Privacy Policy
This policy explains what data Golub – location simulator for Android ("Golub", "the app") processes, why, and the choices you have. It also covers this website, golub.app.
Who is responsible
The controller is the developer of Golub, as listed on the app's Google Play page ("we"). Contact: support@golub.app.
The short version
- No account. Golub has no sign-up and no login.
- Your places stay on your phone. Favorites, collections, history, routes and schedules are stored only on your device.
- No location in analytics. Usage statistics never include coordinates, place names, collection names or addresses.
- Ads only when you choose. Golub shows a video ad only when you choose to watch one to recharge Energy. Premium removes ads.
- We don't sell your data.
- Some features need Google services (maps, search, routes, purchases, ads). Those services receive the data needed to work, as described below.
Data stored only on your device
| Data | Purpose |
|---|---|
| Favorites, collections, recent places and search history | Get back to your places quickly |
| Saved and recent routes (including imported GPX files) | Replay and edit routes |
| Schedules | Start or stop a location at the times you set |
| Settings and app state (joystick, speeds, Energy balance and similar) | Remember your preferences |
This data is stored in the app's private storage, is excluded from Android cloud backup, and is deleted when you clear the app's data or uninstall it. We have no copy of it.
Your real location. If you grant location permission, the app uses your real position on the device, for example to show where you are on the map. It is not sent to us.
Simulated location. The location you choose to simulate is handed to Android's mock location system on your device. It is not sent to us, except the route points described under "Routes".
Data processed by services the app uses
Maps — Google Maps SDK for Android
To display the map, the app downloads map tiles from Google. Google receives technical data such as your IP address, device information and the map area being displayed. Google Privacy Policy.
Place search — Google Places API
When you search for a place, the text you type, a random session token and, when you pick a result, its place ID are sent to Google to return suggestions and the place's coordinates.
Routes — Google Routes API and our routes proxy
When you create a route on real roads, the app sends the route's start, destination and stop coordinates (up to 9 intermediate points), the travel mode, your language and unit setting to compute it. The request goes either directly to Google's Routes API or through our routes proxy, a Google Cloud Function we operate in the EU (europe-west1). The proxy:
- accepts the request only with a valid Firebase App Check token (see below);
- forwards only those fields to Google and returns the route to your device;
- does not store the coordinates. It writes a log entry only when Google returns an error (the status code and the first 500 characters of Google's error message);
- like every Google Cloud service, produces standard request logs (time, IP address, user agent, response status), kept for 30 days.
GPX files you import are read on your device and are not uploaded.
App usage statistics — Google Analytics for Firebase
We use Firebase Analytics to understand which features are used and to fix problems. It collects events such as starting or stopping a simulation, using a feature, opening the paywall, purchase and ad events, and short error codes, plus device and app information (model, Android version, language, approximate country derived from the IP address), an app-instance identifier and, where allowed, your device's advertising ID. The app removes coordinates, place names, collection names and addresses before any event is logged. Retention: up to 14 months.
Configuration — Firebase Remote Config
The app downloads settings (for example feature limits) from Firebase. This uses a Firebase installation ID.
Notifications — Firebase Cloud Messaging
To deliver notifications, Firebase assigns your device a messaging token. We don't store it on our own servers. You can turn notifications off in Android Settings › Apps › Golub › Notifications.
Abuse protection — Firebase App Check with Play Integrity
To make sure requests (such as routes) come from the genuine app installed from Google Play, the app obtains an App Check token using Google Play Integrity, which evaluates device and app integrity signals.
Ads — Google AdMob and the User Messaging Platform
If you choose to watch a rewarded video to recharge Energy, Google AdMob serves the ad. Before ads can be requested, Google's User Messaging Platform asks for your consent where the law requires it (for example in the EEA, the UK and Switzerland). The ads SDK is only started after that check allows ad requests. AdMob may process your advertising ID, IP address and device information to serve, limit and measure ads, and to personalise them only if you consented. How Google uses information from apps that use its services.
You can change your ad consent in Golub's Settings › Settings › Ad privacy options. You can also reset or delete your advertising ID in Android Settings › Google › Ads (or Settings › Privacy › Ads).
Purchases — Google Play Billing
Premium is sold through Google Play. Google processes the payment; we never see your card details. The app receives the purchase status, product and a purchase token from Google Play to unlock Premium on your device. Purchase events (product, price and currency) are also recorded in Analytics.
To measure subscription renewals, trial conversions, cancellations and refunds, Google Play sends those subscription changes to a Google Cloud Function we operate in the EU (europe-west1). It reads the subscription's status from Google Play and records the change in Analytics under the app's random analytics identifier, never under your Google account or email. For that, from version 1.4 the app passes this random identifier to Google Play at checkout; for a subscription bought earlier, the app sends the subscription's purchase token, product and the same identifier once to that function, which checks them with Google Play and stores only a one-way hash of the token with the identifier.
Reviews and updates — Google Play
The app may show Google Play's in-app review prompt and in-app update prompt. These are handled by Google Play.
Why we process data (legal bases)
- To provide the app's features you ask for, such as maps, search, routes, purchases and notifications (performance of a contract).
- Security and abuse prevention with App Check, and service logs (legitimate interests).
- Usage statistics (legitimate interests in improving the app, or consent where required).
- Ads: consent for personalised ads where required; legitimate interests or consent for non-personalised ads, as set by Google's consent framework.
Sharing
We share data only with Google, acting as our service provider or as an independent controller for its own services, as described above. We don't sell or rent personal data, and we don't share it for cross-context behavioural advertising outside the AdMob consent flow.
International transfers
Google may process data in the United States and other countries. Transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses offered by Google.
Your choices and rights
- Delete on-device data: Android Settings › Apps › Golub › Storage › Clear data, or uninstall the app.
- Location permission: grant, limit to approximate, or revoke it anytime in Android Settings.
- Advertising ID: reset or delete it in Android Settings.
- Notifications: turn them off in Android Settings.
- Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to data portability, and to complain to your data protection authority. Write to support@golub.app. Because Golub has no accounts, we cannot link analytics data to a person; tell us the approximate date and device model so we can look for it, or simply uninstall the app to stop all collection.
Children
Golub is not directed to children under 13 (or the minimum age in your country) and we don't knowingly collect their data.
Security
Network traffic is encrypted (HTTPS). The routes proxy accepts only App Check-verified requests and only the fields needed to compute a route.
This website
golub.app is a static site hosted on Firebase Hosting. It sets no cookies and uses no analytics or trackers. Google, as the hosting provider, processes your IP address and request details to deliver the pages and protect the service. Videos are not loaded until you press play; then the player loads from youtube-nocookie.com and YouTube's privacy policy applies.
Changes
We'll update this page when the app's data practices change and change the date below.
Last updated: 18 October 2026.