OSMAnd is listed as a PG Navigation recommendation. It has wonderful capabilities, integrating openstreetmaps & allowing offline navigation. Ive very much enjoyed using it
However, the number of ‘regions’ one can download locally is paywalled at 7, after which an account & paid subscription is required
The account itself is no tremendously offensive privacy breach, requiring only an email. The subscription payment portal additionally asks for a card, name, and zip code
With this paid subscription automatically comes a cloud backup & sync tool, called OSMAnd Cloud. This tool seems to automatically back up your map data to a cloud server.
If given the choice, you may be tempted to opt out of the cloud service entirely. But it seems to be unavoidably bundled with the subscription. Network permissions can be revoked most of the time, but they will need to be reenabled to download new maps, thus reestablishing a connection
The OSMAnd privacy policy claims to delete all individual data from their servers within 7 days of user request, and all account data immediately upon account deletion. I can find no evidence this infrastructure has been audited to verify this policy is being followed, nor details regarding encryption or cyber security practices.
There is a lower subscription tier, called ‘Maps+’. It does not nominally necessitate OSMAnd Cloud, but it claims to include ‘Favorite Location Syncing’. I am unable to confirm whether or not this stores location data to a remote server
To summarize: in order to download more than 7 maps onto the PG-recommended OSMAnd, your app needs to connect to a cloud server that wants to back up location data. An account is needed, PII is collected. I cannot find technical specs on this cloud service, I cannot verify it is private & secure. I see no evidence of an audit. While the app itself is reviewable on GitHub, the cloud infrastructure does not appear to be FOSS. Is this cause for concern?