XPLO's current release keeps the activity library on your device, uses Apple's permission controls and connects to external services for specific features. These are implementation choices, not a promise that any device, app or network is immune to a security problem.
A local activity library
Saved activities, routes and imported Health data are not synchronised to an XPLO account or iCloud in this release. There is no XPLO login to create. Watch and widget features use the app's paired-device and local shared-storage mechanisms. Ride Together is disabled, and Strava connectivity has been removed.
Local storage also means local responsibility: XPLO cannot recover a lost device's library from a developer server. Keep your device passcode and operating system up to date, and export records you want to preserve.
Platform file protection
Sensitive library, profile, Health, recovery and delivery files use Apple's file-protection facilities. The app requests protection until the device's first unlock after a restart. After that unlock, background recording and paired Watch delivery can continue while the screen is locked. This is a specific platform protection setting; it does not mean that data is inaccessible every time the screen locks.
Sensitive storage is excluded from device backups. Local writes are staged and replaced atomically to reduce the risk of an interrupted write replacing a valid file with a partial one. These measures support confidentiality and recovery, but cannot guarantee recovery after device damage, deletion or loss.
Access follows permission
Location, Health, camera, photos and sensor features use the relevant platform permissions. You can review or withdraw those permissions in iOS and Apple Health. A revoked permission stops future access, while an already saved or exported copy needs to be deleted where it is stored.
Connections have a purpose
Map, route, terrain, weather and place requests use HTTPS services. The providers receive the information needed for the request, which can include coordinates, route points or the displayed area, as well as network metadata. HTTPS protects transport; it does not hide a request from the provider receiving it. Requested online surface analysis can also send route coordinates.
Apple handles payment. RevenueCat handles purchase validation and access reporting using an anonymous purchase identifier. XPLO does not send its route library, photos or Health records to RevenueCat. There are no advertising SDKs or automatic uploads of XPLO's local diagnostic report. The privacy policy describes the separate data flows.
Recovery without a cloud library
Recording checkpoints and paired-device delivery queues help preserve work across an interruption. They are retained until completion, acknowledgement or your explicit discard. Bounded automatic caches avoid treating temporary map or terrain files as an unlimited archive. Exported files and previously shared third-party copies are outside the app's local deletion controls.
Report a security concern
Email contact@xplo-outdoor.ch with the subject “XPLO security report”. Include the affected version, device and clear steps to reproduce the issue using test data where possible. Do not send passwords, payment credentials, access keys or a real person's private Health records. Ordinary email is not an end-to-end encrypted reporting channel; begin with a description if the details are sensitive.
Confirmed issues are investigated and addressed according to their impact and the available evidence.