On-device by default. Honest about what leaves.

Summary

• Voyage does not require an account.
• Voyage stores your progress, preferences, and purchase entitlement state on your device.
• Voyage may back up your progress to your iCloud Key-Value Store so it can be restored on a new device.
• Voyage uses StoreKit for purchases and restores; Apple handles payment processing.
• Voyage can request permission to send local notifications related to active focus sessions.
• Voyage may show local Live Activities for active focus sessions.
• Voyage includes Signal Beacons, an optional in-game feature that lets players send short anonymous messages tied to discovered astronomical objects. These messages are stored on Voyage's backend, moderated before delivery, and can be reported and blocked by receivers.
• Voyage sends anonymous usage analytics events (no name, email, contacts, location, or Apple advertising identifier) to a Voyage-operated backend hosted on Cloudflare.
• Release builds of Voyage send crash reports to Sentry, configured to omit personally identifiable information.
• Voyage does not use third-party advertising SDKs or cross-app tracking.

Information We Handle

1. Information stored on your device

Voyage stores certain app data locally on your device so the app can function properly. This may include your discovery and progress data, session state, timing state, app preferences such as haptic settings or default timer length, your purchase entitlement state, locally saved Signal Beacon messages you have received, and a random app installation identifier (a UUID generated on first launch).

Your discovery and progress data is stored locally on your device. It may also be backed up to your iCloud Key-Value Store as described in section 7.

2. Notifications and Live Activities

Voyage may ask for permission to send notifications. If you allow notifications, Voyage uses local notifications on your device to remind you about an active focus session or session drift state.

These notifications are generated locally by the app. Voyage does not use remote push notifications.

Voyage may also show a Live Activity for an active focus session. Live Activities are created locally and use session timing information so iOS can display the current session state on supported system surfaces.

3. Device state used for session behavior

To manage focus-session timing correctly, Voyage may react to certain device or app state changes on your device, such as whether the app moved to the background, whether the device was locked or unlocked, or whether a phone call is active.

This information is processed locally on-device for app behavior only. Voyage does not use it to identify you or profile you.

4. Purchases and entitlement state

If you buy or restore Voyage's paid features, the purchase flow is handled by Apple through StoreKit. Voyage receives enough transaction and entitlement state to unlock paid features, restore purchases, and keep your local app state in sync.

Apple handles payment processing. Voyage does not receive or store your payment card number or other payment credentials.

Voyage may include product identifiers, purchase start/outcome events, restore outcomes, and entitlement state in its anonymous usage analytics so we can verify that purchase flows work. These analytics events do not include your payment card details or Apple account credentials.

5. Signal Beacons

Signal Beacons is an optional in-game user-generated content feature. If you choose to release a Signal Beacon, Voyage sends the short message you wrote to a Voyage-operated Cloudflare backend, along with the astronomical object identifier, message style identifier, a random app installation identifier for the sender, and server timestamps.

Signal Beacon messages are anonymous to other players. Receivers do not see the sender's identity or device identifier, and senders are not told whether their message was delivered, ignored, reported, or moderated away.

Voyage moderates Signal Beacon messages before they can be delivered. The backend stores new messages in a pending state, uses Cloudflare Workers AI for automated safety classification, and only delivers messages that pass moderation. If moderation fails or rejects a message, that message is not delivered.

When a player receives a Signal Beacon, the backend uses the receiver's random app installation identifier to prevent self-delivery, reserve the message for that receiver, mark consumed messages as delivered, and avoid delivering future messages from a sender that receiver has blocked.

If a receiver reports a Signal Beacon, Voyage records the report, marks the message rejected so it will not be delivered again, and records a per-receiver block against the sender's random app installation identifier. The block only affects future delivery to the reporting receiver. It does not reveal the sender to the receiver.

Received Signal Beacon messages may also be saved locally on your device as part of the object detail view. You can delete a local saved copy in the app. Deleting a local saved copy does not remove server-side moderation, report, delivery, or block records that are needed to operate the feature safely.

6. Anonymous usage analytics

Voyage sends anonymous usage analytics events from the app to a Voyage-operated backend hosted on Cloudflare. These events help us understand how the app is used, find bugs, and improve performance.

What an analytics event contains:

• A random app installation identifier (the same UUID stored on your device; not Apple's advertising identifier and not your name or email).
• A per-launch session identifier and a sequence number.
• The app version and build identifier.
• The event name and a small set of event-specific properties -- for example, which view you opened, which focus duration you picked, which object you discovered, how long an in-app operation took, purchase flow outcomes, Signal Beacon delivery outcomes, or anonymized error messages.

What an analytics event does not contain:

• Your name, email address, phone number, address, or contacts.
• Your precise or approximate location.
• The contents of photos, audio, or Signal Beacon messages.
• Apple's advertising identifier (IDFA).
• Payment card details.

Apple's privacy questionnaire categorizes the data Voyage sends as: Gameplay Content, Device ID, Purchase History, Product Interaction, Crash Data, Performance Data, and Other Diagnostic Data. None of these are linked to your identity, and none are used for tracking across apps or websites.

