Privacy Policy

Last updated: 2026-10-27

1. Who we are

Praeter is provided by SB Works Ltd (company number 15398202), 86-90, Paul Street, London, Greater London, England, EC2A 4NE ("we", "us"). We are the data controller for the personal data described in this policy.

For any question or request about your data, email privacy@praeter.co.uk.

2. Summary

We collect only what we need to run a walking tour: your location while a tour is running (processed on your phone), which stops you have heard, and your email address if you create an account or buy a tour on our website.
We never sell your personal data, and we never share it with third parties for advertising or profiling.
We use location and app-usage data to run the tour you started and to improve the app, and for no other purpose.
The app shares information about the stops you visit, the settings you change and the tour features you use (optional tour analytics) only if you agree. It is off until you choose, and you can switch it off or delete what was shared at any time.
Some tours show local businesses we partner with. We may tell a partner how many visits its place had in a month, as a single total. Partners never receive any information about you.
You can download your account's data, or delete your account, from inside the app. A few records we must or may keep are listed in sections 7 and 8, and anything else you can ask us for by email.

3. What we collect, why, and our lawful basis

Location

While a tour is running, Praeter uses your device's location to detect when you reach a stop, so that the right audio plays at the right place. If you allow "Always" location access, this continues while the app is in the background, so the tour keeps working with your phone in your pocket.

Your coordinates are processed on your device. They are not sent to us or stored on our servers. We do not build a location history or record the route you walk. If you agree to the optional tour analytics described below, we learn which stop you reached and when, but never your coordinates. Ending a tour stops all location access.

Walking directions. If you ask for directions to a stop, your device sends your current position and the stop's position to a routing service, which works out the route: Apple Maps in the iPhone app, or the OpenStreetMap routing service run by FOSSGIS e.V. in Germany (routing.openstreetmap.de) in Praeter Web. It receives that one request, with your IP address, and nothing that identifies your account. Apple and FOSSGIS handle it under their own privacy policies. Nothing is sent unless you ask for directions.

Lawful basis: performance of our contract with you, because location is needed to provide the tour you started.

Optional tour analytics

The app asks you once whether you want to help improve the tours. Nothing is recorded or sent unless you say yes, and the app works in exactly the same way if you say no.

If you say yes, we receive the following for each visit to a stop:

which stop it was, and which tour it belongs to;
when you arrived;
how long you stayed;
how many seconds of audio you listened to, and how many of the stop's tracks you finished;
whether the visit started because you arrived at the stop or because you chose a track from the list; and
the app version.

If you say yes, we also receive a short record each time you change a setting or use a feature of the tour screen:

settings you change and the new value: language, background music on or off, music volume, between-stop trivia, auto-sync transcript, showing photos automatically, distance units, playback speed and showing local partner places on paid tours;
tour-screen features you use: starting or ending a tour, switching route (Highlights, Explorer or Beyond), opening a stop's card (and whether from the map, the list of next stops, "View all" or the routes map), playing a stop for the first time or again, walking directions, plan route, the tracklist, photos, the routes map, the location button and the full player, with the tour and stop it was used on;
when it happened, and the app version; and
a random session identifier, made fresh each time you start using the app (or come back to it after 30 minutes away), so that changes made in the same session can be counted together.

We only receive the name of the setting or feature from a fixed list, and the value you chose. We do not receive anything you type, your coordinates or where you were when you used it.

This data is filed under a random identifier that the app creates on your device and keeps until you reset it. The identifier is not your account, your email address or Apple's advertising identifier. It is not sent with your sign-in details, we do not store your IP address with it, and we do not link it to your account. We do not receive your coordinates, the route you walked or anything about where you were between stops.

These records do not carry your name, but they are not anonymous. Because the identifier stays the same from visit to visit, the records for one device show which landmarks it reached, when, and for how long, and someone who knew enough about your movements could recognise you in them. So we treat them as personal data (pseudonymous data, in data-protection terms), keep them only for the time set out in section 7, and protect them as location-related data.

