Privacy policy

01Account and profile

On iPhone, sign in with Apple or verified email. Google is available only for identity verification inside Settings → Sign-in methods and account connections after sign-in; it is not an iPhone login option. On Android, sign in with Google or verified email. Email registration and password reset use a code valid for 10 minutes; check the junk folder if it is missing. No Google account is needed for email sign-in. To use one ShotMap account across platforms, open account connections, verify both identities and confirm the displayed account name and ID. Accounts that both already have content are kept separate and are not automatically merged. Your public profile username is optional, uses 3–30 English letters or numbers, and changes only after approval; your display nickname remains separate. Apple login verifies an identity token and account identifier; we never receive your Apple password. iPhone sessions use Keychain and Android sessions use Android Keystore encryption; the server stores session-token digests. Google verification on iPhone uses the Google Sign-In SDK only inside account binding, with basic identity scopes, without Gmail, Drive or contacts access. Linking requires fresh verification of both identities and explicit confirmation. We retain the provider identifier, link result and necessary audit records. The pixel world map uses bundled public-domain Natural Earth geometry; rendering that overview does not contact a basemap provider.

Android supports Google or verified email sign-in. We process your email for registration, sign-in, verification, password recovery and voluntary account connection. Passwords are stored only as salted scrypt hashes, never in plaintext. Verification codes are stored as keyed hashes, expire after 10 minutes and allow at most five attempts per code. Verification emails are sent through Microsoft Graph using Microsoft 365 supplied by GoDaddy. Microsoft processes the destination address and verification message, not your ShotMap password. OAuth accounts are never matched by email alone. We do not obtain Google passwords or request Gmail, Drive or contacts access.

Android session credentials are encrypted with Android Keystore. Selected photos are copied to app-private local drafts. Closing the app does not clear media cache or drafts. Manual clearing and sign-out clear media cache; drafts remain account-scoped on this device for editing after signing in to the same account. You may delete local drafts. Account deletion clears that account’s drafts and cache on this device.

Your avatar, username, short account ID and optional biography, location, Instagram ID, cover image and appearance settings are used for your profile. Selected avatar and cover files may contain metadata; review them before uploading. Instagram is optional. Following its link opens the Instagram app or website.

On first sign-in, set an avatar and username; manual approval is required before using the app. Later changes to your avatar, username, bio, location, Instagram and background (including crop and opacity) also require review. Approved information stays public while changes are pending. If returned, read the reason, edit and resubmit. The owner can combine permissions for photos and locations, profiles, reports and appeals, and operational status. Ordinary reviewers cannot review their own profiles. Only the owner can explicitly confirm a review of their own profile changes; the decision is recorded in the audit log. Private review copies (avatars, backgrounds, usernames and other submitted fields), versions, submission times, decisions, reasons and audit records are stored on the business server. Only the account holder and authorised profile reviewers can access them before approval. Edits replace the latest candidate; necessary audit records remain. Account deletion removes related profile data; backups rotate on the existing schedule. Privacy visibility settings take effect immediately.

To investigate reports and appeals, we store case identifiers, linked content, participating accounts, reasons, text, source links you provide, decisions, timestamps, read status and necessary audit records on our business server in Singapore. Cases are private: administrators review the evidence; each party sees their own materials and evidence requests addressed to them, and both see decisions. Publishers do not receive the reporter’s identity or private evidence. We do not automatically fetch source links or send photographs to third-party AI detection services. Case forms currently accept text and links, not file attachments; contact support to arrange original-file evidence. Records are retained as needed for disputes and necessary audits. Account deletion removes associated submitted materials; backups rotate under the existing schedule. Do not provide unrelated personal information. Ordinary administrators cannot resolve reports about their own content. Only the platform owner may directly close a report about their own location or work with a required reason shared with both parties and an audit record. Evidence and existing restrictions remain; the reporter retains the normal appeal right. Limits mutual content display while signed in. Public web pages and third-party copies remain accessible. Unblock in Settings.

For app review, we may provide revocable, expiring test accounts. The server stores only salted access-code hashes, records sign-ins and account actions, and rate-limits sign-in attempts. Personal Apple sign-in credentials are never shared.

Only the owner can view the complete directory of avatars, usernames, short IDs and registration times in the management center, and assign or revoke multiple permissions for users who have passed initial profile review. Other administrators cannot access the full directory. Registration times are recorded by the server and are not public on profiles. Older accounts without an original record show “Not recorded”.

