Privacy policy

Urban Secrets is published by Rémi Bernard, the controller of your data. Contact: [email protected].

• Your account: your email address (an Apple relay address if you chose to hide it), your optional nickname or the first name passed on by Apple, your profile photo if you add one, your Apple account identifier and, so that we can revoke it when you delete your account, a token provided by Apple.
• Your sign-ins: the public keys of your passkeys (never the private key, which stays on your devices) and your sessions with the device name (“iPhone”, “Mac”…).
• Your device: what we need to check that requests come from the genuine app and to recognise a device already used by another account (section 5).
• Your language: the app’s language and region (for example en-GB or fr-FR), for your account and for each device, so that your notifications and emails are written in your language.
• What you publish: places (with their coordinates), visit reports (your answers to the form, rating, the place’s condition, comment), photos and videos (including Live Photos and spatial media), as well as your reports of content and the members you block. When you report a demolished place, your note and photo (without its metadata) are seen by the team only; the photo is deleted once the report is handled.
• Your photos and videos: before upload, your device removes their metadata, location included, and blurs the faces and number plates it finds in them: only this blurred version is shown to other members. It also checks, on the device, whether they show a document or a screenshot and, if you turned on your device’s Sensitive Content Warning (or Communication Safety applies to you), nudity or violence; only the result goes with the photo, and a photo caught this way stays hidden until someone from the team reviews it. Finally, we compute a fingerprint of each photo to spot those taken from another report or from elsewhere.
• The original of your photos and videos: we also keep the unblurred version, without metadata. It is never shown to members; it is only used for moderation (spotting a photo taken from elsewhere, the automatic check described below, checking content flagged to the team) and is deleted with the photo or your account.
• The automatic check of what you publish: before anyone else is shown it, everything you publish (texts, photos, frames taken from your videos) is checked automatically by OpenAI’s moderation service (section 6); what was published before this check was introduced is checked afterwards, in the same way. Refused content is not kept; for content set aside, we keep the check’s result (the categories found and their scores) for the team, with the content. The checks made on your device, described above, stay in place.
• Your progression: your XP, tier, trophies and the history of what changed them; your reliability and its history, whose score only the team sees: the app only shows a badge from it, on your profile (sections 6 and 8).
• Your friends: your friendships, requests and invite links, and your member card. An ended friendship is kept for 90 days, so that two related accounts can’t earn rewards for each other.
• Notifications: your devices’ notification identifier, provided by Apple, if you allow them.
• Your purchases: for what you buy on the App Store (Premium, as a subscription or for life with the Founder offer, and scrap), the transactions signed by Apple (the product, its dates, its renewal or refund), and a random identifier belonging to your account, passed to Apple with each purchase to link it to your account. For scrap, your balance and its history (purchases, refunds, items bought in the shop), and the items you own. Payment happens with Apple: we see neither your payment method nor your Apple ID.
• Your card in Apple Wallet, if you add it: a random serial number and the fingerprint of its token, and, for each device that receives it, the identifier Wallet gives it and its notification token, to update it when your card changes. It shows what your member card shows.
• Your activity: the days you use the app (the date only), to measure use in aggregate and for daily rewards.
• Explore mode: the place, the expected return time, the friends going with you, during the exploration only your device’s last position, and at the end a summary of your route (section 3).
• Your safety contact: a friend, or the name and email address of someone you enter. We write to them when the exploration starts, then at the end if an alert was sent, in their own language if they are a friend, otherwise in the language of the app that started the exploration; their details are deleted 7 days after the exploration ends. Only choose someone who has agreed to it.
• The alert chain: with Premium, up to 3 more contacts (friends, or a name and an email address), alerted in turn while the exploration still isn’t ended, each after the delay you choose. Each is told when the exploration starts, alerted in turn and then, once alerted, told if the return time is pushed back and when it ends; their details are deleted 7 days after the exploration ends, with the first contact’s.
• People who no longer want to be a safety contact: every email to a contact holds a link to stop them. We then only keep a fingerprint of their address (never the address itself), so that no one can name it again, until they undo it from the same link.
• Your Saved Places: the places you keep for later, and when you saved them, until you remove them.
• Your expeditions: the title, the dates, the time zone, the stops (spots you unlocked) with the time planned at each, the friends invited and their answer, and the return deadline if you set one. Friends who join see the stops and who is at each; every stop is explored in explore mode, with its own safety contact. With a deadline, the safety contact of the first stop launched is kept for the whole expedition: we write to them once at the start, then if they must be alerted, if the deadline is pushed back after an alert, and when you are back.
• Your albums: for each photo or video of your library kept in your albums (taken in explore mode, picked for a report or added by you), an identifier given by Photos, its type, the spot, the exploration and the day it was taken (never the time or the position), plus your albums (name, order, cover) and your private notes. The photo itself stays on your device and is not sent. “Photos Taken Here” suggestions are worked out on your device from the position Photos recorded, which never leaves it.
• Your group photos: the photos and videos you share to an exploration’s album (with Premium), during the exploration and up to 30 days after it ends. They go through the same steps as report photos (metadata removed, automated checks), without blurring, and are seen only by the members who took part in the exploration; a block hides them both ways.

