Where your location goes.

Heretofore is made by Corvie, LLC. This page says, in plain words, what the Heretofore app for iOS and this website do with information about you: which services see what, what is kept, and what you can delete. The app’s Information and Settings pages link to a shorter Privacy & Data summary and this full policy.

• There is no sign-up form. Account and Library requests use a random installation identifier and a verified Apple app identity, stored by us as keyed or one-way references. We do not receive your Apple password, name or email.
• Find a Story can select a candidate on your phone, but still sends the search position to Heretofore to verify and deliver it. Road Trip also sends location and selected road points to LocationIQ, with your separate AI-hosting permission.
• Explore as you go keeps walked ground and pending finds on your device. Collection happens online against your shared allowance. Optional iCloud Sync shares Library progress, favorites and badges; recordings and walked ground stay on each device.
• Nothing about you is sold or used for advertising. We do not use advertising or cross-app tracking SDKs. The app’s service diagnostics are described below; this website has no visitor analytics.

• What identifies you
• Credits and account eligibility
• Account deletion and retention
• Find a Story
• The map
• Browse and catalog areas
• Explore as you go
• Your AI hosting choices
• Road trip mode
• Audiobook mode
• Narration
• Your Library and iCloud
• Story locations
• What our server keeps
• Who sees what
• Provider processing and retention
• Children
• This website
• Changes, and writing to us

What identifies you

• The app makes a random installation identifier and keeps it in the device’s Keychain. Account, collection, story-delivery and narration requests use that identifier and verified account proofs. Our server stores a one-way installation reference and a keyed account reference to associate your Library and allowances across verified devices. These records are linked to your account; hashing does not make them anonymous.
• Apple verifies your app and purchase transactions. Heretofore checks signed transactions and device-verification proofs in memory, without storing or logging the raw proofs. We retain normalized purchase and access records, device-verification public keys, replay counters and short-lived verification challenges. We do not receive your Apple password or Apple sign-in email.
• Requests to our backend use Firebase App Check and Apple App Attest to help verify the app and device. The serving services also receive network and verification metadata, including IP addresses. Requests travel over HTTPS. Provider API keys stay on our servers.
• Your saved Library is associated with the verified App Store account. After that association, a temporary connection failure does not by itself lock downloaded stories. A confirmed account change prevents another account from opening that Library. iCloud is optional and is separate from App Store account verification.

Credits and account eligibility

Heretofore keeps allowance dates, grants, usage, story and narration rights, and verified purchase references so your plan and remaining balance work across devices. Credits are checked on our server whether or not you enable iCloud Sync. Restore Purchases does not refill them.

Collecting a new story requires a connection. An offline find stays in Pending finds until collection can be confirmed; it is not an unlocked story or a reserved credit. Automatic retry is restricted to the allowance period associated with that find. If the period changes or cannot be verified, you must choose to collect it using the current balance. Old pending finds do not automatically spend a later month’s credits. Older builds’ assigned permissions are reconciled during upgrade; new ones are no longer issued.

The welcome trial uses Apple’s verified acquisition date and a DeviceCheck signal to help prevent repeat trials. It is an account-and-device check, not proof of one trial per person. Deleting the app or account does not automatically clear Apple’s device signal. If an eligible reader is refused on a previously used device, contact support; do not send passwords or verification codes. The plan terms explain the separate allowances and reset dates.

Verification challenges expire after two minutes. Challenges expired for more than 24 hours and verification keys inactive for more than 90 days become eligible for cleanup during account checks. Ordinary active-account purchase, allowance and access records are kept to verify benefits, handle interrupted requests and restore unlocked content.

Account deletion and retention

Clearing local stories or recordings does not delete your server account, cancel an Apple subscription or reset credits. Account & Data in Settings shows the available controls and request status. Account deletion is currently disabled; clearing local files does not submit a deletion request.

The deletion process removes Library and narration rights, detailed usage, purchase links, device-verification records, listening-session records and associated installation records. It also clears account files on that device and the paired iCloud sync contents. A small marker remains in the private iCloud zone to prevent another device from uploading deleted contents again. If cloud cleanup cannot finish, the app keeps the cleanup pending.

