Privacy Policy

1. Information you provide

Account information. We process your account ID, email address, and the profile details you provide, such as your name, username, avatar, bio, and home country. You can sign in with Apple or email and password. Apple may provide a private relay email address. Email credentials are handled by our authentication provider, Supabase.

Your travel record. We store the trips, dates, destinations, coordinates, journals, notes, checklists, companion names, photos, videos, souvenir scans, scrapbook layouts, visited places, and wishlists you choose to save. Media can include recorded audio and information about when or where it was captured. Signed-in trip and library data, including attached media, is backed up to your account; it is not limited to storage on your device.

Connections and Postcards. We process friend invitations, accepted connections, blocks, Postcard recipients, delivery and sharing status, and notification preferences. We store opened and inbox-removal state for the recipient’s own inbox; we do not give senders read receipts.

Referrals and purchases. We process optional referral codes, attribution and qualification status, credit balances, and earned rewards. The app checks Apple purchase and subscription entitlements to enable Pro. Apple handles payment details; we do not receive your full payment-card information.

Support and older records. If you contact us, we receive your message and anything you attach. Account records may also contain profile statistics, trivia scores, or sharing records saved by earlier app versions, even where those features have been retired.

2. Photos, places, and device permissions

Photo-library scanning is optional. With Photos permission, the app reads accessible photos’ dates and location metadata on your device to suggest places you have visited. The scan itself does not upload your photo library. Places and trips you choose to save from those suggestions can sync to your account. Separately, photos and videos you attach to trips can be uploaded for backup and Postcards.

Camera and microphone access let you capture trip photos, souvenir scans, and video with sound. You can change Photos, Camera, Microphone, and Notifications permissions in iOS Settings. Declining a permission limits the related feature, not unrelated features.

The current app does not continuously track your live location. Place information comes from what you enter or select and from media you choose to use. Location search and maps may send search terms and selected areas to Apple. The app does not request access to your contacts, calendar, health data, or biometric data.

3. Technical information and the website

The app uses account and installation identifiers, local preferences, and authentication tokens to keep you signed in and operate features. If you enable push notifications, we store an Apple push token and delivery information. Notification previews may appear on your lock screen according to your device settings.

We use Sentry for crash reports, app hangs, selected technical errors, and crash-free session health. Reports can include stack traces, device and operating-system details, app version, predefined failure labels, an internal account ID when signed in, and a pseudonymous installation identifier for session health. We filter diagnostic payloads to avoid sending trip content, media, email addresses, and profile names. Session replay, screenshots, and performance tracing are disabled.

Our hosting and infrastructure providers process network information such as IP addresses, request URLs, timestamps, and browser or device details to deliver and secure the service. A website invitation or referral code forms part of the requested URL and may therefore appear in infrastructure logs. Invitation pages do not fetch a person’s identity or trip content; invitation acceptance happens in the app.

We do not use advertising SDKs, cross-app tracking, behavioral advertising, or referral fingerprinting. The website does not embed marketing analytics or advertising cookies. Local storage and authentication state are used where needed for app functionality, not advertising.

4. Why we use information

We use information to operate accounts, save and restore your travel record, provide requested sharing and notifications, check purchases, administer referrals, respond to support and privacy requests, diagnose failures, prevent abuse, and meet legal obligations.

Where European or UK data-protection law applies, we rely on performance of our contract for requested account and app services; legitimate interests for proportionate security, reliability, and support; legal obligations where required; and consent for processing that requires it. Accepting this policy is not blanket consent to every use of data. You can withdraw a consent or permission without affecting earlier lawful processing. We do not use your data for automated decisions that produce legal or similarly significant effects.

5. What other people can see

Your travel record is private to your account unless you choose to share it. Friends and people reviewing an invitation in the app can see the identity details needed to recognize you, such as your name, username, and avatar. Accepting a friendship or entering a referral code does not itself share a trip.

Sending a Postcard gives selected connected friends access to the shared trip’s journal, dates, places, attached photos and videos, and companion names. Later edits to the shared trip can appear in the Postcard. Souvenir scans, scrapbook layouts, and private per-media detail fields are excluded from Postcard delivery. If you separately export and share a scrapbook or image, that exported content goes to the people or services you choose.

You can stop sharing a Postcard. Recipients can remove it from their inbox. Removing a friendship, blocking, or deleting the source trip ends access through the app. Access changes require a successful server update; already loaded content or short-lived media links may remain available briefly. We cannot recall screenshots, downloads, or copies someone has made outside the app.