Analytics events are batched on your device and uploaded to a Cloudflare Worker, which writes them as flat files to Cloudflare R2 object storage in a Voyage-controlled bucket. We retain these files indefinitely so we can run year-over-year product analytics. The events are not linked to your identity and are not sold, shared with advertisers, or used for cross-app tracking.

7. iCloud progress backup

If you are signed in to iCloud and have iCloud Drive enabled for Voyage, Voyage may save a small backup of your progress to your personal iCloud Key-Value Store. This backup is stored in your own iCloud account and is governed by Apple's iCloud terms and privacy policy. Voyage does not have access to other users' iCloud backups.

You can disable iCloud for Voyage at any time in iOS Settings, or sign out of iCloud entirely.

8. Crash diagnostics

Release builds of Voyage (the App Store version) send crash reports to Sentry so we can find and fix crashes.

Sentry is configured with sendDefaultPii = false, which tells the SDK not to attach personally identifiable information such as IP-based user identifiers, usernames, or email addresses to crash events. Voyage does not enable Sentry's session replay, performance tracing, or profiling features.

A crash report typically includes the crash stack trace, the OS version, the device model, the app version and build identifier, and limited runtime context that Sentry collects for diagnostics. Crash reports are processed by Sentry on Voyage's behalf under Sentry's privacy policy.

Debug and TestFlight builds may behave differently. Sentry is only initialized in Release builds.

What We Do Not Collect

Voyage does not collect or transmit:

• Your name, email address, or phone number.
• Your precise or approximate location.
• Contacts, photos, camera, or microphone data.
• Health data.
• Browsing history outside the app.
• Apple's advertising identifier (IDFA) or any other cross-app advertising ID.
• Payment card details.

Voyage also does not include third-party advertising SDKs, cross-app or cross-website tracking, account creation or login, or a Voyage-operated cloud sync separate from iCloud.

How We Use Information

Information handled by Voyage is used only to:

• Save and restore your progress.
• Restore your app state after interruptions.
• Apply your preferences.
• Manage focus-session timing, local notifications, and Live Activities.
• Unlock or restore paid purchases.
• Operate Signal Beacons, including moderation, one-shot delivery, reports, and per-receiver sender blocks.
• Understand how the app is used and find bugs (analytics).
• Diagnose and fix crashes (crash reports).

Voyage does not use your information for advertising, sale of data, or profiling.

Sharing

Voyage uses a small number of third-party service providers (sometimes called "processors") to operate the app. They process information on Voyage's behalf:

• Apple -- App Store distribution, StoreKit purchases and restores, push and notification permissions, Live Activities, and iCloud Key-Value Store backup. Apple's processing is governed by Apple's terms and privacy documentation.
• Cloudflare -- hosts the analytics endpoint, stores the analytics event files described in section 6, hosts the Signal Beacons backend, stores Signal Beacon records in Cloudflare D1, and provides Workers AI moderation for Signal Beacon text.
• Sentry (Functional Software, Inc., d/b/a Sentry) -- receives crash reports from Release builds as described in section 8.

Voyage does not sell your data and does not share your data with advertisers.

Data Retention

Local app data on your device is controlled by you. You can remove it by using any in-app reset option Voyage provides or by deleting the app from your device.

Purchase records and entitlements are handled by Apple. Deleting the app may remove local entitlement cache data, but it does not remove Apple's purchase records.

iCloud Key-Value Store backups are stored in your own iCloud account and follow Apple's retention rules. You can clear them by signing out of iCloud or removing Voyage from iCloud in iOS Settings.

Analytics event files in Cloudflare R2 are retained indefinitely so Voyage can run year-over-year product analytics. Because the events are not linked to a personal identity, Voyage cannot delete events for a specific user; you can stop adding new events at any time by deleting the app.

Signal Beacon records in Cloudflare D1, including message text, delivery state, moderation state, reports, and per-receiver sender blocks, are retained indefinitely unless manually removed. Retaining these records prevents reported or consumed messages from being delivered again and keeps per-receiver blocks effective. Because Voyage does not require accounts or collect names or email addresses in the app, requests about a specific Signal Beacon may require enough information to identify the relevant message or report.

Crash reports in Sentry are subject to Sentry's retention policy. Voyage does not extend that retention.

Children's Privacy

Voyage is not directed at children. Voyage does not knowingly request, collect, or transmit personal information from children. If you believe a child has provided personal information to Voyage, please contact us so we can address it.

International Users

Voyage's analytics and Signal Beacons backends are hosted on Cloudflare's global network and may process data outside your country of residence. By using Voyage, you understand that this processing occurs.

Changes To This Policy

Voyage may update this Privacy Policy from time to time as the app changes. If material changes are made to how the app handles information, the effective date above will be updated and this page will be revised.

Contact Us

If you have questions about this Privacy Policy, Voyage's privacy practices, or a Signal Beacon moderation concern, email hello@voyageapp.space.