On-device by default. Honest about what leaves.

Summary

Where the two platforms differ, this policy says so. The differences are: who processes your purchase (Apple on iOS, Google on Android), where a progress backup goes (your iCloud Key-Value Store on iOS, your Google account through Android Auto Backup on Android), and how the anonymous analytics identifier behaves across a restore (section 6). Everything else -- what is stored, what is sent, and why -- is the same app on both.

• Voyage does not require an account.
• Voyage stores your progress, preferences, and purchase entitlement state on your device.
• Voyage may back up your progress so it can be restored on a new device: to your iCloud Key-Value Store on iOS, or through Android Auto Backup to your Google account on Android.
• Voyage uses StoreKit on iOS and Google Play Billing on Android for purchases and restores; Apple or Google handles payment processing.
• Voyage can request permission to send local notifications about your voyage's arrival.
• Voyage includes Signal Beacons, an optional in-game feature that lets players send and receive short anonymous messages tied to discovered astronomical objects. Sending and receiving both work on iOS and on Android. These messages are stored on Voyage's backend, moderated before delivery, and can be reported and blocked by receivers.
• Voyage sends anonymous usage analytics events (no name, email, contacts, location, or advertising identifier) to a Voyage-operated backend hosted on Cloudflare.
• Release builds of Voyage send crash reports to Sentry, configured to omit personally identifiable information.
• Voyage does not use third-party advertising SDKs or cross-app tracking.

Information We Handle

1. Information stored on your device

Voyage stores certain app data locally on your device so the app can function properly. This may include your discovery and progress data, voyage state, timing state, app preferences such as haptic settings, sound settings, or your trip length, your purchase entitlement state, locally saved Signal Beacon messages you have received, and a random app installation identifier (a UUID generated on first launch).

Your discovery and progress data is stored locally on your device. It may also be backed up as described in section 7.

2. Notifications

Voyage may ask for permission to send notifications. If you allow notifications, Voyage uses local notifications on your device to tell you that your voyage has arrived, and to remind you that an arrived voyage is still waiting to be claimed.

These notifications are generated locally by the app and scheduled from your voyage's arrival time. Voyage does not use remote push notifications on either platform.

On Android, this is the POST_NOTIFICATIONS runtime permission, requested the first time a real voyage is under way rather than at first launch.

You can revoke notification permission at any time: in iOS Settings, or in Android's Settings under Apps → Voyage → Notifications.

3. Device state used for app behavior

Voyage reacts to a small amount of app and device state on your device so it can keep your progress correct: whether the app moved to the foreground or background, so Voyage can check whether your voyage arrived while you were away, and -- on iOS -- whether protected data has become available again, so a progress save that failed while the device was locked can be retried.

This information is processed locally on-device for app behavior only. Voyage does not use it to identify you or profile you.

4. Purchases and entitlement state

If you buy or restore Voyage's paid features, the purchase flow is handled by the store you installed the app from: Apple through StoreKit on iOS, or Google through Google Play Billing on Android. Voyage receives enough transaction and entitlement state to unlock paid features, restore purchases, and keep your local app state in sync.

Apple or Google handles payment processing. Voyage does not receive or store your payment card number or other payment credentials, and Voyage never sees your Apple Account or Google Account credentials.

On Android, restoring a purchase means reading the entitlements Google already holds for the Google Account signed in on the device. Voyage does not operate its own purchase record and cannot look a purchase up by any other means.

Voyage may include product identifiers, purchase start/outcome events, restore outcomes, store response-code labels, and entitlement state in its anonymous usage analytics so we can verify that purchase flows work. These analytics events do not include your payment card details or your Apple Account or Google Account credentials.

5. Signal Beacons

Signal Beacons is an optional in-game user-generated content feature, available on both iOS and Android. If you choose to release a Signal Beacon, Voyage sends the short message you wrote to a Voyage-operated Cloudflare backend, along with the astronomical object identifier, message style identifier, a random app installation identifier for the sender, and server timestamps.

Messages are limited to 100 characters, and the number you can release is limited both by the in-game beacons you have earned and by a per-device daily cap enforced by the backend.

Signal Beacon messages are anonymous to other players. Receivers do not see the sender's identity or device identifier, and senders are not told whether their message was delivered, ignored, reported, or moderated away.

Voyage moderates Signal Beacon messages before they can be delivered. The backend stores new messages in a pending state, uses Cloudflare Workers AI for automated safety classification, and only delivers messages that pass moderation. If moderation fails or rejects a message, that message is not delivered.

When a player receives a Signal Beacon, the backend uses the receiver's random app installation identifier to prevent self-delivery, reserve the message for that receiver, mark consumed messages as delivered, and avoid delivering future messages from a sender that receiver has blocked.

