Privacy Policy

Introduction

Streetwise ("we", "our", or "us") is a journal for street photography sessions. This policy explains what we collect when you use the iOS app or read a public session on streetwise.photo, why we collect it, and the choices you have.

We do not sell personal information, and we do not use it for advertising.

1. Information We Collect

1.1 Account

You can sign in with Apple, with Google, or with email.

• A user id from the sign-in provider
• Name and email, when the provider shares them or you enter them
• What you add to your profile: a username, a display name, an optional photo, and an optional city
• Your plan (Free or Pro). You cannot edit this yourself

If you sign in with email, the password is handled by our authentication provider and stored as a hash. We do not see it.

1.2 Sessions, spots, and photos

• The route: GPS points and a time for each point, distance, duration, and, when your phone can provide it, a step count for the time you were recording
• Title, description, and how you felt about the walk
• Who can see the session, and any radius you hide around the start and the finish
• Spots you mark: coordinates, an optional title and note, and who can see the spot
• Photos you choose from your library. We read the capture time and location of the photos you select so we can place them on the route. We store a smaller JPEG for display, and the position used to place the shot. The original stays in your library

1.3 People

• Who you follow, and who follows you
• Nods you give. The session's owner is notified. There is no public list of who nodded
• Favourites on your own sessions. Only you can see them
• Blocks. A block is mutual: their sessions leave your feed and yours leave theirs
• Notifications we send you: a new follower, or a nod on your session. You can delete them

1.4 Location

Location is used to record the route.

• While you record: the app asks for location access, including access when the screen is off or you are in another app, so the route is not cut short. Points are saved as the session. Recording stops when you pause or finish
• On the device, while recording: motion is used to tell walking from a bus or taxi, so a ride is not drawn as part of the walk. We keep the resulting route and the step count. We do not keep a separate log of motion readings
• Other people see a route only when you publish the session, and only the published copy. You can hide a radius around the start and around the finish. We do not share your live location with other people
• The map: when you ask the map to show where you are, that position is used while the app is open. It is not stored as a route unless you are recording
• Photos: placement uses the photo's location from your library or from the file, or estimates it from the capture time on the route. That position is stored with the photo

1.5 Photos and the camera

• Photo library access is requested when you add photos to a session, choose a profile photo, or save a share picture. We read the items you select
• We do not scan the rest of your library

1.6 Device and push

• A push token for this device, so we can deliver a notification. The app asks the system for permission the first time it matters: a follow, or opening notifications
• When the account opens the app, we store that time, at most once a day. Other people cannot see it
• Our hosting provider keeps ordinary server logs, such as IP address and the request, to operate and secure the service

We do not use a third-party analytics or advertising SDK, and we do not collect an advertising identifier.

1.7 Newsletter

If you opt in, we store that choice and your email so we can send occasional notes about the app. You can turn this off in Settings, or unsubscribe from any email.

1.8 Support and reports

If you write to us, or report a session, a spot, or a profile, we receive the message. A report includes the id and the author's username so it can be traced to a row. Reports are email. They are not a public queue.

1.9 Reading without an account

Public sessions, their published route, public spots, and public photos can be read with no account. That visit does not create a profile. The page request is covered by ordinary server logs, described above.

2. How We Use Information

• To record a session and show it back to you, including offline on your phone
• To sync your journal between your devices
• To show a public session to anyone, and a followers session to people who follow you
• To place photos on the route
• To deliver follows, nods, and the two notifications that come with them
• To apply a block, and to read a report
• To run Pro, including the limit of 10 completed sessions on the Free plan
• To send the newsletter, if you opted in
• To keep the service secure and to enforce the Terms of Service
• To see which accounts are still in use

3. How Long We Keep It

• Account and content: for as long as you keep them. You can delete a session, a spot, or a photo yourself. The route stays with the session until that session is deleted
• A published route is what other people can read. Hiding the start or the finish does not delete the full track from your account
• Photos: the JPEG we store is removed when you delete the photo
• Newsletter: until you unsubscribe. Deleting your account drops you from the next send
• Push token: while the app is signed in on that device
• Last opened: while the account exists. Deleting the account removes it
• Server logs: for as long as our host keeps them for security

Deleting your account

Settings includes Delete account. Deletion removes your profile, your sessions, your spots, your photos, your follows, nods, favourites, and blocks, and it cannot be undone. We may keep a record where the law requires it, for example a transaction record from Apple for a subscription.

