Legal

Privacy Policy

Status: draft, not yet in force Effective: EFFECTIVE DATE Applies to: the Two of Us iPhone app and this website

Not yet a finished document. Every factual statement below describes the app as it is actually built — the tables, the fields, the rounding and the deletion behaviour were all read out of the source before this was written, and they are accurate. What is not settled is everything marked LIKE THIS: the identity of the data controller, retention windows and the contact address. Those must be filled in, and the whole document reviewed by a qualified adviser, before the app is submitted to the App Store. Last checked against the app, table by table, on 2 October 2026.

The short version

Your photographs and videos never leave your phone. The Map reads the date and location stamped on each one, on your device, and uploads a short list of place names and dates — never an image, a thumbnail, or a file.
Coordinates are blunted before they are sent. Rounded to about a kilometre: enough to recognise a city, not enough to find a house.
No advertising, no tracking, nothing sold. The app talks to three organisations: our own servers (hosted by Supabase), Apple, and TelemetryDeck, which counts anonymous steps through setup so we can see where people give up. It never receives a name, a place, an answer or anything you wrote. Section 8 has the detail.
Location is off unless you switch it on for the distance widget. Then it is read when you open the app — or, only if you also turn on a second setting, at most once an hour when you have moved. Always rounded to about a kilometre and overwritten each time. No trail is ever kept.
Notifications are sealed. Apple delivers them, but what they say is encrypted for your phone alone; Apple sees only a generic line such as "Something new on the map."
Only your partner can see what you share, and the database enforces that rather than the app asking nicely.
Nothing here is sold or shared for advertising, ever, and there is no mechanism in the app that could.

This summary is written to be read. The sections below are the ones that actually govern.

1. Who we are

Two of Us is an iPhone app for two people. The data controller — the person legally responsible for the decisions described in this policy — is LEGAL NAME, of REGISTERED ADDRESS, registered with the Information Commissioner's Office under ICO REGISTRATION NO..

You can reach a human at SUPPORT EMAIL. There is no separate Data Protection Officer; the controller handles these requests personally.

This policy covers the iPhone app and this website. It does not cover Apple, whose own privacy policy governs your App Store account, your Apple ID and your payments.

2. What is collected

The whole list. If something is not in this table, the app does not collect it.

