Privacy Policy
IFoundIt (the mobile app and ifoundit.app) Β· Last updated: 21 September 2026
IFoundIt lets you snap a photo to remember a place, then guides you back with a finder, AR or a map, and lets you share a place with friends. Your photos and places stay on your phone by default; a place is uploaded only when you tap Share. This policy explains what we collect, how we use it, who we share it with, and how you can delete it.
Data that stays on your phone
- Your photos, the coordinates and accuracy captured at the moment you take them, place names, notes, categories and the time you marked a place as found are stored in the app's private storage on this phone.
- No account is needed to capture, list and navigate to places. Without an account, our servers receive no place data at all.
- Deleting the app deletes this local data; we hold no backup of it.
Data we collect
| Data | Source | Purpose |
|---|---|---|
| Email and password (stored only as a hash and not recoverable) | You, when registering | Signing in, sending verification and password-reset codes |
| Nickname | You, optionally | Shown to your friends in their friend list and share notifications; without one, the part of your email before the @ is shown |
| Shared places: photo, coordinates and accuracy, category, name, note, nearby landmarks, creation time and expiry | Uploaded when you tap Share | Creating the share link and share page so the recipient can see the place and navigate to it |
| Number of times a share link was opened | Counted when the share page is opened | Showing you whether your share was seen; we do not record who opened it |
| Friendships, invite codes and their status | When you invite a friend or accept an invite | Linking accounts so you can send places to friends quickly |
| Which friends you sent a share to, and whether they have read it | When you send a share to friends | Showing their inbox and unread count |
| Push token, platform (iOS/Android), interface language, the "share alerts" setting | Registered by the app after you sign in | Notifying you when a friend shares a place with you |
| Landmark lookups: the coordinates of that lookup (rounded to 4 decimals, an ~11 m grid), the language, and a daily lookup count | When you use the "What's here?" suggestions | Looking up nearby landmarks with Google, caching the result, and keeping usage and cost under control |
| Activation records (validity period, a hash of the code and the time it was redeemed) | When you redeem an activation code | Confirming which paid features your account may use and for how long |
| Connection IP address and access logs | Generated automatically on connection | Preventing abuse and troubleshooting |
Permissions on your phone
- Camera: to take the photo of a place and to show the camera view during AR navigation. The AR view is never stored or uploaded.
- Location and compass: to record the coordinates of a place as you photograph it (we do not read photo EXIF, because social apps strip it), and to compute distance and direction on your phone while you navigate. Your current location is never uploaded and we do not track you in the background. Only a landmark lookup sends that one set of coordinates to our server.
- Notifications: to receive alerts when a friend shares a place. You can turn them off in Settings β Share alerts or in your phone's system settings.
- Photos: to save and read the photos you take in the app.
Who can see your data
- A shared place can be seen by anyone who has the link, including the social or messaging app you paste it into. Share only with people you trust; delete the share in My shares when you no longer want it visible.
- A share sent to specific friends is notified to and listed in the inbox of those friends only.
- We do not sell, rent or share your data with advertisers or data brokers.
- We use no advertising or tracking SDKs, and we do not use your data for advertising.
Third parties that help us run the service
The following services process only the data needed for the feature they provide, and are subject to their own privacy policies:
- Cloudflare: network transport and protection; all connections reach our servers encrypted through it.
- Google Firebase Cloud Messaging and Apple Push Notification service: delivering share alerts. They receive the push token and the notification text (who shared which place name β no coordinates or photo).
- Resend: sending email verification and password-reset messages. It receives your email address and the message content.
- Google Places API: used only for landmark lookups, receiving the coordinates of that lookup rounded to an ~11 m grid. Your email, account and photos are never sent.
- OpenStreetMap: map tiles. Your device downloads map images from OpenStreetMap when a map is shown.
- Google Maps and Apple Maps: opened with the place's coordinates when you tap "Navigate with maps". Their privacy policies apply from then on.
How long we keep data
- Shares with an expiry are deleted when they expire; shares without one are kept for 365 days and then deleted. Photos are deleted with them.
- Friend invite codes expire after 14 days or once used.
- The landmark cache is kept for 180 days; daily lookup counts for 7 days.
- Push tokens are deleted when you sign out or when the token becomes invalid.
- Accounts that are not email-verified within 1 day of registration are deleted automatically; codes are deleted once they expire.
- Access logs are kept only briefly for troubleshooting and rotated out.
Deleting your data
- Delete a place: swipe it left in the list. The photo and the place are removed from your phone.
- Delete a share: in Settings β My shares. The link stops working immediately and the photo and place are deleted from the server.
- Remove a friend: in the friend list. The friendship ends immediately for both sides.
- Delete your account: in the app under Settings β Account β Delete account, or on the web at ifoundit.app/delete-account after verifying your email. Your account, shares (including photos), friendships, push tokens and any remaining paid time are deleted permanently and immediately; places stored on your phone are unaffected. Deleting your account does not cancel an App Store or Google Play subscription β cancel that in the store.
Security and where data is stored
All connections use HTTPS; passwords are stored only as hashes. Data is stored on our servers in Taiwan.
Children
This service is not directed at children under 13, and we do not knowingly collect personal data from them.
Changes to this policy
If we make significant changes, we will update the date on this page and notify you in the app.
Contact us
For any privacy questions, or for help deleting your data, email [email protected].