4. Who Else Sees It

4.1 Other people

• Your profile name, username, photo, and city are visible on sessions people can read, and on your profile
• A Pro label can appear with your name. It is not a list of what you bought
• A public session, its published route, its public spots, and its photos can be read by anyone, including on streetwise.photo without an account
• A followers session can be read by people who follow you
• A private session, and a private spot, stay with you
• A nod notifies the owner. It does not publish a list of names
• Favourites are visible only to you
• The person you block is not given a list of people who blocked them. Their content stops arriving, and yours stops arriving for them

4.2 Service providers

They process data for us, under their own terms:

• Supabase hosts the database, file storage, and authentication. supabase.com/privacy
• Apple provides Sign in with Apple, the App Store, map tiles, and push delivery. apple.com/legal/privacy
• Google provides Sign in with Google when you choose it. policies.google.com/privacy
• Buttondown sends the newsletter if you opted in, and receives your email only then. buttondown.com/legal/privacy

4.3 Legal and transfers

We may disclose information if the law requires it, or to respond to a valid request from a public authority. If we are involved in a merger or a sale of the service, we will tell you before your information becomes subject to a different policy.

5. Security

• Traffic between the app and our servers uses HTTPS
• Database access is limited by row-level security, so another account cannot read your private sessions
• Passwords are stored as a hash by the authentication provider

Keep a passcode or biometrics on your phone. Write to Contact email if you think an account has been accessed without permission. No method of storage or transmission is perfectly secure.

6. Your Rights

6.1 Europe

If the GDPR applies to you, you can ask for access, correction, deletion, restriction, or a portable copy, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. You can also complain to your data protection authority. In Spain, that is the Agencia Española de Protección de Datos (aepd.es).

6.2 California

A California resident can ask what we collect, ask us to delete it, and will not be discriminated against for asking. We do not sell personal information and we do not share it for cross-context behavioural advertising.

6.3 How to ask

• In the app: edit your profile; delete sessions, spots, and photos; turn off the newsletter in Settings; delete the account in Settings
• Email: Contact email. We reply within 30 days

6.4 Legal bases

• Contract: providing the journal you asked for
• Consent: location while recording, photo library access, push, and the newsletter. You can withdraw each one in iOS Settings or in the app
• Legitimate interests: securing the service, moderating reports, keeping a block in force, and seeing which accounts are still in use
• Legal obligation: where the law requires a record

We do not make decisions about you by automated profiling that produce legal or similarly significant effects.

7. Children

Streetwise is not for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, write to Contact email and we will delete it.

8. International Transfers

Our servers are hosted by Supabase. If you use the service from outside that region, your information is transferred there. For people in the EEA, UK, or Switzerland we rely on the European Commission's standard contractual clauses, or another lawful transfer tool, where the host is outside that area.

9. Links

A profile or a session may link to a site we do not run, such as a photographer's own page. Their privacy policy applies there.

10. Changes

We will post changes on this page and update the date above. For a material change we will also notify you in the app. Continuing to use Streetwise after the change takes effect means you accept the updated policy.

11. Contact

12. Apple Privacy Labels

Data used to track you: none.

Data linked to you:

• Contact info: email, if you provide it or a sign-in provider shares it
• User content: sessions, routes, spots, photos, nods, follows, favourites, blocks
• Identifiers: user id, push token
• Location: while you record a session, with permission; photo locations you choose to attach
• Health and fitness: step count for a recorded session, when the phone can provide it
• Product interaction: when the account last opened the app

Data not linked to you: ordinary server logs.