Privacy policy

Your location becomes a country inside the phone

With your permission, WhereIAm checks your location a few times a day and whenever the system notices you have moved far enough. That location is turned into a country code inside your iPhone, by comparing it against borders the app carries with it. No connection and no outside service are involved in that step.

Each check stores the country, the time, the kind of signal and roughly how accurate it was. The coordinates are discarded as soon as the country is known: they are not saved, not sent to anyone, and we cannot recover them. The exception is “Keep the route”, which comes switched on and does keep those positions on your iPhone so your year can be drawn; it is spelled out below.

Your photos are never copied or uploaded

With access to your photo library, WhereIAm reads the technical details of your photos, meaning the date, where they were taken and the camera model, to work out which country you were in that day. You choose which cameras count as proof, so only photos taken with your own devices are considered.

Photos are not copied, not duplicated and not sent anywhere. All that remains of the process is the country and the day.

The daily confirmation photo is one you take with the app's camera, and it is kept as that day's proof. Without an account it stays on your iPhone; with an account it is uploaded along with the rest of your evidence, the same as a boarding pass you attach. Its coordinates are stripped before it is stored, so the image does not say where it was taken.

The network check and your IP address

As an optional extra signal, the app can ask our server which country you are connecting from. That request carries no location, no identity and nothing about you: it asks, and it receives a country code.

In any request to a server, that server sees the IP address it came from, and ours is no exception. We do not store it and we do not link it to any user. Our hosting provider, Vercel Inc., may keep it for a limited time in its technical logs, as any web server does.

You can turn this signal off in Settings. The app works without it.

The maps are drawn by Apple

To decide which country you are in, the app needs nobody: it carries the world's borders inside and resolves the coordinate on the phone itself. Drawing a map does need something from outside. When you open the year's map, the card on History or the map in a day's detail, iOS asks Apple for the map tiles of that area.

That means Apple sees which part of the world you are looking at in that moment, the same as when you open the Maps app. It does not receive your kept positions, your days or your identity: these are map requests, and Apple does not tie them to your account. If you never open a map, nothing is asked for.

What data exists, and where

Everything the app records lives in the local database on your iPhone, and nowhere else:

• One record per day with the country or countries, how verified it is, and a note if you write one.
• The signals backing each day: kind, time, country, rough accuracy and a place name if there is one.
• Your rules, goals and planned trips.
• An activity log so you can see why the app concluded what it concluded.
• Your app preferences.

Crash reports

When the app dies or freezes, it sends a report so we can fix it. It is the only part of the app that talks to a third party, and it only talks when something has gone wrong: there is no ping on launch.

The report carries where in the code it broke, the iPhone model, the iOS version and the app version. It carries no identifier of yours, no email, no screenshots and nothing you have written into your days. The app does not send your IP address, and Sentry is set not to store it. What does get recorded is the country the report arrived from, which Sentry works out from the connection and cannot be turned off. It is not your location: it is where the phone was connected at the moment the app broke.

It cannot carry coordinates. Before leaving, every report goes through a filter that removes anything shaped like a coordinate, and there are automated tests that fail if that filter ever stops working.

Sentry processes them, on servers in the European Union. If you would rather send nothing, uninstalling the app stops it; if that is not enough, write to us and we will tell you exactly what we have received.

While “Keep the route” is on, the iPhone stores your positions so your year can be drawn as a journey. It comes switched on: the app offers it during setup with the switch already flipped, and you can turn it off right there or in Settings. You choose how long it is kept and you can erase it whenever you like without losing your days. With an account, those positions sync to our server too.

The anonymous usage count

To know what works and what doesn't, the app counts each day how many times you open it, which screens you visit, which features you use (verifying a day, importing photos, exporting the dossier…), how you answer the permission prompts and whether you reach the end of the welcome. They are only numbers: how many times each thing happened that day.

Each count goes with a random number the app creates when it is installed, the app and iOS versions, the language and whether you have an account. That number is not tied to your account or to anything of yours: we never match it with your days, and reinstalling the app starts a new one. It carries no location, no countries, none of your days and no email.

It reaches our server in Frankfurt (Supabase) and we only look at it added up: how many people open the app, what gets used and whether they come back. No other company receives it and it is not used for advertising.

It comes switched on and you can turn it off any time in Settings › Privacy and data. Turning it off stops the counting and erases whatever was waiting to be sent. The first time you open a version that includes it, the app explains it before sending anything.

What we do not do

We do not sell or hand your data to anyone. There is no advertising, no profiling, no third-party trackers and no third-party analytics inside the app. The only outside services the app calls are crash reporting, when the app breaks, and Apple's maps, when you open one; on top of that, it sends the anonymous usage count to our own server. All three are explained above. We share nothing with tax authorities or anyone else: what you do with the count is your business.

Legal basis and permissions

Every piece of data the app handles depends on a permission you grant in the system: location, photos, camera and notifications. You can withdraw them at any time in iOS Settings, and the app will tell you and carry on with whatever it still has.

Where this processing falls under the European General Data Protection Regulation, the legal basis is your consent, which you withdraw by revoking the matching permission.

The anonymous usage count relies on our legitimate interest in knowing how the app is used so we can improve it. It is not tied to you, and you can object by turning it off in Settings.

Your rights

You have the right to access your data, correct it, erase it, restrict it, object to its processing and take it elsewhere. Since everything is on your device, you exercise these yourself, without asking us:

• Access and correct: any day can be opened and changed from the calendar.
• Take it with you: Settings, Privacy and data, export your data.
• Erase it: Settings, Privacy and data, erase local data. Deleting the app also removes it.
• Object: turn off the signal you do not want in Settings, or revoke the permission in iOS.

The optional account

You can create an account with Sign in with Apple to sync between your devices and keep a backup. It is genuinely optional: the app works in full without one, and if you never create one nothing is uploaded.

With the account on, these are uploaded to our server: your days with their country and status, the signals backing them, your rules, goals and planned trips, the activity log, and your evidence — both the files you attach by hand and the daily confirmation photos you take with the app.

What does not change: a location becomes a country on the device and the coordinates are discarded there, so the daily signals have nothing to upload. The exception is “Keep the route”: while it is on, those positions are stored and, with an account, synced. Your photo library is not uploaded either: only the photos you deliberately attach to a day, and those have their coordinates stripped before they are stored.

That data sits on servers in the European Union, in Frankfurt, with our provider Supabase, and it is not encrypted in a way that stops us reading it. Which means someone with administrative access to that database could see where you have been. We say it plainly because we would rather you knew before creating the account.

You can sign out whenever you like, and delete the account and everything in it from Settings. Deleting is irreversible. Erasing what is on this iPhone and deleting the account are two different things, each with its own button.

Children

WhereIAm is not aimed at anyone under 16 and does not knowingly collect their data.

Complaints

If you think we are handling your data badly, write to support@whereiam.today first and we will sort it out. You can also complain to the data protection authority of the country where you live.

Changes to this policy

If we change how the app works, we will update this page and its date. If the change affects what we do with your data, we will tell you inside the app before it happens.