What	Why	Where it is held
An account identifier	To know which rows are yours, and to join you to your partner. A random identifier, created when you sign in.	Our database
Your Apple sign-in identifier	Sign in with Apple is the only way to make an account. Apple gives us a random identifier that stays the same each time you sign in, and that is all: the app asks Apple for neither your name nor your email address, so we hold neither.	Our database (authentication)
The two names you choose, the colour each of you picks, your anniversary if you set one, and the date you are next together if you set one	They appear throughout the app and on its widgets. The names are whatever you type — a first name, a nickname, anything.	Our database
Your invite code	Six characters, so your partner can join your couple. It expires, and a new one is made when needed.	Our database
Attempts to join with a code — which account tried, the code typed, whether it worked, the time, and the IP address	To stop someone guessing codes to get into a couple that is not theirs: too many wrong tries in fifteen minutes and that account or address is made to wait. Cleared out after a day.	Our database
Places you have been — a place name, a country code, a coordinate rounded to two decimal places (about a kilometre), a start and end date, how many of your photographs were taken there, and whether you marked it as a trip you took together	This is the Map. Most come from a photo scan (section 4); you can also add a trip by hand, which searches Apple Maps for the place and is rounded the same way. Where your list and your partner's list agree on a place and a set of dates, you were there together.	Our database
Places you would like to go, and any note you attach	The shared wishlist. The coordinate here is not rounded, because it is a place you have chosen on a map rather than a place you have been.	Our database
Places you have hidden from your own map	A reference to each place you took off your map, so it stays off. Readable only by you — not by your partner.	Our database
Where you are — one coordinate, rounded to two decimal places (about a kilometre), and the time it was taken	Only if you turn on the distance widget. It is what lets the two of you see how far apart you are. Your row is overwritten, never appended to: there is no history of where you have been, and no table that could become one. Switching it off deletes the row. See section 5.	Our database
A note you put on their screen	One short sentence at a time, replaced when you write another, and the time your partner first saw it. It is shown on your partner's widget, so treat it as readable by anyone who picks up their phone. See section 5.	Our database
A profile picture, if you set one	One square image per person, shown throughout the app and on your widgets. It is the only image the app uploads, and it is uploaded precisely because its purpose is that your partner sees it. It is shrunk on your phone before it is sent, stored in a private bucket readable only by the two of you, and deleted when either of you leaves the couple. Setting one is optional; the app uses the first letter of your name until you do. See section 5.	Our database (file storage)
Your answers to questions	Things You Haven't Asked. Free text, or an option you picked, plus which question it answers.	Our database
Your answers in a round of a game	What you picked for each prompt in This or That, Who's More Likely, Dial It In or Guess Me, which prompts the round had, who started it and when you finished. Your partner's answers are not readable by you until your own are written — see section 6.	Our database
Things you are counting down to	A short title, a date, what kind of thing it is, whether it comes round each year, and when you asked to be reminded. You write these yourself — "Together again", a birthday, a trip — so treat the title as something your partner will read and as something that appears on a Lock Screen widget.	Our database
Your subscription, if you buy one	To unlock the app for both of you, and to show the person who pays where to manage it. We hold Apple's transaction number for it, which product it is, whether it is a trial, whether it will renew, when it runs until, and which account bought it. When you buy, the app gives Apple your account's random identifier so the purchase can be matched to you; Apple then tells our server about renewals, refunds and cancellations, and the server checks each with Apple directly. We never see a card or a payment.	Our database
Gift codes you redeem	Which code, which couple, who redeemed it and when — so a code cannot be used more times than it allows.	Our database
Which of our widgets you have added	The kinds, and when the app last checked. Your partner's phone reads it so that, for example, a note is not sent as a notification to someone whose Lock Screen widget already shows it.	Our database
A notification address for your phone, and your notification switches	If you allow notifications: the token Apple issues so a message can reach this phone, whether it is a test or App Store build, and a key made on your phone that seals what a notification says (section 5). Plus your four on/off switches — games, map, dates, notes. The token is replaced if another account signs in on the same phone and removed when you sign out.	Our database
Notifications waiting to be sent	When your partner does something you would be told about, a row is queued for you: what kind of thing it was, which item, and the few words the notification needs (a place name, a date's title, a note). Deleted 14 days after it is sent.	Our database
Anonymous usage counts	Which step of setup you reached, and a few yes/no or rough-number facts about it ("between 10 and 49 places", "notifications allowed"). Sent to TelemetryDeck with your phone's model, iOS and app version, language, region and time zone, a few display and accessibility settings, and an identifier that is scrambled on your phone before it is sent. Never a name, place, answer, note or code. See section 8.	TelemetryDeck
Presence, while the app is open	Each phone tells the other that it is open, so the app can say whether your partner is there. This is relayed and discarded; it is never written to the database. The games no longer use it — every one of them is now answered a person at a time — and it remains only for the shelved live games, which are not on the launcher.	In transit only
Technical request data	Like any internet service, our hosting provider records the IP address, timestamp and rough shape of requests in its server logs, to keep the service running and to spot abuse. That includes downloading This or That's pictures.	Hosting provider's logs
This or That's pictures	The stock photographs on This or That's cards are downloaded from our storage as you play (and during setup) and kept in your phone's cache. The requests carry nothing about you or your couple: they are the same public files for everybody. They are ours, not yours, so this does not change the promise that your own photographs never leave your phone.	Your phone's cache
Photographs and app state on your own phone	What you did in setup before you had an account (your first round, your name), reminders the app schedules for you (a date coming up, an invite not yet opened, a trial ending tomorrow), photographs from the shelved Colour Hunt, a cache of place names, and a copy of what your widgets show. All stored in the app's private storage on your device; the setup round is sent to our database only once you have an account, as your first round.	Your phone only

