Your routes are yours.

Last updated: 12 October 2026

Yut is an iPhone app that records the routes you walk, run, cycle or drive and draws them on a map. It is made and run by AlterFlow LLC ("AlterFlow"), at 8jane.com. This policy explains what Yut collects, why, where it goes, how long it is kept, and how to have it deleted.

The short version

• Yut uses your location whenever you allow it, recording or not, to show where you are on the map and keep the map on you. It records and keeps your location only while you have started recording, or where you drop a pin, and keeps your routes and pins on your phone.
• Nothing is backed up unless you connect the app to the Yut server with an enrollment code, which AlterFlow gives to the people it invites. There is no public sign-up.
• Once you connect, your routes (positions, times and names) are backed up to the Yut server over an encrypted connection, so you can restore them and share them. Your pins, imported trail layers and settings are not: they stay on your phone.
• Yut has no ads, no analytics or tracking SDKs, and never sells or rents your data.
• To show maps, weather, offroad routes and the other map layers you turn on, the app asks their providers for the area on screen, directly or through the Yut server.
• Ground elevation, off unless you turn it on, sends sampled points of your routes to the US Geological Survey to look up the ground under them.

What Yut collects, and why

On your phone

When you are not recording, Yut follows your location to show it on the map: the location dot, the coordinates and accuracy, the cone showing which way your phone faces, and a map that moves with you. It does this on screen and in the background, so the map is ready the moment you open the app, until you close the app from the app switcher (it starts again when you next open Yut). It uses a coarse, battery-saving mode for this, and turns GPS off while your phone is still. These positions are used on screen only: Yut does not store them, add them to any route or back them up, except where you drop a pin (see "Pins" below). Showing them means the map downloads its tiles for where you are, and, if you turn Weather on, the app asks for the weather near you while it is on screen, and, if you turn Offroad routes or another map layer on, for that layer in the area on screen; these are described under "Maps", "Weather", "Offroad routes" and "Other map layers" below. While you have location set to "While Using the App", Yut follows it only while iOS keeps the app running.

While you record, Yut stores each location fix (latitude, longitude, altitude, speed, accuracy and time), the route's start and end, its pauses, its travel mode, and the name you give it, in a database on your phone. It uses motion activity (whether you are still or moving) to save battery; that is not stored or sent anywhere. A Live Activity on the Lock Screen shows the route being recorded; the app updates it on the phone, with no server. While you record, Yut also notes the battery's level and whether it is charging, now and then, to work out how much battery each recording mode uses; that stays on your phone and is never sent.

Pins. When you tap Drop pin, Yut stores a pin where your location dot is, recording or not: its latitude, longitude, altitude and the time you dropped it, and the route open then (recording or paused), if there is one, in the same database on your phone. A pin dropped on a route is deleted with that route; you can delete any pin from its card. Pins are not sent to the Yut server, even when you connect to it, so restoring your routes from the server does not bring their pins back. A route's pins leave your phone only in its GPX file, when you export that route and share it yourself.

Trail layers. Trail maps you import from a file (with the Files picker on the Map layers page, or by opening a file in Yut) are kept on your phone, in a database of their own, until you remove the layer or delete the app. Yut comes with no trail data of its own, and never sends imported layers to the Yut server or anyone else. The Vehicle you choose on the Map layers page, which fades the trails it may not ride, is a setting kept on your phone only.

If you never connect to the Yut server, your routes and pins stay on your phone, except when you export a route as a GPX file (with its pins) or a picture (without them) and share it yourself.

If you paste a map provider's API key into the app, it is kept in the phone's Keychain and sent only to that provider, with its map tiles.

When you connect to the Yut server (backup)

Connecting is optional. When you enter an enrollment code, the app sends the server:

• Your device's name, model, iOS version and the app's build, and a random install id, so you and AlterFlow can tell your devices apart. A device's name is often its owner's name ("Alex's iPhone"). The server also notes when each device was last seen. The server gives the app a credential, which it keeps in the phone's Keychain; the server stores only a hash of it.
• Your routes: every fix listed above, with whether you were moving at each fix, each route's start, end, pauses, travel mode and name, the phone's time-zone offset when it was recorded, and its deletions. Backup runs while you record, in the background too, so a route survives a lost or broken phone. A route's pins are not sent with it, and nor are imported trail layers or the app's settings.

