Undrawn is an Android exploration journal by Riccardo Bartoli. Recording is opt-in, and your uncovered areas stay on your phone until you choose a manual backup or opt into automatic encrypted backup.
Backups are encrypted on your device using AES-256-GCM. Our server stores encrypted content, a random account identifier, revision and upload time. It does not receive your recovery code, encryption key, readable explored areas, email, or timestamped GPS trails. A separate authentication token authorizes each request and is not stored.
The app stores explored map cells, distance, outing counts, exploration dates, preferences, a session journal of newly revealed cells, and up to five local recovery points. It retains only the latest GPS fix while recording and removes it on pause. Locations waiting to be saved are kept privately on the phone (up to 100,000 samples) and deleted once saved to the map; samples older than seven days are discarded. Android automatic app backup is disabled. Location is accessed in the background only during an active recording session. If you allow Physical activity, Android reports when you start or stop moving so GPS can rest while you are still; these readings stay on the phone and are not stored.
Railway hosts the encrypted backup service. Infrastructure providers process connection metadata such as IP addresses. OpenFreeMap serves map tiles and receives your IP address and the areas of the map requested. Read OpenFreeMap's privacy policy. If you rate Undrawn in the app, Google Play receives your rating and any review you write, under its own terms. Play publishes them, or during closed testing shares them only with us, and you can delete them from your Play account. The Undrawn app includes no advertising or analytics SDKs.
The website undrawn.app is hosted by Cloudflare, which processes connection metadata such as IP addresses. The site counts page views and visits with Cloudflare Web Analytics, which Cloudflare says does not collect or use visitors’ personal data. If you choose Notify me, we store the email address you enter and the time you entered it, and use it only to tell you when Undrawn is on Google Play. We send that one email, then delete every address on the list within 30 days. To have your address removed sooner, use the contact below.
You can export an encrypted copy, restore with your recovery code, delete all cloud copies, or erase local data from Privacy & data. Local deletion does not delete cloud copies; cloud deletion does not delete local or exported copies. We cannot reset a lost recovery code. Anyone with the code can read or delete your backup. Keep it in a password manager.
The service keeps your latest encrypted backup until you delete it, and up to five previous versions for 30 days. Deletion removes current and historical copies held by this service. Files exported elsewhere remain under your control. You can also delete your cloud backup on this website using its recovery code.
This is a development release. No public account directory or location sharing is offered.
For privacy questions or requests, email support@undrawn.app.