FFF Privacy Policy

Effective date: 26 July 2026  ·  Updated for photos, posts and the live map

FFF is a game about claiming real ground. To draw your route and work out which hexagons you crossed, the app has to know where you are. That is a serious thing to ask for, so this page says exactly what is recorded, who can see it, where it is kept and how to erase it. Plain words, no legal fog.

This version adds the parts about photographs. FFF now lets you set a profile picture, add your own photos of the vehicles in your garage, and post to a shared feed. Photographs carry more about a person than they look like they do, so there is a whole section below on exactly what happens to an image between the moment you pick it and the moment somebody else sees it. The rules on what may be posted, and what happens when you report something, are on the Terms of Use page.

It also covers the live map, which shows other players as a rough district rather than a position, and the one thing that can now travel with that dot if you ask for it: your live speed. Both are off until you switch them on, and both are described in full under “What other players can see”.

The short version

• There is no sign up. No email, no password, no phone number.
• Your location is recorded while an activity is running. You start it — or, if you have turned auto-tracking on, FFF starts it when it detects you are driving and tells you it has.
• Photos are only ever read when you pick one yourself. FFF never scans your photo library and never opens the camera on its own.
• Every photo you upload is rebuilt on the server before anyone sees it, which destroys the hidden data your phone wrote into the file, including the GPS coordinates of where it was taken.
• Other players see your display name, your handle, your colour and the hexes you hold. They never see your route line and never your start point.
• The live map is off until you switch it on. With it on, other players see a rough district you were recently in — about 2.5 km across, never your exact position — and it disappears 15 minutes after you stop. Your speed is a second, separate switch, also off, and it is live only: no finished drive ever shows a speed to anyone.
• Nothing is sold. No ads, no ad networks, no tracking SDKs, no third party analytics.
• You can erase everything, on your phone and on the server, from Settings in two taps.

Who is responsible

FFF is built and run by one independent developer, Safak Gungor, based in Istanbul, Türkiye. That person is the data controller. Write to fff.turf.app@gmail.com about anything on this page and a human will answer.

What FFF stores

This is the whole list. Nothing outside it is collected.

• Precise GPS coordinates, but only during an activity. Between GO and Finish the app records latitude, longitude, a timestamp and a speed reading a few times a minute. This is what draws your route line, measures your distance and decides which hexes you crossed.
• Derived hex cell ids. Each recorded point is turned into an H3 resolution 9 cell id, an area of roughly 0.1 square kilometres. These ids are the game itself. They live on the server so rivals can see who owns what.
• Your display name and your handle. You choose both when you first open the app. They are visible to strangers, so pick something you are happy for strangers to read.
• Vehicle details you type into the garage. Type, year, make, model and an optional nickname. Free text, typed by you, used to tag activities and to print a line on a share card.
• An anonymous per install device id. A random string your phone generates the first time FFF opens. It is how the server knows which territory is yours without knowing who you are. It is not your Apple ID, not your advertising id and not your phone's serial number. Delete and reinstall the app and you become a brand new player with no history.
• An Expo push token, only if you turn notifications on. This is the address your phone gives us so a steal alert can reach it.
• Activity summaries and game state. Distance, duration, average and top speed, hexes claimed, hexes stolen, XP, level, streak, badges, personal bests and your weekly totals.
• Photographs you choose to upload. A profile picture, extra photos of the vehicles in your garage, and photos attached to feed posts. Only the images you pick, one at a time, only when you tap to pick them.
• Feed posts you write. The text of the post, up to 500 characters, the time, and the numbers from the activity if you posted one: distance, duration, hexes claimed, hexes stolen. Never a route line, never a start point, never a speed.
• Your bio, if you write one. Up to 140 characters of free text on your public profile.
• Likes. Which posts you liked, so the count is right and so you are not shown the same thing twice.
• Moderation records. For every image and every piece of text: whether it was approved or rejected, when it was checked, and the score the automatic check returned. This is what makes a 24 hour review promise something we can keep rather than something we can claim.
• Reports you send about another player, a post or a photo. What you reported, the reason, your optional note, your device id and the time. See the Terms of Use for what happens next.

Two more things worth being clear about. The point-by-point line of a drive never leaves your phone — not while you record, and not when you tap Finish. What is sent when you finish is one coordinate for each hexagon you claimed, plus the totals for the drive. And when the map opens, the app sends your current position so the server can send back the territory around you; that position answers the question and is not kept as a location history.

What FFF does not collect

• No email address, no password, no phone number, no date of birth.
• No contacts, no calendar, no microphone. Your share card is drawn on your phone and handed straight to the iOS share sheet.
• No access to your photo library beyond the single image you pick. iOS hands FFF that one file and nothing else. FFF cannot see the rest of your library, cannot count it, cannot search it and never asks for permission to add to it.
• No camera in the background and no camera during an activity. The camera opens only on the screen where you tapped to take a picture, and closes when you leave it.
• No face recognition, no object recognition beyond the safety check described below, and nothing you post is used to train any model, ours or anybody else's.
• No advertising identifier and no IDFA. FFF does not track you across other apps or websites, which is why you never see the App Tracking Transparency prompt.
• No third party analytics, no crash tracking SDK, no attribution SDK, no ad networks.
• No selling, renting or trading of your data. Not now, not later. If that ever changed it would need a new policy and a new agreement from you, and FFF has no plans to change it.