To prevent repeated use of monthly credits or the one-time welcome preview, we retain a keyed account reference, current monthly totals and reset date until the original period ends plus seven days. A welcome eligibility and usage record lasts until the original trial expires plus seven days. An active pause after repeated failed trial preparation lasts only until its original fifteen-minute deadline. Returning before expiry preserves those limits; after the monthly record is purged, Free starts a new monthly date, while paid plans follow Apple’s billing dates. Detailed Library and listening history are not part of these exceptions.

The database keeps seven automatic backup snapshots and seven days of recovery logs. Manual checkpoints become eligible for removal after seven days, subject to verified recovery checks. Some cloud storage also retains deleted objects for seven days after removal. A minimal deletion instruction remains while recoverable copies need it to prevent deleted account data from returning. Deletion from recovery copies and provider systems is not immediate.

Copies on another device, older iCloud data and backups managed by Apple can require separate cleanup. Account deletion does not erase the shared story catalog. It also does not cancel an Apple subscription: use Manage Subscription to cancel Apple billing.

Find a Story

A search starts from your current location or, with Find a Story anywhere, the pin you place on the map. Downloaded regional metadata can let your phone choose a nearby candidate or recognize that a fully downloaded area has no match. When a story is requested, the app still sends Heretofore the search coordinate, whether it was your location or a map pin, radius, chosen genres and story exclusions. A current-location request can include accuracy and capture time. The server verifies the candidate, current publication and account access, and delivers the story; an incomplete local catalog can require a server lookup.

• Catalog selection does not send the search to LocationIQ, OpenAI or another research provider. The launch app does not offer new-story expeditions.
• A successful delivery retains a receipt linked to your installation and account, including the story, search origin, radius and distance. It supports interrupted delivery and access checks. Restoring an owned story on another verified device does not restore the original search coordinate.
• A search with no result creates no successful-delivery receipt, but ordinary request and diagnostic logs can still remain. Canceling a submitted search can retain its request reference and cancellation time.
• On the device, an unfinished request is saved for retry. A saved story can retain its original search coordinate in its Request details. Empty-area history stays locally. Browse and walking collection use the separate story-ID path described below, without sending your walking position.

The map

• Apple Maps is drawn underneath Heretofore’s map. Moving it reaches Apple as in other apps using Apple Maps. Place searches send your search text and map region to Apple. A selected place becomes your search origin if you then use Find a Story.
• The watercolor tiles arrive through Cloudflare. Requests name the map squares in view and carry ordinary network information such as your IP address, without an installation identifier or story text.
• Catalog-area downloads contain shared story locations, titles, genres, identifiers and selection metadata, not the full narratives. They reveal the areas requested to the catalog infrastructure. Library counts request the place names shown on your shelves. These catalog requests do not include an installation identifier in their payload, though the serving services receive network and app-verification information.

Browse and catalog areas

Explore and Browse fetch catalog areas and map tiles as you move around the map. These requests identify geographic areas, without an installation identifier in their payload; the serving infrastructure receives ordinary network information such as your IP address. Library counts also request the place names on its shelves. Revealing the clouds in Browse does not itself collect every visible story. Collecting one sends that story’s identifier and your installation or verified account information, and follows your plan’s allowance. The collection request does not include your walking position.

Explore as you go

Explore as you go is optional. It needs Always location access with Precise Location for background walking, and notification permission if you enable “Tell me when I pass a story.” Turn walking or notifications off from the Atlas, or change their permissions in iOS Settings.

• Your phone remembers walked ground as map squares rather than an ordered route. It matches downloaded story locations to that ground locally. Regional downloads reveal which broad areas were requested, but the walked-ground record itself is not uploaded.
• When offline or unable to confirm collection, the app keeps the story’s catalog details and discovery time in Pending finds on that device. A confirmed collection sends story IDs and account/installation information to Heretofore, without your walking coordinate or route. The server records ownership and when collection was reported. A story’s public location can imply the area in which you encountered it.
• Collection uses your shared allowance online. A find from an earlier allowance period needs your explicit choice before it can use the new period’s credits. Pending finds and the local timing information used for that check are excluded from device backups and are not part of iCloud Library sync.
• Story notifications are created locally by your phone. Lock Screen notifications can show story titles and their places. They do not mean every listed story has already been unlocked.
• Forget Walked Ground removes the remembered squares. It does not remove collected stories or reset credits. Local encounter and removal markers can remain so the same story is not repeatedly offered.
• The optional outing log records location fixes and times and, in listening modes, host words and named places. Local battery/location reports are also saved on the device. These diagnostics are not uploaded by the app; clear them in Settings. Ordinary local files may be included in Apple-managed backups, separately from files the app explicitly excludes.

