Privacy Policy

1.Who we are

SQUARE3 Limited (referred to as “Sentra”, “we”, “us”) is the data controller for personal data processed in connection with the Sentra app, its spot walking features, and the website at sentra.city (the “Service”).

• Registered office: 92 York Street, London, England, W1H 1QX
• Company number: 16466339
• General privacy enquiries: mda@sentra.city

2.Our privacy promises

Sentra is built on privacy by design and by default (Article 25 UK GDPR). Specifically:

• Only what we need to start. You need an Account to use the app, and we ask only for what section 3.1 lists. The website needs no Account.
• Our servers are in the UK and the EU; some service providers handle limited data elsewhere, as section 8 explains.
• Data minimisation. We collect only what is necessary for the feature you are using.
• We keep each kind of data for the periods set out in sections 3 and 9, and we are replacing the few that are still open-ended with fixed periods.
• Encrypted connections, and the security measures described in section 10.
• We do not sell your personal data. An individual location trace is not a product, in any form and at any price.

3.What data we collect, why, and on what lawful basis

3.1 Account creation and verification

If identity verification is used, this is handled by our third-party verification provider under their own privacy terms.

3.2 Location data

Location is the most sensitive category we handle, and Sentra is a walking app, so we treat it accordingly. The point of reading your location is to tell that you actually reached a place on foot, rather than that you pressed a button saying you did.

When we read your location. Only while Sentra is open on your screen, and while you are following a route you started. During a route, Sentra keeps reading your location in the background, with your phone locked or another app open, until you end the route. If you arrive while Sentra is in the background, it keeps reading until you next open Sentra or end the route. Your phone shows when this is happening, with the location indicator on an iPhone or iPad.

You can choose to share a picture of a walk. Sentra draws it on your phone. It shows the date, how far and how long you walked, and may show your neighbourhood, but never the time of day. If it shows the route, the start and end of the walk and anywhere near the home you saved are left out. It is shared only where you send it.

Your walk journal stays on your phone. If you use the walk journal, your walk history (the routes of walks you complete with directions, and any photos or videos you add) is kept only on your phone. We don’t receive it, and nothing in it is sent to us, including in crash reports or analytics. When you open a past walk, the map around it loads from Mapbox, like any map in Sentra; the route itself stays on your phone. It is not included in your phone’s iCloud or Google backup, so if you get a new phone or delete Sentra, it does not come with you. Photos are copied in without their location data, and videos without the location your camera saves with them. You can delete a walk, a memory, or all of it at any time, or set walks to delete themselves after a period you choose. Deleting your Account deletes the journal on the phone you use to do it.

You control location permissions through your device settings and can switch them off at any time. If you do, presence checks stop working and the rest of the app continues.

3.3 Content you submit

We may keep anonymised statistics after deletion so we can identify broader trends. See section 3.6 for the threshold that applies before any of it leaves.

3.4 Device, app, and analytics data

We do not use third-party advertising trackers, Meta Pixel, or cross-site/cross-app tracking SDKs. There is no advertising-ID-based profiling.

3.5 Communications

Enquiry-form messages are processed on the basis of our legitimate interests and steps taken at your request before any contract; the launch waitlist is processed on the basis of your consent, which you can withdraw at any time — reply “remove” to any email from us, or write to the address in section 1.

We will only send you marketing if you have specifically opted in (PECR / soft opt-in). Every marketing email contains a one-click unsubscribe.

3.6 Aggregated and anonymised data

We may use anonymised and aggregated data for analytics, service improvement and business reporting. This data does not identify individual users.

4.Special category data

We do not intentionally collect special-category data (health, ethnicity, sexual orientation, religion, political views, trade-union membership, biometric or genetic data).

Applying that to a walking app specifically: we do not build a profile of how you walk that could identify you, a “movement fingerprint” (a pattern in your movement data used to recognise you), or any other biometric profile of you. That would be special-category data under Article 9 UK GDPR. We have no lawful basis for holding it, and we do not collect it.

