Privacy

In brief

Nahbei is an iPhone app for a private circle of friends: it lets you know when a confirmed friend happens to be in your area or when your trips cross. There is no account with us and no map on which anyone is tracked. Your location is rounded on your iPhone to a cell — about 5 km across, or about 20 to 30 km with the approximate location Nahbei uses by default — and encrypted only for friends you have confirmed yourself; it never passes through a server of ours. Apple's iCloud (CloudKit) serves as the mailbox: contents are stored there encrypted only, and neither we nor Apple can read them. There are two optional exceptions, both described below: when dictating trips, only when you tap "Agree and send" does that one text go through a server of ours to Anthropic (Claude). And only if you turn on "Look up flight numbers online" for your calendar do the flight number and date of events that name nothing but a flight number go through our server to a flight schedule service. Besides that, only your feedback (when you send it), the check for replies to it, a report when you report or block someone, anonymous error reports, the question which version is current and the download of the block list reach our server. There is no advertising, no tracking and no analytics SDKs.

What the app processes

• Location: Nahbei asks for the "Always" location permission because background detection is the core feature. It uses Apple's energy-saving mechanisms (significant location changes and detected visits) plus a single location fix when you open the app — no continuous GPS — and works with approximate location by default. Every position is rounded on the device to a cell: about 5 km with "Precise Location", about 20 to 30 km with approximate location or when the fix is imprecise. Only this cell is shared, never the position. For the home suggestion (below), the app keeps detected visits — arrival, departure and place rounded to about 150 m — for up to 100 days, on this iPhone only. Without the permission, or if you choose so, the app runs in "Home only" mode: it then shares only the cell of your home and your trips.
• Home: you enter a city during setup. The app may suggest a change based on your stays over the last 90 days, but changes nothing without your confirmation. Here too, only the cell (about 5 km) is shared, never the address.
• Friends: a connection only comes about through mutual confirmation, via QR code in person or via an invitation link. The devices exchange your name and a public key. The invitation link (velostats.app/nahbei/einladen#…) carries both, plus random identifiers, after the #: no browser ever sends that part to a server, not even to us — but the app you send the link with sees it like any message. If Nahbei is installed, the link opens the app directly; otherwise the page shows how to continue — it reads the invitation only in your browser and loads nothing else, not even fonts. When the page is loaded (including for a messaging app's link preview), Cloudflare sees the IP address as with any website, never the invitation. The app stores your friends' names and nicknames only on your device; on the way there, a name travels only in the QR code, in the invitation link or encrypted in the mailbox. You can switch visibility off per friend or pause everything (they then see "not sharing right now"), or remove a friend (they are told, and their app removes you as well). You can also block a person: Nahbei then disconnects you and accepts no further request, code or link from them. Whom you blocked is stored on your iPhone; blocking also sends a report to us (see "Terms of use, reports and exclusion").
• Terms of use, reports and exclusion: before first use you accept the terms of use (zero tolerance for objectionable content and abusive behaviour); only your iPhone remembers that you did. The app hides offensive words in other people's names and destinations on the device. If you report a person (in their view or on a request) or block them, the app sends a report to our server: the person's name as it reached you, the destinations (city, country, dates) they are currently sharing with you, your reason and your comment, an identifier of their public key (part of its SHA-256 hash), app version, build number, iOS version and the random installation identifier as with feedback — not your name, your location or your other friends. For this, the reported content leaves end-to-end encryption as an exception; the app says so before you report. The report ends up like feedback as an entry in the private GitHub repository, the developer receives it via Telegram and reviews it within 24 hours. If the person breached the terms of use, their key identifier is added to a public block list (identifiers only, no names). The app downloads this list from our server when you open it, at most every six hours — without an identifier and without content; Cloudflare sees the IP address as with any request — and removes excluded people from your list; if your own identifier is on it, the app withdraws everything you shared. Reports made without a connection wait on your iPhone until the app can send them.
• What a confirmed friend sees: your name as sent when you connected; your current cell (see "Location"), your home cell, the city and country of your current cell, the time of the last update, and your current and upcoming trips (city, country, the city's cell, dates). Not: your address, your movement within the cell, your other friends, the nicknames you give, or details of your events such as title, notes or time. Your home cell, your shared trips and your crossings appear on the map in their app only if you agreed (during setup or in Settings under "Map"); Nahbei never shows your current cell on a map.