If a receiver reports a Signal Beacon, Voyage records the report, marks the message rejected so it will not be delivered again, and records a per-receiver block against the sender's random app installation identifier. The block only affects future delivery to the reporting receiver. It does not reveal the sender to the receiver.

Received Signal Beacon messages may also be saved locally on your device as part of the object detail view. Because they are saved with the rest of your progress, they travel with the progress backup described in section 7. You can delete a local saved copy in the app. Deleting a local saved copy does not remove server-side moderation, report, delivery, or block records that are needed to operate the feature safely.

6. Anonymous usage analytics

Voyage sends anonymous usage analytics events from the app to a Voyage-operated backend hosted on Cloudflare. These events help us understand how the app is used, find bugs, and improve performance.

What an analytics event contains:

• A random app installation identifier (the same UUID stored on your device; not an advertising identifier and not your name or email).
• A per-launch session identifier and a sequence number.
• The app version and build identifier.
• The event name and a small set of event-specific properties -- for example, which view you opened, which trip length you picked, which object you discovered, how long an in-app operation took, purchase flow outcomes, Signal Beacon delivery outcomes, or anonymized error messages.

What an analytics event does not contain:

• Your name, email address, phone number, address, or contacts.
• Your precise or approximate location.
• The contents of photos, audio, or Signal Beacon messages.
• Apple's advertising identifier (IDFA), Android's advertising ID, or ANDROID_ID.
• Payment card details.

The identifier behaves differently on the two platforms, and the difference is deliberate:

• On iOS, the identifier is stored with your progress, so it travels in the iCloud backup described in section 7. Restoring onto a new iPhone keeps the same identifier.
• On Android, the identifier is a separate UUID kept outside everything the backup carries, so it does not survive a restore. An install restored onto a second device mints a new identifier and starts a new, unlinked trail. Voyage deliberately does not use Settings.Secure.ANDROID_ID, the Google advertising ID, or any hardware-derived identifier.

Apple's privacy questionnaire categorizes the data Voyage sends as: Gameplay Content, Device ID, Purchase History, Product Interaction, Crash Data, Performance Data, and Other Diagnostic Data. Google Play's Data safety form categorizes the same data as: Device or other IDs, App interactions, Purchase history, Other in-app messages, Crash logs, and Diagnostics. None of these are linked to your identity, and none are used for tracking across apps or websites.

Analytics events are batched on your device and uploaded to a Cloudflare Worker, which writes them as flat files to Cloudflare R2 object storage in a Voyage-controlled bucket. We retain these files indefinitely so we can run year-over-year product analytics. The events are not linked to your identity and are not sold, shared with advertisers, or used for cross-app tracking.

7. Progress backup

Voyage can back up your saved game -- your discoveries, progress, voyage state, preferences, entitlement state, and any Signal Beacon messages you have kept -- so it can be restored on a new device. The backup goes to your own account with the platform vendor. Voyage never receives it and cannot read it.

On iOS. If you are signed in to iCloud and have iCloud Drive enabled for Voyage, Voyage may save a small backup of your progress to your personal iCloud Key-Value Store. This backup is stored in your own iCloud account and is governed by Apple's iCloud terms and privacy policy. Voyage does not have access to other users' iCloud backups.

You can disable iCloud for Voyage at any time in iOS Settings, or sign out of iCloud entirely.

On Android. Voyage participates in Android Auto Backup, an operating-system feature that copies app data to your Google account, and in Android's device-to-device transfer. Both are operated by Google and governed by Google's terms and privacy policy. Voyage never receives the backup and cannot read it.

Google encrypts backups in transit and at rest. End-to-end encryption -- where the key is derived from your device screen lock and Google cannot read the backup itself -- applies additionally on Android 9 and later, and only when you have a screen lock set. On Android 8, or on any device with no screen lock, the backup is instead protected by keys Google manages. Voyage supports Android 8.0 and later and does not decline to back up when end-to-end encryption is unavailable, so which of the two applies depends on your device and your settings rather than on Voyage.

Voyage includes only three files in that backup, by an explicit include-list rather than by default: the saved game (state.json), your app settings, and the small set of first-run flags that stop the app from replaying onboarding for a returning player. Everything else stays on your device, including the pending analytics queue and the random analytics installation identifier described in section 6.

You can turn Android backup off at any time in Android's Settings under Google → Backup, or per-app where your device offers it.

8. Crash diagnostics

Release builds of Voyage -- the App Store version and the Google Play version -- send crash reports to Sentry so we can find and fix crashes. On Android this also covers ANRs ("application not responding") and native crashes.

