Privacy Policy

Last updated October 26, 2026

We collect as little as we can, never sell your data, and don't use advertising or tracking cookies. Here is exactly what we keep and why.

What we collect

• Account details: your email address (private, used to log in, to confirm it's yours, and for password resets), your public username, and your password, stored only as a secure hash. If you sign in with Google, we receive your name, email and profile picture from Google instead of a password (see below).
• What you add: stories, "I lived here" entries, places, paths, notes, ratings and reports you submit. Most of this is public by design; reports are only seen by moderators.
• Memories you collect from others: the name you give for the person whose memory it is is shown publicly with the memory, together with your username as the collector. Only add someone's name and memory with their permission.
• Photos you add to stories: we re-save them at a smaller size and remove all hidden metadata, including the GPS location and camera details your phone may have recorded. The photo itself is public with your story.
• Reactions and shares: which reactions you gave a story (tied to your account, or to a one-way hash of your IP address if you're not logged in), and a count of how often each story is shared. Only totals are shown publicly.
• Passport stamps: which places you've stamped and when, and which paths you've completed. Only you can see these; other people see your badges and totals.
• Contact messages you send us, with the name and email you choose to give.
• Technical data: our web server keeps standard logs (IP address, pages requested, browser) for security and to fix problems. For rate limits and duplicate reports we store a one-way hash of your IP address, not the address itself.

Signing in with Google

If you choose Sign in with Google, Google shares your name, email address and profile picture with us, and confirms your email is real. We use them only to create your account and log you in: your email is kept private like any other account email, and we don't post anything to Google or read anything else from your Google account. We never sell this information, use it for advertising, or share it with anyone else. It's deleted when you delete your account, and you can remove our access at any time from your Google account settings. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Your location

When you turn on location, it's used in your browser to show where you are, alert you to nearby places and guide tours. It is sent to our server only when you ask for directions (the route's start point) or collect a stamp (to check you're at the place). We don't store your location history: for a stamp we keep only the place and the time.

Cookies and storage

We set one cookie of our own, to keep you logged in. Your browser also stores your preferences, map position, unfinished path and current tour on your device. We use Google Analytics to count visits and see which pages are used; it sets its own cookies and sends Google your IP address, browser and the pages you view, under Google's privacy policy. You can block it with a content blocker or Google's opt-out add-on. No advertising cookies.

Services we rely on

To show the map and content, your browser connects directly to: OpenStreetMap's tile servers (map images) and Wikimedia (photos). Our server sends searches, and the spot where you drop a pin when adding a story, to OpenStreetMap's Nominatim (address lookups) and route points to Valhalla run by FOSSGIS (directions), and loads place information from Wikipedia and Wikidata. These services see the requests they receive under their own privacy policies. Google Analytics receives page views as described above. Password reset emails are sent from our own server.

How long we keep it

Account data and your contributions stay until you delete them or your account. Server logs are kept for a limited time. Password reset links expire after an hour.

Your choices and rights

• Edit or delete your paths, change your username, or delete your account from your profile. Deleting your account removes your account, paths, ratings, stamps and badges. Stories you posted stay on the places they describe, without your username, unless you ask us to remove them.
• Ask us for a copy of your data, a correction, or deletion of anything else, by emailing hello@herebefore.us or using the contact form. Depending on where you live (for example California or the EU), you may have legal rights to access, correct, delete or move your data, and to complain to a regulator.

Children

The Service isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us information, please contact us and we'll delete it.

Changes

If we change this policy in a meaningful way we'll update the date above and say so on the site.

Contact

Privacy questions or requests: email hello@herebefore.us or use the contact form.