Background location

Auto-tracking is off until you turn it on, and it is free to turn off again at any time. With it off, FFF uses your location only between GO and Finish, exactly as before.

With it on, FFF does three things and nothing else. It remembers the spot where you parked and asks iOS to tell it when you leave that spot — this uses the phone's low-power location hardware, not GPS. When you leave, it takes rough, network-grade position readings for up to six minutes to work out whether you have actually started driving. If you have, it records the route the same way a manual drive is recorded, and it stops by itself when you have been stopped for three minutes. The blue location indicator in your status bar is on for every second of this. If it is off, FFF is not using your location.

Letting an app use your location in the background can noticeably reduce battery life.

Your route never leaves the phone. What is sent is one coordinate per block you claimed, and the totals for the drive — the same data a manual drive sends.

Photos and posts

This is the whole journey of an uploaded image, because the details are the point.

• You pick it. iOS shows its own picker or its own camera. FFF receives exactly one file and has no other view of your library.
• It is uploaded to a private holding area. Not a public address, not a guessable one, and not readable by any other player or by anyone holding the key that ships inside the app.
• It is rebuilt, not copied. The server decodes the pixels and writes a brand new image file from them. That is what actually destroys the metadata a camera writes into a photo: the GPS coordinates of where it was taken, the date, the device model, the serial number, the thumbnail and the maker notes. The rebuilt file carries none of it. The original is deleted the moment the rebuild is written, and never later than 24 hours.
• It is checked before it is published. An automated safety check runs on the rebuilt image. Anything that fails is never shown to anybody. Passing is not approval, and a human can remove an image at any time afterwards.
• Only then is it served. The published file sits at a long random address that cannot be guessed or enumerated, and it is only ever shown inside FFF, to the people you posted it to.

The same path is used for profile pictures, for the vehicle photos you add yourself and for photos attached to feed posts. Photos of a vehicle that FFF drew for you, rather than photographed, are not user content and are not covered by this section.

Two warnings that no amount of engineering can remove. Stripping the coordinates from a file does not strip the driveway out of the picture: if the background of your photo shows where you live, people can see where you live. And once an image has been shown to other players, some of them will have it on their phone, or a screenshot of it, and deleting it from FFF cannot reach that. Post accordingly.

What other players can see

FFF is one shared map, so some of your data is meant to be seen. Every player can see your handle, your display name, your colour, and where you stand on the global leaderboard for distance, time, rides and ground held. Players who drive in the same district as you additionally see you on the local board. Players near you can see the hexes you currently hold. You can hide yourself from every leaderboard at any time in Settings — your own rank stays visible to you. When you take a hex from someone, they get a notification naming your handle. That is the game.

To work out which district you compete in, we store one coarse area identifier per player, about 20 km across, derived from territory you have already claimed. It is never shown to anyone, including you, and it disappears when the territory it was derived from ages out after 90 days.

On top of that, anything you deliberately publish is public to other players: your profile picture, your bio, the photos you add to your garage, and every feed post you make with its text and its photo. Treat all of it as visible to strangers, because it is. You can delete any post or photo you have made, at any time, from the item itself, and it disappears for everyone.

The live map

The live map is opt-in and starts off. Nothing below happens on an account that has not switched it on, and switching it off removes what was published immediately rather than waiting for it to expire.

Nothing is published unless you press Check in. There is no automatic check-in and no setting that creates one: the app does not put you on the map when you open it, when you start driving, or on any timer. One press publishes one district for fifteen minutes and then it lapses on its own. To be seen again you press it again.

• What is published is a coarse area identifier — a district about 2.5 km across — and never your coordinates. Other players see a dot drawn at the fixed centre of that district, which is the same place every time and moves only when you move to a different district.
• It is only published where you have already claimed territory, it is withheld inside any home area you have marked or that FFF has learned, and it disappears 15 minutes after you stop.
• You choose who it goes to: anyone nearby, or friends only. Seeing other players is a paid feature; being seen is not, and the app always tells you how many people can currently see you.
• Your live speed is a separate switch, and it is also off until you turn it on. With it on, a whole number in km/h or mph is published alongside your dot while you are checked in and recording, to exactly the people who can already see that dot. It lives with the dot and goes when the dot goes. A recorded speed from a finished drive is shown only back to you, on your own summary and share cards. It is never sent to another player and nothing in FFF is ranked or scored on it.

Other players cannot see your route line, your individual GPS points, your address, your start or end point, your exact position, your garage or your activity history.

Ghost Mode, in Settings, hides your handle, your colour and your territory from other players' maps and from the nearby list while it is on. Your own recording carries on as normal and your hexes still count for you.

