Footnotes Privacy Policy

Last updated: 24 October 2026

Footnotes is a location-based app that surfaces true stories tied to the place you're standing in, and lets you share the places you've stood with friends you've chosen. This policy explains what Footnotes collects, why, who else sees it, and the choices you have. It is written to match what the app actually does. Plain English first; the legal basis is noted where it matters.

The data controller. Kyra Wells, trading as Footnotes, an individual based in the United Kingdom, is the data controller. Contact: kyra@footnotes.world. Footnotes treats the UK GDPR and EU GDPR as the governing regime.

The one-line version. Footnotes keeps moments, not movements: the places you chose to stand, not a record of where you went.

What Footnotes collects

Your account

Email address and password, or Sign in with Apple or Google. Used to sign you in. Passwords are hashed by Footnotes' authentication provider; Footnotes never sees them. If you continue with Apple or Google, Footnotes receives from them only what you allow: an email address (with Apple's Hide My Email, a private relay address rather than your own). Footnotes does not ask Apple for your name. Google passes on your name and the address of your Google profile picture; both are stored with your sign-in details and not used. The name shown in Footnotes is the one you choose when you create your account. Footnotes never receives your Apple or Google password. If you continue with Apple, Footnotes also keeps a sign-in token from Apple on its own server. It is used for one purpose only: when you delete your account, Footnotes uses it to ask Apple to end the link between your Apple ID and Footnotes. It cannot be read by the app, and it is deleted with your account.
First name and username. Your username is public within the app: it appears on your posts and comments, and anyone who knows it can find your profile and send you a friend request.
Profile picture, if you set one. Please read this carefully: profile pictures are stored in a public storage area. That means the image has a web address that will work for anyone who has it, including people who are not your friends and people without the app. Choose a picture you are comfortable being public. Everything else you upload, your footprint photos, is private (below).
A friend code, generated for you, which you can share to let someone add you.
Your preferences: the topics you're interested in, and story depth.

How findable you are. Your username is searchable. Any signed-in user who types the first few letters of it can see your first name, username, profile picture and friend code, and can send you a friend request. If you and they have friends in common, they can see which. If you want to be hard to find, pick an unguessable username.

Your location

With your permission, Footnotes uses your device location in two modes:

While you're using the app, to show stories near you and to detect when you arrive at one.
In the background ("Always"), if you allow it, so that Footnotes can quietly notify you when you're near a hidden story even when the app is closed.

While you are walking to a story you chose, Footnotes reads your location continuously until you arrive or end the walk, so it can tell you when you get there even with the phone in your pocket. iOS shows its own location indicator for the whole of that walk. This stops the moment the walk ends and never runs otherwise.

How that location is handled, precisely:

The work of deciding what's near you and watching the small geofences around nearby stories happens on your device.
To fetch the set of stories around you, and to check you really are standing at a story before it unlocks, your coordinates are sent to Footnotes' server for that request. They are used to answer that request and are not written to your record. Footnotes does not build or keep a trail of your movements.
Maps in the app are drawn by Apple Maps, built into your iPhone; that happens through Apple's own system frameworks on your device, not through any Footnotes account. Your coordinates are also sent to third parties for specific features you trigger: to OpenRouteService to work out a walking route when you start a hunt, and to Open-Meteo to check whether it is actually raining where you are standing (for the rainy-day badge). These providers receive a location, not your name or account.
A list of stories you have simply walked past is kept only on your phone and is never uploaded. If you delete the app, it goes with it.
One coordinate is stored. When you finish setting up, the app pins a "welcome" footnote at the spot you were standing in, so your first story is your own. That single location is kept with your account, and is deleted when you delete your account.

