to continue.

Providing your data. You are not legally required to give us any data. Without location, however, the app cannot run tours.

Recipients. See Section 8.

International transfers. Our service is in the United States, and we collect data from you there directly. Some recipients are in the United States; others are in Germany, Austria and Hungary (see Section 16). Where the law requires safeguards for a transfer, we rely on [safeguard: standard contractual clauses / adequacy decision / EU-US Data Privacy Framework certification of the recipient].

Retention. See Section 11.

Your rights. You have the right to:

• access your data;
• have it corrected or erased;
• restrict its processing;
• receive it in a portable format;
• object to its processing; and
• withdraw your consent to location at any time, by removing the permission in Android settings. The app then stops reading your location and cannot run tours. This does not affect processing that took place before.

To use these rights, see Sections 13 and 14.

Complaints. You can complain to a data protection supervisory authority, particularly in the EEA country where you live or work or where you believe the problem happened. In the UK, you can first complain to us at [email protected]. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office.

Automated decisions. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

Age. In the EEA and UK, Verbocities is for people aged 18 and over.

AI-generated content. Stories, and the voices that read them, are generated by AI, and the app says so.