Your AI hosting choices

Road Trip and audiobook hosting ask separately for permission before sharing their context with AI providers. Review or change each choice in Settings → Privacy & Support. Declining leaves reading and already-unlocked recordings available. Permission does not buy a subscription, start a trial or refill credits.

Turning permission off stops that mode on this device. Server withdrawal needs a connection; if it fails, the app retains the pending withdrawal for retry. An already-sent request may finish, and withdrawal cannot recall information a provider already received. We retain your latest account-linked choice and temporary request permits. After database recovery, permission must be confirmed again.

Road trip mode

Road Trip uses location while the trip is active, independently of the walking switch. Your device draws the route and remembers walked ground locally. Story collection and narration use your verified account and the mode’s allowances.

• To prepare the host, your phone sends Heretofore your current location, heading and speed, broad time of day, typed destination, trip distance and duration, selected/heard/passed story context and selected recent road points. These requests are authorized for your account and listening session.
• Heretofore sends the current position and up to four selected road points to LocationIQ to name the road and surrounding places. OpenAI receives those place names, destination text, trip facts, story context and prior host words. The car and route coordinate fields are omitted from the model’s input; text you type could itself identify a location. The opening may use web search.
• Inworld receives the generated host words to make speech. Those words can include places or trip context. Account-linked session records, temporary generated responses and service logs are described under what our server keeps.

Audiobook mode

The app and server use the towns and stories selected from your Library, played/heard context and previous host text to prepare a set. OpenAI plans the set and writes its introduction and transitions, with web search available for the opening. The current app does not send your device coordinates for this mode. Inworld voices the generated words. Requests and prepared stories are associated with your account and session so access, trial slots and narration allowances can be checked.

Completed host clips and the current listening position are saved on your device so a paused session can resume after reopening the app. That session archive is excluded from device backups and is not synced to another device. New generation still requires a connection and current access. The server’s brief interrupted-request recovery copies are separate from this local resume state.

Narration

• Inworld receives public story text to generate story narration, or context-bearing host text for a listening mode. It receives no Apple or Library account identifier. Heretofore does not record your microphone or collect your voice.
• Story recordings are shared and reused where available. They are served through Cloudflare from Backblaze using short-lived links that identify a recording, not your account. Your IP reaches Cloudflare, and Backblaze if a download falls back directly to storage. Playback can use an existing local recording without a new download.
• Heretofore retains the narration rights, requests and usage needed to verify access, avoid duplicate charges and include official story updates. Listening modes can report story context to prepare the next segment. This is different from uploading a continuous playback-position log; optional position sync uses your private iCloud database.
• The ordinary audio cache keeps up to 500 MB of recent recordings. Clear Audio Data removes local audio; saved host-session audio is also cleared by the app’s account/local-data controls. Lock Screen, Control Center and connected playback displays can show the title and place of the current story.

Your Library and iCloud

• Your Library works without iCloud. Heretofore’s server records which stories and narrations your verified account owns. Restoring available owned content does not spend another credit. Existing local removals and collection dates are preserved, and a temporary connection failure allows access to content already saved for the verified owner.
• Optional iCloud Sync, in Settings → Library & iCloud, shares membership and removals, favorites, read/heard state, exact-recording playback positions, earned badges, seals and Passport details through your private iCloud database. Use the same App Store account and the same iCloud account on each device; those are separate accounts and need not use the same sign-in address.
• The sync copy holds metadata, not story narratives or audio files. Credits and ownership remain server-verified and do not depend on enabling sync. Downloads, pending finds, walked ground, outing logs and the resumable Road Trip/audiobook session stay on each device.
• Turning sync off stops syncing and keeps the local Library and existing iCloud copy. Removing a story while sync is enabled shares that removal; a removal marker prevents an older device from silently restoring it. Account deletion handles the paired sync contents as described above. Copies made by much older iCloud-only builds are separate and are not imported as account rights.
• The catalog can be corrected, merged or withdrawn. Restoration does not recreate a withdrawn edition. Local clearing, removing a story from the synced Library, deleting the account and canceling an Apple subscription are different actions.