What you do in the app

Stands (unlock events). When you arrive at a story's spot, Footnotes records which story and when. That is a discrete event, a story id and a timestamp, not a coordinate and not a trail. This is your history.
Footprint photos. If you take a footprint at a story, the app takes a photo with the rear camera and then, after a countdown, automatically takes a second photo with the front (selfie) camera. The two are composed into a single image. Please be aware of who else is in the frame. The footprint is saved to your account as soon as it has been taken, before you choose whether to post it. If you leave without posting, it remains in your History until you delete it there. Footprints are stored in a private area, in a folder that belongs to you, and are shown through short-lived links. Nothing goes into your phone's Photos unless you choose Save to Photos (on a footprint, or in the menu on your own post). Then the app adds the finished picture (the photo with its date, place and story heading) to your Photos. This uses add-only access: Footnotes cannot see, read or search your photo library. iOS asks the first time you choose it, and you can refuse there or withdraw it later in Settings; the footprint is kept in the app either way. Earlier versions of the app also added the finished picture to Photos by themselves when a footprint was saved; updating the app ends that.
Posts. If you share a stand, you create a post: the story and place, the place's coordinates, your caption if you write one, your footprint photo if you attach one, and the time. Posts are visible to your accepted friends only, with one exception you choose: walking together. When you post, you can tag friends you walked with. A tagged friend is asked first, and nothing is shared about them until they accept. If they accept and choose Post it, the walk also appears on their profile and is visible to their accepted friends, who may not be your friends. If they choose Save to History only, it stays private to them and nobody new sees your post. Either way your post shows that you walked with them. A tagged friend can remove themselves at any time, and you can delete the post. There is no public feed and no public setting. Friends see your posts in their feed and as pins on a map of your profile, so a friend can see the map of places you have posted from. Footnotes gives your friends no way to save, export or forward a post of yours: only the author of a post can save its picture to their own Photos. A screenshot is always possible on any phone, so post accordingly.
Comments, likes and reactions, including who made them and when. The author of a post can delete any comment on their own post.
Activity and mentions. When someone likes, comments on, replies to or @-mentions you, Footnotes stores a notification (who did it, what kind, when, and a short preview of their words) and shows it to you when you open the app.
Friendships and blocks. Who you are friends with, and pending requests. Declining a request deletes it. Footnotes does not keep a record, and the person is not told. If you block someone, Footnotes stores that, and it stays until you undo it in Settings. Friends are added by invite link or username search. An invite link carries your friend code, and your username and first name if you have set them, so the person opening it sees who is inviting them. The app may suggest people you might know based on friends you have in common. Footnotes never uploads or reads your phone's contacts.
Saved spots and private notes. Your notes are yours alone. When you save someone's post, the person who wrote it can see that you saved it, though they are not notified.
Reports. If you report a post, Footnotes stores which post, that you were the reporter, and the reason you wrote.
Story feedback. If you flag a problem with a Footnotes story, Footnotes stores the text you send.
App feedback. If you use the Feedback screen in Settings, Footnotes stores the text you send, together with the app version and platform (iOS or Android) so that what you saw can be reproduced.

Technical and diagnostic data

Usage events: a small set of events (app opened, a nudge fired or held back, a nudge tapped, a hunt started, a hunt arrival, a welcome sent) tied to your account id, with the story, the time, and a short technical tag. When the app opens, that event also notes whether your phone lets Footnotes use location (always, only while using, or not at all) and show notifications, so Footnotes can tell when a phone's settings are why nudges are not arriving. Never a coordinate, and never anything you have typed.
Crash and error reports: if the app hits a problem, a diagnostic report (device model, OS version, technical detail of the error). These are not tagged with your account.
Notifications. The nudges that tell you a story is nearby are scheduled and fired on your own device: Footnotes' servers are not told where you are in order to send them. How often they arrive is decided by Footnotes, not by a setting: everyone starts from the same daily limit, and the app then learns, on your device, from which nudges you tap, sending fewer to people who do not open them and a few more to people who do. That record (a count of the nudges tapped and ignored) stays on your phone and is not sent to Footnotes' servers; the usage events described above are the only nudge information the servers keep. For notifications about other people's activity (a friend request, a like, a comment, a reply, an @-mention, a tag in a walk), Footnotes stores a push token for each device you have signed in on, and sends the notification from its servers through Apple's or Google's push service. The token identifies the device, not your location. It is removed when you sign out, and deleting your account deletes it. The daily "Today in London history" notification is scheduled on your device, at 9am local time, for everyone; there is no in-app switch, so turn off Footnotes' notifications in your phone's settings to stop it. Note that a notification's text can name a place or a person's username, so it may be visible on your lock screen to someone standing next to you.
Authentication tokens, held in your device's secure keychain.

What Footnotes deliberately does not do

Footnotes does not store a trail of where you go, only the discrete stories you chose to unlock.
Footnotes does not upload the list of stories you merely walked past.
Footnotes does not read or upload your contacts.
Footnotes does not use advertising or cross-app tracking SDKs, and does not sell your data.
Footnotes does not make anything you post public. Posts are friends-only, always.

Why Footnotes is allowed to use it (legal basis)

Location and notifications: your consent, given through your phone's permission prompts and withdrawable at any time in your phone's settings.
Your account, your stands, footprints, posts, comments, friendships and preferences: to perform the service you asked for (contract).
Reports, moderation, security, rate limiting and abuse prevention: Footnotes' legitimate interest in keeping the service safe, and its legal obligation where one applies.
Usage events and crash reports: Footnotes' legitimate interest in knowing the app works and fixing it when it does not.

