Privacy policy

What we collect #Link to this section

An account needs a username and a password. Email is optional, used to recover your account and for the few emails listed under Outside services (a password reset, an email change, a trial reminder), and never shown to anyone else. If you open Evergreen checkout, it is also passed to Stripe as your billing email.

• Profile. Whatever you choose to add: an about line, a tagline, a city, an avatar or banner photo.
• Spots. A title, description, category, and a coordinate. A public spot's exact coordinate is shown to every signed-in member, on the map, the spot's page, its directions and the stashes it is in. Signed-out visitors, link previews (a shared link's card and words) and search engines only ever get it rounded to a public grid roughly 50 meters wide. A private spot's exact coordinate is shown only to you as its owner, to the friends you share it with, and to our moderators when they need to check it; nobody else learns it exists.
• Photos and videos. Every photo and video you upload, anywhere in the app, is re-encoded and stripped of embedded location data (EXIF GPS) on our own server before it is stored. The file that ends up on the map or in a post never carries the coordinates your camera or phone recorded.
• Messages, reviews, votes, and posts. The content of anything you send in chat, write as a review, post to the Lounge, or vote for.
• Your connections. Who you have sent a friend request to, who you have accepted, and who you have blocked.
• Alerts. What happened while you were away: a request, a reaction, a vouch ask, a beacon, a badge, with who did it when it was a person. Read alerts are deleted after 30 days; unread ones stay until you read or clear them, and one you dismiss is deleted for good within a day. Messages are not alerts: Crew counts them.
• Today's Gems. Which spots were shown to you as a hidden gem, and on which day, so the same one is not shown twice. Only you see your gems, and each record is deleted after 90 days. If your spot is picked for someone, you get an Alert that says so, never who it was; you can take a spot out of Gems from its edit page.
• Reports. If you report something, we keep the report and your account so a moderator can act on it; if someone reports you, we keep that too, and it is not something your own data export includes, since it is not your data to receive.
• Basic visit counts. Which country a visit came from, roughly when, whether the browser had been here before, which site a first visit arrived from (Reddit, Discord, a search engine), whether it was a phone or a computer, and which part of the app it landed on, each kept as a daily count with no visitor ID attached. The only place any of this is tied to a particular browser is your own session, the same one that keeps you signed in: it clears when you sign out or after about two weeks of not coming back, and nothing in it ever leaves that session to become a record of its own. None of these counts is tied to a person, member or not.
• The days you were here. While you are signed in, the first page you open each day saves one row: your account and the date. No time of day, no page, no address. The staff Overview counts active members and how many come back from these rows, and your data export includes them. Each one is deleted after 35 days, apart from your most recent one, which stays until a newer day replaces it, so the Overview can still tell whether you came back after that. It also reads the time you last signed in, which your account keeps anyway.
• Sign-ins. Each sign-in, and each failed try, is logged with the username typed, the network address it came from, what the browser says it is (its user agent) and the time, and a sign-in also with when it signed out. This is what pauses sign-in after five wrong passwords, and what the staff Overview counts sign-ins and failed tries from. Each entry is deleted after 35 days, or as soon as you delete your account, and your data export includes your own sign-ins.
• Evergreen counts. How often an Evergreen limit stopped something and which limit it was, where a link to the Evergreen page was followed from (the seal, the menu, a limit line), trials started, turned paid or ended unpaid, subscriptions ended and how, checkouts refused or opened without a trial, the reason picked when cancelling, and how often a shared stash was opened. Each is a daily count with no member or visitor ID attached, the same as the visit counts above.