Story locations

A story’s location comes from its sources, not your search origin. Some stories have only broad geography. They may appear with a labeled “Approximate area · exact site unknown” reference; that is not an event site, directions destination or precise nearby claim. A location can identify a business or private home and is context, not permission to visit. Use Report a story issue on its page, or contact support, to request a correction or review.

What our server keeps, and for how long

Active-account records include keyed account/installation references, purchases and access dates, story and narration rights, allowances and usage, delivery receipts, cancellation/acknowledgement records and privacy choices. Listening records include account/device and session references, selected story versions, request status and usage. They support access, recovery, limits and repeat-request protection; they are not anonymous. No blanket short expiry is promised for these active-account records. Account deletion and its limited exceptions are described above.

To recover an interrupted listening request, our server temporarily stores generated plans, words and recording responses. Completed responses are available for at most ten minutes, or earlier if the trial session expires; scheduled cleanup removes expired copies. Unfinished Wayfarer requests expire ten minutes after their first claim. The raw submitted route/coordinate body is not stored in these response tables, but generated words can contain places and trip context. Session/account records, service logs and backups have their own retention periods; ten minutes is not a promise that every related record is erased.

Application logs omit raw Apple proofs, raw installation identifiers and dedicated user-coordinate fields. They can retain request references, errors, timing and generated web-search text that names places or trip context. Google’s serving infrastructure receives IP addresses and request metadata. Firebase also collects platform, app and SDK version diagnostics. Ordinary project service logs are retained for 30 days; required audit logs for 400 days. That longer period does not apply to every app request.

Our backend and database run on Google Cloud in the United States. Cloudflare serves website, catalog, map and audio requests; Backblaze stores shared maps and recordings. Providers may process information in other locations under their own terms. Shared catalog stories, their sources and their recordings are distinct from a reader’s private account data.

Who sees what

Provider processing and retention

We require third parties handling your personal information for us to provide protection at least equivalent to this policy. Their service terms, confidentiality commitments and applicable data-processing agreements support limits on use, appropriate security, and assistance with privacy and deletion requests. We remain responsible for how we use those services. Their specific processing and retention practices are described here; equivalent protection does not mean identical retention periods. Apple’s own account, purchase, map and iCloud services are also governed by Apple’s privacy policy.

We disable OpenAI’s saved-response feature and have its optional data-sharing controls off. This is not zero retention: its standard abuse-monitoring policy can retain inputs and outputs for up to 30 days, with legal and safety exceptions; some model features also use temporary caches. See OpenAI’s data controls. Our account does not have a verified special zero-retention arrangement.

LocationIQ’s request-log policy excludes ordinary API-content logging. We have not requested its temporary debugging logs. Inworld’s zero-data-retention option is not enabled for our workspace; its retention documentation explains that option. We do not promise a fixed deletion deadline for Inworld content or logs.

Google, Cloudflare and Backblaze retain operational and security information under their service terms. Cloudflare’s persisted Workers Logs have a maximum seven-day retention where enabled; that is not a guarantee that every kind of provider record follows the same period. Account deletion does not instantly erase information already received by these providers or Apple.

Children

Heretofore is not made for children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the app in a way that concerns you, write to us.

This website

• This site is a set of static pages. It has no accounts, no forms, no cookies and no analytics. Your choice of Paper or Lamplight is kept in your browser’s local storage and nowhere else.
• The demonstration maps load watercolor tiles from our map host, so your browser’s IP address reaches that host as well as the host serving these pages. The map library, fonts and sample recordings are served with this site. Recordings load only when you use a player. The site cannot use your location, and the map says so.
• Write to us opens your own mail app with our address. Nothing is sent through the site.

Changes, and writing to us

When our practices change, we update this page and its date. Contact Corvie, LLC for questions, access or correction requests, or concerns about a story: write to us.

Support opens your mail app with no automatic attachment or account identifier. A story’s Report a story issue button includes its title in the subject; you choose what to write and whether to send. Zoho Mail processes your sender address, message and any attachments you add. Our manual cleanup procedure removes resolved support cases 90 days after the final reply, unless a case reopens or a specific legal obligation requires retention. Mail can remain in Trash and provider recovery afterward; Zoho documents a further 30-day recovery period after Trash removal in its deletion policy.

Do not send Apple passwords, verification codes or purchase receipts. Contacting support does not cancel a pending deletion, resume collection or cancel Apple billing.

Updated October 31, 2026

← Back to the Atlas