Sentry is configured with sendDefaultPii = false, which tells the SDK not to attach personally identifiable information such as IP-based user identifiers, usernames, or email addresses to crash events. Voyage does not enable Sentry's session replay, performance tracing, or profiling features, and does not attach screenshots or view hierarchies.

A crash report typically includes the crash stack trace, the OS version, the device model, the app version and build identifier, and limited runtime context that Sentry collects for diagnostics. The random app installation identifier from section 6 is attached as the Sentry user id, so a crash can be read alongside the events around it; it is the same anonymous identifier and carries no personal information. Crash reports are processed by Sentry on Voyage's behalf under Sentry's privacy policy.

Debug, TestFlight, and internal-track builds may behave differently. Sentry is only initialized in Release builds.

What We Do Not Collect

Voyage does not collect or transmit:

• Your name, email address, or phone number.
• Your precise or approximate location.
• Contacts, photos, camera, or microphone data.
• Health data.
• Browsing history outside the app.
• Apple's advertising identifier (IDFA), Android's advertising ID, ANDROID_ID, or any other cross-app advertising or hardware identifier.
• Payment card details.

Voyage also does not include third-party advertising SDKs, cross-app or cross-website tracking, account creation or login, or a Voyage-operated cloud sync separate from the platform backup described in section 7.

How We Use Information

Information handled by Voyage is used only to:

• Save and restore your progress.
• Restore your app state after interruptions.
• Apply your preferences.
• Manage voyage timing and local notifications.
• Unlock or restore paid purchases.
• Operate Signal Beacons, including moderation, one-shot delivery, reports, and per-receiver sender blocks.
• Understand how the app is used and find bugs (analytics).
• Diagnose and fix crashes (crash reports).

Voyage does not use your information for advertising, sale of data, or profiling.

Sharing

Voyage uses a small number of third-party service providers (sometimes called "processors") to operate the app. They process information on Voyage's behalf:

• Apple (iOS) -- App Store distribution, StoreKit purchases and restores, notification permissions, and iCloud Key-Value Store backup. Apple's processing is governed by Apple's terms and privacy documentation.
• Google (Android) -- Google Play distribution, Google Play Billing purchases and restores, and Android Auto Backup and device-to-device transfer. Google's processing is governed by Google's terms and privacy documentation.
• Cloudflare -- hosts the analytics endpoint, stores the analytics event files described in section 6, hosts the Signal Beacons backend, stores Signal Beacon records in Cloudflare D1, and provides Workers AI moderation for Signal Beacon text.
• Sentry (Functional Software, Inc., d/b/a Sentry) -- receives crash reports from Release builds as described in section 8.

Voyage does not sell your data and does not share your data with advertisers.

Data Retention

Local app data on your device is controlled by you. You can remove it by using any in-app reset option Voyage provides or by deleting the app from your device.

Purchase records and entitlements are handled by Apple on iOS and by Google on Android. Deleting the app may remove local entitlement cache data, but it does not remove Apple's or Google's purchase records.

iCloud Key-Value Store backups are stored in your own iCloud account and follow Apple's retention rules. You can clear them by signing out of iCloud or removing Voyage from iCloud in iOS Settings.

Android Auto Backup data is stored in your own Google account and follows Google's retention rules -- Google deletes an app's backup after a period of inactivity. You can clear it by deleting Voyage's backup in Android's Settings under Google → Backup.

Analytics event files in Cloudflare R2 are retained indefinitely so Voyage can run year-over-year product analytics. Because the events are not linked to a personal identity, Voyage cannot delete events for a specific user; you can stop adding new events at any time by deleting the app.

Signal Beacon records in Cloudflare D1, including message text, delivery state, moderation state, reports, and per-receiver sender blocks, are retained indefinitely unless manually removed. Retaining these records prevents reported or consumed messages from being delivered again and keeps per-receiver blocks effective. Because Voyage does not require accounts or collect names or email addresses in the app, requests about a specific Signal Beacon may require enough information to identify the relevant message or report.

Crash reports in Sentry are subject to Sentry's retention policy. Voyage does not extend that retention.

Children's Privacy

Voyage is not directed at children. Voyage does not knowingly request, collect, or transmit personal information from children. If you believe a child has provided personal information to Voyage, please contact us so we can address it.

International Users

Voyage's analytics and Signal Beacons backends are hosted on Cloudflare's global network and may process data outside your country of residence. By using Voyage, you understand that this processing occurs.

Changes To This Policy

Voyage may update this Privacy Policy from time to time as the app changes. If material changes are made to how the app handles information, the effective date above will be updated and this page will be revised.

Contact Us

If you have questions about this Privacy Policy, Voyage's privacy practices, or a Signal Beacon moderation concern, email hello@voyageapp.space.