Privacy Policy

Last updated: October 26, 2026

WhereWe (“WhereWe,” “we,” “us”) is a mobile app for keeping a shared map of the places you’ve been and want to go, together with the people you choose. This policy explains what we collect, why, who we share it with, and the choices you have. WhereWe is run by WhereWe LLC, a Wyoming limited liability company, which is responsible for the information described here.

1. Information we collect

Account information

• How you sign in — your email address, your phone number, or your Apple or Google account. Sign-in is handled by Google Firebase Authentication; codes for phone sign-in are sent by text message through Firebase.
• Sign in with Apple or Google — we receive the email address of that account and, if you choose to share it, your name. With Apple you can hide your real email, in which case we receive a private relay address that forwards to you.
• Display name — the name members of your maps see next to the places you add, also shown on your public profile and maps. It starts as the name from your Apple or Google account when there is one. You can change it at any time, up to 10 times a day. We check display names before they appear publicly: one that poses as WhereWe or its staff, or contains a slur, isn’t shown.
• Username — every account has a unique @username, which is public (see section 2). You can change it twice in any 14 days. After a change, links with your old username lead to your new one, and nobody else can take the old one for 30 days.
• Public profile — your display name and @username, plus a short bio and your Instagram and TikTok handles if you choose to add them. Those handles are contact information: anyone who sees your profile can use them to find and contact you on Instagram or TikTok.
• Profile picture — if you add one: the photo you pick and crop in the app. It’s checked before anyone else sees it (see section 3); once cleared, a square copy of it is public on your profile and next to your name on your public maps. Until then, and if it isn’t approved, only you can see it.

Content you create

• Places you save — their names, map coordinates, address details, category, whether you’ve been or want to go, dates, your ratings and the comparisons you make when ranking places, and any notes or links you add. Each place records which member of the map added it.
• Maps you create or join, their names, and their membership.
• Photos you attach to a place, stored in Firebase Storage and visible to members of that map.
• Public maps — if you publish a map, the choices you make for it (its title, description, and cover photo; whether to include notes and photos; whether to show it on your profile, list it in search, or sell it), the results of its automated checks, and our review decisions about it. See section 2 and section 3.
• Likes — the public maps you like. Only you can see which maps you liked; everyone sees how many likes a map has.
• Maps you save — when you save someone’s public map, we copy the places you choose into a map of yours, as places you want to go. Each copy’s note says which map it came from, with a link back. We also record that you saved the map, so each person counts once in its number of saves.

Location

If you grant permission, WhereWe uses your device location to show places near you, to sort your list by distance, and to help you drop an accurate pin when adding a place. We store only the coordinates of the places you deliberately choose to save — never a record of where you’ve been.

Nearby reminders are off unless you turn them on. They need “Always” location access so iOS can let WhereWe know, even when the app is closed, that you’re near a place on your Want list. The watching and the reminder both happen on your iPhone; your location is not sent to us.

You can decline or revoke location access at any time in iOS Settings — the rest of the app still works.

Purchases

WhereWe offers an optional paid subscription (“Pro”). Purchases are processed by Apple through the App Store. To unlock Pro, the app sends us Apple’s signed record of your purchase, and we keep which plan you have and when it expires. We never receive your payment card details.

Some public maps are sold by their creators, also through Apple. When you buy one, we receive Apple’s signed record of the transaction — its transaction ID, the product (the map’s price tier), the price and currency, the App Store country, and the date — and store it with your account to unlock the map, to make sure one purchase can’t be used twice, and to pay the map’s creator their share. If Apple refunds the purchase, Apple tells us and the map is locked again. The creator sees how many people bought their map, never who. A purchase made in a test version of the app (TestFlight) goes through Apple’s test system: it charges nothing, pays no creator, and unlocks the map for 7 days.

Selling maps

If you sell maps, we also keep the payout email you give us (and, for 7 days after you change it, the one before), which version of the Creator Terms you accepted and when, your sales and estimated earnings — each sale’s share waits 60 days, so refunds come back first, before it can be paid — and the payouts we’ve made to you, and any amount a refund after a payout means you owe. Your payout email is seen only by you, by us, and by the payment service we use to pay you.

