Leuchtturm
Privacy Policy
Leuchtturm is an app for family and friends to see each other's location. The developer runs no server: everything is stored in iCloud, and content is encrypted on your device before it leaves it.
Last updated: October 12, 2026
- Locations, names, messages, pictures, places and all other content are end-to-end encrypted. Only the members of your lighthouses can read them. Neither the developer nor Apple can.
- Apple sees metadata: which iCloud accounts are in a lighthouse together, who owns it, when and how often data is written and its approximate size.
- No ads, no tracking, no analytics or advertising SDKs, no selling or sharing of data.
- You can stop sharing, leave lighthouses and delete all your data in the app at any time.
1. Controller
Tim Schaller
c/o Online-Impressum 11539
Europaring 90
53757 Sankt Augustin, Germany
Email: contact@timschaller.de
More in the legal notice (Impressum).
The app's source code is public: github.com/Tim-Schaller/Leuchtturm. You can check there what this policy describes.
2. Where your data is stored
Leuchtturm stores data in iCloud through Apple's CloudKit service. Each lighthouse (a group of people) lives in its owner's iCloud and is shared with its members. Your contract for iCloud is with Apple (in the EU, Apple Distribution International Ltd., Ireland); Apple's terms and privacy policy apply. The data may be stored in Apple data centers outside the EU, including the United States. Apple is certified under the EU-U.S. Data Privacy Framework.
Before anything leaves your device, it is encrypted with keys that only the members of the lighthouse have. Your keys are kept in iCloud Keychain (end-to-end encrypted by Apple) so your iPad or a new iPhone works right away, or, if you choose "keys only on this device", only on this device.
3. What data is processed
| Data | When | Who can read it |
|---|---|---|
| Location (coordinates, accuracy, time), battery level, speed while driving | while "Share Location" is on | members of your lighthouses |
| Name, profile picture, banner, colour, emoji, status | when you set them | members of your lighthouses |
| Chat messages, photos, stickers, reactions | when you send them | members of the lighthouse |
| Notes such as check-ins, "on my way", "pick me up", "where are you?", SOS, low battery, arriving at and leaving places | when you trigger them or your device reports them | members of the lighthouse |
| Places (e.g. home, school) | when someone adds them | members of the lighthouse |
| History (your paths of the last days) | only if you turn on "Share History" | members of your lighthouses |
| Trips (route, distance, top speed, hard braking and acceleration) | only if you turn on "Share Trips" | members of your lighthouses |
| Driving statistics: totals for 7 days, 30 days, one year and all time (number, distance, driving time, top speed, hard braking and acceleration) | only if you turn on "Share Trips" | members of your lighthouses |
| Today's and this week's steps from Apple Health | only if you turn on "Share Steps" and allow access in iOS | members of your lighthouses |
| Friend code card (your name and public keys) and friend requests | when you open the friends menu or add someone | whoever has your code; requests only the recipient |
| Public keys, signatures, invite expiry times | always | members and Apple (not secret) |
Everything in the table except the last row is encrypted and signed on your device. In fog mode your exact location does not leave the device; only a rough area is shared.
Only on your device
- Memories ("a year ago today"): your own paths, only on this iPhone, can be turned off.
- Visits for place suggestions: 30 days, only on this iPhone.
- Trip archive for the driving statistics: the numbers of your own trips (without routes), only on this iPhone.
- Widgets, Live Activity, Siri and Shortcuts: a small copy (names, places, battery, small pictures) in the app's protected storage on the device.
- "Not arrived yet" alerts and walk-home company are checked on the devices.
Apple Watch and Apple TV
The Apple Watch gets the widget copy directly from your iPhone (no server). An Apple TV you connect with its QR code gets an encrypted copy of the map through your own private iCloud; only that Apple TV can open it. Anyone in front of the TV sees the map.
Live link for people without the app
When you create a live link, your iPhone writes your location (and name, battery level), encrypted, to the app's public iCloud database for one hour. The key is only in the link after the "#". The web page (hosted on GitHub Pages) decrypts it in the browser. Anyone with the link sees your location until it ends. When the page is opened, GitHub (web page) and Apple (CloudKit) see the browser's IP address, but not the key. After one hour, or with "End Link", the entry is deleted.
Other Apple services
- Apple Maps provides the map. Apple sees which map area you load, but not who is where.
- Apple Weather (can be turned off): for the weather where your people are, the app asks with places rounded to about 1 km, without names.
- Notifications: Apple wakes the app with silent push notifications when something changes. The app decrypts the content on the device and shows it as a local notification.
- TestFlight (test versions only): Apple gives the developer crash reports and feedback if you allow it in TestFlight.
4. What the developer sees
None of your content. The developer runs no server and holds no keys. In Apple's CloudKit console, the developer sees only aggregate usage numbers and the encrypted entries of the public database (live links) with an anonymous user identifier assigned by Apple. With TestFlight, crash reports and feedback are added if you share them.
5. Purposes and legal bases
- The app features you use (sharing your location, lighthouses, chat and so on): Art. 6(1)(b) GDPR.
- Location access, motion data, Apple Health and all features you have to turn on: your consent, Art. 6(1)(a) GDPR, for steps from Apple Health also Art. 9(2)(a) GDPR. You can withdraw it at any time in the app or in iOS Settings.
- Security (signatures, checking invites): legitimate interest in a secure app, Art. 6(1)(f) GDPR.
6. How long data is kept
- Your location is replaced with every update and deleted at once when you stop sharing.
- History: as many days as you choose (today, 7 or 30 days), deleted at once when you turn it off.
- Trips and chat messages: 30 days. Notes (check-ins and the like) are no longer shown after 7 days and are deleted by your device.
- Live links: one hour.
- When you leave a lighthouse or are removed, your entries there are deleted and the lighthouse gets a new key. When the owner deletes a lighthouse, it is gone for everyone.
- "Delete all my data" in Settings deletes your own lighthouses, leaves all others and removes your keys.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability (e.g. exporting your history as GPX) and objection, and the right to withdraw consent. Because the developer cannot read your content, you do most of this directly in the app. For data held by Apple, contact Apple. You can lodge a complaint with a data protection supervisory authority.
8. Children
Leuchtturm is made for families. Children under 16 should use the app only with their parents' consent. Sharing your location is sensitive: please talk as a family about who can see whom.
9. Changes
When the app changes, this policy is updated. The current version is always here; earlier versions are in the source code history.