The server also holds your account: the name AlterFlow gave it when it invited you (usually your name) and the enrollment codes it made for it. It keeps an audit log of enrollments, disconnections, revocations and deletions: who or what did each, and when. An enrollment's entry records the device's name, model, iOS version and app build.

These are used only to back up your routes, restore them to your phone, show them to you, and share them when you ask. AlterFlow, as the server's administrator, can see the routes backed up to it, and uses that access only to run and fix the service.

Shared links

You can share a backed-up route by link. The link has a long random part that cannot be guessed, and opens a page anyone holding it can see: the route with 200 m trimmed from each end (so it does not show exactly where you started or finished, such as your home), its name, its figures (distance, duration, elevation), and a GPX or GeoJSON download. Shared pages ask search engines not to index them. Whoever you send a link to can pass it on, save the page or download the route. Links do not expire; you can stop sharing a link at any time, after which the page stops working (a copy cached by Cloudflare may still be served for up to 5 minutes). Deleting the route stops its links working too.

Deleting your server data

In the app, Options → Backup → Delete my server data closes your account on the server and disconnects every phone connected to it; your routes stay on your phone. It erases your backed-up routes and their points, your shared links (their pages stop working), your diagnostics and your account's settings overrides: most of it at once, the rest within 15 minutes. It keeps a record that the account existed and was closed (its name is replaced with "(deleted)"), the records of its devices, now revoked (each one's name, model and iOS version, as the table below lists), and AlterFlow's audit log, which records the deletion.

Diagnostics

A connected app sends the server diagnostic events, such as an upload the server refused, an error message the app showed you, or a part of iOS the app could not use, with the app's build, the route's random id when one is concerned, and the device they came from. They never contain a route's name. They never contain coordinates: the server strips any it finds. They are used only to find and fix bugs, and are deleted after 30 days.

Maps

To draw the map, the app downloads map tiles for the area on screen and around it, which tells the map provider roughly where you are looking (while the map follows you, recording or not, roughly where you are). Tiles are fetched only while the app is on screen, never while it follows your location or records a route in the background. Most map styles fetch their tiles straight from the provider. For OpenStreetMap and OpenTopoMap styles, a connected app may fetch tiles through the Yut server, which fetches them from the provider and caches them, so the provider sees the server rather than your phone. The app caches tiles on your phone, within each provider's limits.

Offroad routes (off by default)

If you turn on Offroad routes, the app asks the US Forest Service and the Bureau of Land Management for the routes in the area on screen, in squares about 15 km across, over US public lands only and while the app is on screen. Each request carries the square's bounds and nothing else of yours. A connected app may ask through the Yut server instead, which caches the answers. The app keeps them on your phone for up to 7 days.

Other map layers (each off by default)

Each of these asks only while it is on and the app is on screen, and only for the area on screen:

• Terrain, Slope, Streams and water and Public land download map images of the area on screen from the US Geological Survey's The National Map (basemap.nationalmap.gov, elevation.nationalmap.gov and edits.nationalmap.gov), only while the view is over the US. Slope asks from zoom 12 and Public land from zoom 7. A tap on the map with Public land on sends the tapped point to the same service, to name the land there. The images are kept in the app's map tile cache, as the map's are.
• The USGS Topo map style downloads its tiles from basemap.nationalmap.gov while the view is over the US, and from OpenTopoMap outside the US and where USGS has none.
• Lightning and Satellite clouds download images of the area on screen from NOAA's nowCOAST (nowcoast.noaa.gov), every 5 or 10 minutes while the app is on screen. They are not kept on your phone.
• Creek levels and Active fires work only while your phone is connected to the Yut server. The app sends the server a box around the map's view in whole degrees (roughly 100 km or more across), with the device's credential, again for a new area as the map moves: for Creek levels, the same area at most every 15 minutes, from zoom 10 and over the US; for Active fires, a box at most 5° each way, the same box at most once every 30 minutes. The server asks the US Geological Survey's Water Data API (api.waterdata.usgs.gov) or NASA's FIRMS (firms.modaps.eosdis.nasa.gov) for that box only, with nothing about you or your device, and caches the answer for other phones viewing the same area (15 minutes for gauges, 30 for fires). The server counts how many fire requests each device makes a day, to keep within NASA's limits.

