Vistale — Privacy Policy

Effective: October 14, 2026
Operator: Xin Song, an individual developer ("we"). Contact: [email protected].

Vistale lets you photograph a place, keep the story behind it, and meet the people who stood in the same spot. This policy explains what we collect, why, and what you control. If an in-app summary and this page differ, this page applies.

1. Two ways to use the app

• On this device (local mode): no account. Photos, stories and capture details stay on your phone. Nothing is sent to our server. Deleting the app deletes them.
• Cloud account: signed in with Apple or a phone number. Content you choose to save is stored on our server so it can sync, be matched with spots, and be shared according to your visibility settings.

2. What we collect

Account

• Sign in with Apple: a stable Apple user identifier and, if you choose to share them, your name and email address (which may be Apple's private relay address). We use the identifier to recognize your account. We never see your Apple password.
• Phone sign-in (where offered): your phone number and one-time verification codes.
• Profile: nickname and optional avatar. People in a view with you see them only if you turn on "Show My Name and Photo in Views" and they pass review; otherwise they see a traveler code that is different in every view.

Content you create

• Photos, stories, comments, questions and answers, "Same here" reactions, and Want-to-Go places.
• Capture details: capture time, compass heading and device orientation, and location if you granted it (see section 3). For photos picked from your library, the photo's own metadata (time, location, direction) when present.
• Photos you take in the app are also saved to your iPhone's Photos library at full quality, with when and where they were taken, unless you turn this off (Settings → Save Originals to Photos). That copy stays on your phone; we never receive it.

Derived data

• Image vectors ("embeddings") computed from your photos to recognize the same spot. They are used only for matching, are never shown to anyone, and are deleted with the photo.
• Spot memberships and match results.

Technical data

• Push notification token (only when you enable notifications), app language, app version and OS version.
• Server logs: IP address, request time and path, and error diagnostics, kept for security and rate limiting.

3. Location

Location is optional. If you allow it, the app records your position at the moment of capture to place the photo and to find matching spots.

• Nobody, including matched members, receives your precise coordinates from our server.
• Discover shows only the photo and a place name (for example "Nanhu Bridge, Changchun"), never the story.
• Place names are derived on your device through Apple's geocoding service. We do not use a server-side geocoding service.

4. Why we use data

Purpose	Data	Legal basis
Provide the service: sync, spot matching	account, content, capture details, embeddings	performance of contract
Show content to others as you chose	content, place names, nickname	contract / your consent
Safety and moderation	content, reports, blocks, logs	legitimate interest, legal obligation
Notifications you enabled	push token	consent
Security and abuse prevention	logs, IP address	legitimate interest

We do not sell personal data, we show no ads, and we do not use your photos to train AI models.

5. Who can see what

Every memory has a visibility setting:

• Only me: private. Not matched, not shown to anyone.
• People at this view: after the photo passes review and matches a view, people who photographed the same spot can see it and your note, and take part in its conversation.
• Show Photo in Discover (a separate switch for shared photos): the photo and place name also appear in Discover for everyone. Notes stay within the view.

A photo you take in the app with location starts as People at this view with Show Photo in Discover on; you can change both before saving and at any time after. Records without an account, without location, or imported from your library stay Only me (an earlier photo added to a view you have joined can be shared with that view).

The rule the app is built on: people who have not been to a spot see only photos and place names; stories, comments and questions open only to matched members.

Shared content is checked before it becomes visible to others. Automated systems review it first; a person reviews anything they are unsure about, every report and every appeal. If we don't publish something, we tell you why, and you can appeal once. Reports, blocks and moderation decisions are stored to keep the community safe.

6. Service providers

• Hosting: our server runs with Hetzner Online in Germany. Your account data, content and photos are stored there.
• Cloudflare: keeps copies of photos (Cloudflare R2, United States) and database backups (Cloudflare R2, Europe), encrypted at rest; delivers photos to the app through its network over short-lived signed links; and forwards email sent to [email protected].
• Apple: Sign in with Apple, push delivery (APNs), and on-device geocoding.
• Expo push service (exp.host): relays notification payloads (title, short text, ids) to Apple when you enable notifications.
• OpenAI (content safety check): receives a copy of shared photos, reduced in size and without location or other metadata, and their text, to detect unsafe content. Under its API terms, this data is not used to train its models.
• Anthropic (content review, when enabled): receives the same reduced photos and text to check them against our community rules. Under its commercial terms, this data is not used to train its models.

Providers act on our instructions and receive only what their function needs. Your data may be processed outside your country; we rely on the providers' contractual safeguards.

7. Retention and deletion

• Content stays until you delete it or delete your account. Deleting a memory removes the photo (including its copies with Cloudflare), story, embeddings and related discussion.
• Delete account (Settings → Account): removes your profile, content, memberships, tokens and sessions, and revokes Sign in with Apple. Removal from the live service is immediate; encrypted backups are rotated out within 14 days.
• Server logs are kept for up to 30 days. Verification codes expire within minutes.
• Moderation records hold the decision, a reason code and automated signals, not copies of your content. They are deleted when the content is deleted, except records of suspected child-safety violations, which we keep for up to one year where the law requires it.
• Local-mode data never leaves your device; deleting the app removes it.

8. Your rights

Depending on where you live (including the EU/EEA, the UK, California and mainland China), you may have the right to access, export, correct, delete or restrict your data, to withdraw consent, and to complain to a supervisory authority. In the app you can export your data (Settings → Export), change visibility at any time, revoke location and notification permissions in iOS Settings, and delete your account. For anything else, email [email protected]; we reply within 30 days.

9. Children

The app is not directed at children under 13, or under the minimum age of digital consent in your region. We do not knowingly collect their data. Contact us if you believe a child has created an account.

10. Security

Data travels over HTTPS. Sessions use short-lived tokens stored in the iOS Keychain. Access to stories, comments and questions is enforced on the server according to the visibility rules above. No method is perfectly secure; if you find a problem, tell us at [email protected].

11. Changes

We post changes on this page and, for material changes, notify you in the app before they take effect.

12. Contact

Xin Song · [email protected]