Notifications

WhereWe asks whether it may send you notifications when it first has something to tell you — for example, after you publish a map. If you allow them, we store with your account the notification token that Firebase Cloud Messaging (Google’s service, which delivers through Apple’s) gives your iPhone, and the language your app uses, so each notification arrives in your language. An account keeps up to 10 phones.

• What we send — the results of checks and our decisions about your public maps, your profile, and your account: for example, that a map is being reviewed, is live again, was listed in search, was approved for sale, was hidden, or wasn’t approved, or that your account was suspended. A notification names the map; the reason is shown only inside the app, never on your lock screen. Each one is also kept as a notice in the app, where you can read why.
• Review alerts — when something needs review, WhereWe’s moderator gets a notification on their own phone naming the map’s title or the profile’s @username.
• Turning them off — in iOS Settings › Notifications › WhereWe. Signing out removes that phone’s token from your account, deleting your account deletes all of them, and a token that stops working is removed automatically.
• Nearby reminders (see Location above) are made on your iPhone and don’t use any of this.

Reports and blocks

• Reports — when you report a map or a profile, we store your account’s internal ID, what you reported, the reason you chose, any details you add, and when. Only we can see reports; the person you reported is never told who reported them. If you report something by email, we have your email address and your message.
• Blocks — the @usernames you block, stored with your account where only you can read them, so their maps and profile stay out of your Explore and search results. We keep the username and a code that lets the block follow that person if they change it, not their account ID. They aren’t told.

Moderation and safety

• Check records — for each public map, which of its words and photos have already been cleared (stored as fingerprints, so a check reads only what changed), and, when something is flagged, the reasons and a small copy of a flagged photo, kept in our review queue with the map; for a profile picture, which photo it is, whether it’s cleared, and its public copy. We also count how many photos each account has had checked in the last 24 hours, to limit the cost.
• Link check results — for each link web address looked up with Google Web Risk, whether it was listed as unsafe, kept for a day; and, when a link is left off a map, an entry in our moderation log.
• Photo fingerprints — a fingerprint (a SHA-256 hash) of each photo that has been cleared or rejected, so the same photo is never checked twice and a rejected photo can’t be put up again, on any map. A fingerprint can’t be turned back into the photo and isn’t linked to your account.
• Publishing count — when you published in the last 24 hours, so that each account can publish up to 10 times a day.
• Decisions — a log of every moderation action, whether we took it or the automated check did: what was done (for example, a map held, hidden, or approved, or an account suspended or banned), to which map, profile, or account, why, and when. Notices of the decisions that affect you are kept with your account (see Notifications above).
• Suspensions and bans — if we suspend or ban an account, a record of it with the reason and the date. The account’s own copy of its standing (whether it’s suspended or banned, and why) is private: only its owner and we can read it. Banning an account also switches off its sign-in account and uses Apple DeviceCheck, as described below.

Crash reports and usage statistics

WhereWe uses Firebase Crashlytics and Google Analytics for Firebase, both provided by Google.

• Crash reports include what the app was doing when it crashed, your device model, iOS and app versions, and an identifier for the app installation.
• Usage statistics record which features are used — for example that a place was added, a map was shared, or an import was reviewed — along with device and app information, an identifier for the app installation, and an approximate location (such as the country) that Google derives from your IP address.
• Both are linked to your WhereWe account’s internal ID so repeated problems can be recognized. They never include the names of your places, your notes, your photos, your email address or phone number, or map coordinates.
• WhereWe never asks for permission to track you, so your device’s advertising identifier is not available to it, and none of this information is used for advertising.

Invitations, referrals, and bonuses

• Referral codes — your code, who invited you, and how many free imports you’ve earned or used.

The website: cookies and local storage

wherewe.net uses no cookies, no advertising, and no third-party trackers or analytics, so it doesn’t ask you to accept any. It keeps one setting in your browser’s local storage: the language you picked (and a note that it already chose one for you from your browser’s language once), so the site opens in that language next time. It never leaves your browser, and clearing your browser’s site data removes it.

