Location sharing and safety

Location sharing exists so a guide can find the two people who wandered off — not to track a group. It is off for every traveler until they turn it on, it turns itself off, and the one exception runs in the traveler's favor: an SOS always gets through. This page tells you the model straight, because your travelers will ask and you should be able to answer.

The consent model, told straight

• Off by default. Joining a trip shares nothing. There is no setting you or a guide can flip on a traveler's behalf.
• The traveler chooses, from their own phone. On the Share My Location screen they can tap Send my location once, Share for the next hour — a timed session that expires on its own (under the hood, sessions are capped between 15 minutes and 4 hours; the app keeps the choice simple) — or Share for my whole trip, which asks them to say yes twice: once on a full-screen explanation in the app, and once more to the phone itself, for its "allow all the time" permission.
• Positions are last-known, not a live track. During an hour session, a new position is sent every 5 minutes while the app is open, and nothing once it is closed. During trip sharing, the phone sends a position about every 15 minutes, and only after the traveler has moved about 500 meters — even with the app closed, never more often, never a trail.
• No continuous tracking, ever. Trip sharing is as fine as it gets: the roughly-15-minute pace is a written rule, not a dial, and there is no setting — for you, for us, or for a guide — that makes it finer, turns it into a live track, or switches sharing on for a traveler. That is not a setting we hid; it is a thing we did not build, and will not.
• SOS is the exception. From the Emergency screen, a traveler can deliberately send their position once — after an are-you-sure confirmation — even with sharing switched off. The tap itself is the consent.

The live map during a tour

Open a departure and go to its Where they are tab. You get a map of whoever is currently sharing, and a list of everyone on the departure with their sharing state. It refreshes itself every 30 seconds, tells you when it last checked, and there is a Refresh now button when you cannot wait. Each shared position says how old it is and how it was sent — shared by them, automatic during sharing, or SOS — and when a session will end. Beside each name, pin or no pin, sits what the traveler last said from their app — On my way, Running late or Sitting this one out, with the time — for 12 hours after the tap. It is a fixed choice, not a location: it says nothing about where they are, so it does not depend on sharing being on.

Because positions ride the same offline-honest machinery as everything else, a traveler in a dead zone queues their pings and the app sends them the moment it is back online — the map shows what it knows and how old it is, never a pretense of "live."

What "Not sharing" means

A traveler who has not turned sharing on appears in the list as "Not sharing — that's their choice, and it's fine." That sentence is the product position, written into the dashboard itself. No coordinates are kept for them, there is no gap where data secretly accumulates, and neither you nor the guide should treat not-sharing as a problem to fix. If you need to know where someone is, the roster has their phone number.

How long location data lives

Thirty days. Every location ping is deleted by an automatic daily purge once it is 30 days old — location data in Cordelle is ephemeral by design, useful during a tour and gone shortly after. Sessions expire on their own well before that; the purge is about the history.

What to tell your travelers

The app already explains itself on the Share My Location screen, in four sentences you can read aloud as they stand: sharing is off unless the traveler turns it on; their guide sees their last sent position, not a live track; every way of sharing turns itself off; and the one way of sharing that works with the app closed — sharing for the whole trip — is one the traveler sets up themselves, can see on their own phone the whole time, and can stop with one tap. If a traveler asks you directly, that is the whole truth, and the traveler help page says the same thing in the same plain terms.