What leaves the phone, and how to stop it.
RookFlow runs entirely on your device. The map, the positions, the moves: all in the app bundle. Signing in is optional, and all it does is keep your progress (below). There is no advertising and no tracking across other apps or sites.
Without an account it makes three kinds of network request of its own. The first is an anonymous GET to api.github.com for the GrappleMap repository’s star and fork counts, shown on the credit screen. Nothing about you is sent, and if it fails you see a dash.
The second is crash reporting, through Firebase Crashlytics, Google’s crash service, so that faults can be found and fixed. Each time the app opens, or comes back after half an hour or more in the background, a short note goes to it, so that crashes can be counted against the times the app was used: when it opened, the app and operating system versions, the device model, and random IDs that Firebase makes up for the installation and the session. And when something goes wrong — when the app crashes or gets past an error, as when something fails to load at launch or the 3D renderer fails as it starts or as it draws — a report goes to it. A report carries the stack trace and the error; the app version; the device and its state at the time, such as its model, operating system, language, memory and orientation; the same random IDs; what the app was doing at the time — the screen you were on and the ones before it, whether the app was in the foreground, the arena, the character look, the quality setting, the renderer, how far the AR mat had got in finding the floor, and whether developer options were on; and, while usage statistics are on, the screens and events they counted before it. Neither carries a name, an email address, an advertising ID or a location, and Crashlytics keeps a report, and the IDs that come with it, for 90 days.
The third, since version 1.8.1, is usage statistics, through Google Analytics for Firebase. The app counts which screens are opened and twenty-nine things that happen in them: a course opened, a drill rep, a goal met, a chain shared, a chain opened from a link, the AR mat placed, a roll taken into Drill, the shop opened, an arena picked, a look picked, and from version 1.9.0 a recall answer graded, a gym clock started, a clock setup saved, the app opened from its icon’s shortcuts, its widget, Siri or its reminder, a training session logged, a game plan saved, a game plan shared, the welcome closed, the tour ended, how long a new install took to its first drill rep, in versions after 1.12.0 a level reached and a feat met on the ladder, in versions after 1.14.0 how the offer of the reminder was answered and how long it took to the first rep the player started rather than one the tour played, and in versions after 1.15.0 your gym opened, a visit to RookFlow HQ or back to your gym, a room built in your gym and its plot grown, and in versions after 1.16.0 what is done on Your HeatMap — each with one or two small details, such as the number of steps, the arena’s name, the clock’s room, the kind of session, the page or step it was left on, where it was picked, which level or feat it was, the answer, the gym it went to, the plot and the stripes on your belt, the room and whether it was built on its site or came from the tray, or which way Your HeatMap was opened and what was done there, such as a position sent on to Drill or HELM, never which position it was. What you write in the log and what you call a plan are never among them. Firebase adds its own: first open, sessions, app updates, a crash (when crash reports are on too), the device model, operating system, app version and language, and the country or region your network address suggests; the address itself is not stored. The counts hang on a random installation ID that Firebase makes up. It is not your name and not an advertising ID — the app never asks for one — and it is not used to follow you anywhere else. On iPhone and iPad, versions before 1.8.2 also send Apple’s identifier for vendor, which only apps from the same developer can see; from 1.8.2 that is switched off. We read the numbers to decide what to build next. They are never sold, never shared and never used for advertising, and the events behind them are deleted after 14 months at most.
Both are on when the app is installed, and each has its own switch from version 1.8.2: scroll to the bottom of the first screen and tap Privacy. Switching crash reports off stops the notes too. Switching the statistics off also throws their installation ID away, and a report written while reports were off is deleted, not sent later.
The fourth is your account, and only if you sign in. Back up your progress, at the foot of the profile, signs you in with Apple or Google through Firebase Authentication, Google’s sign-in service, which keeps the user id Apple or Google gives the app and the name and email address that come with it (with Apple, the relay address if you hide yours), and, with Google, the link to your profile picture, which the app never reads. Your progress is then kept in the account, so that it comes with you to another phone: one record in Cloud Firestore, Google’s database, stored in the EU, in Frankfurt. It holds what you have earned and found: the XP and the counts each of your phones has added, and the level each has reached on the ladder; the rooms, pieces and feats you have earned, and what else you have unlocked or finished; the moves and positions you have found; the days you trained; for each move you have drilled, how often, how many of recall’s questions on it you got right, and the first and last day; how RookFlow HQ and your gym are laid out, and your gym’s name, each with when it last changed; and when the record last changed. Each phone’s part goes under a random name the app makes up for that install of the app, and nothing about the phone itself; in versions after 1.15.0 a copy of the app restored from a backup makes up a new one, and the part it came with stays in the record. In versions after 1.15.0 the record is read when you sign in, after a reinstall, before your gym opens on a phone that is signed in, the first time a copy of the app restored from a backup opens, when the app opens, or comes back from the background, twelve hours or more after the last read, and when you sign out, if you signed in with 1.15.0 or earlier and no later version has read it on that phone yet, or if a copy restored from a backup has not read it yet; it is written when the app goes to the background with something new, at most three times a day and four hours apart, and at once when you sign in, after a reinstall, when you sign out and when your gym opens. Before, it held the XP alone, and was read and written when you signed in or after a reinstall, at most once a session as the app went to the background, and when you signed out. In versions after 1.15.0 a second record beside it keeps your own entries, so that they come with you too: the chains you keep, and for each when recall asks it next and how many of its questions you got right; the positions you starred; your game plans, with their names; and your training log, each session’s day, kind, minutes, rounds, positions, moves, chains