Profiles may optionally include Instagram, a Rednote ID and a Rednote profile link, published after review. Blank fields stay hidden. A Rednote profile link opens the profile; an ID alone opens user search and may require installation or sign-in. External services process data under their own privacy policies.

The owner's user directory shows the total number of accounts separately from search results. Tap an avatar or name to view an available public profile; a separate control manages permissions.

Location feedback stores the reporting account, spot, explanation, optional suggested coordinates, creation/read state, correction proposals and review/audit decisions. Creators and authorized content reviewers can access the case; reporter account identifiers are not shown to creators. Public coordinates and address change only after approval. Account deletion removes associated reports. Spot milestone medals derive from the number of currently approved public spots and are publicly displayed; they require no additional location permission.

Connect email, Google or Apple to use the same ShotMap account. Verify both sides and check the name and ID before confirming. Accounts are never matched by email alone. The verified empty account will be retired. Its profile is replaced by the account shown here. Local drafts on this device will be kept. Confirm only if this is your account. Existing works, favorites and account permissions will not be automatically merged or overwritten. Both accounts have content or relationships. They will be kept separately; automatic merging is unavailable.

Verification attempts expire after 10 minutes. We temporarily store a hashed state, nonce, source session and matching account identifiers. An Apple refresh token used to reauthenticate deletion or ownership transfer is encrypted until the attempt expires or is completed; linking does not retain it. We retain an account-link audit action and timestamp. Deleting a linked account requires Apple reauthentication and revocation.

For cross-platform compatibility and account support, we record whether an account has used iOS, Android or both. Only the platform owner can see this in the user directory. No unique device identifier is collected.

Normal use renews your session. Sign in again after 30 days of inactivity or 90 days from login. Signing out, revoking access or resetting your password requires a new login.

02Location, maps and searches

With system permission and the app's location setting enabled, we use location to identify your city and show your position and nearby photography locations. You can deny or revoke access, disable precise location, and continue selecting cities and positions manually. The current app does not request continuous background location or publish a live movement feed.

Map bounds, search terms, query coordinates or city information are sent to the relevant provider and ShotMap server as needed for maps, addresses, weather and nearby locations. A photography location includes the camera position, subject and address you confirm; its exact position becomes public after approval.

Bundled city names and centre coordinates are derived from GeoNames (CC BY 4.0), selected and reorganized by ShotMap. Coverage is incomplete; a city centre is not an exact shooting position. Directory searches do not send queries or location to GeoNames. City search first uses a built-in directory of major cities and alternative names, without a network request. Check the country or region for cities with the same name. Unlisted cities need online lookup. Maps, landmarks and photography locations still need an internet connection after choosing a city.

Camera position and subject position are separate. Search for the subject or tap its exact point and enter a name. A manually selected subject point is saved with the spot. Map-provider coordinates are used only with that provider and cached for up to 30 days; they may need refreshing. Older spots without a saved subject point depend on a successful provider lookup. If it fails, no subject pin is invented; the creator can edit and select the position again.

Android landmark search uses Places SDK for Android 6.0.2 (Places API New), starting only after map-service consent. For weather, the ShotMap server sends the viewed spot coordinates, rounded to about three decimal places, and language to Apple Weather, without your ShotMap ID or login credentials. The server caches weather for about 15 minutes and rate limits requests; private signing keys stay on the server. The app may keep a weather copy for up to 48 hours, showing its source time and a not-refreshed notice. Clear it in cache management. Sun/moon and offline spot time-zone estimates run on the device; boundaries may be inaccurate.

When you choose Save or Share on the world map, ShotMap creates an image of public city coverage. It contains no live location or private account data. iPhone requests permission only to add the chosen image to Photos; Android uses the system file picker or share sheet.

Creators can use Edit spot information to change the camera position and subject on the map. Withdraw a pending new-spot submission before editing.

03Photographs and metadata

The system photo picker gives ShotMap only the files you select; we do not scan your whole library. Selected originals, captions, topics, associated location, capture date and camera details are saved in local drafts and uploaded when you submit them.

Originals may contain GPS, capture dates, camera and lens information, authorship tags and other photo metadata. We read relevant fields to assist placement and capture details and preserve original media, colour and HDR information. Size adjustment requires your confirmation. Remove unwanted metadata before selection or edit supported display fields. Editing a displayed field does not necessarily remove it from the original file.

