What we collect
- Account: email, name and your password's verifier (never the password itself); with Google or Apple sign-in, the name and email they share.
- Profile: photo, username, bio, age, country, languages you speak, interests, and your choices about who sees which parts of your profile.
- What you share (user content): posts, photos, comments, forum questions and answers, ratings, place and correction suggestions, and messages. What you share publicly (for example forum posts and city photos) is visible to other users; what you share with friends only is visible to your friends.
- Trips: plan requests (city, dates, preferences, free text), the plans you save, visited marks, trip photos, and who you invite (an invite only reaches a friend, who joins by accepting).
- Location (only if you allow it):
- Day mode, visits and trip verification: when you open day mode, your location is shown on the map on your device and used to work out the distance to the next stop. When you mark a stop with "I'm here" or tap "I'm here" on a place page, we check whether you are close to that place; when independent pieces of evidence (a location check-in, live location points or a photo's location) show you were in the city during the trip, the trip becomes "Verified by location". We keep the result (verified, how and when); a location you send waits in the trip only until verification completes. Simulated (mock) locations never verify.
- Live location: on a trip that is under way you can share your location with that trip's members. While it is on we regularly record your position (latitude, longitude, accuracy, time) and draw it as a route. "Pause" records nothing; "in the background too" is a separate choice. It is off by default.
- "There now": travellers whose trip is verified by location can appear in that city's "There now" list during their trip dates. The list shows that you are in the city, never where exactly.
- We collect no location beyond these; in a lobby nobody sees where exactly you are or your room number.
- Photo time and place: when you add a photo to a trip, the time and place it was taken (EXIF) are read on your device and sent to us to verify the trip; the server compares them with the trip's dates and city and keeps neither. The app re-encodes the photo before uploading it, which removes the location data inside it. The same applies to a photo you add to a city: its time and place are read on your device and sent along only so our team can check, while reviewing the photo, that it fits the city; we keep them privately with the pending photo, never show them to anyone else, and the published file carries no location or camera data (we remove it on our servers too).
- AI requests: what you write and choose for a plan, a revision or a forum question is sent to our AI service provider to produce the answer. It goes as the text of the request only: no name, email, account id or other identifier of yours is added to it.
- Purchases: you can buy the Locy Plus subscription (monthly or yearly, auto-renewing) and one-time AI trip packs through the App Store or Google Play; prices are shown in the store for your country before you buy. The store tells us the status of your purchase and subscription and the renewal date; your card and payment details never reach us.
- Bookings: when you book a tour, the name, email and phone the booking needs. Payment is taken on the provider's page, and card details never reach us.
- Device: your device's push notification token to send notifications, a random device id the app creates to count guest plan allowances, your language and region settings, and your IP address for security and abuse prevention.
- Usage statistics (on unless you turn them off): usage statistics are on by default; you can turn them off at any time with the switch in Settings → Privacy (or in the welcome screens), and while they are off nothing is sent. When on, the app reports which cities you search for and open. Our own counts are sent without your sign-in (only whether someone is signed in, so members' and guests' counts stay apart), and our server keeps no individual events: it only adds one to weekly counters per country (your profile's home country, else the country your IP address points to), city and member/guest, with no user id, session id or IP address. The home page orders cities by these counts, reading your IP address's country for that request without storing it. The same switch also controls the product analytics tools we use in the apps and on locy.app's public pages, run by analytics service providers on our behalf. They receive: the names of the screens or pages you open; a short, fixed list of events (such as a city or place opened, a search with its number of results but never its words, a plan made or saved, a trip shared, the Plus page shown or a purchase completed, or a store badge clicked on the website) with city, place, tour or product ids and counts only; program errors on the website (with addresses and email addresses removed); your device model, OS and app version, the app's language and your region (from your device setting, or approximately from your IP address, which is not stored); your plan type and whether you have a business account; and a random identifier for this install or browser, kept on your device (on the website in browser storage and a first-party cookie). On the website they also receive the domain of the site you came from (the domain only, never the full address) and the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign). If you sign in, the apps also send a one-way scrambled code made from your account number (never your account id, name, email or username), so your use on different devices counts as one person; signing out starts a new random identifier. The same identifier may decide which version of some screens you see (experiments); with the switch off you see the usual version. When an AI plan is made, our server also records the job's technical figures (such as duration, size, cost and a success or error code) with the plan's scrambled code, never your identity or the text of your request or plan. Advertising features are off, no session recordings are made, and turning the switch off stops collection and deletes the identifier on your device or browser. No advertising identifiers, no tracking across apps or websites (so the iPhone app never asks for tracking permission) and nothing you typed.
- Crash reports (only if you turn them on): off until you turn them on in the welcome screens or in Settings → Privacy. When the app crashes or hits an unexpected error, it sends the technical details (the error, where in the code, device model, OS version, memory state) with a random installation identifier. Reports are never linked to your account: no user id, name, email, location or anything you wrote.
Why
To provide the service and run your account (performing our contract with you); to generate plans; to keep the community safe (moderation, reports, abuse prevention: legitimate interest); to complete subscriptions and bookings; to meet legal obligations; and to count which cities travellers from each country look at, so the home page can show them, and to understand how the apps are used so we can improve them (legitimate interest: our own counts are anonymous and aggregated, our analytics providers get no account data beyond a one-way scrambled code, and you can turn all of it off in Settings → Privacy). Location and live location are processed only for the features you turn on, based on your permission.
Who processes your data
Service providers (processors). These companies process data only on our behalf, under a contract (a data processing agreement), only as far as needed to run Locy, and may not use it for their own purposes:
- Hosting and email: our cloud provider, in the EU: servers, database, file and photo storage, sign-in and verification emails.
