Whereabouts

Privacy Policy

In effect from October 22, 2026.

Whereabouts maps rooms so that anyone can ask where their things are and be guided to them, by voice when they can't see where. This page says what the app keeps, where, who else handles it, and how to delete it. It's written to be read, not skimmed past: if anything in it isn't clear, write to us.

The short version

What stays on your iPhone

The app keeps your spaces on the phone: each room's plan, its map (a file the phone uses to recognize the room again; it isn't a picture and can't be viewed), the names, notes and positions of the things in it, a small photo of each thing, and your settings. These files are protected by iOS data protection, which encrypts them while the phone is locked.

The app asks iOS for permission before it uses the camera (to map and to guide), the microphone (only after you tap the microphone button, until you stop talking or tap it again), speech recognition (to turn what you say into a question), notifications (family alerts) and your location (see Where a room is). Each can be refused or withdrawn in the Settings app; the parts of Whereabouts that don't need it keep working.

Voice commands use Apple's speech recognition. Depending on the language and the phone, Apple may process what you say on its servers; that's covered by Apple's privacy policy, not by this one. The sound of your voice never comes to us. The words do in one case: when something you ask for can't be found, or isn't on any map, that request goes to the room's family as text (see Reports and alerts).

A space can be sent to another iPhone as a file (a .vaspace file). It holds the room's plan, names, notes, map and photos, but never a room's location. Who you send it to is up to you.

What your account keeps

You need an account to map rooms with Claude, to open your rooms on a computer, and to share rooms with your family. Creating one keeps the following with us, under an account ID:

Your email address and password
The address is confirmed with a code we email you, is how rooms are shared with you by name, and is where emails about your account go. The password is kept only as a one-way hash: neither we nor anyone else can read it. The times you sign in are logged by our sign-in service.
Your rooms
Each room's name, its plan (walls, doors, windows and furniture, as measured by the phone and as you've edited it), the things in it (names, notes, categories, measurements and positions, including what's inside drawers and closets and what rests on what), its map file, and the photos the app took while scanning: pictures of the room, close-ups of the insides of drawers and closets, and a small photo of each thing. A photo with a person in it is never kept: the phone checks each picture it takes while scanning, on the phone, and drops any with someone in view, before it's saved or sent anywhere. The scan before the current one (its plan, map and things) is kept with the room, so it can be brought back from the editor; the scan before that is deleted when a new one arrives.
Where a room is (optional)
If you allow location while scanning, the phone records the room's precise position and which way it faces, so the editor on the computer can show the building and floor on a map. It's kept with the room, is seen by anyone you share that room with, and is never put into a .vaspace file. Refuse the location permission, or allow only an approximate one, and nothing is recorded; the room still works everywhere else.
Reports and alerts
When something can't be found, isn't where the map said, or isn't on any map, the phone reports it to the room's owner and to the people who can make changes to the room, with the room, the thing asked for, a short text, the name the reporter typed for themselves (or, if none, the first part of their email), the reporter's account email, and a random ID for that installation of the app, so an alert never goes to the phone the report came from. If you turn on family alerts, the app also registers a push token for your phone (the address Apple's notification service delivers to) and the language the phone uses, so alerts reach the right phones in the right language.
How the app is used
So that we can see what works and what doesn't and keep improving Whereabouts, the app, the editor and this website send our own service a record of what happens in them: the screen opened, a scan started, finished, given up or failed (how long, how many walls and things), a thing asked for and whether it was known, whether the phone brought you to it, a label read or not, a command the app didn't understand and the words it heard (so we can teach it them), a scan paused, the phone getting hot, Done tapped before the room was complete and what was advised, a name said for a thing (how many words, never the name itself), a page of this site opened and which site sent you, and errors with their messages. Each record has a time, the app's version and language, and whether VoiceOver was on. It never includes the names of your things or rooms, your photos, your location, or what you said when the app did understand it. When you're signed in, the records are under your account; when you're not (this website, the editor's sample room), only under a random ID your browser or phone makes up for itself, with the day's hash of your network address to count visitors. They're kept for 180 days, then deleted. In the app, the gear icon, then Share how the app is used, turns this off; the website and editor keep only the visit itself. We use these records only to understand and improve the product, never to make decisions about you.
Your plan
How much mapping you've used, the minutes you've bought, and whether you have Plus. For each request made to Claude from your account, we record which account, which of the app's questions it was (or that it was the editor's assistant), the room or scan it was for, when, and how much of Claude's capacity it used. We don't keep the photo, the question or Claude's answer in that record.

Everything above is kept in a database and file storage hosted for us by Supabase in London, United Kingdom. Photos are in private storage: only the accounts that can see the room a photo belongs to can open it.

Who else handles your data

We use a few services to run Whereabouts. Each one receives only what it needs to do its part.

