This policy explains how information is handled in the ohmycity app, on the website and when you contact support. For privacy questions, email albertaz1992@gmail.com.
Travel records stay on your device
Cities, wishlist status, passed-through/visited/lived records, dates, notes, collectible claims and display preferences are stored on your device first. Only after an active Pro member enables iCloud Sync and confirms the merge are visits, dates, notes, collections, wishlist, selected free cities and minimal deletion markers uploaded to the private CloudKit database of your current Apple Account. Once enabled, sync runs automatically when the app is opened or records change, with retries while the app is in the foreground. Immediate sync is not guaranteed while the app is closed. Turning sync off or losing Pro access pauses sync without deleting existing local or cloud records. Display preferences, unfinished actions and Pro purchase credentials are excluded. Our content server does not receive these travel records. The app does not provide a developer-managed account.
Maps and city search
Online maps, extended city search and location lookups use Apple mapping and geocoding services. Relevant search terms or selected places are sent to Apple. Bundled directory searches can run on your device. The app does not track your location in the background or continuously track your movements to award badges.
Sharing, Photos and backups
Content is sent to the selected app, recipient, photo library, file location or your private iCloud only when you export, share or have enabled iCloud sync. Shared images contain the cities, travel status and dates you choose to show, not private notes. Saving images requests add-only Photos access and does not read your photo library. JSON backups may contain places, dates and notes; keep them in a trusted location. Backup imports are processed on your device.
Purchases and restoration
Apple StoreKit handles Pro payments and purchase restoration. The app verifies transaction results to determine paid access and does not receive payment-card details. Apple handles account, payment and refund information under its policies. Data backups do not contain credentials that restore Pro.
Content downloads and the website
Cloudflare hosts the website and content service. Requests send an IP address, request time, URL and necessary device or browser information for delivery and security; the provider's processing and retention policies are linked below. The current city catalog and all badge artwork are bundled for offline use. After launch, the app checks a small update index at most once a day; you can also check in Settings. New catalogs and images download only when you choose Download Update, with cellular downloads off by default. Checks and downloads do not upload travel records, notes or purchase data. Downloads use Apple App Attest to verify the app instance. The authorization service stores a verification key identifier, public key, signature counter and short-lived download allowance. Unregistered verification state expires after three minutes, registered state after 180 days without authorization requests, and download grants after ten minutes. Request bodies and authorization tokens are not logged by the application. Resource updates contain only city catalog data, descriptions and badge artwork, not executable code or new app functionality. The update check shows whether a compatible resource pack is available. Original artwork backups remain in a private R2 bucket with no original-image download feature. There is no advertising tracking or analytics SDK for measuring individual in-app behavior.
Network and security information
Cloudflare processes network metadata to deliver requests and prevent abuse, including IP address, request time, path, response status and necessary device or browser information. Domain-level security analytics may retain sampled requests and aggregate statistics, including the country or region inferred from an IP address. This information supports service operation, troubleshooting and security, not advertising or cross-app tracking. Retention depends on Cloudflare products, plans and security practices; see the official information below. Disabling Worker application logs does not mean the provider retains no network security information. We do not combine these requests with your local travel records, notes or purchase information.
City suggestions you choose to submit
When you submit a city suggestion, the app sends the city name, country or region, administrative area, public place identifier, source, entry point and a one-time request ID to our Cloudflare service to review and plan new cities. It does not include your visits, notes, collection status, purchases, email address or device identifier. Do not enter personal information in city fields. Receipt is confirmed only after server storage succeeds. Previously saved local drafts are not uploaded automatically. Raw suggestions and deduplication receipts are automatically removed within 90 days. IP addresses are used by the provider for network security and request rate limiting, not stored in the suggestion database or linked to content-download verification identities. App usage metrics remain disabled.
Support email
The website has no waitlist, account or email-collection form. Browsing does not collect your email, and support links only open your own email client. Email sent to our Gmail address is used to respond, resolve requests and meet necessary legal obligations, not sold or used for advertising. Email providers may process information outside China. Do not send identity documents, card details or unnecessary sensitive information.
Retention and deletion
Uninstalling removes device records and unsynced changes but does not delete records successfully synced to iCloud. Deleting a visit removes its notes and place details from local records and new exports while retaining minimal deletion markers. Deletions reach iCloud after the next successful sync; they do not propagate while sync is off, Pro access is inactive or sync fails. an earlier cloud copy may still contain records whose deletion has not been synced. You can manage app data in system iCloud storage settings. Manage old exports, shared images and system backups separately. We do not promise forensic erasure from device storage. Support emails are retained only as needed to handle requests and legal obligations; contact us to request deletion.
Your choices and requests
You can leave notes blank, avoid online search, choose not to share and manage Photos permission in system settings. Contact us to ask about, access, correct or request deletion of information you sent, or withdraw consent where applicable. We may request only the verification needed to handle your request. The developer cannot directly inspect, change or recover travel records held only on your device.
Minors and policy updates
Minors should use the app with a guardian and have appropriate authorization for purchases. Do not send children's sensitive information to support; contact us if information was sent by mistake. Material changes to features, providers or data practices will be reflected here with a new date, with additional notice or consent where required. This policy does not limit rights provided by applicable law.