Privacy

onewhere turns your photo library into private memories on your iPhone. Almost all of it happens on the device. This page says exactly what leaves it, and when.

What stays on your iPhone

Your photos and videos, their locations and times, and everything derived from them — journeys, stops, places, stories, notes and reflections — are read and kept on your iPhone. Original photos are never uploaded. You can use the app without an account.

Apple's map services

To name the places in your journeys and to search for places, the app sends coordinates or search text to Apple's map services, which Apple's privacy policy covers. We do not receive them.

What we receive, and only when you choose

• Your account. Signing in with Apple gives us an anonymous Apple user identifier, and the display name and profile picture you set.
• A guide or place you share. Exactly what the preview showed you before you created the link: the names you chose, your take, tip and message if you wrote them, the month of your visit if you left it on, and the photos you picked, re-encoded without their location or camera data. A location is included only for a place Apple's maps recognise, rounded to about a hundred metres. Nothing from the rest of the journey, and never your private notes.
• A backup. Only when you tap "Back up journeys now": your journeys' stops with their precise places, times and notes, stored privately for your account so they can be restored. For each stop that includes the time of its first and of its last photo, so a restore can find which of your photos belong to it. These are times only — a backup holds no photos, no thumbnails, no photo identifiers and no camera or location data from your photos. Nobody else can see a backup.
• Your food map, only if you share it. The app finds the restaurants in your journeys on your iPhone and keeps that map there. If you choose "Share with followers", we receive each restaurant's name, its location rounded to about a hundred metres, the map's identifier for it when Apple's maps know it, and the months you went — never your journeys, the days or times, your notes, or anywhere else. Photos only the ones you choose for a restaurant, at most three, re-encoded without their location or camera data; no photo is ever added for you. Only people who follow you see it. Turning sharing off takes it down.
• Comments, follows, blocks and reports you make. A comment on a restaurant is seen by you and by the people joined to you by a follow, either way — never publicly.
• Likes and saves. When you like or save a guide or a place post while signed in, we record that your account did, and when. Everyone who can see the post sees only how many people liked and saved it; its author also sees who, in their Activity. Which stops you saved stays on your iPhone, and a save made signed out is never sent. Taking a like or a save back deletes it.
• People search. When you search for someone by name, the name you type is sent to find matching travelers and is not kept: it is not stored and not logged. You can find registered travelers by their profile name, including people who have not published publicly. This does not grant access to their private posts. People you blocked or who blocked you do not appear.
• Performance data, only if you turn it on. "Share performance data" in You → Settings is off until you switch it on. When it is on, the app sends, in occasional batches, how long a few steps took (opening the app, opening a story, sharing, opening the map), how smoothly screens scrolled, how long a photo scan took, a few counts of how often something happened, and Apple's daily performance and crash summaries if you also share analytics with app developers in iOS Settings. Every value is rounded into a range — "under 750 ms", "10,000 to 50,000 photos" — alongside the app and iOS version, the iPhone model, your language and a random code for this installation. It never includes your photos, places, locations, titles, notes, people, account or anything you typed. It is not linked to your account, the random code is replaced when you turn sharing off or sign out, and we delete it after 90 days. Turning it off deletes anything not yet sent.

Request logs

Our server and the web front end in front of it keep no request logs. We do not record your IP address, the pages or links you open, or what you searched for. Errors are logged without any of these. Your IP address is used only in memory, to limit how often one device can sign in or send performance data; it is never written to disk or logged, and is forgotten soon after that limit's window — a minute for signing in, an hour for performance data — has passed. So nothing links performance data, or anything else you send, to your IP address.

Who can see what you share

A link is seen by whoever has it until it expires or you stop sharing it. A guide shared with followers is seen by people who follow you, and so is a food map you share. A guide or place post you make public can be seen by anyone, and lets people find you by name. You can edit or withdraw any share from You, and turn food map sharing off in Food map or Settings.

Keeping the community safe

Text others will read is checked against a list of disallowed words before it is published. Anything can be reported from its menu, and a person reviews reports; content that breaks the rules is removed and repeat offenders are suspended. Blocking someone hides them from you and stops them commenting on your guides or following you.

Keeping and deleting your data

Performance data is kept for 90 days and then deleted. Because it is not linked to an account, deleting your account cannot find it; it is gone within 90 days regardless.

We keep what you shared until you withdraw it or delete your account. Deleting your account in You → Settings removes everything we hold for it — journeys, backups, guides, place shares, your shared food map, photos, comments, likes, saves, follows and your profile — and, where configured, revokes Sign in with Apple. A report you made is kept without your account, so a moderator can see what was decided before. Your photo library is never touched.

People searches and request logs are never kept, so there is nothing of them to delete.

What we don't do

No advertising, no tracking across apps or websites, and no selling or sharing of your data.

Contact

Report anything in the app from the item's menu; a person reviews every report. You can delete your account and everything we hold from You → Settings.