Ongroove Labs

← All privacy policies

WayBackHome Privacy Policy

Effective October 18, 2026

In short: WayBackHome has no accounts and no database of its own. Your location and routes are stored in your own iCloud and shared only with the people you invite. We, the developer, can't see any of it. Only two things pass through us, and neither is stored: an SOS notice (your name, never your location) and a request to wake a family member's iPhone (a code from Apple, nothing else).

What the app stores, and where

To let your family see where you are and how you got there, the app records on your iPhone:

This data is kept on your iPhone and in your own private iCloud database (Apple's CloudKit). Location and trip data is stored in CloudKit's encrypted fields. If you and the people you share with turn on Advanced Data Protection for iCloud, it is end-to-end encrypted and even Apple can't read it.

You choose how long trips are kept. Older trips are deleted from your iPhone and your iCloud automatically.

Who can see it

Only the people you invite. Sharing uses iCloud sharing: when you share your location with someone, iCloud gives their Apple Account read access to:

Because iCloud sharing works this way, the people you share your location with can see who else you share it with (their names or Apple Account details, as iCloud shows them), but not anyone else's data.

An alert you send (SOS, or arriving at or leaving a place) goes only to the person it's for. Your settings stay private. You can pause sharing at any time, which hides your location and the trips you make while paused, or stop sharing with a person, which removes their access.

The developer has no access to your iCloud data, so we can't see, sell or hand over your location, routes or contacts.

What passes through our relay

When you send an SOS, the app can show it on your family's Lock Screen as a Live Activity, even if their app isn't open. Apple only accepts these from a signed request, and the signing key can't safely be kept inside the app, so the request goes through a small relay we run on Cloudflare Workers. It carries your display name, your initials, the time the SOS started, an identifier the app uses for you, and each recipient's Live Activity token (a code from Apple that lets this app show a Live Activity on that iPhone). It never carries your location. The relay passes the request to Apple Push Notifications and keeps nothing: no storage, no logs. Like any website, Cloudflare handles your IP address to deliver the request.

Each iPhone's Live Activity token is kept in the iCloud space it already shares with each family member, so only they can use it to send it an SOS.

When you open a family member's card, the app asks their iPhone for a fresh location, even if their app isn't running. This request also goes through the relay. It carries only their iPhone's location push token (a code from Apple that lets this app wake that iPhone): no name, no location, nothing else. Their iPhone then saves its location to their own iCloud, which you can see because they share it with you. The relay keeps nothing.

What we don't do

Apple services the app uses

The app uses iCloud (CloudKit) for storage and sharing, Apple Push Notifications to deliver alerts, and Apple Maps for maps and address search. These services are provided by Apple under Apple's Privacy Policy. When you search for an address, your search text is sent to Apple Maps, and when you set up Home, its location is sent to Apple Maps to look up the address. When you invite someone, the email address or phone number you choose is sent to Apple to find their iCloud account.

WayBackHome Plus (in-app purchase)

WayBackHome Plus is an optional one-time purchase sold through the App Store. Apple handles the payment; we never receive your name, Apple Account or payment details. The app checks Apple's signed receipt on your iPhone to turn Plus on. If you buy the Family option, Apple's Family Sharing makes Plus available to your family group.

Exporting trips

You can export trips as a PDF report, a CSV or a GPX file. The files are made on your iPhone after Face ID (or your passcode) confirms it's you, and they go only where you send them with the share sheet; nothing is uploaded to us. You can export your own trips and, with Plus, the trips someone shares with you. That data belongs to them: use it only for legitimate purposes, such as their safety or with their consent.

Permissions

The app doesn't ask for access to your contacts. When you invite someone, you can pick them with iPhone's contact picker, which gives the app only the one email address or phone number you choose.

SOS is not an emergency call

The app's SOS notifies your family and friends. It does not contact emergency services. To call emergency services, use your iPhone's built-in Emergency SOS.

Location, alerts and SOS can be delayed or unavailable, for example without a network connection, when location access is limited, or when iCloud or notifications are turned off. Don't rely on the app as your only safety measure.

Deleting your data

Deleting the app removes the data on your iPhone. To delete the copy in iCloud, open Settings › [your name] › iCloud › Manage Account Storage, choose WayBackHome and delete its data. Stopping sharing with someone removes their access to your data.

Children

WayBackHome is meant for people 13 and older. A child under 13 should use it only if a parent or guardian sets it up and decides who can see the child's location. We don't collect personal information from anyone, including children: a child's data stays in their own iCloud and is shared only with the people they or their parent invite.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Privacy contact: Kevin Wang, Partner, ONGROOVE LABS — support@ongroovelabs.com