If you submit content that incidentally includes special-category data (for example, a description of a person that mentions their ethnicity), our moderation policy is either to redact the identifying details before display, or to ask you to resubmit without those identifiers and delete the preceding submission.

5.Who we share data with

We share personal data only with the parties listed below, and only for the purposes described.

5.1 Sub-processors (act on our instructions)

5.2 Third-party data sources

Third-party data sources.

This is their data coming in, not your data going out. We ingest and cache public and licensed datasets so that the map has something on it: Ordnance Survey Open Names, Office for National Statistics ward and borough boundaries (Open Government Licence v3.0), Overture Maps, OpenStreetMap and Overpass, Wikidata, Wikimedia Commons and Wikipedia, data.police.uk (Open Government Licence), the Met Office (weather warnings), Yelp (opening hours), toiletmap.org.uk, and Transport for London (including line status).

Services we call while you are using a feature. These are not sources we ingest from and they are not processors acting on our instructions — we send a coordinate or a query and get public information back. Transport for London receives your coordinate to return nearby stops, live departures, bike docks and disruptions. Open-Meteo receives your coordinate to return the weather where you are. Mapbox receives an address or place name you type when you search or ask the assistant to find somewhere, with a nearby point to rank the results, and the coordinate of where you are when the app looks up your street address. None of them receives an account identifier or anything that names you.

Place photos from Foursquare. Photos of places in the app may come from Foursquare. When the app shows one, your device loads the image directly from Foursquare’s servers, which means Foursquare Labs, Inc. receives your device’s IP address and the usual technical information any website receives when it serves an image. We store only Foursquare’s reference number for the photo, never the photo itself. Foursquare decides independently what it records; it is not acting for us when it does.

Photos from Wikimedia Commons. Some photos of places and landmarks in the app come from Wikimedia Commons. When the app shows one, your device loads the image directly from the Wikimedia Foundation’s servers, which means the Wikimedia Foundation, Inc. receives your device’s IP address and the usual technical information any website receives when it serves an image. We store only a link to the photo and to its credit page, never the photo itself. The Wikimedia Foundation decides independently what it records; it is not acting for us when it does.

Map data shared with Mapbox, if you agree. If you agree, Mapbox also receives anonymous map usage and location data while you use the map, which it uses to improve its maps under its own privacy policy. This is off unless you turn it on. Sentra asks you once, after you allow location, and you can change your answer at any time in Settings. Mapbox, Inc. is based in the United States.

5.3 Disclosures to law enforcement

We may disclose personal data where required by law or where necessary to protect users or others from harm.

5.4 Corporate transactions

If Sentra is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the successor controller, subject to confidentiality obligations and the same protections as this Policy. We will notify users of any change in controller.

Individual location traces are excluded from any such transfer. They are deleted rather than transferred. Only data that has been aggregated to the threshold in section 3.6 may pass to a counterparty. This holds without exception: section 3.6 says an individual location trace is never made available to a third party in any form, and a corporate transaction does not create one.

Investors are not successor controllers. We do not transfer personal data as part of a financing round, due diligence exercise, or any similar process.

5.5 We do NOT

• sell your personal data;
• share it with advertising networks for profiling or behavioural advertising;
• use it to train third-party AI models;
• share an individual location trace with anyone, including a university, an employer or a council.

6.Advertising

If advertising features are introduced in future, this Policy will be updated accordingly, and we will obtain your consent under PECR before introducing any advertising that uses cookies or device identifiers for tracking purposes.

7.Your rights under UK GDPR

You have the following rights, exercisable free of charge in most cases:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure (“right to be forgotten”) — delete your data, subject to legal retention requirements.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest, including profiling.
• Withdraw consent — at any time, where we rely on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making, where it produces legal or similarly significant effects on you. We will provide human review on request.
• Complaint to the ICO — as shown in section 15.

To use any of your rights, email mda@sentra.city with the subject line “Data request”. You can also delete your Account in the app, in Settings → Privacy & account → Delete account. We will respond within one calendar month (extendable by two further months for complex requests, with notification). We may need to verify your identity before responding, especially for access and erasure requests.