Referrers see aggregate qualification counts and their own credits and rewards, rather than a list of referred accounts or their trips. A combined invitation can carry both a friend invitation and a referral code; those serve separate purposes.

6. Providers and other disclosures

Supabase provides authentication, databases, storage, and backend processing. Sentry provides technical diagnostics. Vercel hosts joinblue.app. Apple provides Sign in with Apple, App Store billing, push delivery, and map/search services. These providers receive information needed for their respective services; Apple also processes information under its own policies.

We use Google Gmail to receive and respond to support and privacy emails; Google handles the messages, attachments, and related email metadata.

Country-facts features may request public statistics directly from the World Bank API. Those requests identify the country and statistics requested, not your account or private trips; the service also receives ordinary connection information such as your IP address. External websites, exported files, and services you choose to open are governed by their own privacy practices.

We may disclose information where reasonably necessary to comply with law, respond to valid legal process, protect people and the service, or investigate abuse. If the service changes ownership, information may transfer with it subject to applicable law and notice requirements.

We do not sell personal information or share it for cross-context behavioral advertising. We do not provide your travel record to advertisers or data brokers.

7. Retention and deletion

We keep account information and saved content while needed to provide your account and the features you use. You can delete individual trips or request account deletion in Settings. Account deletion schedules permanent removal after a 30-day grace period. You can sign back in during that period and cancel the pending deletion. Deletion clears local app data on the device making the request; it does not delete original photos from your Apple Photos library.

The server removes expired accounts through a scheduled purge. Deleted media may pass through a storage-cleanup queue, so physical removal can follow loss of access. Backups, security records, and records needed to meet legal obligations or resolve disputes may remain for their applicable retention periods. We do not promise that every copy disappears immediately.

Sent push-queue records are scheduled for cleanup once they are more than seven days old. Referral records remain as needed to administer attribution and earned rewards; disabled code names may remain reserved to prevent reassignment. Limited deletion markers can prevent stale device data from restoring deleted trips.

Diagnostics and infrastructure logs follow the providers’ configured retention periods and the needs of troubleshooting and security. Account deletion does not automatically remove previously submitted Sentry reports. Contact us to request removal of diagnostics associated with your account. An account identifier may remain in a restricted record while we handle historical diagnostics deletion and check for delayed reports; we remove that lookup when the work is verified complete. Support correspondence is kept for handling your request and any necessary follow-up.

Deleting the app alone does not delete your cloud account or cancel an Apple subscription. Exports, original media, device backups, and copies you or recipients keep outside Blue Dot remain under their respective owners’ control.

8. Your choices and privacy rights

You can edit your account and travel information, manage connections and sharing, change device permissions, and use Settings → Export Data to download available account records as JSON. This export is not a complete archive of original media files or provider diagnostics; contact us if you need additional information. Settings → Delete Account starts the deletion process described above.

Depending on where you live and which laws apply, you may request access, correction, deletion, a portable copy, or restriction of processing; object to processing based on legitimate interests; and withdraw consent where consent is the basis. California residents may have rights to know the categories and specific information collected, its sources, purposes and recipients, to correct or delete it, and to exercise applicable sale/sharing and sensitive-information rights. We use sensitive information only as needed for the features you request and other legally permitted purposes, not to infer personal characteristics.

Email joinbluedot@gmail.com to make a request, including through an authorized agent where permitted. We may verify your identity and the agent’s authority before disclosing or changing account data. We will respond within applicable legal deadlines and will not discriminate against you for exercising your rights. If a request is refused, you can ask us to reconsider or appeal where available. You may also complain to your local data-protection authority, including an EEA authority or the UK Information Commissioner.

9. Security and international processing

We use encrypted connections and account-based access controls to protect information. No system can guarantee absolute security. Blue Dot’s private account storage is not represented as end-to-end encrypted: our providers process information to operate the service.

Blue Dot is based in the United States, and its primary Supabase database is hosted in the United States. Providers may process information in other countries with different privacy laws. Where applicable law requires safeguards for international transfers, those transfers must be covered by an appropriate legal mechanism, such as an adequacy decision or approved contractual protections. Contact us for information about the safeguards relevant to your data.

10. Children and policy changes

Blue Dot is not directed to children under 13. Users must also meet any higher minimum age required where they live. We do not knowingly collect information from children below that age; contact us if you believe a child has provided information so we can investigate and remove it as appropriate.

We will update the date above when this policy changes and provide additional notice of material changes where required. A new use that requires consent will not be authorized merely by changing this page.

11. Contact

Luke Todd, doing business as Blue Dot — California, United States. Email joinbluedot@gmail.com for privacy requests, support, or questions about this policy.