Location sharing and safety

Location sharing exists so a guide can find the two people who wandered off — not to track a group. It is off for every traveler until they turn it on, it turns itself off, and the one exception runs in the traveler's favor: an SOS always gets through. This page tells you the model straight, because your travelers will ask and you should be able to answer.

The consent model, told straight

• Off by default. Joining a trip shares nothing. There is no setting you or a guide can flip on a traveler's behalf.
• The traveler chooses, from their own phone. On the Share My Location screen they can tap Send my location once, or Share for the next hour — a timed session that expires on its own. (Under the hood, sessions are capped between 15 minutes and 4 hours; the app keeps the choice simple.)
• Positions are last-known, not a live track. While a session is on and the app is open, a new position is sent every 5 minutes. Nothing is sent while the app is closed.
• No background tracking, ever. This is not a setting we hid — it is a thing we did not build, and will not.
• SOS is the exception. From the Emergency screen, a traveler can deliberately send their position once — after an are-you-sure confirmation — even with sharing switched off. The tap itself is the consent.

The live map during a tour

Open a departure and go to its Locations tab. You get a map of whoever is currently sharing, and a list of everyone on the departure with their sharing state. It refreshes itself every 30 seconds, tells you when it last checked, and there is a Refresh now button when you cannot wait. Each shared position says how old it is and how it was sent — shared by them, automatic during sharing, or SOS — and when a session will end.

Because positions ride the same offline-honest machinery as everything else, a traveler in a dead zone queues their pings and the app sends them the moment it is back online — the map shows what it knows and how old it is, never a pretense of "live."

What "Not sharing" means

A traveler who has not turned sharing on appears in the list as "Not sharing — that's their choice, and it's fine." That sentence is the product position, written into the dashboard itself. No coordinates are kept for them, there is no gap where data secretly accumulates, and neither you nor the guide should treat not-sharing as a problem to fix. If you need to know where someone is, the roster has their phone number.

How long location data lives

Thirty days. Every location ping is deleted by an automatic daily purge once it is 30 days old — location data in Cordelle is ephemeral by design, useful during a tour and gone shortly after. Sessions expire on their own well before that; the purge is about the history.

What to tell your travelers

The app already explains itself on the Share My Location screen — off unless you turn it on, your guide sees your last sent position, it turns itself off, nothing is sent while the app is closed. If a traveler asks you directly, those four sentences are the whole truth, and the traveler help page says the same thing in the same plain terms.