• Normally, your location shows you on the map and gives the distance to places. It stays on your device. Outside an exploration, the only coordinates sent are those of the places you add, and your location for your leads and your first spots (below).
• For leads, your first spots and the number of spots around you, your location is immediately reduced to a square of about 5 km: only its centre is used, distances are rounded, and the precise location isn’t kept. If no spot is within a lead’s reach, we keep that square to tell you when a spot appears in it; it is erased as soon as you are told, when the lead is used or lost, or when you delete your account.
• During an exploration, and only then, your device’s position is sent so that your safety contact can be alerted with it. If you choose to share it with the group, the friends exploring with you also see it on the map. It is erased when the exploration ends.
• During an expedition with a return deadline, the last position of each stop that ends is kept so the contact can be alerted with it if the group doesn’t come back. It is erased when you are back, or when the expedition ends.
• Nearby spot alerts (off until you turn them on) are worked out on your device: it asks for the areas of about 5 km where one of your leads could open a spot, sending only the large square of about 28 km you are in, never your position, and your device watches those areas itself. The server keeps those large squares for one hour only, in memory, to limit requests.
• The exploration’s first position is used to work out how far from the place you started: we keep that distance, not the position.
• At the end of every exploration, your device sends a summary of your route, computed on the device: the time spent in the place’s area and near its edge, the closest you came to the place or how far into it you went, the length of the route, the number of positions received, whether you stayed still outside the place and, if you allow access to motion data, your steps (pedometer) and the floors you went up or down (barometer). The route itself stays on your device: no raw position is kept on our servers.
• When your device can, this summary is signed with App Attest (section 5). It is used to check that your reports match your visit (section 6).
• An exploration made without a safety contact can be recorded afterwards, within 7 days, with its summary, so that your reports can be linked to it.
• The exploration itself (the place, the dates, who took part, the starting distance and the route summaries, without any position) is kept for 400 days, to link your reports to your visits, recognise related accounts and detect abuse.

• A report is published the day after you send it, for the whole community. Only the day is shown, never the time, so that no one can tell you are on site.
• For each report, you choose whether it is published with your profile or without your name: the default is set in Profile › Settings › Privacy and can be changed at the end of the form. A report published without your name stays linked to your account for the team, rewards and moderation.
• Urgent safety warnings (collapsed floor, flooding, bad air…) are published at once, always without your name.
• A report held for checking (section 6) is visible only to you and the team until a decision is made.

So that each person has a single account and rewards stay fair, we use:

• App Attest (Apple): on iPhone, iPad and Apple Vision Pro, a key belonging to the app (we keep its public key and Apple’s receipt) signs some requests, such as the route summary, to confirm that they come from the genuine app.
• DeviceCheck (Apple): Apple keeps two flags per device for us, which survive reinstalling the app. They are only used to recognise a device that has already been used to create an account, and hold nothing else.
• An install identifier: the app creates a random identifier, kept in your device’s keychain. We only keep a fingerprint of it computed with a secret key, which tells us that two accounts were used on the same device.

Related accounts are friends (including for 90 days after a friendship ends), members who shared at least 2 explorations within 90 days, and accounts used on the same device. Their reports don’t confirm each other and don’t earn each other bonuses; nothing else is limited. These signals are only used to prevent abuse, never for advertising or to follow you.

To keep reports reliable and rewards fair, some calculations are made automatically from your activity:

• XP and tiers: XP counts your activity (reports, photos, explorations…). It goes up with your activity, and only goes down when the team removes content: the XP it earned you is taken back. Your tier depends on your XP, your reliability, your verified reports, the number of different places and your account’s age; it unlocks features of the app. The team can also set a tier.
• Reliability: a score from 0 to 100, starting at 50. It goes up when visitors confirm your reports, and down when several visitors contradict them, when the team takes moderation action on your content, when it dismisses one of your reports of content as plainly abusive, or when it removes another member’s report that had confirmed yours (that confirmation is then cancelled). It weights your reports in a place’s condition and counts towards some tiers. It also decides whether your report of a photo or a video hides it from other members until the team decides: it takes a high enough reliability, and only your first few photo reports in 24 hours hide the photo (later ones still reach the team); the team sets these thresholds and may change them. Your reliability when you file a report is kept with it, for the team. The score itself is not shown, so that it can’t be gamed, but you can ask us for it (section 10). The app only shows a badge from it, “Reliable Reporter” from 70 or “Trusted Reporter” from 85, which changes at most once a week and only after several reports, so that no one can tell what moved the score. It shows on your profile, to you and to the members who can see your tier (section 8).
• Suspicion score: computed for each report when it comes up for publication, from how well your answers match the exploration’s summary (or its absence), a recent or unreliable account, many reports in a short time, impossible travel between two places, reports already contradicted, a device already used by another account, a link with the account that shared the place, and a photo reused from another report, or hidden or removed by the team (not one only set aside by the device’s check). Above a threshold, the report is held automatically: neither published nor rewarded, it shows to you as “pending confirmation”. It is published when a reliable member confirms the place’s condition or when the team approves it.
• Automatic moderation of what you publish: your texts (a place’s name and other details, a report’s note, a comment, your display name, your card’s tagline), your photos (as a reduced copy) and a few frames taken from your videos are sent to OpenAI’s moderation service, without your name, your email address or any account identifier. When your device blurred faces or number plates, it is the unblurred original, faces included, that is sent for this check: the published version stays blurred, and the original stays private, sent only for this check. OpenAI’s service says whether they fall into categories such as sexual content, violence, hate, harassment or self-harm. Explicit sexual content is refused: it is neither published nor kept, and the app tells you at once so that you can change it; this includes an unblurred original that is explicit. Other content it flags is set aside: you see it (“being reviewed”), others don’t, until someone from the team reviews it. If the check can’t run (service unavailable), the content is set aside too and checked again as soon as possible: published if it passes, reviewed by the team if flagged, removed if explicit, in which case you are told. At publication only a few frames of each video are checked; when a member reports a video or a Live Photo (or the report or place that holds it), more of its frames are sent, once, for a fuller check, with the same outcomes: removed if explicit (you are told), set aside for the team if flagged. What was published before this check was introduced (texts, photos and video frames, through their unblurred original when there is one, display name, tagline and profile photo) is checked afterwards, gradually, by the same OpenAI service, and stays visible meanwhile. Explicit sexual content found this way is removed and you are told; other content it flags is hidden from other members until the team reviews it.
• Audit sampling: every week, the team rereads a sample of published reports, drawn at random or among the riskiest, to measure how well the checks work.

No other adverse decision is made without a person: apart from explicit sexual content being refused or removed automatically, a held report or content set aside is never rejected automatically, and removing content, lowering reliability for moderation or suspending an account are decided by the team. You are told when it rejects one of your reports, removes part of one, removes one of your reports, photos or places, or upholds a report about your content with a penalty; the message gives the reason when the team gave one. Content hidden while it is reviewed, or a report of content handled without a penalty, does not trigger a message. You can contest it, ask for a person to review a held report or refused content and give your point of view by writing to [email protected]: we review the decision and answer you.

Only to run the app: your account, the map, sharing your places with the visibility you choose, publishing your reports, your friends, your progression, notifications, moderation and explore mode alerts. The legal basis is the performance of the service you ask for by creating an account. Checking reports, automatic moderation, your device’s signals and related accounts rely on our legitimate interest in keeping the community safe and preventing fake reports and reward abuse; you can object to this by writing to us.

We only email you about the service: your account’s approval, the outcome of a report, a moderation decision about your content, the dismissal of one of your reports as abusive (with the reason the team gave), a safety alert or an invitation you send.

• Other members see your places with the visibility you chose, your published reports (with or without your name, as you chose), your member name, your profile photo and your member card (its number, tagline, trophies and badges). Depending on the “My Tier and Reports” setting (Profile › Settings › Privacy: everyone, your friends or no one), they also see on your profile your tier, your XP, your reliability badge and the number of your visits they can see.
• Our moderation team, to approve accounts and handle reports of content, held reports and photos to check. It also sees route summaries, reliability and related accounts. It only sees a group photo when the automated checks hold it or a member reports it.
• Apple, for Sign in with Apple, notifications, purchases (App Store), your card in Wallet, App Attest, DeviceCheck and maps (Apple Maps). Address searches and map display go through Apple’s services, under Apple’s own privacy policy.
• Our technical providers: the hosting of our servers, Cloudflare to route and protect traffic, and our email server.
• OpenAI, our processor for automatic moderation (section 6), which receives the texts and images to check (for a blurred photo or video, its unblurred original), and nothing else. For customers in the European Economic Area and Switzerland, OpenAI’s data processing addendum (in force since 1 January 2026) is concluded with OpenAI Ireland Ltd, which acts as our processor and processes this data only on our instructions. According to OpenAI’s published data controls, its moderation service keeps nothing of what it is sent, not even for abuse monitoring, and data sent to its API is not used to train its models. We do not use OpenAI’s European data residency (which requires its approval), so the check may be processed in the United States. Transfers outside the European Economic Area and Switzerland to OpenAI’s affiliates or to third parties rely on standard contractual clauses or on an adequacy decision of the European Commission (article 45 GDPR).