You can switch analytics off at any time in Settings → Privacy, which stops collection immediately. You can also delete everything your device has shared by tapping Delete my shared data, which also gives your device a new identifier. Because the records are not linked to your account, deleting your account does not delete them. We use this data only to see which stops hold people's attention and where they stop listening, and which settings and features people use, so we can improve the tours and the app, and to work out the monthly visit totals described under Local partner places. We never use it for advertising and never sell it. The records themselves are seen only by the people who maintain the app.

Lawful basis: your consent, which you can withdraw at any time.

Local partner places

Some tours show local businesses and attractions, such as restaurants, cafés and shops, that we have agreed to promote in return for them promoting Praeter. They are marked Local partner in the app. Free trial tours always show them. Paid tours hide them unless you switch them on in Settings → Local places.

To show a partner that the arrangement is worthwhile, we may tell them how many visits their place had in a calendar month, as one total across all tours and languages. We work this total out from the optional tour analytics above, so only visits from people who said yes are counted. We never tell a partner a total below 10, so that no one can be singled out from a small number. A partner never receives the visit records, your analytics identifier, the times of individual visits or anything else about you, and we do not receive any information about you from partners.

The totals do not identify anyone, so they are not personal data. Working them out from the analytics records is part of what you agree to when you say yes to tour analytics, and switching analytics off stops your visits being counted.

Account details

If you create an account with your email address, we store your email address, an optional display name and a hash of your password. Your password travels to us over an encrypted (HTTPS) connection, and we store only a bcrypt hash of it, never the password itself. We cannot see or send you your password.

You can also sign in with Apple or with Google. Apple or Google then shares your name and email address with us. With Sign in with Apple you can choose to hide your email address, and Apple gives us a private relay address that forwards to your real one. We also store the account identifier Apple or Google gives us, so we can recognise you the next time you sign in. For Sign in with Apple we keep a token Apple issues, used only to cancel your Apple sign-in when you delete your account, as Apple requires. We never receive your Apple or Google password.

To buy a tour, play a tour preview or write a review, your account needs a confirmed email address. When you sign up with your email address, we send you a link to confirm it, and we record whether you have. Addresses that Apple or Google have already confirmed count as confirmed. This keeps automated sign-ups out and makes sure we can reach you about your purchases.

Lawful basis: performance of our contract with you.

Purchases

In the app, Apple processes the payment, and we never see your card details. We store a record that your account owns a tour, together with the transaction identifier Apple provides, so your purchases work on your other devices and can be restored.

On our website and in Praeter Web, Paddle.com sells the tour to you as our reseller and Merchant of Record and processes the payment, and we never see your card details. For each order we keep the email address you gave (or, in Praeter Web, the account you were signed in to), the tour, the price you paid and the currency, any discount code you used, when you asked for the tour to be supplied straight away and acknowledged that you would lose the 14-day right to cancel once supply began, the order's status (paid, expired or refunded) and the transaction references Paddle gives us. Our order email confirms the tour you bought, that request and that acknowledgement.

A website order reaches an account in one of two ways. If a Praeter account has the same confirmed email address, now or when you create one, we add the tour to it automatically. If the tour isn't in an account yet, our order email contains a secure link: opening it while signed in adds the tour to that account instead, whatever its email address, for example a Sign in with Apple account that uses a private relay address. When that happens, we record which account the order went to. The link works once, and only for that order.

We also use the email address to make sure each buyer uses a discount code only as often as its rules allow. In Paddle's dashboard we can see your order, your country, the type of payment method and, for cards, the brand and last four digits, which we use only to answer questions about your order.

Lawful basis: performance of our contract with you, our legal obligation to keep transaction records, and our legitimate interests in making sure discount codes are used fairly.

Tour progress

We store which stops you have visited and how far you got through each audio clip, so a tour resumes where you left it and carries over to another device when you are signed in. Tour progress is part of the service and is linked to your account. It is separate from the optional tour analytics, which are not linked to your account and which you can refuse without losing your progress.