• Demo: "See the demo" shows Nahbei with sample friends. The demo runs only on your iPhone and only in memory; it sends nothing, uses neither iCloud nor your location, and is gone after "End demo".
• Trips: you enter trips by hand, by dictating or typing in the app, via Siri ("Share a trip in Nahbei"), through the share sheet (text, image or PDF such as a booking confirmation; a shared link is read only as text, the page is not loaded) or from your calendar. Bookings are read on the device (text recognition with Apple's Vision). Calendars are read only after your permission and only the calendars you select (title, location, notes and times of events, on the device); the app proposes trips from them (events with a location, flights and train journeys, only beyond a distance from home that you set, 40 km by default). Cancelled events and declined invitations do not count; The app shares nothing without your confirmation (one tap can share all new proposals at once). If the events behind a shared trip only move in time, the app takes over the new dates; a new destination is proposed as a change; if the events are cancelled or deleted, the app withdraws the trip. A shared trip goes, encrypted, to all confirmed friends you are visible to — including friends who join later, as long as the trip is current or upcoming. Past trips are kept for the "Your world" map on this iPhone only. An event that names only a flight number ("LX 318") yields no proposal — unless you turn on "Look up flight numbers online" (below).
• Dictating trips: when you dictate your plans in the app, your iPhone recognises the speech itself (Apple's on-device speech recognition, German or English); the recording never leaves the device, and if on-device recognition is unavailable for the chosen language, typing is the only path. Understanding the trips (places, dates) also happens on the device — with Apple's on-device language model where available, otherwise with fixed rules. The app does, however, look up the places it recognises with Apple while you are still dictating (see "Place names"). Nothing is shared before you confirm the list.
• Optional: send text to Claude. If the app did not understand your plan correctly, you can send the recognised or typed text to Claude. This happens only when you tap "Agree and send" on the consent card; beforehand the app shows you verbatim the text that would be sent and says what goes with it and that it goes to Anthropic. Only that text, today's date, your time zone, the app's language (German or English, for the answer) and the device identifier iOS assigns to Nahbei (identifierForVendor — the same for all apps by the same developer on this iPhone) are then sent to our server at Cloudflare. The identifier serves only the daily limit and is kept there in a counter that expires at the latest 24 hours after the last request. The server passes text, date, time zone and language on to Anthropic (Claude) and returns the answer. No names from the app, no location, no calendar data, no friends. We do not store the text; we only count requests and costs. Anthropic processes the text as a processor under its commercial terms and the accompanying Data Processing Addendum and, by default, does not use data from its API to train its models; the text is therefore protected there at least as described in this policy. If you dictate a name, it is in the text — which is why you can edit the transcript first.
• Optional: look up flight numbers online. Off by default. If you turn it on under "Manage calendars", the app asks for the route of events that name only a flight number ("LX 318"). Only the flight number, the date and the device identifier for the daily limit (the same as for the Claude step, in a separate counter that likewise expires at the latest 24 hours after the last request) are then sent to our server at Cloudflare, which asks the flight schedule service AeroDataBox, via the API marketplace API.Market, with nothing but flight number and date, and returns the departure and arrival airports. No title, no location, no notes, no names, no position. We keep flight number, date and answer for up to three days without the device identifier, so the same flight is not looked up twice; the app keeps the answer for at most seven days. If you turn it off, the app deletes what it has looked up.
• Place names: so that notifications say "Zurich" instead of a code, the app queries Apple's geocoding service, and only with the centre of your cell, never with your position; likewise for a home suggestion and for a calendar event with coordinates (in each case the centre of the cell of about 5 km). It sends place names to the same service when you enter a home or a destination — typed, via Siri, from the share sheet or recognised by Claude —, when you search for a place in "Who’s there?", and when you dictate or type your plans: while you are still speaking or typing, for every place the app recognises, before you confirm anything (this can include intermediate results). From calendar events, the location text of an event without coordinates goes out when the event looks like a trip, as do a destination in the title ("Mallorca") and, for flights and train journeys, the places on the route — without station, platform or train and flight numbers. Apple sees the request and your IP address; we see none of it.