To show a public map, your browser loads the map software (MapLibre) from wherewe.net itself, the map from OpenFreeMap, and the map’s photos from Firebase Storage. Like any website, those services receive your IP address and basic browser information when they send them. The site is hosted on Firebase Hosting (Google), which keeps standard server logs. The admin area, used only by WhereWe’s moderator, keeps its Google sign-in in the browser.

Apple DeviceCheck

Apple’s DeviceCheck lets an app ask Apple to remember two yes-or-no flags for an iPhone, which stay even if the app is deleted. Apple stores only the flags, not who you are. WhereWe uses one flag for referrals and one for bans:

• Referrals — when you redeem a referral code, we ask Apple to remember that a code has been redeemed on your iPhone. This stops the same phone from redeeming codes again and again.
• Bans — when you sign in or open the app, it sends us a one-time DeviceCheck token from your iPhone. We keep the latest one with your account, replacing the one before, and use it to ask Apple for your phone’s flags. If we ban an account, we ask Apple to set the ban flag on the iPhone that account last used. An account that signs in on an iPhone with that flag is closed too, so a banned person can’t simply make a new account. If we lift a ban, we clear the flag it set.
• If Apple can’t be reached, nobody is blocked from the app. A referral code can be redeemed only once Apple has answered for your iPhone.

If you delete your account

You can optionally tell us why you’re leaving. If you do, we keep your answer together with your account’s internal ID so we can improve the app.

2. Public profiles and public maps

Your profile

Your profile — your display name, your @username, and the bio, Instagram or TikTok handles, and profile picture you add (the picture once it’s been checked) — is public. Anyone can see it in the app and look it up by your username. Once you show a public map on your profile, it also appears on the web at wherewe.net/@yourusername. Your email address and phone number are never part of it.

Publishing a map

Maps are private to their members unless the map’s owner publishes one. Anyone with a published map’s link can see it, in the app or on the web, without an account. It shows:

• the owner’s display name and @username, and their profile picture if they added one and it was approved;
• the map’s title and description, and a cover photo if the owner picks one;
• each place’s name, location, category, city and country, whether it’s been visited or is wanted, and its rating — city names as they were saved (we don’t send them to Google or anyone else to translate them), and country names in the visitor’s language;
• each place’s notes — only if the owner turns on notes;
• each place’s links — only if the owner turns on links (on a map published before links had their own switch, they follow notes), and never a link Google Web Risk lists as unsafe;
• each place’s photos — only if the owner turns on photos, and only once each photo has been checked;
• how many people liked it.

It never shows who else is on the map or which member added each place. On a shared map, only the owner can publish it, and what’s published includes the places other members added — with their notes and photos, if the owner turns those on.

If a map is for sale, people who haven’t bought it see only a preview: its title and description, how many places it has, its cities and categories, approximate dots on a map (to within about 1 km), and up to three place names.

Search and Explore

A published map is link-only: it appears in WhereWe’s search and Explore only if its owner asks for it to be listed and we approve it. Public map pages and profile pages are ordinary web pages, though, so a search engine such as Google may find and show one that someone has linked to.

Before you publish

Anyone can copy or screenshot what’s public, and people who save your map keep their copies of its places (with notes and links, if you included them) even after you change or unpublish it. You can unpublish a map at any time, which takes it off the web and out of the app. Everything public must follow our Community Guidelines, and every public map is checked as described in section 3.

3. AI features

Importing from Instagram and TikTok

WhereWe can turn a public Instagram or TikTok post you share into suggested places to add: its link, a screenshot of it, or its caption (or any text) pasted in. When you use this feature, and only then:

• A post’s link may be sent to TikTok’s or Instagram’s public embed service and, for Instagram and TikTok links while we have it switched on, to Apify, a web-data service, to fetch the post’s public caption, location tag, and thumbnail image. (For a link to any other website, our server reads that page’s public preview instead.) A screenshot or pasted text is never sent to Apify.
• That caption and thumbnail, or the text you paste, or the screenshot you share, are sent to Anthropic (the Claude API) to identify the real-world places mentioned. This content is processed to generate your suggestions and is not used to train AI models. A screenshot is uploaded to our storage only for the import and is deleted as soon as the import is done.
• The identified place names, with their city and country, are sent to the Google Places API to find each place. Google’s answer — its name and address for the place, where it is, and its place ID — comes back to your app so you can check it. When you save a place, the app finds it in Apple Maps and saves Apple’s location; the only thing of Google’s we keep with the place is its place ID.
• A post, screenshot or text you share from another app is queued in our database until it has been processed, and its thumbnail is saved to our storage so it can appear with your suggestions. The result, including Google’s answer, waits for you in the database until you add it to a map or discard it, and is deleted within about 7 days either way. Until then, the app also keeps a copy of the result on your iPhone (without Google’s answer) so it isn’t lost if the app closes; that copy is deleted when you add or discard it, or sign out.

If you never use the import feature, none of your data is sent to these services.

Checking public maps

Every public map — link-only, listed in search, or for sale — is checked when it’s published, when it’s published again, and whenever it changes while it’s public. Each part is checked a different way:

• Words — the map’s title and description, the owner’s display name as the map shows it, and each place’s name, city, country, notes, and links — pass an automatic word filter that runs on our own servers. It looks for slurs, sexual terms, hate slogans, and threats. Your words aren’t sent to anyone for this. Words that pass are public straight away; if the filter finds something, the map is taken down at once and its owner gets a notice. Changing the words brings it back; otherwise a person at WhereWe looks at it.
• Photos — the map’s cover, the places’ photos (only if the owner turns on photos), and every profile picture — are sent to Anthropic (the Claude API) for an automated check before anyone else can see them. They’re sent as reduced-size copies, usually nine at a time on one contact sheet; a photo the check can’t judge at that size is sent again on its own, a little larger. Nothing else is sent with them: not the map’s words, not who is on the map, and not who made it. This content is processed to produce the check’s result and is not used to train AI models. A photo is public only once it’s cleared — until then the map is public without it. A photo the check flags is never shown, and a person at WhereWe looks at it. A photo that has been checked is never sent again, on any map. If the check can’t run (for example, because the service is down), photos wait and aren’t shown.
• Links — the web address of each link on a public map is looked up with Google Web Risk when it’s published or changed. A link Google lists as malware, phishing, or unwanted software isn’t shown, and the owner’s app says how many weren’t. We keep each address’s result for a day so the same link isn’t looked up again.

A map whose link was turned on in an older version of the app stays private. A person at WhereWe decides whether a map is listed in search or put on sale; no automated check approves anything on its own.

4. How we use your information

• To provide the core app — sign-in, saving places, and syncing shared maps across the people you invite.
• To power features you choose to use, such as nearby search, nearby reminders, public map links, and AI import.
• To operate, secure, and troubleshoot the service, and to prevent abuse of free features.
• To understand which features are used and fix what’s broken.
• To process purchases and unlock Pro features.
• To run public maps: usernames, profiles and links, search and Explore, selling maps, and paying their creators.
• To keep WhereWe safe: checking public maps, acting on reports, limiting how often an account can publish, suspending or banning accounts that break our rules, and keeping banned people from coming back.
• To send you the notifications you allow, about decisions on your maps, profile, and account.

We do not sell your personal information, and we do not use it for advertising.

5. How your information is shared

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and the service.

6. Data retention and deletion

We keep your information for as long as your account is active. You can delete your account at any time from Settings inside the app. Doing so deletes:

• maps only you were on, with their places, photos, and invite codes (a used code is kept only as a marker that it no longer works, so nobody else can take it over);
• your membership of every other map;
• your profile (including your public profile and your profile picture), your import history and allowance (except the count of free imports used, described below), imports waiting for you, and your referral code;
• your likes (each map’s count goes down by yours);
• every map you published, from the web and from the app, with its public photos and links;
• your blocks, your saves, the maps you’ve bought (you can no longer open them), and, if you sold maps, your payout email and creator account;
• your notices, the phones registered for your notifications, the DeviceCheck token we kept for your iPhone, your publishing count, and the check records of maps that are deleted;
• your sign-in account — and, if you signed in with Apple, WhereWe’s access to your Apple Account.