3. What is never collected

Your photo library. Not the files, not thumbnails, not copies, not identifiers pointing at them. Two exceptions, both of which are a single picture you choose by hand and both described in section 5: a profile picture, and a photograph you send your partner to play a game with. Nothing is ever taken from your library without you picking it.
Your location in the background — unless you go and switch it on. The app asks for "While Using the App", the weakest location permission there is, and with only that it cannot read your position while it is closed or while the phone is in your pocket. One setting changes that, and nothing else does: Keep it up to date on its own, in Settings under Distance, which asks for "Always" and is described in full in section 5. Until you turn it on it is not on, and turning it off puts things back. Nothing on the Map uses location either — the Map is built entirely from stamps already sitting on photographs you took in the past.
A location history. Your position is one row that is overwritten. There is no trail, no log, and no table that could be turned into one.
Your name or email from Apple. Sign in with Apple offers to share them; the app does not ask.
Your contacts, calendar, health data, microphone or messages. The camera is used only if you choose to take a new profile picture, and that picture is the one described in section 5.
Advertising identifiers. There is no advertising in the app and no tracking across other apps or websites. The App Tracking Transparency prompt never appears because there is nothing it would be asking about.
Anything personal in our analytics. The anonymous counts in section 2 are the only analytics. No crash reporting service, no session recording, no heatmaps. They say how far people get through setup; they do not say who you are, and nothing you write or play is in them.
Third-party code beyond two libraries. The app contains the client for our own database (Supabase) and TelemetryDeck's library for the counts above. No advertising, attribution or social SDK is present in the binary.

4. Your photo library, in detail

This is the part worth being precise about, because it is the biggest thing the app ever asks for.

What happens when you tap "Scan my photos"

iOS asks your permission. If you grant it, the app walks your library and reads two things from each photograph and video: the date it was taken and the GPS coordinate stamped on it, if it has one. No image is opened or decoded. That is why a library of fifty thousand photographs is read in seconds — nothing is looking at the pictures.

Photographs with no location — most screenshots, most saved images — are simply ignored. Hidden photographs stay hidden: the scan excludes them. Shared-album photographs are excluded too, because they belong to other people and would place you in cities you have never been.

During setup

Setup offers the same scan before you have an account, to show you your own map. That run uploads nothing at all and is thrown away when the step ends. To illustrate it, the app opens a handful of your photographs — two from your trips, and up to five from one of them — and shows them to you on your phone. Those are the only photographs it opens, and they are never uploaded either.

What is then worked out, on your phone

The located photographs are grouped into stays — runs of photographs close together in space and time. A stay becomes one row: a coordinate, a date range and a count.

What is sent, and what is left behind

Before anything is uploaded, the coordinate for each stay is rounded to two decimal places, which is roughly a kilometre. What leaves your phone is: the rounded coordinate, the place name, the two-letter country code, the first and last date, and the number of photographs. What stays on your phone is: every photograph, and the internal identifiers that let the app show you your own pictures when you tap a pin. Those identifiers are never uploaded, which is why your partner sees that you have two hundred photographs of Lisbon and never sees one of them.

Your photographs are the evidence. Only the conclusion is shared.

Apple's geocoder

To turn a coordinate into "Lisbon · PT", the app asks Apple's geocoding service, which means the coordinate is sent to Apple for that lookup. This is Apple's own location service, built into iOS, and Apple's privacy policy governs it. Results are cached on your phone so each place is looked up once, ever. We mention it because "nothing leaves your phone" would otherwise be very slightly untrue, and we would rather be exact.

Saying no, and changing your mind

Declining the photo permission costs you the Map and nothing else — every game still works. You can withdraw it at any time in iOS Settings, and the app has a shortcut to that screen. Withdrawing it stops any further scanning; to remove places already uploaded, see section 10.

Scans are manual. The app does not re-read your library in the background, on a schedule, or on launch — only when you ask it to.

5. Things you switch on yourself

Everything in this section is off until you turn it on, and each can be turned back off in the app. None of it contradicts section 4 — but all of it deserves saying plainly.

How far apart you are

Turning on the distance widget asks iOS for location access. We ask for "While Using the App" — the weakest permission available — so a position is taken when you open the app and at no other time. Your phone is not reporting while it sits in your pocket.

There is then a second, separate step you can take if you want to, and it is the only thing in this app that reads your location while you are not looking at it.

Keeping it up to date on its own

Keep it up to date on its own, in Settings under Distance, asks iOS for "Always". With it on, your phone reports without you opening anything — because a number that is usually several hours old is not much use on a Lock Screen.

What that does and does not mean:

At most once an hour, and only when you have moved. Sitting still produces no readings at all. We use the system's significant-change service, which notices movement of roughly half a kilometre; we do not run continuous or precise location, and the app never follows you in real time.
Exactly the same rounding, and the same single row. Two decimal places, about a kilometre, overwritten each time. Reporting more often does not mean keeping more: there is still no trail, and still nothing that could be turned into one.
Only your partner ever reads it, exactly as before.
It is reversible from both ends. Turn the setting off in the app, or change the permission back to "While Using the App" in iOS Settings, and the background reporting stops. Turning the distance feature off altogether deletes your row.

iOS will also, on its own, remind you some days later that the app has been using your location in the background and offer to stop it. That prompt is the system's, not ours, and we would rather you saw it.