We do not sell or rent your data, and we share it with no advertiser.

• Your account and your progression (XP, reliability and their history): until you delete your account. What you publish: until you delete it, then one year hidden (below); your published reports and their photos stay, anonymized, after you delete your account.
• A report, photo or place you delete disappears at once for everyone, you included, but is kept, hidden, forone year: the team can restore it (a deletion by mistake, your request, the review of an abuse). It is then erased for good, text and files. A place other members published a report on is not deleted: you withdraw from it, and it stays visible to them, no longer linked to you.
• Content removed by moderation (the team or the automatic check) or following a legal request is erased without waiting; of a removed photo we only keep a trace without the image (its fingerprint, to spot it being reused elsewhere).
• A session expires after 90 days without use, and after one year at most.
• Explore mode: the position is erased at the end; your safety contacts, the alert chain included, are deleted 7 days later; the exploration and route summaries, without position or contact, 400 days later.
• Expeditions: the last position kept for the deadline is erased when you are back or at the end; the safety contact 7 days after the end; the expedition, without position or contact, 400 days later. A draft never planned is deleted 30 days after its end date.
• Albums: an item’s spot and day are erased when its exploration is deleted (400 days later, or sooner if its organiser deletes their account), unless it is in one of your published reports on that spot; your albums and notes stay until you delete them. Group photos: deleted with the exploration, 400 days after it ends; every member is told 30 and 7 days before, to save the ones they want to keep.
• Leads: the square of about 5 km kept for a waiting lead is erased as soon as a spot appears in it, or when the lead is used or lost.
• Your days of activity and ended friendships: 90 days.
• Your purchases: as long as your account exists. When it’s deleted, they’re no longer linked to you, and a running subscription can join the next account you create. Your scrap, its history and the items bought in the shop are deleted with your account.
• Card in Wallet: voided when you delete your account, then erased within 30 days with the devices that received it. A device that stops checking in for 400 days is forgotten.
• The fingerprint of the address of someone who no longer wants to be a safety contact: until they undo it.
• A report of a demolished place: the photo is deleted once the report is handled, the note with your account.
• App Attest key and install identifier fingerprint: until you delete your account. If the same device was used by another account, they stay linked to that other account only. The two DeviceCheck flags stay with Apple for the device, and may still show that it has already been used to create an account.
• Content refused by automatic moderation is not kept. The result of an automatic check is kept with the content checked; we also record each check (date, kind of content, outcome), without the content itself, for 90 days.
• The log of moderation decisions is kept as a record of the team’s work; once your account is deleted, it is no longer linked to you.
• This website sets a single cookie, and only if you switch language: it remembers the language you chose (for a year), for nothing else. The “Download on the App Store” badge is loaded from Apple’s servers, which therefore receive your IP address and the site’s address (not the page’s path), under Apple’s privacy policy.
• IP address: used in memory for a few minutes to limit abuse (repeated sign-in attempts). The app does not record it; it may appear in the technical logs of our hosting and of Cloudflare, kept for a limited time.

When you delete your account (Profile › Settings › Account › “Delete My Account”), your account (email address, name, profile photo, card), sessions, passkeys and devices, explorations, expeditions (which also disappear for the friends invited), albums, your group photos and those of the explorations you organised, progression, friends, private and friends-only places, Saved Places, unpublished reports, what you had already deleted, the unblurred originals of your photos, your reports of demolished places, your scrap and the items bought in the shop are erased, your card in Wallet is voided, and the app’s access to your Apple identifier is revoked. Your published reports and their photos stay visible to the community, anonymized: they show as published by a “Deleted member”, with no name and no link to you or your account, so that what they say about the places (access, hazards, presence) keeps helping others stay safe. The places you shared with the community stay visible, no longer linked to you; a friends-only place other members published a report on stays visible to them.

Under the GDPR, you can access your data (including your reliability and the reasons for a decision about your content), correct it, delete it, restrict or object to its processing, and ask for a copy in a machine-readable format. You can also ask for a person to review a decision made automatically (section 6). Most of this can be done directly in the app (name, profile photo, account deletion); for the rest, write to us at [email protected]. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Connections are encrypted (HTTPS), sessions rely on tokens of which we only keep a fingerprint, and photos are only served to the members allowed to see them. No system being perfectly secure, we will tell you if a breach affected your data.

Urban Secrets is for people aged 18 and over.

This policy may change along with the app. The date of the last update is shown at the top of this page; we will tell you by email about any significant change.