MudQuest is built offline-first, and that shapes this policy more than anything else. The core of the app — seeing who’s around you, sharing a live map with your convoy, talking on push-to-talk — runs peer-to-peer between phones over Wi‑Fi, with no server in the middle. Data that rides the mesh does not pass through us, because there is nothing for it to pass through.
This policy explains what stays on your device, what rides the mesh, what reaches our cloud when you sign in, and how to delete all of it.
Operator: Dmitrii Skrylev, an individual developer. Contact: zivou4@gmail.com
The short version
- Your live position is never uploaded. It goes rig-to-rig over the local mesh and nowhere else.
- Push-to-talk voice is never uploaded. Same mesh, same reason.
- We run no analytics and no crash reporting. There is no advertising SDK, no tracking SDK, and no third-party analytics in the app at all.
- We never sell or share your data, and we do not use it for advertising.
- Signing in is what creates a cloud copy. Saved runs, trails, your profile, friends and blocks back up to your own private area so a new phone can restore them.
- Everything in your cloud area is readable by you alone. The one deliberate exception is a convoy you choose to make public — see Public convoys below.
- You can delete everything from Settings ▸ Delete Account.
What stays on your device
Never uploaded anywhere, by design:
- Camera and LiDAR terrain scans. The camera is used to scan the ground around your rig. Scans stay on the device unless you explicitly save one, which files it in your own private cloud area.
- Downloaded offline map areas. Map tiles you download live in the app’s storage on your phone.
- Your photo library. MudQuest can save an exported adventure video to Photos. It has add-only access and never reads your library.
- The app’s local cache of everything below, so the app works with no signal.
What travels over the mesh (not the internet)
When rigs are near each other, MudQuest exchanges data directly between phones over Apple Multipeer Connectivity (peer-to-peer Wi‑Fi) and, for Android, a direct Wi‑Fi link. MudQuest does not use Bluetooth. Range is roughly 30–60 m line of sight. None of this reaches a server:
- Your live position, heading and speed, while you are sharing location.
- Your rig card — display name, handle, avatar, and rig make/model/colour.
- Convoy chat messages, map pins and breadcrumb trails.
- Push-to-talk voice.
- Trail routes shared with a convoy.
Anyone within radio range who is running MudQuest can receive what you broadcast. That is the point of the app, and it is worth understanding plainly: a mesh is a local broadcast, not a private channel. You control it — location sharing is a toggle, and you can run the app without it.
What we store in the cloud
Only when you are signed in. Everything below is written to a private area keyed to your account
(users/{your-id}/…) and, by enforced server-side security rules, is readable and writable only by
your own signed-in account.
Account data (Firebase Authentication)
- Your email address, and which method you signed in with — Sign in with Apple, or email and password.
- We never see or store your password. Firebase handles authentication, and if you sign in with Apple your Apple credentials are entered with Apple, never with us.
- If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple’s private relay address. That is fine — it is the only address we need, and we never try to resolve it.
Your content
- Profile — display name, handle, avatar image, and rig details (make, model, colour).
- Saved runs and trails — the recorded GPS track, route, distance, duration and elevation of a convoy you completed or a trail you built. This is the one case where location data does reach our cloud, and it only happens for a run you finished and saved.
- Friends, blocked users and reports — the identifiers of people you have added, blocked or reported. Blocks and reports are uploaded deliberately so they follow your account to a new device.
- Alert summaries — one short row per notification so your history survives a reinstall. The notification body is not uploaded.
- Saved terrain scans, if you save one — stored as a file in your own private storage area, capped at 32 MB per scan.
Your identity is derived, not collected. Your public rig ID is a hash of your account ID. It is what other rigs see on the mesh; it is not your email, and it cannot be reversed into it.
Public convoys
If — and only if — you set a convoy to public, MudQuest publishes a small card for it so other users can see the run on the Discovery map from anywhere. That card contains:
- The convoy’s name and blurb, its coordinates, its member count, and the host’s rig ID.