Before anything is sent, the coordinate is rounded to two decimal places, about a kilometre: the same blunting the Map uses. Enough to say "two hundred miles apart" or "same place", nowhere near enough to say which building. It is stored as one row that is overwritten each time — your current position, never a history of where you have been. Only your partner can read it.

Because of all that, the distance is not live either way. It is as fresh as the last reading each of you sent — the last time you opened the app, or up to an hour ago if you turned on the setting above — and the widget says so rather than implying otherwise. Switching the feature off deletes your row immediately, so no stale position is left sitting on anyone's screen.

A current position is a very different object from a record of where you have been. This app only ever holds the first.

Notifications

If you allow them, your phone is told when your partner does something that involves you: plays their half of a round, answers a question you haven't, adds a wish, a trip, places from a scan or a date, joins you, or leaves a note (only if you don't have the note widget, which already shows it). Map news arrives quietly. Each area — games, map, dates, notes — has its own switch in Settings.

A notification has to pass through Apple to reach you. So its real content is encrypted on our server with a key that only your phone holds, and your phone opens it when it arrives. Apple can read only a generic line for the area, such as "Something's waiting for you in Games." Separately, a silent signal with no content at all wakes your partner's phone to refresh its widgets.

Some reminders are made entirely on your phone and never touch our servers: a date you asked to be reminded of, an invite your partner hasn't opened after a day, and the day before a free trial ends.

A word on their screen

You can put one short sentence on your partner's widget. It replaces whatever you wrote before — this is not a chat and no thread is kept. It is stored until you replace it or take it down, and either of you can delete it. Remember where it ends up: a widget is readable by anyone who glances at their phone, so it is the wrong place for anything private.

Photographs you deliberately send

Your profile picture

If you tap your face in the app you can choose a picture for it, or take a new one with the camera. To choose one, iOS shows you its own photo picker, which runs outside the app: we receive only the one image you tap, and the app never gains access to the rest of your library through it.

That image is cropped to a square and shrunk to 400 pixels on your phone, before anything leaves it, and the smaller version is what is uploaded. It is held in a private storage bucket keyed to your couple: a row-level policy means only the two of you can read it, and it is not reachable by a public link. It is deleted when either of you leaves the couple, and removed from both phones at the same time.

Two honest notes. A photograph of a face is personal data, and if you choose a picture of yourself you are choosing to share it with your partner — that is the whole point of the feature, but it is worth saying out loud. And it will appear on their Lock Screen widget, which is visible to anyone who glances at their phone. You can remove it at any time, and until you set one the app simply uses the first letter of your name.

Piece Together and Colour Hunt

These two games are built but are not currently on the launcher, so nothing below can happen unless they return. It is described anyway, because the code is still in the app and a policy that only covers what is switched on today is a policy you have to remember to update before you switch anything back on.

You choose one photograph from your library to turn into a jigsaw. That image is transmitted to your partner's phone, in pieces, through the same live relay that carries the rest of the game. It is relayed, not stored: it is never written to the database and no copy is kept on our side. Your partner's phone holds it for as long as you are playing. Only a picture you pick, for a game you started, goes anywhere.

Photographs you take inside the app are saved in the app's private storage on your phone. They are not uploaded. If you make a poster of a hunt and save it, it goes to your own photo library — which needs its own iOS permission, and is a copy going to you.

6. What your partner can see

A couple is two accounts joined by an invite code. Within it:

They see your places — names, dates, counts and rounded coordinates. They do not see your photographs.
They see the shared wishlist, and either of you can remove anything from it.
They see your answer to a question only once they have answered it themselves. Until then the app will not even tell them what the answer is — only that one is waiting. This is enforced in the database, not in the app, so it holds regardless of what any client asks for.
They see your answers in a round of a game only once they have answered the same round themselves — the same rule, enforced the same way. Until then the database will not return your answers at all; the only thing it will confirm is that you have finished.
They see everything you are counting down to, and either of you can add, change or remove any of it.
They see your profile picture, if you set one. Only you can set or remove it, and only they can set or remove theirs — same for your two names. Before the second person joins, whoever set the couple up fills in both.
They see the names and the anniversary, and whether the couple is subscribed. The anniversary is a fact about the pair, so either of you can change that one.
They see your note, and when they have seen it.
They see your position, if you share it — rounded, and only the latest.
They see which of the app's widgets you have added, though the app only uses that to decide what to notify.
They do not see the places you hid from your map, your notification switches, or your subscription's details.

