Your people, your privacy
Private by design.
Last updated 28 September 2026.
What the app uses
Your Apple-linked account identifier, chosen display name and avatar color identify you inside your private groups. The service stores group membership, requests, descriptions, photos, links, prices, comments, sightings, notification preferences, reports and blocks so the app can work.
Who can see it
Active members of a group can see its requests and discussions, including history from before they joined. Invitation previews reveal the group name and inviter. There are no public profiles or searchable public groups. Authorized operators can review reports and manage abuse.
Service providers
Supabase provides authentication, database and private image storage. Apple handles Apple sign-in and iPhone delivery. Firebase Cloud Messaging handles push transport and device registration, and Firebase Crashlytics receives crash reports. Apple Maps answers place searches when you look for a shop to put on a lookout. No third party screens your photos. These providers process information needed to perform those functions.
What stays on your phone
Drafts and cached content are stored locally under your account. Signing out clears remote caches and widget snapshots; your account’s drafts stay separate from other accounts. Widgets hold minimal display data and expire after 24 hours. Offline devices can temporarily retain previously authorized content.
Where you are
A lookout can carry a place, chosen from Apple Maps by whoever posted it. That place is part of the lookout and is visible to the group exactly as its photo is. The app does not use your location. It never asks for location permission, it is never told where you are, and no record exists anywhere of you being near any place. A place on a lookout is a name and a point on a map, nothing more, and tapping it opens Apple Maps the way any address would.
Photos, links and notifications
The app resizes photos and removes metadata before uploading them to private storage. External links open only when you choose them; the server does not fetch linked pages for previews. Lock-screen notifications use generic text. Notification permission is optional.
Crashes and feedback
When the app closes itself unexpectedly, a crash report is sent to Firebase Crashlytics. It describes where in the code the app stopped, on which build and which iPhone model, together with the color theme you had chosen and whether you were in the demo. It carries no account identifier and nothing you wrote. The next time you open the app it tells you this happened.
You can also write to the person making the app, from Settings or from Help. That message is whatever you choose to type, plus the label you picked for it, the app build, your iOS version, your iPhone model, your language and your theme, so that a bug report arrives with the facts a bug report needs. It is stored privately and no other person using the app can read it. If you delete your account, anything you sent stays without your name on it.
Deletion and retention
You can delete your own requests and discussion entries and delete your account in Settings. Account deletion also removes authored content and photos; a group you own is handed to its longest-standing remaining member, and only a group with nobody left in it is deleted. Cleanup is retried automatically if a provider is briefly unavailable.
No advertising
The app has no advertising SDK, ad targeting, session replay, or sale of personal information. Any future change to these practices requires a revised disclosure.