8.International transfers

Our servers are in the UK and the EU (see section 5.1). Some sub-processors (Google, Mapbox and others) may transfer data to the EEA, US, or other jurisdictions for technical reasons (for example, global CDN nodes). Where personal data is transferred outside the UK, we implement appropriate legal safeguards.

Mapbox, Inc. and Netlify, Inc. are in the United States. Both are certified under the UK Extension to the EU–US Data Privacy Framework, and where that does not apply, their terms include the UK’s international data transfer agreement.

9.Retention

We retain personal data only as long as necessary:

• Account data: while your Account is open. When you delete it, it is removed from Sentra at once; copies can remain in server backups until those are deleted.
• Location points recorded by the app: 30 days.
• Pins: until you delete them or your Account.
• Photos and videos you post: until you delete them or your Account. Videos: 400 days after posting at the latest.
• Aggregated and anonymised statistics: no time limit, subject to the threshold in section 3.6.
• Billing and tax records: 6 years (HMRC requirement).
• Legal holds: if data is subject to a court order or active dispute, we retain it until the matter is resolved.
• Marketing consents: until you opt out.
• Security and access logs: kept until our servers rotate them out; we are setting a fixed 30-day limit.

Location points and videos are deleted by a scheduled job when their period ends. If you delete a post, a photo or your Account, it stops appearing in Sentra straight away, and its files are removed from our storage at the next daily deletion run. Copies held in internet caches expire within a further hour.

10.Security

Sentra is a small, early-stage service. These are the measures we have in place today; we will improve them as Sentra grows, and update this section when we do.

• Encryption in transit: connections to Sentra’s app and website use TLS 1.2 or higher.
• Storage: photos and videos are stored with Google Cloud, which encrypts stored data by default.
• Access: access to personal data is limited to a small number of named people.
• Hosting: our servers are in the UK and the EU (see section 5.1).
• Reporting a security problem: email mda@sentra.city.
• Breaches: if a personal-data breach is likely to put people at risk, we report it to the ICO within 72 hours of becoming aware of it, as the law requires, and we tell you directly if the risk to you is high.
• Privacy assessments: we assess the privacy risks of new features (data protection impact assessments) and review them when a feature changes.

No system is completely secure.

11.Children

The Service is not directed at children. If you believe an individual under 18 has used the Service, contact mda@sentra.city and we will delete the account and associated data.

12.Cookies and similar technologies

Apart from Mapbox map telemetry, which reads and stores information on your device only if you agree (section 5.2), the Sentra app does not use tracking, analytical or third-party cookies, pixels or tags. We may use strictly necessary functional cookies or similar device storage (for example, for session continuity, security, and core app functionality). These are exempt from the consent requirement under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 (PECR).

For the website you are reading now, see the cookie policy.

13.Using Sentra without an Account

The app does not have an anonymous mode at the moment: you need an Account to use it. If we add one, this section will say what we collect when you use it.

14.Changes to this Policy

We may update this Policy. The “Last updated” date at the top will always reflect the current version.

What changed in version 2.6 (15 October 2026):

