Privacy

Last updated: 2026-08-10

Cairn is a trail conditions app for iPhone. It uses your location, and this page says exactly when, exactly what is kept, and exactly what leaves the phone. Where the answer is uncomfortable it is still the answer.

Location: used, kept, and sent are three different things

Used — while the app is open

Cairn reads your location whenever the app is in front of you. It has to: it puts you on the map, and it attaches a hazard report to the right stretch of trail rather than a guess. Nothing about where you have been is written down for this.

Kept — only for a walk you start

Tap Track and Cairn records your positions to the phone, so it knows which stretches you actually covered. This is the only circumstance in which your location is stored. Stop recording and it stops.

In the background — only while recording

Background location runs only while a recording is active, so a track keeps going with the phone in your pocket. It is switched on when you start a walk and off when you stop.

What leaves the phone

Hazard reports

When you file one, Cairn sends the hazard type, the trail segment it was matched to, and how far along that segment it sits. The matching happens on your device; the segment identifier is the position, and it is deliberately coarser than a coordinate.

Which stretches you covered

If you recorded a walk, Cairn sends the list of trail segments you passed over — not your track. This is what stops a report ahead of where you turned back from being wrongly marked as cleared.

Recorded walks — off by default

There is a setting called Share walks for calibration. It ships off. If you turn it on, Cairn uploads the raw positions of walks you record, including their accuracy, so the matching can be tested against real data rather than assumptions.

This is the most revealing thing the app can send, which is why it is opt-in, why it is stated plainly in the app, and why you can delete it — see below.

Nothing else

There is no analytics SDK, no advertising identifier, no crash reporter that leaves the device, and no third-party tracker of any kind. Cairn does not ask for your name, your email, or an account.

How your phone is identified

Cairn mints a random write token the first time it runs and keeps it in the iOS keychain. It exists so the service can rate-limit an anonymous device and shut off abuse. It is a capability, not an identity: it is not derived from your device, your Apple ID, or anything about you, and it is not shared with anybody.

Reports and walks are stored against that token. Nothing links it to a person, because nothing about a person is collected.

Deleting what you have sent

In Settings → Recorded tracks there is a button: Delete my uploaded walks. It removes every walk this device has uploaded and tells you how many walks and positions went.

It is authorised by the write token, which is why no account is needed — the device that uploaded a walk is the only one that can present the token that owns it.

The honest cost of storing no identity: if you delete the app and lose the token, we cannot tell which walks were yours, and neither can you. The token is shown at the foot of Settings where you can copy it if you want to keep it. Hazard reports are not deletable this way — they are trail conditions other walkers are relying on, and they carry nothing about you.

What stays on your phone

• Downloaded maps and trail geometry
• Your recorded walks, unless you turned sharing on
• Saved trails
• Reports waiting to send, until there is a signal
• The write token, in the keychain

Deleting the app removes all of it except the keychain entry, which iOS keeps by design.

Children

Cairn is not directed at children and collects nothing that would identify anyone, of any age.

Changes

If this ever changes materially, the date at the top changes and the app says so before anything new is sent. This page and the app's own wording are kept in step deliberately — if they ever disagree, the app is wrong and that is a bug worth reporting.

Contact

See Support.