Location, specifically #Link to this section

Your browser only asks you about your position when you tap something that needs it. Once you have allowed it, the map also reads it without a tap to find beacons near you. These are all the places HiFinder uses it, and what happens to it:

• "Fly to me" on the map. Your position moves the map and works out how far each spot is. It stays in your browser, apart from the rounded copy beacons near you use, below.
• Beacons near you on the map and on a spot's page. While you are signed in, and only once your browser already lets HiFinder use your location, the map and a spot's page look for anyone-nearby beacons with your position rounded on your own device to about 1 km. It is used for that one request, so our server sends only the beacons whose reach includes you, and is never logged or kept as a position. We remember only the roughly 50 km square it fell in, in memory for two hours, so a position far from it a moment later is not believed. Without it you still see your own beacons, the ones you said you are on the way to, and the ones your friends light for friends only.
• "Route here" on the map. Your position is rounded on your own device to a point on a grid about 110 m wide before it is sent, then used to ask a free routing service for directions. It is never stored.
• "Share my approximate location." Off by default. Turning it on sends your position, rounded on your device the same way, so members who also share can find each other within a distance you pick, shown to each other in whole kilometres or as under 2 km. A new position can be sent three times a day. Turning it back off clears the stored position outright, not just hides it.
• "I'm here" check-ins and lighting a beacon. These send your position once, so our server can confirm you are really at the spot. Only the answer (close enough or not) and your phone's accuracy figure are kept, never where you stood.

Nothing else on HiFinder reads your location. A spot you add uses wherever you place a pin on the map, not your device's position.

Outside services #Link to this section

A short, complete list, because "we share data with our partners" means nothing. These are the only outside services HiFinder talks to, and what each one gets:

Photo and video screening for policy violations happens on our own server, using our own model. No photo or video is ever sent to an outside service for this. Anything the model holds is then looked at by a human moderator, who makes the actual approve-or-reject call; the model narrows down what needs a look, it does not decide on its own.

If you arrive from one of our Google ads and tick the box when you sign up, we keep only the ad's Google click ID (gclid) and the time you signed up, with the time of the click, not linked to your account, and share only the click ID and the sign-up time with Google, so it knows the ad led to a sign-up. All of it is deleted 90 days after the click. Until you sign up, the click ID only waits in your session on our server; without the tick it is dropped then and nothing is kept.

Cookies #Link to this section

Necessary cookies keep you signed in, remember your 18+ confirmation and protect forms against cross-site requests.

Optional Google Ads measurement. Google’s browser tag loads only after you choose Allow measurement. It runs only on anonymous public introduction, map, Guide and privacy pages, never on signed-in pages, spot pages, profiles, messages or account forms. It receives your IP address, browser details and generic public page addresses. Pages with query strings or private page referrers do not load the tag, apart from Tag Assistant's single non-personal debug signal used to check the setup. We do not send account details, member content, exact locations or a specific spot or profile address. Personalised advertising is disabled.

Google may set first-party advertising measurement cookies, including cookies whose names start with _gcl_. Our _hf_ads cookie remembers your allow or decline choice for six months. Choosing No thanks prevents the browser tag from loading. Changing your choice to No thanks stops future loads and removes the first-party _gcl_ cookies we can remove; it cannot erase information already received by Google.

Change your ad measurement choice. Browsing and membership work whether you allow it or not. The legal basis is your consent. Google Ireland Limited receives the browser measurement and may transfer it to Google LLC in the United States under the EU-US Data Privacy Framework and Google's standard contractual clauses.

The separate Google ad sign-up upload uses its own unticked box when you register. Allowing the browser tag does not tick that box for you, and declining it does not prevent registration.

How long we keep it, and your rights #Link to this section

Your data stays as long as your account exists. From account settings you can, at any time and without asking anyone:

• Download it. A JSON export of everything tied to your account, apart from what is someone else's (reports about you, spots others shared with you, visits others tagged you in) and the secrets behind your sign-in and alerts.
• Correct it. Every field you can set, you can also change, directly.
• Delete it. Typing your own username deletes your account permanently, along with your spots, posts, reviews, votes, and messages. This cannot be undone and we will not recover it for you.
• Turn off what's optional. Location sharing, being listed under "Find people," and appearing on the monthly leaderboard are each their own switch.