- Photo safety check: every photo you upload is checked automatically by our cloud provider's image moderation service, in the EU, before others can see it. The photo is sent there only for this check (it is not stored there and is not used to train models) and is not linked to your name. Photos the check cannot clear are reviewed by our team.
- AI: an AI service provider generates trip plans and forum answers from the text of your request. It may not use your requests to train models.
- Usage statistics and product analytics (unless you turn usage statistics off): analytics service providers, with their own use of the data and advertising features turned off.
- Crash reports (only if you turn them on): a crash reporting service.
- Notifications: the push notification services of your device's operating system, to deliver notifications to your device.
- Security: a bot protection service that filters automated traffic and may show a check on the website's sign-in.
A list of our service providers is available on request at privacy@locy.app.
Services you choose to use, under their own privacy policies. We pass on only what you ask us to:
- Sign-in: Google and Apple, if you sign in with them.
- Payments: Apple (App Store) and Google (Google Play) sell the subscription and handle billing and refunds.
- Tours and activities: Viator. If you book, your booking details go to Viator to make the booking. When you open a Viator link, we add only our partner id and which part of the app it was opened from, so Viator can pay us a commission; nothing about you. viator.com then sets its own cookies under Viator's privacy policy.
- Maps and photos: map tiles and some place photos load directly from map and photo providers. Like any website, they see your IP address and the map area or photo requested; we send them no location or account data.
Other people, as you choose: live location is visible only to the members of that trip (people who accepted its invite), never to your other friends, followers or the public. If you join a lobby, that accommodation and the other travellers staying there see your profile.
Content sources: some place information and photos come from open-data projects and photo libraries, credited where they are shown. We send none of your data to these sources.
Authorities: only when the law requires it, in response to a valid legal request.
What we never do
- Sell personal data, or share it for cross-context behavioural advertising, in any country.
- Give or rent data to data brokers, advertisers or marketing companies.
- Use an advertising identifier (IDFA, Android advertising ID), third-party ad SDKs or tracking across other companies' apps and websites. Signed-out users see only our own cards labelled "Ad", which are not personalised and use no data about you; once you sign in you see no ads.
- Make decisions about you by automated profiling that have legal or similarly significant effects.
Where your data is stored
Your data is stored in the EU. Some of the providers above may process data outside the EU or your country; where they do, appropriate safeguards (such as EU Standard Contractual Clauses) apply.
How long
- Account and profile data are kept while your account is open.
- Content you delete disappears at once and is removed from backups within a reasonable time.
- When you delete your account your data is deleted within 30 days; records the law requires us to keep (such as subscription and report records) are kept only as long as required.
- Our own usage statistics are only ever stored as anonymous counters; no individual events are kept. Our analytics providers keep event data for at most 90 days, then delete it.
- Server logs and security records (such as your IP address) are kept for up to 30 days. Sign-in security records (the time, IP address and device of each sign-in) are kept for one year, only to investigate attacks on accounts and abuse.
- Live location stops by itself at the end of the trip's last day; the route is kept with the trip so its members can look back on it, and is deleted when you delete it ("Delete my route"), when you leave the trip, when the trip is deleted or when you delete your account.
A copy of your data, and deleting your account
- A copy: write to privacy@locy.app from your account's email address and we will send you your data in a common, machine-readable format.
- Deleting your account: in the app, Profile → Settings → Delete account. Deletion removes your profile, the content you shared and your login (the account itself); if you signed in with Apple, the access Apple gave us is revoked too. If you can't get into the app, use locy.app/en/delete-account. Deleting your account doesn't cancel a Plus subscription in the store; cancel it in the App Store or Google Play as well.
Your rights
Wherever you live, you can ask to access, correct, delete or get a copy of your data, object to or restrict how we use it, and turn off usage statistics and withdraw any consent you gave (crash reports, location) at any time in the app or in your device settings. Write to privacy@locy.app; we answer within the deadline your local law sets, and never later than 30 days. Using your rights never costs you anything or changes the service you get. What your country's law adds:
- EU, EEA and UK (GDPR, UK GDPR): the controller is Majmoon. You can also complain to your data protection authority.
- Türkiye (KVKK): you have the rights in Article 11 of Law No. 6698. Apply to us first; you can then complain to the Personal Data Protection Authority (KVKK).
- California and other US states (CCPA/CPRA and similar laws): we do not sell or share personal information, and we don't use sensitive personal information to infer things about you. You have the right to know, delete and correct, and we won't treat you differently for using them.
- Brazil (LGPD): you have the rights in Article 18, including confirmation, anonymisation and information about sharing; you can complain to the ANPD.
- Canada (PIPEDA): you can access and correct your data and complain to the Office of the Privacy Commissioner of Canada.
- Japan (APPI): you can ask us to disclose, correct, stop using or delete your data; we don't provide it to third parties without your consent except as the law allows.
- South Korea (PIPA): you can ask to access, correct, delete or suspend processing of your data, and complain to the Personal Information Protection Commission.
- Singapore (PDPA): you can access and correct your data and withdraw consent; you can complain to the PDPC.
- India (DPDP Act): you can access, correct and erase your data, nominate someone to act for you, and raise a grievance with us and then the Data Protection Board of India.
Children
Locy is not for children under 13; lobbies are for people 18 and over.
Changes
We may update this policy and will announce material changes in the app. The version date is at the top. We will never change the privacy promise above to allow selling or sharing your data.
Contact
Majmoon, privacy@locy.app