Ground elevation (off by default)

Ground elevation is off unless you turn it on (Options → Map → Ground elevation). While it is on, the app sends the US Geological Survey (elevation.nationalmap.gov and epqs.nationalmap.gov):

• points sampled about every 50 m along each route you stop, over the US only, and along an older route when you ask for it on its page;
• the position of a pin or a waypoint whose card you open.

USGS answers with the ground's elevation there. Nothing else is sent with them but the app's name and version. The ground profiles are kept on your phone with their routes and are never sent to the Yut server. While Ground elevation is off, your routes are never sent anywhere for this.

Weather (off by default)

If you turn on Weather, the app sends your location rounded to two decimal places (about 1 km) to get the current conditions: to Open-Meteo directly, or, in a connected app, to the Yut server, which asks Open-Meteo and caches the answer by the rounded location for 10 minutes. The precipitation radar downloads radar image tiles for the area on screen, a much coarser area than the map's. None of this is sent while the app is in the background.

What the network sees

Like every app that uses the internet, Yut's requests carry your IP address, which the Yut server's host (Cloudflare) and each map and weather provider receive. The Yut server uses it only to limit how often enrollment codes can be tried. Cloudflare keeps request logs for a short time. These logs record the address of each request, so they can include the rounded location of a weather request and the tile coordinates of a map or radar tile fetched through the server, along with which device asked. The Yut server also counts how many map, radar and weather requests each device makes through it, so it can keep each provider within its limits; the counts say how much, not where. Cloudflare keeps the Yut server's request logs for 7 days, and the per-device usage counts for up to three months.

The website

The Yut website (alterflowllc.com) sets no cookies and has no analytics or advertising. If you write to us from its support page, the name, email address, topic and message you enter are emailed to AlterFlow LLC and kept only in that mailbox; the website stores nothing else. The support page loads Cloudflare Turnstile to tell people from bots; Turnstile is Cloudflare's, under Cloudflare's privacy policy. The website's host, Cloudflare, also receives the IP address of each request.

Who else receives data

Yut does not sell, rent or give your data to anyone for their own use. These services receive data as part of running the app:

Each map and weather provider handles requests under its own privacy policy. A provider sees only the styles you use. AlterFlow may disclose data if the law requires it.

How long data is kept

Deleting your data and disconnecting

• Delete a route in the app's history: its pins are deleted with it on your phone. While the app is connected, the backed-up copy is deleted too at the next sync, and its shared links stop working. A route deleted after you disconnect, after the device is revoked, or on a phone that never syncs again stays on the server until you delete the server's data or ask AlterFlow.
• Disconnect on the app's Backup page: the app stops backing up, and its credential stops working. Your routes stay on your phone, and the routes already backed up stay on the server, as does the device's record (see the table above).
• Delete the server's data on the Backup page, or ask AlterFlow: every route backed up from your account is deleted from the server.
• Revoke a device: AlterFlow can revoke any device, for example a lost phone, so it can no longer reach your backups. Ask AlterFlow if you lose a phone.
• Delete the app: removes the routes, pins, trail layers and settings stored on the phone. The backup credential is kept in the iOS Keychain, which iOS does not clear when an app is deleted, so it can stay on the phone until the device is disconnected or revoked. Deleting the app does not delete backups; disconnect first, delete the server's data, or ask AlterFlow.

You can ask AlterFlow at any time what data the server holds about you, for a copy of it (your routes download as GPX), or to correct or delete it.

Security

All traffic to the Yut server uses HTTPS. The app proves who it is with a short-lived token, never placed in a URL; the server stores only a hash of each device's credential. The admin pages are behind Cloudflare Access with a one-time PIN or a sign-in with two-factor authentication. No system is perfectly secure, but AlterFlow keeps what is collected to what the app needs.

Children

Yut is not meant for children under 13, and the server is invite-only. AlterFlow does not knowingly back up data from children.

Changes

If this policy changes, the new version is published at the same address with a new date. A change that collects more data, or uses it differently, is described at the top of the policy, with the date it takes effect, before it applies.

Contact

AlterFlow LLC: yut-support@alterflowllc.com, or the support form (choose "Privacy or data request").