For a photo over 5MB, you may choose to resize an upload copy. This changes the copy’s pixels and encoding; your photo-library original stays unchanged. The adjustment checks capture details, colour and HDR, and does not use a copy that fails these preservation checks. Files awaiting adjustment may be stored temporarily on this device for processing and retries, and are removed after successful processing, replacement or normal completion of the editing flow. Upload begins only when you submit for review.

1–9 photos per work, up to 5MB each. Originals within the limit are not compressed. Oversized upload copies are adjusted automatically, leaving the photo-library original unchanged. Originals are limited to 100MB and 20 works per UTC day. There is no cumulative account storage limit. New uploads may pause when server space is low, with an explanation.

Multi-photo works show the selected photo count. Every photo must finish loading, size checks and capture-date setup. After upload, the app verifies the server's ordered photo list. If it differs, keep the local draft and contact support.

Shooting notes are reviewed with their work. Published notes also appear in a separate spot section, with three previews and more pages. Tap a note to read its full text in the original work. Works without notes are omitted.

Optionally suggest annual month/day dates, such as March 20–April 10. An earlier end date continues into the following year. Times of day remain separate. Dates are photographer recommendations; actual conditions may vary.

Withdraw a submission to remove or replace individual photos and resubmit for review. Replacement files and confirmed capture information are uploaded to the business server; unchanged originals are not uploaded again. A successful save updates the work and removes superseded server files; a failed edit preserves the previous version. Photo-library originals remain unchanged, and existing backups rotate on their current schedule.

04Public content, moderation and interactions

A new photography location and its first work require joint moderation. Unapproved submissions are available only to their author and authorised administrators. After approval, the location, work, creator profile, capture date and photography information may appear in the app and public sharing pages, including search-engine indexing and third-party share previews.

We record likes, saves, views, notifications, submission states, administrator roles and review actions for statistics and service management. You control whether your profile's saved and liked lists are public. Names of people who liked or saved particular content are restricted to its publisher only.

Original downloads are off by default and can be controlled in settings. Turning them off does not prevent viewing, screenshots or use of copies obtained earlier. If enabled, original downloads can include complete metadata, including GPS.

Each time the login page opens, it randomly selects a photo from approved, publicly visible user works and credits the uploader. The background uses a display copy, does not provide the original or add a work view, and never reads unpublished submissions. A built-in image appears if no eligible photo is available or loading fails. Withdrawn, hidden or restricted photos are excluded from new background requests.

Your optional recommended shooting periods are public spot information; new spots are published after approval. These are creator recommendations, not live sun, moon or weather forecasts.

City pioneer recognition is derived from existing spot authorship, platform city classifications and first-publication records. It requires no additional location access or input. Other people can view the badge, pioneered cities and corresponding public spots. Drafts, unapproved and restricted spots are not publicly listed. Account deletion removes the recognition's user and spot associations. Only an anonymous city reservation without account or spot identifiers remains, preventing a historical first from being incorrectly transferred.

Only the publisher can see who liked or saved their spot or photo; other users and administrators cannot access these lists.

Before approval, a spot contribution is visible only to its author and the spot creator. After approval, its text, author name and submission date are public. Submission, approval, return, withdrawal and removal records are stored for review and disputes; return reasons are private. Account deletion removes that account’s contributions and associated records.

05Third-party services and SDKs

The following services process information according to the features you use and their policies. Listing multiple providers does not mean all information is sent to every provider.

Android tests use Google Maps SDK for Android 19.2.0 and AMap Android map/location/search SDK 11.3.100/11.3.101/9.8.1. Map SDKs initialize only after map consent. They may process map views, queries, coordinates, IP/network, device and SDK-use information; this version does not start continuous background location. Provider availability and licensing must be verified separately.

06Advertisements and external websites

Advertisements may appear before a spot’s photos or below a photo’s shooting parameters. Swipe to change ads. Tap to view the full image and any description; choose Visit advertiser website to open your browser. Rotation pauses with Reduce Motion or when the app is inactive. ShotMap uses no third-party ad SDK or click reporting. External sites have their own privacy policies.