• Section 5.2 now names the Wikimedia Foundation. Photos from Wikimedia Commons load straight from its servers, so it receives your device’s IP address; we store only a link to each photo and its credit page.
• Section 5.2 no longer lists Mapillary, which Sentra does not use.
• Sections 7, 8, 9 and 10 now say how to use your rights, how long account data and logs are kept, and where our servers are.
• Section 10 now describes our security measures as they are today, and section 2 matches it.
• Correction: section 3.1 now lists what sign-up really collects. There is no password (you sign in with an email link, Google or Apple), and the age check uses your date of birth on your phone only.
• Sections 2 and 13 no longer describe an anonymous mode, which the app does not have.
• Location (section 3.2) now says exactly when we read your location, including in the background while you follow a route; that location points are deleted after 30 days; and what we keep from each walk.
• Section 3.2 says what a shared picture of a walk shows.
• Section 3.2 now describes “Walk with me” shares, which contain no location, and how long we keep them.
• New: the walk journal (section 3.2), which stays on your phone.
• Correction: photos and videos (sections 3.3 and 9). Earlier versions said content you submit is deleted after 90 days. That was not true for photos and videos: they were kept until deleted, and on account deletion the files were not removed from storage. They are now kept until you delete them or your Account, videos at most 400 days.
• Section 3.5 no longer gives a deletion period for website enquiries that we were not applying.
• Section 5.2 adds the Met Office (weather warnings) and Wikipedia (landmark introductions) as sources and mentions Transport for London line status.
• Section 5.1 now names Netlify, which hosts our website and its forms.
• Section 5.1 names Hetzner, which hosts the servers for test versions of the app.
• Correction: Mapbox (section 5.2). Mapbox also receives your coordinate when the app looks up your street address, and a nearby point with searches. Earlier versions mentioned only what you type.
• New: Mapbox map telemetry (sections 5.2 and 12), off unless you agree.
• Section 9 gives a fixed period for location points, pins, and photos and videos.
• Section 9 now explains how deletion works when you delete something yourself.
• Section 4 explains in plain words what we mean by a profile of how you walk.
• Section 8 now says how transfers to Mapbox and Netlify are protected.

What changed in version 2.4 (1 October 2026): section 5.2 now names Foursquare Labs, Inc., which may supply photos of places in the app. When a photo loads, your device fetches it straight from Foursquare, so Foursquare receives your device’s IP address. We store only the photo’s reference number. Section 5.5 now says “including a university, an employer or a council” (it said “your university”). Version 2.3 is dated 25 September 2026 but was published on 1 October 2026; version 2.2 applied until then.

What changed in version 2.3 (25 September 2026): privacy requests and questions now go to mda@sentra.city. Mail to legal@sentra.city was not being delivered. If you wrote there and it bounced, please resend to mda@sentra.city. Nothing else changed.

What changed in version 2.2 (21 September 2026):

• Section 3.5 adds two rows: the website’s enquiry forms (partners, and work with us) and the launch waitlist, with the purpose, retention period and lawful basis for each. Enquiry-form messages rely on our legitimate interests and on steps taken at your request before any contract; the launch waitlist relies on your consent, which you can withdraw at any time.
• Section 5.2 previously said the Service did not ingest data from third-party sources. That was wrong, and it had been wrong for some time. It now names the datasets we actually ingest and cache, and the undertaking attached to the old sentence — that the Policy would be updated if this changed — has been removed along with it.
• Section 5.2 now also names the services we call outbound while you use a feature. The old text described third-party involvement as purely inbound (“their data coming in, not your data going out”), which was wrong in the direction that matters most to you. Transport for London and Open-Meteo each receive your coordinate; Mapbox receives an address or place name you type when you ask the assistant to find somewhere. None of them receives an account identifier or anything that names you.
• Section 5.1 adds five sub-processors that were operating but not listed: Anthropic (the concierge, which processes messages you write, your location and photographs you send — the most significant of the omissions), Apple, Firebase Crashlytics, Firestore and Resend.

What changed in version 2.1 (3 August 2026):

• Section 3.2 now describes location processing in terms of the spot walking features — the daily shared destination, cap pickups and the two-sided co-walk streak — instead of the earlier feature set. The permissions, the controls and the retention position are unchanged.
• Section 3.6 states the aggregation threshold explicitly as k ≥ 5 and adds that individual location traces are never sold or shared.
• Section 4 states expressly that no gait template or movement fingerprint is built.
• Section 5.4 now excludes individual location traces from any corporate transaction: they are deleted rather than transferred, and only data aggregated to the section 3.6 threshold may pass to a counterparty. Financing rounds and due diligence are removed from the clause entirely — an investor is not a successor controller. This narrows what we may do with your data; it does not widen it.
• Section 9 clarifies that deletion runs on a schedule.

15.Contact

• Privacy and data subject requests: mda@sentra.city
• Postal: 92 York Street, London, England, W1H 1QX, United Kingdom

If you have a complaint that we cannot resolve, you have the right to lodge it with the Information Commissioner’s Office (ICO): ico.org.uk, or call 0303 123 1113.