It is readable by any signed-in MudQuest user, worldwide. That is the feature. It is refreshed about every five minutes while the run is live by whichever member has internet, it expires automatically, and every convoy closes within 24 hours. A private convoy publishes nothing at all.
Location
MudQuest asks for location twice, for two different reasons:
- While using the app — to place nearby rigs on the map relative to you, to record a run, and to navigate. This is the app’s core function.
- In the background, during a convoy only — so the mesh stays awake and join requests and convoy alerts still reach you with the screen off. iOS shows the blue indicator the whole time. It stops the moment the run ends, and you can switch it off in Settings ▸ Notifications.
Background location is used only to keep the mesh alive during an active convoy. It is not used for advertising, profiling, or tracking you between sessions.
Third parties
MudQuest uses very few, and none of them receive your mesh traffic:
| Service | What it does | What it receives |
|---|---|---|
| Google Firebase (Authentication, Firestore, Storage) | Accounts and your private cloud backup | Your account data and the content listed above |
| Mapbox | Map tiles, offline map downloads, and place search | Map requests, and the text you type into search with an approximate location to bias results |
| Apple | Sign in with Apple, plus App Store and TestFlight distribution | Only what Apple’s sign-in sheet sends back — an identity token, your name if you share it, and either your email or a private relay address. Handled by Apple under Apple’s privacy policy |
We do not use any advertising network, analytics provider, attribution SDK, or crash-reporting service.
Notifications
Every notification MudQuest sends is scheduled by your own phone, from something that arrived over the mesh. There is no push server, and no notification content is sent to Apple’s push service or to us — which is also why alerts work with no signal.
How long we keep things
- Mesh data is not retained by us at all; it lives only on the phones that received it.
- Your cloud content is kept until you delete it, or until you delete your account.
- Public convoy cards expire automatically and are removed when the run ends; every convoy is capped at 24 hours.
Your rights and choices
- See and export your data — everything is visible in the app; email us for a copy in a portable format.
- Correct it — edit your profile and rigs in the app at any time.
- Delete individual content — delete any saved run, trail or scan from My Content.
- Delete everything — Settings ▸ Delete Account permanently deletes your account, all your cloud data, and this device’s copy. It requires an internet connection, because the deletion has to reach our servers to be real. It cannot be undone. If you signed in with Apple, the deletion also revokes MudQuest’s Apple sign-in token, so the app stops appearing under your Apple ID’s “Sign in with Apple” settings — you do not have to go and remove it yourself.
- Withdraw permissions — location, local network, microphone, photos and notifications are each revocable in iOS Settings. The app degrades honestly rather than nagging you.
- Stay offline — MudQuest needs a connection only for that first sign-in. After it, the app runs entirely offline, and nothing reaches our cloud until you next have a connection.
Depending on where you live you may have additional rights under the GDPR, the UK GDPR, or US state privacy laws including the CCPA/CPRA. We honour all of them for every user regardless of location. We do not sell personal information, and we do not “share” it for cross-context behavioural advertising as those laws define it. To exercise any right, email zivou4@gmail.com; we respond within 30 days.
Children
MudQuest is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, email us and we will delete it.
Security, stated honestly
Cloud data is protected by Firebase’s server-side security rules and encrypted in transit and at rest by Google. Mesh traffic is local radio between nearby devices; treat what you broadcast on it the way you would treat anything said over a CB radio. No system is perfectly secure, and we will not claim otherwise.
Safety disclaimer
MudQuest is not an emergency or safety device. It is not a personal locator beacon, it does not contact emergency services, and it depends on nearby phones running the same app. Never rely on it as your only means of communication in the backcountry.
International transfers
Our infrastructure runs on Google Cloud in the United States. If you use MudQuest from outside the US, your cloud data is transferred there, under Google’s standard contractual clauses.
Changes
If this policy changes materially we will update the date at the top and note the change on this page. Continuing to use MudQuest after a change means you accept the updated policy.
Contact
Dmitrii Skrylev — zivou4@gmail.com