Lawful basis: performance of our contract with you.

Usernames and reviews

When you create an account you choose a username. It is shown only with the reviews you choose to make public.

You need to be signed in to review a tour. A review is a star rating and, if you want, a written review. We store it with your account. A public review is shown to other users with your username and your written review. A private review is only counted in the tour’s average and listed as an anonymous star rating; your written review is not shown to anyone else. We may remove the text of a review, or the whole review, if it breaks our terms. If you delete your account, we delete your reviews and free up your username.

Feedback you sent through the app before we replaced it with reviews stays linked to your account until you delete it; after that we keep the message without your name or email address.

Lawful basis: our legitimate interests in understanding and improving the app.

Diagnostics

When something goes wrong, we record what failed: the error, the screen or operation where it happened, the app version and the device model. We use this only to find and fix faults.

Diagnostics contain no location data, no audio and no message content. We do not use them for advertising, profiling or tracking, and we never share them with anyone other than the people who maintain the app.

Lawful basis: our legitimate interests in keeping the app working.

Marketing email

We send marketing email only if you opt in, either when you sign up or later in Settings. You can opt out at any time in Settings → Account or with the unsubscribe link in any marketing email. Opting out does not affect service email such as receipts, verification and password resets.

Lawful basis: your consent, which you can withdraw at any time.

Praeter Web

Praeter Web, at https://app.praeter.co.uk, is the version of Praeter that runs in your phone's browser. It collects the same data as the iPhone app, with these differences:

Storage in your browser. Praeter Web keeps your settings, your sign-in session, which tours you own and your tour progress in your browser's local storage, so it works when you come back and while you are offline. A claim link you open is kept in session storage only until it is used. Its service worker stores the app's own files, not your data. None of this is a cookie, and none of it is used for advertising or tracking: it is all needed for the service you asked for, so we do not ask for separate consent.
Sign-in sessions. When you sign in, your sign-in tokens are kept in your browser's storage, not in a secure system store like the iPhone's Keychain. Anyone who can use your browser can use your account in Praeter Web, so sign out (Settings → Account → Sign out) on a shared device. Signing out removes the session from the browser.
Downloaded tours. When you download a tour, its audio, text and photos are stored in your browser, encrypted with a key that only your browser can use. They stay there until you remove the download or clear your browser's data for Praeter Web.
Location. Praeter Web asks your browser for your location only while the page is open and you are on a tour or asking for directions. Your coordinates are used in the browser to find the nearest stop and are never sent to us; directions are the one case where they go to a routing service (see Walking directions). When you close the page or leave the tour, it stops asking.
Tour analytics. Praeter Web asks the same optional question as the iPhone app and keeps your answer and a random identifier in your browser, but at present it does not send us any stop visits, whatever you choose.
Buying. You buy while signed in, and the tour goes straight to that account. Paddle's checkout opens inside Praeter Web and may set its own cookies or similar storage, as described under This website.

Lawful basis: performance of our contract with you, and your consent for optional tour analytics.

This website

This website has no analytics, no advertising and no tracking cookies. Netlify, which hosts it, processes visitors' IP addresses in its server logs, as any web host does.

Our own pages can set one cookie, praeter_glass. It remembers a display preference you choose with the glass opacity switch (a number from 1 to 5), lasts one year and is sent only to this website (SameSite=Lax). It is set only if you use that switch, which is currently hidden, so at present our own pages set no cookies. Because it only remembers a choice you made, we do not ask for separate consent.

The payment page is different. When you go on to pay, it loads Paddle's checkout, and Paddle may set its own cookies or use similar storage on your device that it needs to take the payment securely and prevent fraud. Those are Paddle's, under Paddle's cookie policy. Paddle's checkout loads only on the payment page, not while you browse.

Lawful basis: our legitimate interests in running and securing the website.

