Leave Behind Privacy

The short version

You leave a kindness at a place. A stranger finds it later. Neither of us ever learns your name.

But your drops carry a code that ties them to each other, and anyone can read it. If you drop near where you live, that is enough to work out where you live. We would rather tell you that at the top than bury it.

Where your drop goes

When you leave a kindness, it goes to Apple’s iCloud, into a shared area that other people’s phones can read. That is how a stranger finds it. There is no SillyDroose server anywhere. We could not build one that logs you, because we did not build one at all.

What we save, and what never leaves your phone

We save a fuzzy area, not the spot you stood on. Your phone rounds your location to a grid square roughly 150 metres by 100 metres before anything leaves it.

Read that carefully, because it is easy to hear as more protection than it is. That number is the size of the grid square. It is not a measure of how well you are hidden. A single drop already narrows you to about fifty metres.

We also save the category you chose, a number standing for which of our written phrases you picked, the day you left it, and a one-time code for a thank-you feature we have not built yet.

Your exact location is held for a moment on your phone while you walk away, then deliberately erased from memory. It is never written to disk and never sent anywhere. We are saying “held for a moment and erased” rather than “never held” because the first one is true.

The app also asks iOS to wake it when you have moved a significant distance, so it can notice you have walked away from a drop. That is location work happening after you have put your phone away. It stays on your phone.

The part we cannot turn off

Apple stamps every drop with a code that identifies the phone account it came from. The same code appears on all of your drops. It sits in the shared area with everything else, so any phone reading the database can read that code. This is not something only Apple sees, and no court order is needed to reach it.

Every drop also carries the exact moment you left it, down to the millisecond, and that time is indexed so that anyone can sort by it.

We did not ask for either. We do not read them. We cannot remove them, and no app can. Apple uses the code internally to decide who is allowed to change what.

Here is what that means in plain terms.

One drop seen is every drop found. If somebody watched you leave a single kindness, they know the minute it happened. They can sort the database by time, pick out that drop, read the code on it, and then find every other drop you have ever left. This does not take patience, volume, or a court order. It takes one sighting and one sort.

And if you leave drops around where you live, the fuzzy areas converge. We ran the numbers at the fastest rate this app allows, seven drops a week. Over one ninety day window that lands somewhere around ten to forty-two metres, depending on how widely you walk. That figure is the best case for somebody hunting you, not a prediction. Drop less often and it is wider. It still narrows.

Nobody can turn that code into a name. There is no way to do it, not for a stranger and not for us. That matters less than it sounds. Somebody who already knows your name is not looking for your name. They are looking for your places, and the code hands them those.

If being found would put you in danger

Please read this part twice.

If you are hiding from someone, this part is for you. It is also for you if there is a person in your life who should not know where you are.

Please do not use this near home.

And please know that staying away from home is not the whole of it. Moving your drops away from your door protects you against the slow version of this, where somebody watches your drops pile up. It does not protect you against somebody who sees you leave one.

If that person could be watching you, the honest answer is not to use this at all. We will not be offended.

If you have already left drops near home, we cannot take them back for you. There is no button for that, and we have not built one. They will expire on their own within about ninety days. We are telling you because you deserve to know, not because we are comfortable saying it.

One more thing, closer to home than any of the above. This app keeps your own drop history on your phone so you can look back at what you have left. If somebody else can open your phone, they can open that.

Your safety is worth more than a drop.

We thought hard about whether to say all of this. It would be easier to leave it out. But an app that asks you to trust it should tell you where its protection ends.

How long a drop lasts, and what happens to it

A drop expires on its own after roughly sixty to ninety days and is removed.

There is no way to withdraw a drop before then. We have not built one. If we do, this page will say so.

If somebody reports a drop as harmful, a person reads it. That review shows the phrase and the fuzzy area on a map. If it comes down, the record is marked removed and clears out within thirty days.

If you want something deleted sooner, write to lb@sillydroose.com and we will do what we can. We would rather tell you that plainly than pretend there is a button.

What we do not do

• No account. No sign up. No name, no email, no phone number.

• No analytics, ever. No third party code that watches you.

• No ads, no advertisers, no data sold to anyone.

• No streaks, no badges, no notifications nagging you back.

• No reading the Apple account code stamped on every drop. It is on the record and we leave it alone.

• No server of ours that could log anything, because there is no server of ours.

What could be handed over, and by whom

If somebody came with a court order, Apple holds, among other things:

• the fuzzy area

• the category

• the number standing for the words you picked

• the thank-you code

• the day you dropped it

• Apple’s own stamps: the account code, a number that tells one of your devices from another, and the exact time

About that device number, one honest caveat. We measured that it exists and that it stays the same across your drops. We have not measured how far it reaches, whether it only tells your own devices apart or means something wider. We declared it to Apple the cautious way, and we are telling you the same thing here rather than guessing.

Apple does not hold your exact location, and there are no analytics of ours about how you use the app. The exact spot never leaves your phone, so there is nothing there to hand over.

What we will not claim is that Apple holds nothing else. Your phone has to talk to Apple’s servers to leave a drop, and every connection on the internet carries the address it came from. Apple’s logs are Apple’s. We never see them and cannot read them, and we are not going to tell you they do not exist.

There is a second party you should know about, and it is us. Because the drops sit in a shared area, we can open Apple’s dashboard and see them, the same as any other reader. We cannot put a name to anybody. We can tell one person’s drops apart from another’s, because that code is on every record. We do not go looking, and we have built nothing that does. But “we have no server” is not the same as “we cannot see it”, and you should have the accurate version.

Why we are telling you this

We found the account code by going and looking, after the app was built. We could have written a friendlier page. The whole point of SillyDroose is that we do not lie to you, and a privacy page that leaves out the inconvenient part is a lie with better manners.

If you have questions, write to lb@sillydroose.com. A person reads it.

Every measurement on this page was taken on 2026-08-20 against our development database, because the live one has not been set up yet. When it is, we will check again and change this line. If you are reading this much later, write to lb@sillydroose.com and ask us to re-check. Measurements go stale.