This is the same document that ships inside the Milepost app — no shorter, and worded identically.
Privacy Policy
Milepost has no account and no sign-in. Your letters have no server — everything you write exists only on this phone, unless you switch on iCloud backup or export something yourself; the anonymous counts are sent to our statistics endpoint.
What stays on this phone
Everything you write. Letters, recipient names, stationery choices, the note you add after opening a letter, and your postcard collection are stored only in this app's local database on this device. None of it is uploaded anywhere — unless you turn on iCloud backup, or share or export something yourself. Both of those are your own doing, both are described below, and neither one sends anything to us.
iCloud backup (optional, Pro)
Backup is off until you turn it on. It is part of Waystation Pro, it is never switched on for you, and while it is off nothing in this section happens at all — the app works exactly as it always has.
When you do turn it on, Milepost writes an encrypted snapshot of your letters and your collection into your own iCloud Drive — the app's private container, which belongs to your Apple Account (iCloud.com.topxup.milepost), not to us. It is encrypted on this phone before it is written, and the key is kept in your iCloud Keychain, where only your own devices can reach it. There is no Milepost server anywhere in this. Nothing is sent to us and nothing passes through us; we cannot open that file, and we could not read your letters out of it if we tried.
Nothing comes back without you asking. A backup is restored only when you tap Restore — on this phone, or on a new one after you sign in with the same Apple Account.
You can take it back at any time. Turning the switch off stops any further backup and removes the snapshot; the file is also yours to delete directly, in the Files app under iCloud Drive, like anything else you keep there.
Sharing and exporting
A few things are meant to leave the app, but only ever because you asked: the share card for a journey, the yearly footprints poster, and the PDF letter book of letters you have already opened. Milepost does not send them anywhere. The file is made on this phone and handed to the iOS share sheet at the moment you tap share; after that it goes wherever you choose to send it, and what happens there is between you and the app you picked. A sealed letter is never in any of them: while a letter is still walking, it appears in no export, no poster and no PDF.
Steps
With your permission, Milepost reads your daily step count through Apple's motion sensor (CoreMotion). It is used for one thing: moving your letters forward at 1,000 steps per mile. It is never used for advertising, never combined with anything else, and never leaves this device. Milepost does not request Health data or your location. If you decline, the app stays fully usable — the waystations carry your letters slowly instead.
Anonymous counts
To know whether Milepost is working for the people using it, the app records anonymous usage counts — that a letter was sealed, that one arrived, that one was opened, that the waystation screen was seen. These counts are the only thing Milepost ever sends.
What actually leaves the phone is an event name and numbers: a short label such as “a letter was sealed”, the distance bracket it was sealed at, which of the built-in papers and wax colours were chosen, how many miles were walked that day. Never the letter. Never a recipient's name. Never a single character you typed. Free text cannot get into the payload at all — the app can only send labels from its own fixed list, so there is no path for your words to reach it.
Each count carries a rotating session identifier: a random string that is replaced after 30 minutes without activity. It is not linked to your identity, not derived from your device, and does not follow you anywhere. It exists for one purpose — so that several counts from one evening are not read as several different people returning.
These counts are on by default. Nothing at all is sent before you have finished the introduction on first launch, and you can turn them off at any time in Settings.
You can switch this off whenever you like, in Settings → Anonymous counts. Switching it off stops all sending completely: nothing is queued, nothing is held back, and nothing is sent later if you switch it on again.
No third parties
The statistics endpoint is our own. There are no advertising SDKs, no analytics SDKs, no trackers, no data brokers and no social logins in this app, and nothing about you is ever sold or shared.
Deleting your data
Deleting the app removes everything it stored. There is no copy of your letters elsewhere for us to delete, because one was never made. If you would like the anonymous counts to stop as well, turn the switch off before you delete the app.
If you had switched iCloud backup on, deleting the app does not delete that backup — it sits in your iCloud Drive, not ours. Turn the backup switch off first, or delete the file from iCloud Drive afterwards.
Who publishes Milepost
Milepost is written and published by WANG WENJIE. Questions about privacy go to Fuuqiu@gmail.com and are read by that person.
Effective 2 September 2026.