Your @username is retired: it no longer points to you, and nobody else can take it for 30 days, so old links never lead to a stranger. People who bought one of your maps can no longer open it. Places that other people saved from your public maps are copies in their own maps, so they stay.

Maps you share with other people stay with them. A map you owned passes to the member who joined it first, and places and photos you added to a shared map remain, because they are part of what the other members saved. If you had published that map, it becomes private until its new owner publishes it. We keep the optional reason you give for leaving; records of maps you bought, with your account removed from them; records of your maps’ sales and of payouts we made to you, for accounting and tax; and reports you made, as a record of what we reviewed. Backups and operational logs may persist for a limited period before being overwritten.

Moderation records stay. For the safety of the people who use WhereWe, and so that nobody can escape a ban by deleting their account and starting again, we keep these after you delete your account: the log of moderation decisions about your maps, profile, and account (what was decided, why, and when); our review-queue items and the reports about them; any suspension or ban of your account; and photo fingerprints (see section 1). They are tied to your account’s internal ID, not to your email address or phone number, and only we can see them. They can include a map’s title and the reasons for a decision, but not your maps’ places or photos, which are deleted as described above.

How long we keep them. A ban, for as long as it’s in force and 2 years after it ends; suspensions and the moderation log, 2 years; reports and review-queue items, 1 year after they’re closed. Fingerprints of photos we rejected are kept while WhereWe runs, so the same photo can’t be posted again; the fingerprints of your other photos are deleted with your account.

If your account was banned, the ban stays in force after you delete it: the flag Apple keeps for the iPhone the account last used stays set (it’s stored by Apple against the phone, not against your account), so a new account made on that iPhone is closed too. A banned account can’t sign in to delete itself; email us and we’ll delete it for you, keeping only the records above.

Referral flags work the same way: the flag that says a referral code was redeemed on an iPhone stays with that phone.

Free imports work in a similar way. So that deleting an account and signing up again doesn’t bring back the 5 free imports, we keep a count of the free imports used, filed under a one-way code made from the account’s verified email address, phone number, or Apple or Google sign-in. The record holds only that code and the count, never the address or number itself.

If you deleted your account using a version of WhereWe older than 1.1, some of your content may remain. Email support@wherewe.net from the address you used (or tell us the phone number you used), and we will erase it within 30 days.

7. Security

Data is transmitted over encrypted connections and stored with our cloud provider’s access controls and security rules. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

8. Children

WhereWe is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

9. International users

WhereWe is operated from, and its data is processed in, the United States and other locations where our service providers operate. By using WhereWe you consent to the transfer and processing of your information in those locations.

10. Your choices and rights

• Access & deletion — view and edit your content in the app, or delete your account and its data from Settings.
• Location — grant or revoke location access in iOS Settings, and turn nearby reminders on or off in the app.
• Your profile — change your bio and Instagram and TikTok handles, or leave them empty, at any time; change your display name at any time, and your username twice in any 14 days.
• Public links — a map’s owner can turn its public link on or off at any time, and chooses whether to include notes and photos, show the map on their profile, list it in search, or sell it.
• Notifications — allow or turn off notifications at any time in iOS Settings › Notifications › WhereWe.
• Reporting and blocking — report a map or block its creator from the ⋯ menu on the map, and report a profile from the ⋯ menu on the profile. Our Community Guidelines explain how.
• Moderation decisions — if you think we got a decision about your map, profile, or account wrong, email us and we’ll take another look (see the Community Guidelines).
• Depending on where you live (e.g. the EEA, UK, or California), you may have additional rights to access, correct, or delete your personal information. Contact us to exercise them.

11. Changes to this policy

We may update this policy as the app evolves. When we do, we’ll revise the “Last updated” date above, and significant changes will be reflected in the app.

12. Contact us

Questions about this policy or your data? Email support@wherewe.net, or write to WhereWe LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.