Contact form

If you write to us through the contact page, we receive the email address you give and your message. Netlify, which hosts this website, stores the message through its Netlify Forms service and emails it on to us. We use it only to answer you, and keep it only as long as we need to deal with your message and any follow-up.

Lawful basis: our legitimate interests in answering the people who contact us.

4. What we do not do

We do not sell personal data, under any circumstances.
We do not share data with advertisers, data brokers or analytics networks.
We do not give local partner businesses any personal data. They receive only the monthly visit totals described in section 3.
We do not track you across other apps or websites. The app contains no third-party advertising or tracking software.
We do not use your data to make automated decisions that have legal or similarly significant effects on you.

5. Who we share data with

Service providers that act on our instructions

These providers process personal data for us, as our processors. Each is bound by contract to use it only on our instructions:

Railway: application and database hosting.
Cloudflare: storage and delivery of audio and images (R2), and protection of our servers. Requests to the app's server pass through Cloudflare, so it processes the IP addresses they come from.
Resend: delivery of account and marketing email.
Sentry: error monitoring for the app's server. It receives technical details of server errors. Request bodies, cookies, authentication headers, IP addresses and URL query strings are removed before sending, so it gets no account details.
Netlify: hosting of this website. Like any web host, it processes visitors' IP addresses in its server logs. It also stores messages sent through the contact page and emails them on to us.

Companies that use data for their own purposes

These companies are not our processors. Each decides for itself how it uses the data it receives, as an independent controller, under its own privacy policy:

Apple: payment for purchases in the app, and distribution of the app. See Apple's privacy policy.
Paddle: our reseller and Merchant of Record for tours bought on our website. Paddle receives the email address you give, your payment details, your country (and, where tax rules need it, your postcode) and the order amount. As the seller it takes the payment, works out and pays any tax, issues your receipt and handles refunds, and it uses the data for these, for its own fraud prevention and for its legal obligations. See Paddle's privacy policy.
Apple and Google: sign-in, if you choose Sign in with Apple or Sign in with Google, for your Apple or Google account. See their own privacy policies.
Apple Maps and FOSSGIS e.V.: walking directions, only when you ask for them (see Walking directions). See Apple's privacy policy and the FOSSGIS privacy policy.

6. International transfers

Some of the companies in section 5 process data outside the UK and the EEA, including in the United States. We are based in the UK, so the UK GDPR governs the transfers we make. Where the EU GDPR also applies, for example to data about people in the EEA, it governs those transfers too. The safeguards differ:

Transfers from the UK rely on UK adequacy regulations (for the United States, the UK–US data bridge, for a recipient certified under it), or, where there are none, on the Information Commissioner's International Data Transfer Agreement or the European Commission's Standard Contractual Clauses with the Information Commissioner's UK Addendum.
Transfers from the EEA, where the EU GDPR applies, rely on a European Commission adequacy decision (for the United States, the EU–US Data Privacy Framework, for a certified recipient), or, where there is none, on the European Commission's Standard Contractual Clauses.

Which safeguard applies depends on the provider and is set out in its terms with us. We are responsible for every transfer we make: when we send your data to another company, it makes no difference whether that company acts on our instructions or as an independent controller. Information you give a company directly, such as your card details in Paddle's checkout or your Apple ID password, goes to it without passing through us, so it is that company's responsibility, as are its own onward transfers.

To find out which safeguard applies to a provider, or for a copy of it, email privacy@praeter.co.uk.