Where your data lives

• The database is Supabase, a hosted Postgres service. The FFF project runs in Supabase's European Union region in Frankfurt, Germany. Supabase acts as our processor and does not use your data for its own purposes.
• Push notifications go through Expo's push service, run by 650 Industries, which hands the message to Apple's Push Notification service for delivery. Both see the push token and the text of the alert, which is why alerts say things like "someone stole 2 of your hexes" and never anything private.
• Apple runs the App Store. If you subscribe, Apple handles the payment and tells us only whether a subscription is active. Your card details never touch FFF and are never visible to us.
• Subscription state is checked through RevenueCat, which receives an anonymous subscriber id and the receipt Apple issues. It never receives your location, your handle or your territory.
• The developer is based in Türkiye and reaches the database from there. Expo and Apple may process the push token outside the European Economic Area. Those transfers rely on the standard contractual clauses those companies publish.

How long it is kept

• The only coordinates we store are the one per hexagon you claimed. They live with that hexagon and go when it does, on the schedule below. The point-by-point route of a drive is never uploaded, so there is nothing else to delete.
• Hex ownership follows the game clock. A hex lives 7 days, plus 3 days for each of up to 3 reinforcements. When it expires it rots into a grey ruin owned by The Rust and anyone can reclaim it. Expired ownership rows are cleared 30 days later.
• Your profile, handle, garage, totals and badges stay for as long as you keep playing, and are deleted 18 months after your last activity if you never come back.
• Your push token is deleted as soon as you turn notifications off, or when Apple tells us the token is dead.
• Photos you have published stay up until you delete them or delete your account. Deleting a photo removes the file itself, not just the row that points at it.
• The file you originally uploaded, before it was rebuilt, is deleted as soon as the rebuilt version exists, and swept away within 24 hours in every case, including uploads that failed halfway.
• A photo or a post that was rejected by moderation, or removed after a report, is kept for 30 days and then deleted. That window exists so a decision can be appealed, and it is deliberately too short to become a library of rejected pictures.
• Feed posts and comments you delete are removed from view immediately and hard-deleted 30 days later.
• Moderation records, meaning the outcome and the timestamp rather than the image, are kept for 90 days after the case is closed.
• Reports and the notes attached to them are kept for 12 months so repeat offenders can be spotted.

Deleting everything

Open Settings and tap "Delete my account and data". One confirmation, no email, no waiting. It removes your profile, your handle, your display name, your bio, your garage, every activity and every GPS point, your push token and your device id from the server, and wipes the copy held on your phone. The hexes you held are released and become grey ruins for someone else to take.

Your photographs go with it. Your profile picture, every vehicle photo you uploaded and every photo attached to a post are deleted from storage as files, not merely unlinked, along with the posts, comments and likes they belonged to. Nothing of yours is left behind for another player to open. Two honest exceptions: an image already saved or screenshotted by another player is beyond our reach, and encrypted backups of the database age out on their own schedule within 30 days.

There is no login, so there is no way to bring any of it back. Deleting the app from your phone on its own does not delete the server side, so use the button first if you want a clean exit.

If the app will not open, email fff.turf.app@gmail.com from any address with the device id shown in Settings under About, and it will be deleted for you within 30 days.

Your rights

Depending on where you live, you have the right to ask for a copy of your data, to correct it, to have it deleted, to take it elsewhere in a readable file, and to object to how it is used. Because FFF holds no email address and no account, requests are matched to the device id in Settings under About. Send it to fff.turf.app@gmail.com and you will get an answer within 30 days. If you are in the European Union or the United Kingdom you can also complain to your local data protection authority. If you are in Türkiye you can apply to the KVKK.

Children

FFF is not built for children. Do not use it if you are under 13, or under the age of digital consent where you live, which is 16 in some European countries, unless a parent or guardian agrees on your behalf. We do not knowingly keep data from children under those ages. If you believe a child is using FFF, email fff.turf.app@gmail.com and the account will be deleted.

Content other people can see, and how it is policed

Handles, display names, bios, posts and photographs are written or taken by players and shown to strangers. Text is filtered when it is created. Images are checked automatically before they are ever published. Anything at all can be reported by anyone, from the item itself, in two taps, and any player can be blocked instantly and silently from their profile sheet.

Every report is reviewed and acted on within 24 hours. Content that breaks the rules is removed and repeat offenders lose access to the shared map. Reporting, blocking and deleting your own account are free for everybody and are not part of any subscription. The full rules are on the Terms of Use page.

Security

The app talks to the database over HTTPS. Writes go through restricted server functions rather than open access to the tables, and the key shipped inside the app cannot read or change another player's rows. No system is perfect, and if a breach ever affects your data you will be told in the app and the relevant authority will be notified.

A word about moving

Nothing in FFF rewards speed. Territory, distance, streaks and comebacks are the whole scoreboard. Start your activity before you set off, put the phone in a mount or a pocket, and leave it alone until you stop. Obey the road. No hex is worth it.

Changes

If this policy changes, the new version appears here with a new effective date, and anything that meaningfully changes what is collected or who sees it will be shown in the app before it takes effect.

Contact

fff.turf.app@gmail.com. One person reads it.