Who else processes your data

Footnotes uses a small number of providers, only as needed to run the service:

Supabase: database, authentication and file storage. Holds your account, stands, posts, comments, friendships, preferences, footprint photos and profile picture.
Sentry (servers in Germany): crash and error reports.
Expo (Expo Application Services, servers in the United States): delivers push notifications to your iPhone. Expo receives your device's push token and the text of the notification, which can include the username of the friend whose activity prompted it. Expo does not receive your email address, your location, or the stories you have stood on.
Anthropic (servers in the United States): when feedback is left on a story, the text of that feedback is passed to Anthropic's Claude to separate genuine reports from spam and abuse. Only the story's title and the feedback text are sent; the account that wrote it is not. The outcome decides whether a person reads the feedback, and nothing else.
Google: used server-side, by Footnotes, to place stories on the map when the story library is built. If you choose Continue with Google, Google also confirms your identity to Footnotes each time you sign in that way. Otherwise the app on your device does not talk to Google, and Google never receives anything about your location.
OpenRouteService: when you start a hunt, Footnotes sends the start and destination coordinates to generate a walking route. No account data is sent.
Open-Meteo: when a rainy-day badge is being checked, Footnotes sends a coordinate to ask whether it is raining there. No account data is sent.
Apple: the App Store and TestFlight, Apple Maps, which draws the maps in the app through your iPhone's own system frameworks, and Sign in with Apple, if you choose it.

Footnotes will update this policy before using your data in a materially new way, and will ask for your consent where the law requires it.

Where your data lives. Footnotes' providers may process data outside the UK. Where they do, transfers are covered by the safeguards those providers offer (UK/EU adequacy or standard contractual clauses).

How long Footnotes keeps it

Footnotes keeps your data for as long as your account exists. When you delete your account in the app (Settings → Manage account → Delete account), Footnotes deletes your profile, your stands, your posts and comments, your footprint photos and your profile picture. If you signed in with Apple, Footnotes first asks Apple to end the link between your Apple ID and Footnotes. The token is deleted with your account either way. Backups are retained for a short period and then overwritten.

Two exceptions, stated plainly:

If you deleted a post before deleting your account, that post is hidden from everyone immediately but its row is retained so that the conversation around it does not break mid-thread. It goes when your account goes.
If you type a reason when you delete your account, that reason is kept without any link to you, so that Footnotes can learn from it. Please do not put anything identifying in that box.

Deleting something from your History. You can delete a footnote you unlocked from your History. This deletes the record that you stood there, your footprint photo, and your post from that spot. So that a footnote cannot be deleted and unlocked again over and over, Footnotes keeps a short note that you deleted it (which footnote and when, nothing else) until 2 days have passed, and deletes that note within a day after that.

Your rights

Under UK and EU GDPR you can: access your data, export it (in the app, Settings → Manage account), correct it, delete it (in the app), object to or restrict processing, and withdraw consent (turn off location or notifications in your phone's settings).

To exercise any right, or to raise a concern, contact kyra@footnotes.world. Footnotes will respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.

Other people's data

Footnotes is social, so some of what you create is about other people. When you take a footprint in public, other people may be in the shot. When you comment, your words sit under someone else's post. Please use the app kindly and lawfully: do not post photos of identifiable people who would not want it, and do not post anything that reveals where a specific person lives or works. If something about you appears in Footnotes and should not, tell Footnotes at kyra@footnotes.world and it will be dealt with.

Age

Footnotes is for people aged 16 and over. It is not designed for children and Footnotes does not knowingly collect data from anyone under 16. If you believe a child has an account, email kyra@footnotes.world and Footnotes will remove it.

Security

Data is stored with Footnotes' providers under industry-standard protections. Access to your stands, posts and comments is enforced at the database level: only you, the friends you have accepted, and, for a walk you tagged someone in, the friends of the person who accepted and posted it, can retrieve them. Footprint photos are held in a private area and served through short-lived links. Profile pictures, as noted above, are the one deliberate exception and are public. No system is perfectly secure, but Footnotes takes reasonable measures and will tell you promptly if something goes wrong that affects you.

Automated checks against faked visits. A story unlocks only when you are physically at the place, so Footnotes checks whether a visit was possible: when two of your unlocks are impossibly far apart for the time between them, that pair is recorded as a flag on your account, with the distance and the time gap. This is derived from unlocks Footnotes already holds; it adds no new tracking and no route between them. Flags exist to catch faked visits, they are reviewed by a person, and a flag alone never restricts an account. If Footnotes ever suspends an account, you may write to kyra@footnotes.world to contest it and a person will answer.

Changes

Footnotes will update this page and the date at the top when this policy changes, and surface significant changes in the app.

Contact

Kyra Wells, trading as Footnotes: kyra@footnotes.world

Footnotes