Privacy Notice
Updated September 14, 2026
Guest mode
Guest mode lets you browse, record visits and export without an email. Guest records are stored on our server and accessed through an essential cookie in this browser for 30 days after creation. Access ends at expiry and records are removed during subsequent cleanup. Clearing cookies or changing browsers or devices may remove access. You can delete the guest journal in Guest options or choose to import it privately into your account after signing in. Photo uploads and social features require an account.
Data we handle
We handle sign-in identifiers, verified email, your chosen profile, visit dates, notes, images, social connections, companion confirmations, visibility settings and reports. Visit dates are entered by you. The app does not request live device location. Identity and hosting providers may process connection, security and diagnostic data under their own policies.
Purpose and storage
We use these data to provide your journal, synchronize visits, authenticate you, carry out your sharing choices, and handle safety, reports and deletion. App records use the hosting database and object storage; language and appearance preferences use your browser. Supabase handles email authentication when enabled. This version does not sell personal data or use advertising trackers. Processing may occur in the United States or other hosting locations.
Visibility
Visits start private. Public visits are visible to other signed-in visitors with site access; friends-only visits require an accepted friendship. Notes and images have separate sharing choices. A created profile's nickname, handle, avatar and follow relationships can be discovered by signed-in visitors, but your sign-in email is not shown. New invitations explain sharing before sending and confirming. Each person authorizes use of their own avatar and nickname on shared pages and exports for that trip. Older confirmations without sharing permission require that person to confirm sharing. Removing a tag affects future reads and exports, not copies already downloaded.
Photos
The server removes unnecessary metadata such as GPS and author fields from uploaded and served images, retaining essential rendering information. Visible pixels and downloaded copies may still reveal people or places. Review image content before uploading.
Retention and deletion
Records are kept until you remove them or delete your account. Account deletion immediately disables access and removes profile and business records from the active database. Failed object or identity-provider deletion remains queued for operator retry. Minimal disabled-identity markers prevent old sessions from restoring an erased account. Closed reports are cleared at the next maintenance run after 180 days; an account's submitted report text and contact are cleared on deletion. Provider backups and security logs follow provider retention mechanisms and may not disappear immediately.
Your choices
You can edit, export or delete records, change audiences, withdraw tags, block or report users, and delete your account in Profile. Contact support for access, correction, a complete copy or other privacy requests. Applicable statutory rights remain unaffected. This trial is for people aged 16 and older; do not create accounts for children.