Anthropic (Claude)
Claude names what's in a scan and lists what's inside drawers and closets. In Find, while its setting is on (it is unless you turn it off), Claude finds a thing the phone's own detector can't see, and when you ask, reads labels. For that, photos taken by the app go through our server, with the room's name, the name of the drawer or shelf a close-up is of, and, when looking for something, its name, its note and where you said it should be (which holds the key to Claude; the phone never has it) to Anthropic's API, which sends back the names, positions and text it found. Under Anthropic's commercial terms, what's sent to its API isn't used to train its models, and is kept only for a limited time for safety monitoring. See Anthropic's privacy policy. You can turn Claude off for scanning, and for Use, under the app's Claude settings; the phone then knows only what its own detector does. In the editor on a computer, Ask sends Claude your questions about a room together with the room's list as the editor has it (the plan, the furniture, the places and items with their names, notes, positions and sizes, and what's inside each; no photos) and the conversation so far, and shows you its answer; nothing of the conversation is kept after it. Trying it in the sample room without an account works the same way, with the sample room's list; to share it out fairly, we keep a hashed form of your network address, changed daily and unreadable back, for a week, with how many questions it asked that day.
Stripe
Minutes and Plus are paid through Stripe payment pages that open in Safari. The app sends Stripe's page your account ID and email, so the payment is for your account and the email on the page can't be changed. Stripe collects your card details and billing information; we never see your card number. Stripe tells us the payment's ID, the amount and how many minutes it was for, or the subscription's ID, its customer ID and its status (active, past due, cancelled), and the email it was paid with, together with your account ID, so the minutes or Plus go to the right account. See Stripe's privacy policy. Stripe also emails you receipts and a link to manage or cancel the subscription.
Apple
The app comes from the App Store or TestFlight, family alerts sent as push notifications are delivered by Apple's push notification service (which sees the alert's text), and voice commands use Apple's speech recognition, all under Apple's privacy policy.
Our email service
The emails that confirm your address and reset your password are sent through an email service, which sees your address and the email's text (a code).

We don't share anything about you with anyone else, except when the law requires it.

Rooms you share

You can share a room with someone's account by their email address, either to see it or to see and change it. They then see everything in that room: its plan, the names and notes of what's in it, its photos, its map, and its location if one was recorded; someone who can make changes also sees the reports about it, and who last changed each thing. They see which account it was shared by. Sharing can be taken back at any time in the editor, and the room then leaves their phones. Rooms can't be made public on this service.

How long we keep it, and deleting your account

Your account and everything in it are kept until you delete the account. To delete it, open the app, tap the gear icon, then Account, then Delete account…. Our server deletes your photos and maps, then your account, with its rooms, the things in them, the reports, the push tokens and your sharing; shared rooms leave the phones they were shared with. If you have Plus, cancel it first (in the app, or with the link in Stripe's emails), because deleting the account wouldn't stop Stripe from charging the subscription; the app says so. You can also email us to have the account deleted.

Your email address is also taken out of other people's rooms, where it was noted as who last saved a map, changed a thing or marked a report done; a copy already on a family phone keeps it until that room next syncs. People who shared rooms with you keep your address in their sharing list until they remove it.

Two things are kept after deletion: the records of the requests made to Claude, with the account removed from them, so our accounts stay right; and a one-way hash of your email address with how much of the free minute was used, so the free minute can't be had again by signing up again with the same address. Neither can be turned back into your email. Our database host's backups may hold a copy of deleted data for a short while after.

The records of how the app is used (above) are kept for 180 days at most; those under your account lose the account when it's deleted and go when their time is up.

On the phone, deleting the app deletes its spaces, maps and photos.

Your choices

You can see and change everything in your account from the app and the editor, and delete it as above. If you want a copy of what we hold about you, or want something corrected or deleted that you can't reach yourself, email us; we'll answer within a month. Where you live may give you further rights over your personal data, and we honor them.

Who at Whereabouts can see your rooms

The people who run Whereabouts (the admins) can look at an account's rooms as they are: the plan, where a room is, the things in it with their names, notes and positions, and the photos, including the close-ups of drawers and closets. They do this to help when something has gone wrong with a room, and to understand how the app is used so it can be made better; not to make decisions about you, and never to share with anyone else. It's read-only: nothing can be changed from there. Every such look is recorded, with who looked, at what, and when; write to us and we'll send you the record of looks at your account. The same people can see the record of how the app is used (above) and your plan and payments.

Security

Everything between the app, the editor and our servers travels over HTTPS. Each account can reach only its own rooms and the rooms shared with it, and the admins theirs (see above); that's decided in the database, not by the app, so a changed copy of the app can't get round it. Photos are in private storage. Passwords are stored as hashes. The keys to Claude and Stripe live only on our servers, never on phones. No system is perfect; if we learn of a breach that affects you, we'll tell you.

Children

Whereabouts isn't directed at children under 13, and we don't knowingly keep an account for one. If you believe a child has made an account, write to us and we'll delete it.

Changes to this policy

If this policy changes, the new version is posted here with its date. For a change that matters to what we keep or who handles it, we email every account before it takes effect.

Contact

Whereabouts is run by its developer. Questions, requests and complaints about privacy: computervision226@gmail.com.