Nobody outside your couple can read any of it. Every table carries a row-level policy scoping it to your couple, so a request for somebody else's data returns nothing rather than being politely declined by the app.

One asymmetry worth knowing: neither of you can write a place for the other. "We were both here" is always the result of two independent ledgers agreeing, or of one of you tapping to confirm it.

7. Why we are allowed to hold it

Under the UK GDPR and the EU GDPR, each purpose needs a lawful basis. Ours:

To give you the app you asked for — your account, your couple, your places, your answers, your subscription status. Basis: performance of a contract (Article 6(1)(b)).
To read your photo library. Basis: your consent, given through the iOS permission prompt and withdrawable at any time in iOS Settings.
To show how far apart you are, if you switch the distance widget on. Basis: your consent, given twice over — once in the app and once in the iOS permission prompt — and withdrawable from either.
To notify you and remind you, if you allow notifications. Basis: your consent, withdrawable in iOS Settings or area by area in the app.
To keep the service up and to prevent abuse — server logs, the record of attempts to join with a code, rate limits. Basis: legitimate interests, in running a service that works and is not being attacked.
To count, anonymously, how far people get through setup (TelemetryDeck). Basis: legitimate interests, in finding the steps that confuse people. The counts carry nothing you wrote and cannot be tied back to you. ADVISER: confirm basis and PECR position for the on-device identifier; add an in-app opt-out if needed

There is no profiling and no automated decision-making with legal effects. Nothing in the app scores you, ranks you or decides anything about you.

8. Where it goes, and who else touches it

Three organisations are involved, and no others.

Who	What they do	What they hold
Supabase	Hosts the database, authentication, file storage (profile pictures, and This or That's pictures), the live game relay and the small server functions that send notifications and check subscriptions with Apple. They act as our processor, under their data processing terms, and do not use your data for their own purposes.	Everything in the table in section 2 marked "our database", hosted in the European Union (Ireland).
Apple	Distributes the app, handles sign-in, takes payment for subscriptions, delivers notifications, draws the maps, searches for a place when you add a trip by hand, and provides the geocoding that turns coordinates into place names.	Your Apple ID and your payment details, which we never see. Apple tells us about your subscription (section 2), passes on notifications it cannot read, and receives the coordinates it is asked to name or show.
TelemetryDeck	Counts anonymous steps through setup (section 2). Based in the EU and built for privacy: it does not store IP addresses, and the identifier it receives was scrambled on your phone and is scrambled again on arrival.	Anonymous counts, which cannot be used to identify you.

We are the merchant of nothing. Card details never reach us and never could; Apple takes every payment.

International transfers. Your data is held in Ireland, inside the EEA. Transfers from the UK to the EEA are covered by the UK's adequacy regulations, so no additional safeguard is needed for them. TRANSFER MECHANISM — Supabase's own support operations may reach the data from outside the EEA; the safeguard in their data processing agreement (Standard Contractual Clauses, plus the UK Addendum) should be named here once that agreement is signed.

We do not sell your data, and we have no advertising business. We would disclose data outside these three only if a court or the law required it, and only to the extent required.

9. How long it is kept

Your account, couple, places, wishes and answers are kept while your account exists. They are what the app is — a map that forgets last year would not be worth having.
Presence messages are not stored at all.
Your profile picture is kept until you remove it, or until either of you leaves the couple, or you delete your account.
Things you are counting down to are kept while the couple exists — including ones that have already happened, because "we did that" is worth keeping. Either of you can remove any of them.
Your position is a single row, overwritten each time and deleted the moment you switch sharing off or delete your account.
A note on their screen is kept until you replace it or take it down.
Attempts to join with a code, including the IP address, are cleared out after a day.
Notifications are kept in the queue until sent, and deleted 14 days after. Your phone's notification address is kept until you sign out, another account signs in on that phone, or you delete your account.
Your subscription record is kept while your account exists, because it is what unlocks the app.
Anonymous counts are kept by TelemetryDeck under its own retention, and cannot be traced to you to delete.
Server logs are kept for LOG RETENTION.
Backups. Deleted data can persist in encrypted database backups for up to BACKUP WINDOW before those backups roll off. It is not restored or read in the meantime.

