Draft template, not legal advice — have this reviewed by a lawyer before treating it as your real policy.

Privacy Policy

Last updated: [date]

What we collect

Account info: your email, a username, a display name, and a password (stored hashed — we never see it in plain text). Optionally: a profile photo, a freeform location string, and whatever visits, trips, notes, ratings, and photos you choose to log. If you sign up through Google, we receive your name, email, and profile photo from Google.

What we don't do

• No ad tracking, no third-party analytics pixels, no selling data.
• No location tracking. The "Location" field on your profile is plain text you type yourself, never geocoded, and we don't record where you are when you use the site.
• Photos are re-encoded on upload specifically to strip embedded location metadata (EXIF GPS) before they're ever stored or shown to anyone. We do read those coordinates once, in memory, and only to offer you a suggestion — "this looks like it was taken at Ellis Island; add it to this visit?" — for units made up of several separate places. The coordinates are discarded in the same breath: never written down, never logged, never shown to anyone else. Ignore the suggestion and nothing is kept at all.
• No marketing email. We send account email only — verification and password reset. Social notifications (someone you follow earning a badge, someone asking to follow you) stay inside the app; we don't email them to you.

Who can see your data

Your profile is private by default. You choose whether it's private, visible to approved followers, or public — and that choice is yours to change or revert at any time in Settings. A private profile's page doesn't exist to anyone else — visitors see the same "not found" page as for a username that was never registered. (One unavoidable exception: because usernames are unique, signup will say a taken name is taken.)

Cookies

One cookie, to keep you signed in. If you turn on MFA, signing in sets a second cookie for up to 10 minutes while you enter your code — it's deleted the moment you do, or expires on its own if you don't. No advertising or cross-site tracking cookies.

Your data is yours

Export everything you've entered as JSON or CSV at any time from Settings. Deleting your account is real deletion — your rows and any uploaded photos are permanently removed, not just hidden.

Contact

Questions about this policy: [contact email].