Every night an encrypted copy of the whole database is kept for 30 days with GitHub as a backup, so the app can be put back if something breaks. Only HiFinder holds the key that opens it; GitHub stores it without being able to read it. Photos and videos are not in it. Anything deleted, by you or on the schedules on this page, stays in the copies made before it was deleted until they expire, 30 days at most. If a copy is ever put back, anything deleted after that copy was made is deleted again before the app runs on it. The one exception is a failure that destroys the database itself: then what was deleted since the last nightly copy cannot be known, so it cannot be deleted again.

When a free Evergreen trial starts, we keep the date and a one-way fingerprint of your email (and of the one you gave Stripe at checkout), and when you delete an account that ever had Evergreen we keep the same for the email it has then, each for 3 years, even after you delete your account, so the same address never gets a second free trial; the fingerprint cannot be turned back into the address.

If you are in the EU, UK, or California, these are the same rights those laws already give you (GDPR access, correction, and erasure; CCPA know, delete, and opt out); we just built them as ordinary account settings instead of a request you have to email in for.

Legal basis, and where data leaves the EU #Link to this section

For anyone in the EU or UK, here is the specific basis for each thing above, not just the general rights already listed:

• Your account, spots, messages, and everything you post. Processed because you have an account and this is what running it requires (performance of a contract).
• Basic visit counts, the days you were here, the sign-in log, and error monitoring (Sentry). Processed under legitimate interest: keeping the app working and secure, and knowing whether members come back, weighed against how little it actually collects (no visitor ID on visit counts, only a date on the days you were here, kept 35 days apart from your most recent one, sign-ins kept 35 days, no personal data alongside an error report).
• Location sharing, GIFs, sign-in providers, vibe tracks, and beacon alerts. All opt-in; the basis is your own consent, and turning any of them off withdraws it immediately.
• Sign-ups from our Google ads. The basis is your consent (GDPR Article 6(1)(a)), and the only way to give it is to tick the box when you sign up: without the tick nothing is kept. It covers what Outside services describes: the ad's Google click ID (gclid) and the times of the click and of your sign-up, not linked to your account and deleted 90 days after the click. You can withdraw it at any time by asking us (email us at hifinderapp@gmail.com): we delete what we kept, so nothing more about it goes to Google.
• The nightly backups. Processed under legitimate interest: being able to put the app, and your account, back after a failure, weighed against a copy that is encrypted, readable only by HiFinder, and deleted after 30 days.
• Evergreen billing (Stripe), and the trial fingerprint. Processed because it is necessary to fulfil the subscription you chose to buy (performance of a contract), and for the trial fingerprint, legitimate interest in one free trial per email address.

Some of the outside services above sit outside the EU: Sentry, GIPHY, Apple, AWS, Google (sign-in and directions), GitHub (sign-in and the backups), Stripe, and the browser push services are US-based. Resend, which delivers HiFinder's emails, is outside the EU too. Stripe's own EU contract is with its Irish entity, but the data itself is still processed on US infrastructure under the EU-US Data Privacy Framework, the same kind of safeguard the others rely on. If you tick the box for our Google ads, the click ID and sign-up time we share go to Google Ireland Limited, which may pass them to Google LLC in the United States under the EU-US Data Privacy Framework and Google's standard contractual clauses. We do not run any of our own infrastructure outside the EU.

If you believe we have mishandled your data, you can complain to your own country's data protection authority at any time; contacting us first (email us at hifinderapp@gmail.com) is welcome but never a required step before doing so.

Age #Link to this section

HiFinder is for adults aged at least 18 who are also of legal age in their own location, the same rule as the community rules. We ask once, on your first visit, and do not otherwise attempt to verify age beyond that.

Changes to this policy #Link to this section

If what we collect or who we share it with changes, this page changes with it, and the date at the top moves. We will not quietly widen what leaves this app without saying so here first.

Questions, or a request about your data specifically: email us at hifinderapp@gmail.com.