10. Leaving, breaking up, and deleting

This is a couples app, so this section matters more than it usually does. Here is exactly what each action does today.

Delete account

In Settings, and it really deletes. Your sign-in account is removed, your profile with it, and with it every place you uploaded, the places you hid, your answers, your plays, the rounds you started (with both of your answers in them), the wishes you added, your note, your position, your notification address and queue, your gift code redemptions, your subscription record and your profile picture. Your partner's own places, answers and wishes are not touched — they are theirs. Dates you added stay on the couple's list, no longer marked as yours. If you were the last person in the couple, the couple and everything in it goes too; if your partner is still there, the couple becomes theirs. This cannot be undone.

Deleting your account does not cancel a subscription. Apple bills your Apple ID, not your account with us, so cancel it in your Apple ID settings first or it will keep renewing. A subscription you paid for stops unlocking the app for your partner once your account is gone.

Leaving a couple

Leaving detaches you from the couple so you can start again, and takes your data with you: every place you uploaded, every answer you wrote, every round you played, your note, your shared position and your list of hidden places are deleted as you go. Your former partner keeps their own map and their own answers, because those are theirs. Your account survives, so you can pair with someone else and scan again — one tap, and the map rebuilds.

Both profile pictures go, not just yours. They belonged to the pair, and a photograph of somebody you are no longer with should not be left sitting on their Lock Screen. The one who stays can set a new one in two taps. Your countdowns and the wishlist stay with the couple: unlike a place or a round, they are not one person's record of anything, and the one who stays should not lose their own birthday.

What leaving never undoes

Answers your partner has already unlocked and read, and anything they have seen or screenshotted, cannot be recalled. No app can do that. Share accordingly.

11. Your rights

If the UK or EU GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how it is used, to receive it in a portable form, and to withdraw any consent you have given. Exercising any of them costs nothing and will not make the app worse for you.

Two of those are buttons rather than emails: deletion is in Settings, and withdrawing photo consent is in iOS Settings. For anything else, write to SUPPORT EMAIL. We will respond within one month.

If you think we have got it wrong, you can complain to the Information Commissioner's Office (ico.org.uk), or to your own country's data protection authority if you are in the EEA. We would rather you told us first, but you do not have to.

12. Age

The app is for people aged MINIMUM AGE and over, and is not directed at children. We do not knowingly collect data from anyone below that age. If you believe a child has an account, write to SUPPORT EMAIL and it will be deleted.

13. Security

Everything in transit is encrypted with TLS. Everything at rest is encrypted by the hosting provider.
Your sign-in session is held in the iOS Keychain, not in ordinary app storage.
Access control is enforced in the database by row-level security, not by the app. A modified or hostile client gets nothing it is not entitled to.
The key shipped inside the app is a publishable key and carries no privileges of its own; every privilege is decided server-side.
The live game channel is private and authorised per couple, so guessing another couple's identifier gets you nothing.
Notifications are encrypted for your phone before Apple carries them (section 5).
Invite codes expire, and repeated wrong guesses are slowed down.
No security is perfect. If a breach affects your rights we will tell you, and the ICO, as the law requires.

14. If you are in the United States

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no mechanism in the app that could — no ad network, no data broker, no advertising identifier. California residents may request access to, or deletion of, their personal information under the CCPA/CPRA; use the same contact address above, and you will not be treated differently for asking.

15. Changes, and features not yet built

If this policy changes materially we will say so in the app before the change takes effect, and update the date at the top.

An earlier version of this policy said that a distance widget and on-screen notes did not exist and were not covered by it. Both now exist, and section 5 was written at the same time as they were — not afterwards. That is the commitment worth holding us to: this document changes with the app, in the same breath, and never quietly widens to cover something you have not been shown.

This version (2 October 2026) was brought back in line with the app after it had fallen behind, which is exactly what the paragraph above promises will not happen. It now covers notifications, the anonymous setup counts, the record of attempts to join with a code, what we hold about a subscription, the newer games and This or That's downloaded pictures, and it no longer describes a way to use the app without signing in with Apple, which was removed. Nothing it adds was hidden in use; it was missing from here, which is the same failure.

Still not built, and still not covered: a shared photo board would mean photographs actually leaving your phone, which is the promise the Map rests on. If that is ever built it will be separate, opt-in, and described here first.

16. Contact and complaints

LEGAL NAME, REGISTERED ADDRESS
SUPPORT EMAIL

Also worth reading: the Terms of Service.