Privacy Policy

Introduction

This Privacy Policy explains what Invisible String ("App," "we," "us," or "our") collects, where that information goes, and how long it is kept when you use our mobile app on iOS or Android.

Information We Collect

Information You Provide

• Your Name: Used to identify you to your partner within the App
• Meeting Date: The date you met your partner, used to filter photo matching
• Partner Connection: Information about your connected partner (name, pairing data)

Information Collected Automatically

• Photo Metadata: When you grant photo library access, the App reads the location coordinates and timestamps saved with your photos (and, on iPhone, your videos). This happens on your device. We do not upload, collect, or store your photos on any server.
• On-Device Photo Analysis: To pick a good photo for each moment, the App looks at image content on your device (for example, whether a photo contains faces, text, or scenery). The results of this analysis never leave your device.
• Device and Usage Information: App version, operating system version, device model, and anonymous usage events (see Analytics below)

Information Shared with Your Partner

When you choose to share data with your partner, the following is exchanged:

• Photo location coordinates (latitude/longitude)
• Photo timestamps
• Photo reference IDs (identifiers that point to photos in your library, not the photos themselves)
• Your name
• The date you met

Photo Sharing Between Partners

The iPhone app includes an optional, in-person feature for sharing photos from your matched moments with your partner. If you choose to use it, small previews of the photos you select are sent directly to your partner's phone over an encrypted device-to-device connection. You pick each photo, and your partner must accept before anything is sent. Shared photos are stored only on your two devices. We never receive, access, or store your photos on any server.

How We Use Your Information

We use your information solely to:

1. Find Near-Misses: Compare your photo locations with your partner's to identify times you were in the same place
2. Generate Stories: Create shareable story cards showing your near-miss encounters
3. Improve the App: Understand usage patterns (without accessing personal data)

Data Storage and Security

On-Device Processing

• All photo scanning occurs entirely on your device
• Your photo library is never uploaded to any server
• Near-miss calculations happen locally

Data Encryption

• Invite code transfers are encrypted on your device (AES-256-GCM) before upload, using a key derived from the invite code. Anyone who has the code can decrypt the data until it expires, so share the code only with your partner.
• Nearby transfers (iPhone) use Apple's encrypted peer-to-peer connection between the two phones.
• Exported data files (see File Export below) are not encrypted.

Partner Data Transfer

• We do not operate our own servers, and we keep no user accounts
• Invite Code Pairing (iOS and Android): When you pair using a 6-character invite code, your photo locations and timestamps are encrypted on your device and then held in Google Firebase Realtime Database so your partner can download them. The code expires 12 hours after it is created, and expired records are deleted automatically, always within 48 hours.
• Nearby Pairing (iOS): Data transfers directly between the two phones over Bluetooth/Wi-Fi with no cloud involvement.
• File Export (iOS and Android): If you choose Share File (iOS) or Export Data (Android), the App creates a file containing your name, meeting date, and photo locations and timestamps, and hands it to the app you pick (Messages, email, and so on). This file is not encrypted, so share it only with your partner.
• Apart from the short-lived pairing records above, no copies of your data exist outside your device, your partner's device, and your own device backups

Data Sharing

We do NOT:

• Sell your personal information
• Share your data with advertisers
• Use your photos for anything other than finding and displaying your moments
• Upload your photos to any server
• Access your data without your explicit action

We MAY share information:

• With your connected partner (only the data you explicitly choose to share)
• If required by law (though we have minimal data to provide)
• To protect our rights or safety, or those of others

Third-Party Services

iOS Platform Services

• App Store: Handles app distribution and payment processing
• StoreKit: Manages in-app purchases
• Photos Framework: Provides access to photo metadata (with your permission)
• MapKit and Core Location: Display maps and look up place names. The coordinates of matched moments are sent to Apple to look up place names.

Android Platform Services

• Google Play Store: Handles app distribution and payment processing
• Google Play Billing: Manages in-app purchases
• MediaStore: Provides access to photo metadata (with your permission)
• Google Maps SDK: Displays maps
• Android Geocoder: Looks up place names. The coordinates of matched moments are sent to Google for this.

Google Firebase (Both Platforms)

We use Google Firebase to relay encrypted data between paired partners when you use invite code pairing. Specifically:

• Encrypted data is uploaded to Firebase Realtime Database, stored under a one-way hash of your invite code
• Your photo locations and timestamps are encrypted on your device before they reach Firebase
• Invite codes expire after 12 hours, and expired records are deleted automatically, always within 48 hours
• If you redeem a promo code, the App sends a one-way hash of the code to Firebase to check whether it is valid

Firebase is operated by Google LLC. Data may be processed on Google Cloud infrastructure outside your country of residence. See Firebase's Privacy and Security page for more information.

Analytics

On iOS we use TelemetryDeck, a privacy-focused analytics service, to understand how the app is used. It receives anonymous usage events (such as "scan started" or "story viewed") along with the app version, OS version, and device model. Events are linked to a random installation identifier that is hashed before it leaves your phone, so we cannot tie it back to you. Your name, photos, and locations are never included.

On Android we use Google Analytics for Firebase, which automatically records basic app-usage events (such as first open and session length) along with an app-instance identifier, device model, OS version, and approximate country. Collection of the advertising ID is disabled. Your name, photos, and locations are never included.

Neither service tracks you across other apps, and no advertising networks or data brokers receive your information.

Your Rights and Choices

Access and Control

You can:

• View Your Data: See all stored data within the App
• Delete Your Data: Use "Start Over" in Settings to delete all local data
• Revoke Photo Access: Change permissions in your device's Settings app
• Disconnect from Partner: End the connection and remove your partner's data from your device

Data Portability

Your data is stored on your device (and in your device backups, if you have them turned on) and on your partner's device. You can export your photo locations as a file from the pairing screen.

Opt-Out

You may stop using the App at any time. Deleting the App removes all associated data from your device.

Children's Privacy

The App is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

Data Retention

• Local Data: Stored on your device until you delete it or uninstall the App
• Shared Data: Exists on your device and your partner's device
• Pairing Relay (Firebase): Encrypted invite-code data expires after 12 hours and is deleted automatically, always within 48 hours
• Analytics: Anonymous usage events are retained by TelemetryDeck (iOS) or Google Analytics for Firebase (Android) according to their retention settings

Security Measures

We implement appropriate security measures including:

• Encryption on your device before partner data is uploaded for invite code pairing
• Local-only processing of your photo library
• Photos are only sent when you choose to share previews with your partner in person (iOS)
• Short-lived pairing records that expire automatically

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by:

• Updating the "Last Updated" date
• Posting a notice on this page for material changes

Your continued use of the App after changes constitutes acceptance of the updated policy.

California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect
• Request deletion of your personal information
• Not be discriminated against for exercising your privacy rights

Since we process data locally, keep no user accounts, and only hold short-lived encrypted pairing records, most CCPA requests are satisfied by the App's built-in data deletion features.

International Users

The App processes your photo metadata locally on your device regardless of your location. When you use invite code pairing, your encrypted partner data is briefly relayed through Google Firebase, which may store it on Google Cloud infrastructure outside your country of residence before it is deleted automatically, always within 48 hours.

Summary

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Email: support@invisiblestringapp.com