• Encryption: for each pair of friends the two devices derive a shared key (X25519, HKDF); contents are end-to-end encrypted with ChaCha20-Poly1305. Your keys live in this iPhone's keychain, are not synced to iCloud and do not move to a new device; friends and trips are also excluded from backups. After a device change you reconnect with your friends.
• Feedback (optional): if you send feedback in the app (speech bubble at the top left), the app transmits your text, the chosen category, app version, build number and iOS version, plus a random identifier created per installation, so we can trace problems, group your reports and limit abuse — no name and no Apple device identifier. Follow-up questions and edits to your feedback are added as text. Images (such as a screenshot) are only included if you pick them yourself — downscaled and saved anew as JPEG, without the original's metadata. The diagnostics report is only sent if you add it to feedback under Settings → About Nahbei → Diagnostics and send it; it is shown in the text field first and contains states (such as location permission, notifications, iCloud) and a log of the last 48 hours — when iOS woke the app, encounters, distances in whole kilometres — but no places, cells or names; friends appear as "Friend 1, 2 …". The log itself stays on your iPhone. The feedback, including the identifier, ends up via our server as an entry in a private GitHub repository that only we can read; the developer receives a Telegram message with your text. To show you replies, the app asks our server for the status of your own feedback (only its numbers and the app version) when you open the app and, if you turn on "Notify me about replies", now and then in the background as well. To prevent abuse, the server counts feedback per identifier and edits, follow-up questions and images per IP address (what is stored is not the address but a hash with a random value that changes daily and is deleted after three days); these counters expire at the latest two days after the last count.
• Error reports: if the app crashes or hits an error, it automatically sends an anonymous report to our server: app version, build number, iOS version, device type (such as "iPhone17,1"), the place in the code and the kind of error, and for a crash the chain of code locations that iOS delivers at the next launch — no identifier, no places, no names, no trips. Only versions from the App Store and TestFlight on a real iPhone do this. The report ends up as an entry in the private GitHub repository; the developer receives a Telegram message with the summary.
• Update notice: at launch the app asks our server whether a newer version exists that you can install the way you installed the app. Only the app name, the installed version number and whether the app came from the App Store or TestFlight are transmitted — no identifier, no content.
• Mailbox in iCloud: the encrypted entries live in the public database of the Nahbei iCloud container (Apple CloudKit). They carry only ciphertext, a random mailbox identifier per friend and direction, and a timestamp; a connection request via an invitation link additionally carries the random identifiers of both sides and the sender's public key, with the name inside encrypted. Location entries are overwritten on every change of cell. If you delete a trip, pause, switch visibility off for a friend or remove them, the app overwrites its entries for them with an empty placeholder; it deletes trip entries entirely once the trip is over, and notification triggers after two days (a disconnect signal after 30 days). Apple sees which iCloud account writes an entry and when, but neither position nor city nor names. Other users of the app see only ciphertext and, per entry, an anonymous creator identifier that links entries of the same person without revealing who it is.
• Notifications: when your device detects an encounter, it notifies you locally and leaves an encrypted trigger for your friend; their device receives a push notification for it through Apple's push service. The push contains only ciphertext; the text ("Tom is in your area right now") is written by the receiving iPhone itself. Reminders about travel plans are local notifications. "Message" opens the iOS share sheet with a prepared text; it only leaves your iPhone through the app you choose there.
• Widget: the Nahbei widget shows on the Home Screen and Lock Screen what the app shows anyway — such as friends' names (including nicknames), the city and dates of an encounter or crossing, the end of a pause — never coordinates, cells or your own location. The data for it stays on this iPhone. Names and places are marked as sensitive; whether iOS hides them on the locked iPhone depends on your iOS settings.
• Siri and Shortcuts: if you dictate a trip via Siri, Apple processes your speech under Apple's terms; Nahbei evaluates the recognised text on the device, looks up the place name with Apple (see "Place names") and asks before sharing. This only works while your iPhone is unlocked.
• No advertising, no tracking: the app contains no advertising, tracking or analytics SDKs. Location, friends and trips run exclusively through Apple services; our server only handles the two optional steps above (text to Claude, flight number lookup), your feedback, reports, anonymous error reports, the version check, the block list and the invitation page.
• App Store and TestFlight: Nahbei comes through Apple's App Store and, for testers, through TestFlight. We receive crash reports and TestFlight feedback from Apple only to the extent you allow this in iOS or in TestFlight; Apple's terms apply.

