Privacy · version 1 · 5 October 2026

Privacy

Everywhr is built so that your photos and your exact locations stay on your iPhone. This page lists everything our server stores, and why.

What stays on your phone

• Your photo library, the location and date stored in each photo, and the map, trips, passport and cards the app builds from them.
• Your home city and your bucket list.

The app reads your photos on the device. It never uploads your photo library, a photo's exact location, its EXIF data or your home location.

Share links

Guess where, Swap places and Been here too links carry their content in the part of the link after the #. Your browser does not send that part to any server. These pages read it on your device, store nothing and send nothing back. Our web pages use no cookies, no analytics and no scripts or fonts from other companies.

When you sign in with Apple

You need an account only for groups, swaps, crowd counts and posting photos. We store:

• The account id that Sign in with Apple gives Everywhr. We do not store your email address or phone number.
• The display name and emoji you choose, that you confirmed you are 13 or older, and the version and date of the posting terms you accepted.
• Sign-in sessions, stored only as a hash. A session ends after 90 days without use.
• The push notification token of each device you allow, and an App Attest key that shows requests come from the real app.

Places, groups and swaps

• Crowd counts and group goals receive place ids only (a country, a region, or a place from the app's own list) and the month you first visited. They never receive a photo, a photo's location or your home.
• Crowd counts are shown rounded to 10, and a place with fewer than 50 visitors shows as a hidden gem with no number. We never show who visited a place.
• Group members see the group goal and the places added to it with the display name of the person who added them. They do not see anyone's totals.
• A swap stores that two accounts swapped places, so the app can tell your friend.

Photos you post

• A photo leaves your phone only when you post it to the public map. The app removes its metadata and makes two sizes before upload. Our server checks again and rejects any photo that still has EXIF, XMP or GPS data.
• We store the photo, the place you chose, a location rounded to about 100 metres, the time, and likes, saves, follows, blocks and reports.
• Every new photo is checked automatically for nudity, violence and hate symbols. Photos that the check flags, or that it cannot check, are not shown until a person reviews them. Reported photos are reviewed by a person.

Support messages

The support form stores the topic, your message and the app version if you add it. It does not store your email address or IP address. Messages are deleted after one year.

Security and abuse limits

To limit abuse we count requests for a short time under a one-way hash of your account id or IP address. The counters are deleted when their time window ends. A log of push notifications sent is kept for 30 days.

Who runs the service

Everywhr runs on Cloudflare (Workers, D1 and R2). Cloudflare processes IP addresses to deliver and protect the service. We do not sell data and we do not use advertising or tracking.

Delete your account

In the app, open Me, then Settings, then Delete account. We delete your account and every record linked to it at once, and your posted photos within 24 hours.

Children

You must be 13 or older to sign in or post. The app without an account has no age limit and sends nothing about you.

Credits

• Map data: Natural Earth (public domain).
• Place photos marked "Commons": Wikimedia Commons. Each photo shows its author and licence. Place popularity uses Wikipedia page view counts.
• Fonts: Geist and Geist Mono, under the SIL Open Font License.

Contact

Use the support form.