No account, no ads, no analytics
Three absences, stated and designed in: nothing to sign up for, nothing to display, nothing to track. What the app stores, what it sends, and why the privacy is fixed by design instead of by settings.
Published on 3 min read
Every privacy policy on the internet says the same first sentence: "We only collect what we need." This one is shorter: there is nothing to collect into. Sea Level has no account, shows no ads, and runs no analytics. Those are three features, and this post is about each one, because building a product where the absence is structural is more work, and more unusual, than the paragraph implies.
No account
No account means no server holding a profile, no password to leak, no emails to send, no "we have reset your password" phone calls. It also means there is no way to sync your map pages between devices, and the app gives that up on purpose, because the thing you would sync, your location history and your personal flood map, is the most sensitive data the app ever touches. The trade is stated plainly in the app store description: local device, no cloud, no backup of your readings.
This is the decision that keeps every other one cheap. With no account, there is no reset flow to build, no abuse choreography to police, and no reason to encrypt a database when there is no database.
No ads
An ad-supported app needs engagement; Sea Level has nothing that needs to be sold on its back. The absence shows in the two places ads usually live. There is no ad SDK compiled in, so there is no third-party tracker process in either app store's privacy label. And there is no "designed to keep you scrolling" screen, because attention does not pay any bill in this project. The only screen with a strong pull is the map, and its pull is the scenario, not a thumbnail feed.
No analytics
This is the one people find hardest to believe, so let it be concrete. Analytics SDKs are how most apps learn which screens people abandon, and Sea Level gave them up and kept the question they answer in another form: the app is small, the feedback loop is the contact inbox, and the roadmap is public enough that a question is as good as a dashboard. What that buys is real: no analytics means no tracking identifiers, no crash-reports-with-location attached to a session, no behavioral fingerprint that the store's privacy labels then have to describe in three paragraphs of legalese.
The measurement is not the point, and it never was.
What the app does store
The honest counterpart to the three absences is the short list of what exists. A local cache file holds the recent coordinates used to compute elevation, and the results sit on the device until you clear the app cache or uninstall. When warnings are enabled, a session checks your position, caches the result, and stops within two hours. The only request that leaves the device is the pair of coordinates sent to the open elevation service, and the privacy policy says exactly that, in the same order as this post.
Why it stays that way
The three are not features you can add to and keep: each one, once invited in, carries the next. An account invites billing and sync and their whole support surface. An ad SDK invites a data broker and its consent dialogs. An analytics library invites a dashboard you will then want to enrich. Keeping all three out at the start, when the app is small, is the only point in the lifecycle where it is free. That is the whole design note.