Where TF privacy
Your library stays yours.
Where TF stores your saved items on your device. You choose when to share details or export a copy.
Saved items and media
Names, places, notes, tags, photos, videos, voice notes, and other saved item details live in the app’s local storage. There is no Where TF account, advertising, or third-party analytics.
The app does not automatically upload your library to an app-owned service or synchronize it between devices. Apple device backups and destinations you select in Files are governed by your device settings and the provider you choose.
Permissions and Apple services
Camera and microphone access support photos, video, and voice notes you choose to capture. The system photo picker lets you choose existing media.
Optional map points, directions, and nearby reminders use Apple services and your selected permissions. Apple Maps searches and directions can transmit the request to Apple even though your saved library remains local. Nearby reminders depend on system permission and delivery behavior.
Making a voice note searchable uses on-device speech recognition followed by your review; Where TF does not fall back to hosted recognition. Siri and Shortcuts may transmit information to Apple according to your system settings and the actions you run.
Protected items
Public beta build 1.1 (12) excludes protected content from ordinary item lists, search, Locations, and Shortcuts. Fresh device authentication opens a names-only protected catalog; opening an item’s details requires authentication. If you still use build 1.1 (10), unlocking protected items can also expose them in Locations until they relock. Update to build 1.1 (12). Until then, avoid unlocking around other people and leave the app to relock. Protected items relock when you leave the app, and the app shows a privacy cover in the app switcher.
This access control is not a separate encrypted vault. A complete exported backup includes protected records and media and is unencrypted.
Backups, retention, and deletion
A complete .wheretf backup is unencrypted. You choose its destination through Files; anyone with access to that file may be able to read its contents. Choose a destination and access controls appropriate for your information.
You control local records through item deletion, the in-app reset option, or uninstalling the app, subject to iOS storage and backup behavior. Files-provider backups and copies owned by a recipient remain at their destination until they are deleted there. Removing an item or uninstalling Where TF does not recall those copies.
Import adds copies after validating an archive. Where TF does not offer readable report exports or direct text-and-photo item sharing.
Limited private links
With Plus, you explicitly review and select a copy of an item’s name, written place, optional notes, and any photos, video, or voice note to share. Protected-item sending also requires fresh device authentication. The app encrypts this copy with AES-GCM before temporarily uploading ciphertext to a private Cloudflare R2 bucket through the Where TF sharing service. It does not upload the rest of your library, map coordinates, original filenames, or the encryption key.
The secret needed to decrypt the copy travels in the full link’s URL fragment, which is not sent in the HTTP request. The recipient’s browser, including the viewer inside Where TF, decrypts the selected copy after an explicit Open action. In the app, a recipient may choose Add to my items, review the copy, and Save it locally; viewing alone does not add an item. The key and viewing-session information are retained in that browser tab so a refresh can reuse the session. Anyone with the full link can read and forward the copy while it remains available.
You choose a 3- or 7-day lifetime and an open limit. Access ends at expiry or when no new viewing sessions remain; an existing session may continue until its own deadline or the link’s expiry. Cleanup deletes expired ciphertext and retries failures. An eight-day storage lifecycle is an additional cleanup fallback; physical removal can lag the access deadline. There is no early revocation control. Deleting the original item or uninstalling the app does not delete a recipient’s retained copy.
The service retains opaque share identifiers, ciphertext sizes and digests, timestamps, open/session counts, and quota records to enforce access and capacity. Daily keyed hashes are used for source-address throttling; the application’s quota records do not store raw IP addresses. Cloudflare may process ordinary request metadata, including IP address and user agent, when serving the app’s requests and recipient page. There is no app advertising, tracking SDK, or third-party analytics script on the private viewer.
Copying and pasting a received link
When the shared page offers a copy-and-download action, choosing it copies the full private link to your system clipboard and opens the app download separately. The private link is not added to the App Store destination. Where TF reads the clipboard only when you choose its Paste control.
A validated pasted link is kept in protected app storage excluded from automatic backup and library exports. It waits through relaunch without opening automatically. Saving its received copy or choosing Remove waiting link clears that waiting-link record. Removing it does not clear your system clipboard or other copies of the original message. Your system and other apps may offer their own clipboard features. The saved item becomes part of your library and any complete backup you later choose to export.
Existing basic links
Builds 1.1 (11) and earlier offer basic text links containing encrypted name, place, and selected notes in the URL fragment. No snapshot payload or media is uploaded to that static viewer. Cloudflare Pages serves it and may process ordinary web-request metadata.
Existing basic links remain readable and have no expiry, revocation, or open limit. They do not acquire the new controls when you update. Both kinds of link are independent snapshots and do not update when the original item changes.
Purchases and trial
Apple StoreKit handles the Plus upgrade and trial; Where TF does not collect payment-card details. The lifetime upgrade is configured at a $9.99 US launch price, and Apple shows the regional price for your account.
The zero-price trial lasts 72 hours, permits up to three private-link creations on that device, and does not renew or charge automatically. Saved data stays readable and complete backup stays available after expiry. TestFlight test builds use Apple’s sandbox purchase environment; App Store downloads use Apple’s live purchase environment.
This website and support
Cloudflare hosts this website and may process ordinary request information. See the Around Find Out website privacy notice for hosting and support-email handling.
For a support question, include only the information needed to explain the issue. Do not send a complete backup, private media, or sensitive item details.