and note. Each entry goes with when it last changed, and one you delete stays in the record as its name and when you deleted it, so that a phone with an older copy does not bring it back. The record keeps your newest entries, up to three quarters of a megabyte; a log longer than that keeps its oldest sessions on the phones that have them. It is read when you sign in and with the first record when another of your phones has changed it, and written with the first record when your entries have changed. Before, they stayed on the device. Nothing else goes with them: not what you bought, which the store gives back on each phone, and not a pause you set for an injury, which stays on the device. Everything works the same without an account. In versions after 1.15.0, signing out backs your progress and your entries up first, so it needs a connection; your progress on the phone then starts over, your entries stay on it, and signing in again brings the progress back. Before, signing out left the belt in the account, and signing in again brought it back. The account is kept until you delete it: Delete account, in the profile, deletes the records and the account, or write to the address below. In versions after 1.15.0, deleting it also takes your progress on the phone back to the start, and your entries stay on the phone. Deleting it in version 1.15.0 or earlier, which does not know the second record, leaves that record if a later version on another of your phones has written it: write to the address below and it is deleted. In versions after 1.15.0, while you are signed in, Firebase App Check vouches that each request to your account comes from the real app: on Android through Google Play Integrity, which asks Google Play about the app, its licence and the device, and on iPhone and iPad through Apple’s App Attest, which makes a key for the app on that device and lets Firebase keep its public half to check the requests that follow. What Google Play and Apple handle to answer is theirs, under their own terms, and none of it, nor anything App Check sends, is your name, your email address or your progress. App Check starts only as a sign-in begins, or when the app finds you signed in, and sends something only with a request to your account. If you never begin a sign-in, App Check never starts, and sends nothing.
Signing in aside, the shop is the one place the app talks to anybody else’s server: it asks the App Store or Google Play what is for sale, and a purchase or a restore happens between your device and the store, under your store account. None of it passes through us, and the store never tells us who you are or how you paid.
The camera, when you open the AR mat, draws the room behind the mat and finds the floor. Frames are drawn to the screen and thrown away: nothing is recorded, stored or sent anywhere unless you tap the shutter, and then only that one picture, with the pair drawn over it, goes to your phone’s share sheet and on to wherever you send it. The app asks for the permission only at the moment you tap into AR.
Everything else — the chains you keep, your reps, your streak, your training log and game plans, your settings, the hour of the daily reminder — is stored on your device, and in your phone’s own backup if you have that turned on (Google’s on Android, iCloud on iPhone and iPad, under your account). None of it is sent to us but your progress and your own entries, to your account if you sign in, and what a bug report carries, when you send one. The reminder is scheduled on the device too; no server sends it. A game plan, or the card of your week — how many sessions, their minutes, how many moves — leaves it otherwise only when you share one, and then only to whoever you send it to. A link you share names what it shares by the map’s own keys: a position, or the moves of a drill or a class. A challenge to beat your recall adds how many you missed and how many seconds your answers took. Opened without the app, or shown as a preview in a chat, a link asks this website for its page with all of that in the address, and the page sends nothing on. A game plan’s link keeps its name and its moves after the #, which a browser keeps to itself. A bug report leaves it only when you send one, and then to us at the address below unless you change it: it opens in your mail app, addressed to us, and nothing goes until you send it. Where there is no mail to open, it goes to your phone’s share sheet instead, and then only to whoever you send it to; with no picture either (in AR, or with the picture switched off), it is copied to your clipboard. It carries what you wrote, which screen it came from and, unless you switch it off, a picture of it (never in AR), the app’s version, the phone’s model and operating system, the language, renderer, character look and developer options, and the position and move; as a mail, it comes with your email address. Uninstall the app and all of that is gone from the device; a backup keeps it until you delete the backup, and your account keeps your progress and your entries until you delete the account.
The formal part. Crash reporting and usage statistics are processed on the basis of our legitimate interest in an app that works and gets better (Art. 6(1)(f) GDPR); the switches above are how you object. An account, and the progress and entries kept in it, is processed to give you what you signed in for (Art. 6(1)(b) GDPR), and kept until you delete it. App Check, in versions after 1.15.0, rests on our legitimate interest in keeping the accounts from abuse (Art. 6(1)(f) GDPR), and goes with a signed-in player’s requests alone. Google Ireland Ltd. processes all four on our behalf under a data processing agreement, and may transfer data to the United States under the EU–US Data Privacy Framework; the record of your progress itself is stored in the EU, in Frankfurt. A bug report, and your email address when it comes as a mail, is processed on the same basis, to fix what it reports and to answer you, and kept no longer than that takes. You have the right to access, correction, deletion, restriction and objection — write to the address below — and the right to complain to a data protection authority; ours is the State Commissioner for Data Protection of Baden-Württemberg.
One thing on this website is not the app. The Android build is on a closed Google Play test, and a closed test admits people by Google account address, so the product page has a field that asks for one. If you use it, that address is stored — with the moment you sent it, and nothing else — for the single purpose of adding you to the tester list. It is not a mailing list, it is never sold or shared, and it goes no further than us and the Play Console. Write to the address below and it is deleted. The website also counts its own visits, with our own counter and no cookies: pages, time on them, clicks. Visitors are told apart by a shortened, hashed network address and a random number that lasts until the tab is closed, and none of it goes to anyone else. The typefaces load from Google Fonts, which sees your network address when they do.
Questions: ghostlabsoftware@gmail.com. GhostLabs, Stuttgart, Germany.
Last updated: 15 October 2026.