7. How long we keep data

Account details: until you delete your account.
Tour progress: until you delete your account or reset your progress in Settings.
Purchase records: seven years after the transaction, to meet our accounting obligations. If you delete your account, the records are unlinked from your account. A website order keeps the email address it was bought with for the same period, because it is part of the transaction record. An unclaimed order waits for an account with that address for the same period.
Reviews and username: until you delete your account.
Contact form messages and support email: as long as we need to deal with your message and any follow-up. Deleting your account does not delete them, but you can ask us to.
Feedback: linked to you until you delete your account. After that, we keep the message without your name or email address. What you wrote can still mention you, so if you want a message deleted altogether, ask us.
Diagnostics: 90 days.
Optional tour analytics: individual visits are kept for 90 days, or until you delete them in Settings. After that, we combine them into daily totals for each stop (for example, number of visits and average time spent) and delete the individual records and their identifiers. The totals contain no identifier, and we do not try to link them to anyone.
Settings and tour features used (part of the optional tour analytics): the same rule. Individual records, with their identifiers and session identifiers, are kept for 90 days or until you delete them in Settings, then combined into daily counts (for example, how many times background music was switched off that day) that contain no identifier.

8. Your rights

Under the UK GDPR and the EU GDPR, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict how we process your data;
object to processing based on our legitimate interests;
receive your data in a portable, machine-readable format; and
withdraw your consent at any time, where we rely on consent.

Some of these you can exercise directly in the app, without contacting us:

Settings → Account → Export my data downloads, as a JSON file, the data linked to your account: your account details, purchases, website orders bought with your address or added to your account, tour progress, reviews and any feedback you sent.
Settings → Account → Delete my account deletes your account details, tour progress, reviews and username, and removes your name and email address from feedback.
Settings → Privacy switches off optional tour analytics and deletes what your device has already shared.

The export does not include optional tour analytics, because they are not linked to your account, or emails you have exchanged with us. Deleting your account does not delete:

purchase records and website orders, including the email address on a website order, which we must keep for seven years for our accounts (section 7);
feedback messages, which we keep without your name or email address, though what you wrote may still mention you;
optional tour analytics, which you can delete in Settings → Privacy before or after deleting your account; and
contact form messages and support email.

For a copy of anything the export leaves out, to have something deleted that the app can't delete, or for anything else, email privacy@praeter.co.uk. We will respond within one month. Where the law lets us keep something, such as a transaction record, we will tell you what we are keeping and why.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EEA, to your local data protection authority.

9. Children and young people

Under 13

Praeter is not intended for children under 13 years of age. You must be 13 years of age or older to create an account, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has given us personal data, contact privacy@praeter.co.uk and we will delete it.

Aged 13 to 17

Young people aged 13 to 17 can use Praeter with a parent's or guardian's permission. The same protections apply to everyone who uses the app, whatever their age:

optional tour analytics and marketing email are off unless you switch them on, and the app never pushes you to say yes;
location is used only while a tour you started is running, or when you ask for directions, and your coordinates are never sent to us;
we do not build profiles of users, show advertising or share data with advertisers; and
you can see, download or delete your data from inside the app.

In the UK, you can give consent to optional data uses (optional tour analytics and marketing email) yourself from the age of 13. In some EEA countries the age is higher, up to 16. If you are under that age where you live, a parent or guardian must give or authorise consent before you switch either of them on.

Parents and guardians

Young people have their own rights over their data. Someone aged 13 to 17 can see, download or delete their own data in Settings → Account, without asking us.

If you are a parent or guardian and want to make a request about your child's data, email privacy@praeter.co.uk. Being a parent does not by itself entitle you to your child's data, so before we act we will:

check that you are who you say you are, and that you have parental responsibility for the child;
consider whether your child is mature enough to understand their own rights. If they are, the data is theirs, and we will normally ask them before we act, and act only if they agree or if it is clearly in their best interests; and
where your child is not yet able to understand their rights, act on your request if it is in their best interests.

We will tell you if we can't act on a request and why.

10. Security

Data is encrypted in transit. Passwords are stored only as bcrypt hashes. In the iPhone app, your sign-in tokens are stored in the device's Keychain rather than in ordinary app storage. In Praeter Web they are kept in your browser's storage (see Praeter Web), so sign out on a shared device. Downloaded tours in Praeter Web are encrypted in your browser. Only the people who maintain the app can access our production systems.

11. Changes to this policy

If we make a material change to this policy, we will update the date at the top and tell you in the app before the change takes effect.