07Storage, logs and retention

ShotMap's business server is currently hosted by Alibaba Cloud in Singapore. Account information, submitted locations and media, interactions and moderation records are stored there. Submitting from mainland China or other regions involves a transfer to Singapore. Map, Apple sign-in and weather providers also process requests through their infrastructure. If you do not want a submission uploaded there, do not submit it and contact us with questions.

Requests generate necessary operational logs such as IP address, time, request path and status code for operation and security. We do not sell personal information. New advertising, marketing or other purposes would require further disclosure.

iPhone edition: Account and submission data are kept as needed to provide the service until a deletion request is processed, subject to applicable retention requirements. Sessions expire. Media caches persist across restarts and can be cleared in settings. Signing out clears relevant media caches but does not delete the account, server submissions or local drafts. We explain the scope and progress of backup and audit-record deletion when handling a request.

iPhone edition: For unreliable connections, the app caches spot-coordinate weather snapshots, source information and confirmed time zones on this device. Old weather may be displayed as fallback for up to 48 hours; confirmed time zones require confirmation again after 30 days. Storage is bounded and removed during rotation or explicit clearing. It survives app restarts, is included in Settings cache information, and is cleared on sign-out. Offline time-zone estimation uses bundled data and sends no location requests to its publisher. Estimates are labelled and checked online when possible.

Reports store targets, reasons, details, status and necessary audit records. Blocks filter signed-in content. Terms acceptance records version and time. Apple authorization codes are used only for server exchange during deletion. Revocation tokens are encrypted; proofs expire after five minutes. Deletion removes your data and media, retaining an internal deletion identifier without Apple identity to prevent re-publication after restore. Daily backups retain the latest seven copies on the operator’s Mac, including profile data and precise positions, protected by local permissions. The Mac must be awake and online.

08Your choices and rights

Account deletion requires fresh authentication with the account’s sign-in provider: Apple accounts also require Apple authorization revocation; Google accounts require choosing the same Google account again. Deleting a ShotMap account does not delete your Apple or Google account. Owners must transfer ownership first. Deletion removes your account, works and profile; shared places with others’ works retain necessary location facts without your attribution. The latest seven Mac backups rotate out; remaining copies and lawful retention are explained when handling deletion requests. Deletions must be replayed before a backup is restored publicly. Questions, appeals and data requests: support@shotmap.app.

You can also contact support@shotmap.app to request access, correction or a copy of personal data, or raise privacy concerns. Include your short account ID and request scope, never your Apple password. After identity verification, we explain progress and any information that must be retained by law.

09Security and necessary disclosure

We use HTTPS, permission checks, private media controls and moderation, and limit administrative access. Internet transmission and copying of public content cannot be absolutely secure. We respond to incidents and provide notices as required. Disclosure is limited to your instructions, providing requested services or legal obligations. If the operator changes, we will notify you and require continued protection.

10Children

The current test service is not directed to children under 14. Minors should use it with a guardian's guidance. Do not publish private locations or others' portraits without permission. Contact us about improperly submitted children's information.

11Changes and contact

We update this policy when SDKs, purposes, storage regions or publication scope change, with appropriate notices and choices where consent is needed. Updating this page does not replace required in-app permission. Contact Anthony Lau, the developer and operator, using the email below.

12Phone notifications and review reminders

On iPhone, opt into phone notifications in Settings and control task/interaction and release notices separately. Apple receives a device notification token and generic notification text; notifications do not include precise locations, photos or report evidence. ShotMap stores the token, language, app build and preferences to notify devices associated with your account. Signing out or disabling notifications unregisters the device. Tokens not registered for 90 days are deleted. Delivery records are retained for seven days and removed on account deletion. Android push is deferred; in-app messages remain available. Reviews outstanding for over five days appear in the platform owner’s queue. Owner takeover decisions are audited.

13City manager applications

Apply from Settings, choose a city and explain why you would like to help. The platform owner or a designated reviewer must approve the request before you can review new spots and photos in that city. Only you and authorized reviewers can read your application.

14Automatic translation

Published spot names, subjects, photo notes and biographies can be automatically translated by Microsoft Translator through ShotMap servers. City and country labels use bundled multilingual names first. Translations may contain errors; refer to the original. Nicknames, user IDs and original content stay unchanged. Original text appears when translation is unavailable. Details: https://www.microsoft.com/en-us/translator/

The server sends only the above published text and target language to Microsoft, excluding passwords, email addresses, local drafts, unreviewed content and photo files. Translation caches expire within seven days; removed content is no longer served.