Drink Buddy

A record of where the year happened, not a picture of where you are

The map tab reads as a tracking feature and is the opposite of one. Nothing runs in the background, nothing broadcasts, and in the default mode no coordinate is written down at all — the map still works, showing you your own year, with nothing stored about anybody.

Captured once, when you press the button

The only moment a location is read is when you open a check-in. The app is in the foreground, you are the one who started the flow, and one reading is taken and cached for the rest of it.

Nothing happens outside that window. There is no background permission in play, no periodic wake-up and no transport that would carry a position anywhere between check-ins. The photographs do not carry it either — location metadata is removed on the device before upload, so the image cannot become a second, unfiltered copy of the coordinate.

Four modes, and what each one writes

The mode is a single setting on your account rather than a question asked at each check-in.

Mode	Device captures	Server stores	Who can read it
Ghost — the default	No	No	Nobody. No capture, no write, no row
Only me	Yes	No	Nobody
Friends	Yes	Yes	Every accepted friend, blocks excluded
Selected	Yes	Yes	An allow-list that is always a subset of friends

Why the default writes nothing

Four reasons were recorded, and one rejected alternative is recorded alongside them.

Nothing is written, so nothing can leak.: The strongest privacy guarantee available is the absence of a row. Every other mode is a promise about access control; this one needs no promise.
The map still works.: It is not a degraded state with a feature switched off. The tab functions and shows you your own history; it simply has nothing of yours stored on the shared layer.
The cost of the two errors is wildly asymmetric.: An accidental over-share is unbounded and irreversible. An accidental under-share costs one tap. Defaults belong on the side of the recoverable mistake.
The alternative was considered and rejected by name.: Defaulting to friends so the map would feel alive at launch was explicitly turned down, on the reasoning that seeding engagement with a privacy default the user did not choose is the failure mode behind every location-sharing scandal of the last decade.

The screen that was refused

A natural feature request here is a log of who looked at your locations. It does not exist, and no access telemetry is collected at all.

The reasoning is that a log of who watched whom is itself a surveillance record, and holding one indefinitely accumulates risk faster than it provides protection. A viewer-history screen built on that log would be the stalking tool the telemetry was meant to detect.

The cost is stated plainly rather than buried: if someone reports being followed, there is no data to investigate with. The product will not build a surveillance record in order to detect surveillance.

Where this page stops

Each of these is answered elsewhere, or deliberately not answered.

How visibility works for everything that is not a location, which is the friends-only model in general.
What a block does to location specifically. It overrides every mode, and the mechanics live with blocking.
Whether venue pages or a business dataset will ever exist. This is not a venue product and no such plan is recorded.
How accurate the pin is in practice. A balanced accuracy class is requested; the actual figure depends on the device and the sky, and no number is claimed here.

Questions

Does the app track me in the background?

No. Background location and live location were removed by decision. A coordinate is read only when you open a check-in, with the app in the foreground, and nothing is captured between check-ins.

Can my friends see where I am right now?

No. There is no presence feature of any kind. The map shows past check-ins, so the most recent thing anyone can see is somewhere you already published.

What does the app store if I leave location off?

Nothing. In the default mode no fix is requested, no value is written and no row exists — there is no record to protect, share or delete later.

Can I see who looked at my locations?

No, and no such log exists. The reasoning is that a record of who watched whom is itself a surveillance record; the accepted cost is that there is nothing to investigate with if you are being followed.