Services that receive data

• Apple — iCloud/CloudKit (mailbox for ciphertext; your iCloud account is your identity), push service, geocoding (cell centres and place names), Apple Maps (the map areas you view on the map in Trips), Siri (only if you use it), and the App Store and TestFlight. Speech recognition and the language model run on the device.
• Cloudflare — runs our servers (Cloudflare Workers) and sees your IP address with every request: for feedback, reports, error reports, the version check and the block list download, for the optional steps "Send text to Claude" (text, date, time zone, language and device identifier; only text, date, time zone and language are passed on) and "Look up flight numbers online" (flight number, date and device identifier; only flight number and date are passed on), and when the pages under velostats.app are loaded, including the invitation page — never the invitation itself.
• Anthropic (Claude) — only for the Claude step: the text you sent with date, time zone and language, without the device identifier and without your IP address. Anthropic processes it as a processor (commercial terms including the Data Processing Addendum), does not train models on it by default and protects it at least as described here.
• AeroDataBox (flight schedule service, queried via the API marketplace API.Market; the app credits it as “Flight data: AeroDataBox”) — only with "Look up flight numbers online": flight number and date, without the device identifier and without your IP address.
• GitHub (the developer's private repository) — your feedback including the installation identifier and any images you attach, reports, and the anonymous error reports.
• Telegram — notifications to the developer: for new or edited feedback and follow-up questions with your text, for reports with their content, for error reports with the summary, for emails to support@velostats.app with sender and subject.

Nobody else. We have no access to the contents of the encrypted entries.

This website (velostats.app)

The pages under velostats.app/nahbei use no cookies apart from the strictly necessary language-choice cookie (DE/EN), no trackers and no analytics services, and they load nothing from other servers, not even fonts. The website runs on Cloudflare Workers. Whatever you send by email to support@velostats.app is used solely to answer your enquiry and is deleted automatically after 90 days at the latest; the developer is notified of new emails via Telegram (sender and subject), and nothing else goes to third parties.

Deleting your data

In the app: Settings → “Delete all my data”. This disconnects you from all friends (they are notified), deletes everything Nahbei stored for your iCloud account in the mailbox and all of Nahbei's data on your iPhone, including the keys; the app then starts as if newly installed. So that your friends learn about the disconnection, one encrypted disconnect signal per friend — without name, place or trip — remains for up to 30 days and is then removed by Nahbei, as long as the app is still installed. Feedback and reports you sent stay with the developer — write to us if you want them deleted.

If you only delete the app (or use a version before 1.0.0), first remove your friends in the app: the app then overwrites its mailbox entries for each of them with an empty placeholder. Then delete the app — friends, keys, trips and history are removed from the device. You can withdraw location and calendar access at any time in the iOS settings. If you delete the app without removing friends first, your last encrypted entries remain, readable only by the friends you had confirmed; Nahbei no longer uses a location after seven days, a home shared in “Home only” mode after 60 days, and a trip after it ends. If you reinstall Nahbei with the same iCloud account, the app offers to remove these entries (“Remove old installation”). For questions or access requests: support@velostats.app.

Controller

David Gertis
support@velostats.app