The short version
Safestall has no accounts, no tracking, and never stores or shares your location. We use one privacy-first analytics tool to see which features get used — anonymous events that can't be traced back to you, which you can turn off in Settings. If you send feedback on a listing (thumbs up/down), it includes a random identifier so duplicate reports can be recognized — and nothing else about you. Details below.
About Safestall
Safestall is a free, non-commercial iOS app that helps you find safe, gender-neutral restrooms nearby. It's a passion project — there is no business model, no ads, and no monetization.
Location data
Safestall uses your device's location solely to find restrooms near you. Here is exactly what happens with your coordinates:
- Refuge Restrooms — your approximate latitude and longitude (rounded to ~100 m) are sent to refugerestrooms.org to query their restroom database.
- OpenStreetMap (Overpass API) — your approximate latitude and longitude are sent to overpass-api.de to query for nearby gender-neutral restroom nodes.
- Apple MapKit — the app uses Apple's on-device MapKit framework to display the map, to enrich listings with business names and hours via Apple Places, and to load street-level imagery (Look Around) for a listing you select. MapKit requests are handled by iOS itself. Apple's Privacy Policy
- Restroom summaries — to show a short summary of a listing's community notes, the app fetches a pre-computed summary from a read-only Safestall server, sending only the public IDs of the restrooms in your current map area — never your location, identity, or device. If that server is unavailable, supported devices summarize the (already-public) notes on-device instead, and otherwise the original notes show. Nothing about you is collected or stored.
Your approximate coordinates are used in real time and go only to the third-party services above — never stored, logged, or sent to a server we operate. (Our own server, described below, receives restroom IDs, not your location.) No personal information beyond approximate coordinates is ever included in a location request.
When you ask Siri or run a Shortcut, Apple handles your request. Safestall uses your location once, in memory, to answer — nothing is stored or shared, and the app never hands your restroom searches to Spotlight or Siri Suggestions.
No accounts
Safestall does not require or offer user accounts. There is no sign-up, no login, and no profile.
Analytics
Safestall uses a privacy-first, third-party analytics service to see which features people use, so we can improve the app. It records simple, anonymous events — like “opened a listing's detail” or “tapped the map-style toggle.” It never records your location, the restrooms you look at, an account (there isn't one), or anything that identifies you.
The identifier it uses is hashed twice — once on your device, again on the service's servers — so neither it nor we can ever tie events back to you. Its servers are in the EU, and you can turn it off any time in Settings under “Share anonymous usage.”
It's the only analytics SDK we use — no Firebase, Mixpanel, Amplitude, or Segment — and we use no ad networks, attribution SDKs, or crash reporters that collect device identifiers. Apple's built-in App Analytics (anonymous, off by default) may also apply; we have no access to individual-level data from it.
Third-party services
Safestall connects to these outside services. When the app looks up restrooms, each receives only the approximate location described above — no profiles, no personal information.
- Refuge Restrooms — community-maintained open dataset. refugerestrooms.org Privacy info
- OpenStreetMap / Overpass API — open geographic data. overpass-api.de Privacy policy
- Apple MapKit / Apple Places — on-device framework provided by iOS. Apple's Privacy Policy
- Analytics service — a privacy-first, third-party analytics service that records anonymous feature-usage events (described under Analytics above). It receives an event name and a double-hashed identifier that can't be traced back to you — never your location, account, or which restrooms you view. EU-hosted; you can turn it off in Settings.
Our server
Safestall runs one server of its own. It returns pre-computed restroom metadata (short summaries of public community notes, whether a listing is still listed, and a corrected display name), looked up by the public IDs of the listings in your map area. Those lookups send only those IDs and your IP address — no account, precise location, or anything else about you.
If you give feedback on a listing (the thumbs up/down on its detail), the report sends that listing's public ID, your feedback, and a permanent random identifier the app generates, so duplicate reports can be recognized. That identifier isn't your name, account, device ID, or location (there are none of those) — it's the only thing that persists between your reports.
We don't share data with ad networks, data brokers, or anyone else, we don't sell data, and there are no ads. The only data the app sends anywhere is described above.
Accuracy of listings
The restroom listings come from Refuge Restrooms and OpenStreetMap — open databases that real people add to over time. We don't write, own, or check these listings. We just help you find them.
So some of it might be wrong, out of date, or missing. A listing showing up here doesn't guarantee the restroom exists, is open, is accessible, or is safe right now.
Use your own judgment — especially when it comes to your safety. If something feels off, trust yourself over the app.
On-device data
Safestall stores a small amount of data locally on your device using standard iOS storage. None of it ever leaves your device:
- Preferences — settings like your chosen map style and app icon.
- Cached restroom results — recently fetched listings, kept so the app loads faster and works offline.
- Last map position — the area you were last viewing, so the map can open there instantly on your next visit instead of loading from scratch. It's an approximate location, kept only on your device.
- Recent destinations — the last few places you tapped in search (their names and map coordinates), so you can get back to them quickly. You can remove these anytime with the Clear button next to Recent in search.
Deleting the app deletes all of this data.
On-device summaries
On supported devices, Apple's on-device language model may summarize the community notes from a listing's duplicate entries into a short blurb. This runs entirely on your device — the notes (already public Refuge data) are never sent anywhere, and no new data is collected.
Children's privacy
Safestall does not collect personal information from anyone, including children. The app requires only location permission to function and stores nothing about its users.
Consent
Safestall requests location access through the standard iOS permission prompt. You can revoke this permission at any time in Settings › Privacy & Security › Location Services › Safestall. Without location access, the app cannot show nearby restrooms.
Because Safestall does not store your location or any personal data, there is no data to delete. Revoking location permission immediately stops all location use.
Your rights
Because we don't collect or store personal data, there is nothing for us to provide, correct, or delete. If you have questions or concerns, you're welcome to reach out.
Changes to this policy
If this policy changes, the updated version will be posted here with a new date.
Contact
Questions? Reach out: