Privacy Policy

1. In short

Unbeen records your walks and paints the streets you have walked onto the map.

Your walk routes, satellite points and notes are kept on your phone. They reach our server only inside an encrypted copy, which we do not open.

Numbers about your walks and a technical log of how the app works, without coordinates, go to our server. They show us what breaks so we can fix it. One toggle switches this off.

You sign in with Apple, Google, or email and password; on Android, with Google or email (§3.3). Your password never reaches us, the Supabase sign-in service checks it. To the server you are a random player number that your account is linked to. There is no advertising, no advertising identifier and no third-party analytics.

There is an Android version. Its data works the same way, but it has fewer features for now and a different map: how it differs from iPhone is described in §3.14.

Everything that leaves your phone, and where it goes, is listed below. The app has no other paths for sending data anywhere.

2. What stays on your phone only

This never leaves your phone in readable form:

• walk routes and raw satellite points;
• the names of the streets you walked and the places you have been;
• note text; note photos and videos never leave your phone at all;
• where your home is, if you marked it;
• app settings.

The only exceptions are described below: the encrypted copy (§3.6), which we do not open; a route you yourself draw for a group walk (§3.8); "Capture" territories, if you play it (§3.10); reports and pictures you send yourself (§3.1).

3. What leaves your phone, and where it goes

3.1. The Apple map and what you send yourself

The app shows an Apple map (MapKit). Like any app with a map, it requests map imagery from Apple for the area you are looking at. Apple handles that under its own privacy policy.

3.2. City maps

For your line to land on the streets, the app needs a street map of the city: a file of usually a few megabytes, up to 20 MB for the largest cities. The files live in two places: the project's public storage on GitHub (github.com/Efimother/unbeen-citypacks) and the project's storage maps.unbeen.app on Cloudflare. A list of some cities is built into the app. To find a map for a place that is not on that list, the app requests a piece of the catalogue from maps.unbeen.app by the number of a square of roughly 28 by 28 km: your coordinate is not sent. Before installing a map, the phone checks the file's checksum so that the map arrives intact.

• When you open the app, only after asking. If you are in a city whose map is not on your phone yet, the app asks whether to download it. Nothing is downloaded without your "yes". The question comes again when you tap the walk button.
• During a recording, on its own. If you enter another city, the app downloads its map so that counting new streets is not interrupted. This is on by default and can be switched off: Settings → Cities → "Download cities automatically on the go". Maps can also be downloaded and deleted there by hand.

GitHub and Cloudflare receive only the request for the file: the file name shows which city's map or which square was needed, and, like any website, they see the address of your connection. Coordinates, your walk history and your player number are not sent to them.

3.3. Our server and who you are to it

The unbeen.app server runs on Cloudflare. Data is stored in a Supabase database in Frankfurt (Germany).

Who you are to the server. On installation your phone creates a random player number and a secret key. On iPhone the key is kept in your phone's keychain and, if iCloud Keychain is on, there too, so that a new phone with the same Apple ID gets it back. On Android the key is kept in a file on the phone, encrypted with a key from Android's protected storage; it does not go to Google's cloud. From it the phone derives a pass for requests (the server stores only its fingerprint) and a seal for the encrypted copy. Until you sign in to an account, the server never receives the key itself.

Signing in with Apple, Google or email. On iPhone: Apple, Google or email; on Android: Google or email. With Apple or Google you sign in through the system window (on Android the window is shown by the phone's Google Play services), and the phone passes the sign-in token it receives only to our server. With email you register yourself: a nickname, an email address and a password. The email and password go straight to Supabase Auth (the same provider as the database) and the password never reaches us; Supabase sends you an email with a link to confirm your address. The server checks the sign-in token with Supabase Auth. After you sign in we keep: your Supabase user number, which way you signed in, an email hint (first letter and domain, such as m•••@gmail.com; we do not keep Apple's hidden email) and the time of sign-in. Supabase itself keeps its user record: the number and the email and, if you signed in with email, the password as a hash (the password itself is stored nowhere). We do not ask for your name. When you sign in, the phone also sends the server your key; the server keeps it sealed with its own secret and hands it only to you, right after you sign in with the same account on another phone, so that your copy (§3.6) comes back there.

Signing in with email. You can create an account with email: a nickname, your address and a password typed twice. The email and password go straight to Supabase Auth, bypassing our server. Supabase keeps the address and a hash of the password (nobody keeps the password itself) and sends an email with a link to confirm the address, and on "Forgot your password?" an email with a code. The password is not saved on the phone. The phone passes our server only the sign-in token from Supabase; from there it works like signing in with Apple or Google: we keep the Supabase user number, the sign-in method "email", the email hint and the time of sign-in. The nickname from sign-up becomes your profile name (see "Your nickname" below).

Your nickname is the name you entered in your profile or, if there is none, an automatic one such as Otter-03.

Introducing itself to the server. Once a day and whenever something changes, the phone reports: your player number and a random number for the phone within the app, the app version, the phone model, the iOS or Android version, whether notifications are on, your nickname, the app language, the country from your phone's region settings, your time zone and the positions of the "My data" toggles. If statistics are off, once a day the phone reports only the numbers, the app version and the toggle positions, so that the server can ask you to update a version that is too old.

Request log. The server records which address was called, the response, the duration, the size and which Cloudflare location handled the request. Cloudflare sees the address of your connection and uses it to protect against overload; it is not written to our database.

3.4. Statistics and technical log

The "Statistics and technical log" toggle: Settings → Privacy → My data. It is on by default, but nothing is sent until the "What we receive" screen has been shown (it appears soon after the first launch): events wait on the phone and are sent after that screen if the toggle is still on. Switch it off and the queue of unsent items is wiped and nothing more is sent, apart from the introduction in §3.3.

While it is on, the following is sent:

• Numbers about each walk, without coordinates: start and end time, time zone, walking or cycling, distance, how many metres of new and repeated roads, duration, number of points, city (the city map number), experience earned.
• Progress: level, experience, day streak, achievements, tasks, daily spots (when issued and collected, and how far from home: under 500 m, up to 2 km or further), beans and spending, walk promises, the share of streets and districts explored in each city.
• Explored streets not by name but as fingerprints that your phone computes with its own secret: without your phone a fingerprint does not reveal the street. Length, city and date are added to each fingerprint.
• Notes only as numbers: kind (text, photo, video), text length and file size. The content is not sent.
• Purchases with money: which bean pack you bought, the App Store purchase number, the date and any refund; which plan you have. We receive no payment details: Apple handles payment.
• Technical log: which screens are opened and which buttons are tapped, app launch and going to the background, time spent in the app, walk recording events (start, pause, stop, rejected inaccurate points, gaps, save errors) without coordinates, map downloads, changes to permissions and settings, notification delivery, how widgets and the lock screen card work, and Apple's crash and hang reports (MetricKit): the kind of failure and places in the app's code, with none of your data.

As a safeguard, the server strips from the log any field that looks like coordinates, addresses, street names or text.

3.5. Anonymised walk map

The "Anonymised walk map" toggle in "My data" is off by default. Until you switch it on, nothing is sent.

If you switch it on, after a walk the following is sent: the grid squares, about 60 metres on a side, that the track touched; street segments by their numbers in the city map; the hour of the week; the city; and a category: level band (1–4, 5–9, 10–19, 20 and above), walking or cycling, time in the app (under a week, a month, a year, or longer) and country. The server only adds one to the weekly counter of each square or segment. Neither the player number nor the walk number is written into the map, and the request log does not record the player for this address either. Since the 28 September 2026 version the squares are sent with no player number at all: the app attaches a one-time token that the server issues when the app says hello and does not link to you. Older versions send the number and pass; the server checks them only to keep strangers out and stores them nowhere. We may show this street summary to partners.

3.6. Encrypted copy

The "Encrypted copy with us" toggle in "My data" is on by default.

What the copy contains. A copy of your phone's database: walks with routes, note text, progress. Note photos and videos are not included.

How it is protected. Before sending, the phone compresses the copy and encrypts it (AES-GCM) with a seal derived from your key. The server and the developer see only its size, date, checksum, version and number of walks; we do not open the copy. If you signed in to an account (Apple, Google or email), the key is kept by us in sealed form (§3.3) and handed only to you after you sign in. If you never signed in and the key is lost (on iPhone, iCloud Keychain was off and the phone is gone; on Android, the phone is gone or the app was deleted, §3.14), nobody can open the copy, including us.

When it is sent. Only over a network without data limits (Wi-Fi), at most once every 15 minutes, and only if there is at least one walk on the phone.

Where it is kept. In Cloudflare R2 storage, the 7 most recent copies; older ones are deleted. Each night the latest copy of each player is duplicated to Supabase storage in case of failure; a copy that is no longer in R2 is removed from that duplicate the same night.

Getting it back. On iPhone after reinstalling or on a new iPhone with the same Apple ID and iCloud Keychain on, and on any phone after you sign in with the same account, the copy comes back by itself. Moving an atlas between iPhone and Android does not work yet (§3.14). By hand: "My data" → "Restore from our server".

Switching the toggle off stops new copies; copies already stored are deleted by "Delete everything on our side".

3.7. Leaderboard and avatar

The leaderboard is on by default and is switched off with a single toggle: Settings → Privacy → "Take part in the leaderboard".

While it is on, your row is stored on the server and visible to all players: nickname · avatar, if you chose one (a small picture of a drawn animal from the app) · avatar frame · level · experience · number of streets explored · kilometres and number of walks in total, on foot and by bike · average walk length · day streak (a number, not dates) · how many text notes, photos and videos you have (counts only) · kilometres and walks for the current and previous week · time of the last update. The row also carries service fields needed to show it correctly: the player number (random, not tied to your name or phone), labels of the current and previous week, the avatar picture version and the row format version.

Never published: coordinates, routes, your live position, street and city names, the dates of your walks, the content of your notes.

You cannot upload your own photo: the avatar is chosen only from drawn animals. A photo set in earlier versions is deleted by the app from the phone and from the server.

Switch participation off and the row and avatar are deleted from the server. If someone reports a player (§3.11), the developer can hide that player's nickname, avatar and "Capture" territory from everyone.

3.8. Friends, group walks, challenges and gifts

All of this is stored on our server and visible only to the people involved.

• Friendship: both numbers and nicknames, and the date.
• Group walk: title, date and time, city, length, organiser, invitees and their replies, start and end marks. And the route with the coordinates of its points drawn by the organiser: this is the plan for a meeting, not a record of your movement. Only the organiser and the invitees can see it, and only friends can be invited. About two days after the start, the organiser's app erases the route points from the server.
• Shared challenges and one-on-one duels: kind, goal, dates, participants, their replies and progress.
• Bean gifts: who, to whom, when, and whether the gift was accepted.
• Promo codes: which code you redeemed and when.

When the organiser deletes a group walk, it is deleted for everyone; removing a friend ends the friendship for both people.

3.9. Notifications about other people's actions

Notifications such as "someone added you as a friend" or "you are invited for a walk" are delivered by our server through Apple's notification service.

What the notification service keeps (Cloudflare): your phone's notification address, issued by Apple; your player number; your secret notification address; the notification language; your time zone (between 22:00 and 08:00 notifications arrive silently); the time of the last update. Also: who you allowed to write to you and who you blocked, your friend code, one-time invite links (valid until used or for 30 days) and friend requests (valid for 30 days). The hourly notification counter disappears after two hours, the "already delivered" mark after six hours.

A copy in our database for the developer: friendships, requests, codes, a fingerprint of the address (not the address itself) and a log of notifications sent: kind, from whom, to whom, whether delivered and whether opened. Notification texts are not stored.

Who can send you a notification. Only someone you yourself gave your invite link or friend code to and who is your friend. A number from the leaderboard is not enough.

Turning notifications off erases your phone's address. The rest of the record stays, so that friends do not lose you when you turn them back on; "Delete everything on our side" erases it in full. When Apple reports that the app has been removed from the phone, the phone's address is erased automatically. In countries where Cloudflare is blocked, notifications do not work.

3.10. The "Capture" game mode

If you play "Capture", the areas of completed captures, the parts of the city you have enclosed, are stored on the server with the capture time to the minute, your nickname and colour. You receive your own record in full. To other players the server returns only the painted ground in your team's colour: no nickname, photo, player number or capture times, and it cannot be linked to your leaderboard row. In the Capture table you are just "Player" with your share of the city. Your live position and the route itself are not published.

Plainly: from the painted ground, other players can see places where someone from a team walked. Better to close the loop away from home; the mode's introduction says so. "Leave the game" deletes your territory from the server.

3.11. Feedback and reports

"Report a problem" and "Suggest an idea" (these are support requests) send to our database your text, a contact for our reply if you give one, the app version, the iOS or Android version, the phone model, the language and your player number, so that we can reply and look at the technical log.

Reporting a player ("Report") records who reported whom, where (leaderboard, "Capture", friends, requests, shared activities) and when. The developer immediately receives an email with the reported player's nickname and number, sent through Cloudflare to the developer's mailbox, and may hide that player from everyone.

3.12. What remains of Apple's cloud

Until 13 September 2026 the leaderboard, friends, group walks and the backup lived in Apple's cloud (CloudKit). Now:

• the leaderboard, friends, shared activities and "Capture" are stored only on our server; the app no longer reads old friendship records from Apple's cloud;
• a copy of the database is no longer made to your personal iCloud; the encrypted copy (§3.6) replaced it;
• note photos and videos are no longer copied to iCloud: they are kept on the phone only. Those that earlier versions saved to your private iCloud storage stay there, and the app may bring them back to the phone if any are missing. We have no access to that storage. To delete: iPhone Settings → your name → iCloud → Storage → Unbeen;
• the player key is kept in iCloud Keychain (§3.3).

3.13. Who processes data on our behalf

• Cloudflare: the unbeen.app server, the notification service, copy storage, the maps.unbeen.app city map storage, the website.
• Supabase: the database (Frankfurt), the nightly duplicate of the latest copy and signing in with Apple, Google and email (Supabase Auth), including the emails that confirm your address.
• Google: signing in with Google, if you choose it. On Android also Google Play location services: on phones that have them, they determine your position for recording a walk (§3.14).
• OpenFreeMap: map imagery in the Android app (§3.14).
• GitHub: hosts the public city map files and, on our behalf, runs the nightly database backup (GitHub Actions); the data passes through its machines without staying there.
• Grafana Labs (Grafana Cloud): reads the database, read-only, so that the developer can see dashboards; it cannot see the encrypted copies themselves.
• Apple: the map and directions, notification delivery, note photos saved by earlier versions in your own iCloud, in-app purchases, Sign in with Apple. Apple processes payment; we receive no payment details.

Each of them is bound by its data processing terms to protect the data and may not use it for its own purposes. The exceptions are the Apple map, Google Play location services and OpenFreeMap: they work under their own rules, not on our behalf.

3.14. The Android app

The Android version of Unbeen works the same way as on iPhone: walks, routes, satellite points and notes are kept on the phone, and everything said above about what reaches us applies to it too. The differences are these.

The map. Instead of the Apple map, the app shows a map built on OpenStreetMap data. Map imagery for the area you are looking at comes from the open OpenFreeMap service (tiles.openfreemap.org). Like any map service, it sees the address of your connection and the area shown on the screen. It uses no keys or accounts, and your player number is not sent to it. On Android this replaces what §3.1 says about the Apple map.

City maps. On Android a city map is downloaded only after your "yes" or your tap: it is not downloaded on its own while you are on the move recording. The files come from the same two places as on iPhone (§3.2) and are checked against their checksum in the same way. To find a map for the place where you are, the app requests a piece of the catalogue from the project's storage maps.unbeen.app by the number of a square of roughly 28 by 28 km: your coordinate is not sent. In Settings → Cities, when you tap, the app loads the list of countries from there and, when you open a country, the list of its maps. All that leaves the phone then is which country you are interested in.

Location. On phones with Google Play services the app gets your position from them; on others, from Android's built-in location provider. The app sends the coordinates nowhere. How Google's services determine your position is set by your phone's settings and Google's rules. Activity recognition (whether you are walking or riding) is not used on Android: recording starts only when you start it.

Location in the background. The "Allow all the time" permission is optional. The app asks for it when you start a walk and uses it only during a walk you started yourself: if Android closes the app while the screen is off, recording continues and the whole walk is saved. Outside a walk, location is not used in the background. While recording is on, a persistent notification about it stays in the phone's notification shade; you can stop recording right from it.

Not on Android yet: Sign in with Apple, friends, group walks, shared challenges, duels and gifts (§3.8), notifications from our server (§3.9), "Capture" (§3.10), purchases and crash reports. So the data described in those sections is not sent from Android. When any of this arrives, this policy will be updated.

What reaches us from Android: the introduction to the server (§3.3), statistics and the technical log (§3.4), the anonymised walk map if you switched it on (§3.5), the encrypted copy of the app's database (§3.6) if the "Encrypted backup with us" toggle is on (it is on by default, as on iPhone), your leaderboard row and avatar picture (§3.7, details below), and "Report a problem" and "Suggest an idea" requests (§3.11). Like statistics, the copy is not sent before the "What we receive" screen; it is sent only over Wi-Fi or another unmetered network, never while a walk is being recorded and no more than once every 15 minutes; we see only its size, date, number of walks and checksum. As on iPhone, statistics are not sent before the "What we receive" screen and are switched off with one toggle: Settings → Privacy → My data. On Android the technical log also records the phone state that background recording depends on: whether the battery restriction is lifted, whether location is allowed all the time, whether battery saver is on, and whether the screen is on. The log contains no coordinates.

The leaderboard and avatar on Android work the same way as on iPhone (§3.7). Participation is on by default and is switched off with a single toggle: Settings → Privacy → "Take part in the leaderboard". While it is on, your leaderboard row is sent to the server with the same fields as from iPhone, and, if you chose an avatar, its picture too. On Android the avatar is only a drawn animal from the app, a small picture of no more than 9,800 bytes. Your own photo never leaves Android: you cannot set one as your avatar, and the app does not access the phone's gallery. Switch participation off and the row and picture are deleted from the server; remove the animal and the picture is deleted. Special avatar frames are bought with beans earned in the app, not with money: the purchase is recorded in the wallet on the phone and, like any spending of beans, is included in statistics (§3.4) if they are on; the leaderboard row carries only which frame you are wearing. From the leaderboard you can report a player (§3.11) and block them (§3.9): this reaches our server the same way as from iPhone.

Signing in to an account on Android works with Google or email, the same way as on iPhone (§3.3): the Google sign-in token goes only to our server, the email and password go straight to Supabase Auth, and the password never reaches us. If the email to confirm your address or reset your password did not arrive, you can send it again: for now we send only a few emails per hour. You can also sign in later: "Continue without signing in" is always there; the app will then remind you to sign in with a window every few hours and every evening at 19:00 with a notification made on the phone itself (without our server). One account keeps one atlas: if the account's atlas is kept on an iPhone, Android says so and moves nothing; moving an atlas between iPhone and Android will come later.

The player key is kept on the phone, in a file encrypted with a key from Android's protected storage. The encrypted copy is sealed with this key. Until you sign in to an account, the key never leaves the phone. When you sign in, the phone passes it to our server, and the server keeps it sealed with its own secret and hands it only to you, right after you sign in with the same account on a new phone (§3.3, as on iPhone).

No copy in Google's cloud. Android's automatic backup to Google's cloud (Google Drive) and data transfer to a new phone through Google are switched off for Unbeen: the app's data does not go there. To bring your walks back on a new phone or after reinstalling, use the encrypted copy with us (§3.6): sign in with the same account, and the app downloads the copy by itself and opens it with your key. Without signing in, the key is kept only on this phone: deleting the app deletes it too, and the copy can no longer be opened. The copy also brings walks back if the database on the phone is lost while the app stays: Settings → Privacy → My data → Restore from our server. Note photos and videos are not part of the copy.

Note photos and videos are taken with the app's camera and never leave the phone. The microphone is never requested: videos are recorded without sound. The app does not access your phone's gallery.

Permissions on Android:

Deletion. "Delete everything on our side" (Settings → Privacy → My data) erases on the server everything that came from the phone and switches sending off; if you signed in, the account is deleted together with the data. Signed-in users also have "Delete account", as on iPhone (§10). You can also write to support@unbeen.app with your nickname. Data on the phone is erased together with the app.

4. Permissions the app asks for

These are the iPhone permissions; on Android they are different and listed in §3.14.

The camera is used only for notes: the avatar is chosen from drawn animals, and the app does not access your photos. The microphone is never requested: video notes are recorded without sound.

You can revoke any permission in your phone settings. The app keeps working, just without whatever that permission enabled: for example, without location walks are not recorded, while the map, the atlas and everything else still open.

5. What the app does not have

• no passwords on our side: with email sign-in, Supabase Auth checks the password and keeps only its hash;
• no advertising, no advertising identifiers, no tracking across apps;
• no third-party analytics or tracking libraries; we keep the technical log ourselves (§3.4);
• no sale of data. The only thing we may show partners is the anonymised map summary (§3.5), and only from people who switched it on.

6. The unbeen.app website

What the site collects. An email address, and only if you enter it yourself so we can tell you when the app is released. A separate button lets you leave an address for an Android version. Together with the address we store the page language, which version you signed up for (iPhone or Android), the country determined from the address of your connection, and the date, so that we can write to you in your language when the app becomes available in your country.

Why. To send you one email when the app launches. For that and nothing else: there will be no marketing mailings.

Where it is stored. On Cloudflare infrastructure, where the site itself is hosted.

For how long. Until launch plus thirty days, or until you ask us to delete it. After that the address is erased.

Unsubscribing. Every email has an unsubscribe link. You can also simply write to support@unbeen.app and we will delete your address.

The site uses no advertising or analytics cookies.

7. Legal basis

• Statistics and the technical log: our legitimate interest in finding and fixing failures. On by default, no coordinates and no text, opting out is a single toggle.
• The encrypted copy: our legitimate interest in giving your data back after you lose your phone; we do not open it, and opting out is a single toggle.
• Your account (Apple, Google or email) and the stored key: performance of a contract: you sign in so that your atlas comes back on a new phone.
• The anonymised walk map: your consent; only you can switch it on.
• The leaderboard and avatar: our legitimate interest in showing a shared table of pseudonymous results; opting out is a single toggle, after which the row is deleted.
• Friends, group walks, challenges, gifts, purchases, notifications, "Capture", feedback: doing what you yourself asked for.
• Reports and hiding players: our legitimate interest in protecting players from offensive nicknames and titles (the App Store rules require this too).
• The map (Apple on iPhone, OpenFreeMap on Android) and city maps: necessity for the app to work.
• The launch email: your consent via the checkbox in the form, withdrawable at any time.

The app makes no automated decisions with legal effects and does no profiling.

8. How long data is kept

• The technical log and the server request log: 90 days. The log is stored by month, and a month is deleted as a whole once it is 90 days old, so the oldest entries live up to four months.
• Walk numbers, progress, purchases, your leaderboard row, avatar, friendships, shared activities, "Capture" territory, feedback, reports you filed, the notification log, daily usage summaries: until you use "Delete everything on our side" or delete them with the buttons in the app.
• Your account and the sealed key: until you delete the account or use "Delete everything on our side".
• A group walk route: about two days after the walk starts.
• Encrypted copies: the 7 most recent; the nightly duplicate holds only the latest.
• Nightly backups of the whole database (for disaster recovery): 7 daily, 8 weekly and 12 monthly, that is up to a year. After "Delete everything on our side" your data remains in backups already made until they are replaced, no longer than 12 months, and is used only to recover from a disaster.
• The archive before a general progress reset (a full backup of the database and copies): up to 6 months, then deleted by hand.
• The notification service: the phone's address while notifications are on; the rest until "Delete everything on our side". Invite links and friend requests: 30 days, the hourly counter: two hours.
• Reports filed against you by other players, and a moderator's hiding mark: "Delete everything on our side" does not erase these, as they protect other players. If you think the hiding was a mistake, write to us.
• The anonymised map: counters without a player number are kept with no time limit, because they cannot be linked to you.
• Note photos and videos saved by earlier versions in iCloud: until you delete them.
• Your email address from the website: until launch plus thirty days, or until you ask.

9. Where the data physically lives

• Supabase: the database and the nightly duplicate of copies, in Frankfurt, Germany.
• Cloudflare: the server and the notification service run on the network location nearest to you, worldwide. Nightly database backups and the archive are kept in storage bound to the European Union. The encrypted copy storage is not bound to the EU: Cloudflare chooses the location. Transfers outside the EU rely on the EU standard contractual clauses and the EU–U.S. Data Privacy Framework.
• GitHub (map files, the nightly backup run): the United States and other countries; EU standard contractual clauses, and GitHub is certified under the Data Privacy Framework.
• Grafana Cloud: our instance is hosted in Germany.
• Apple's cloud (note photos and videos saved by earlier versions in your iCloud). Data of European users is controlled by Apple Distribution International (Ireland); as Apple itself states, it is stored mainly in the United States under the EU standard contractual clauses.

10. Your rights and how to delete your data

If you are in the European Economic Area or the United Kingdom, you have the right to obtain a copy of your data in a machine-readable form, correct it, delete it, restrict its processing, object to processing, withdraw consent, and lodge a complaint with a supervisory authority.

How to do this in Unbeen:

• "Delete account": Settings → Privacy → Account → "Delete account" (the same button is at the bottom of "My data"). Erases the same as "Delete everything on our side": both buttons erase the account together with the data — the account link, the sealed key and your Supabase user (with the email and the password hash); "Delete account" only asks you to confirm with a word. On Android the path is the same as on iPhone: Settings → Privacy → Account → "Delete account", or the button at the bottom of "My data". Deleting does not cancel a subscription: Apple renews it, and you cancel it in your Apple ID settings (the deletion screen has a "Manage subscription" button).
• "Delete everything on our side": Settings → Privacy → My data. On the server it erases your numbers and progress, purchases, the technical log and request log, your leaderboard row and avatar, your "Capture" territory, friendships, your group walks and challenges (you are removed from the participant list of other people's), feedback with its contact, reports you filed, the log of notifications from and to you, daily usage summaries, the encrypted copies and your record in the notification service: address, friend code, permissions and requests. Sending is switched off. Everything stays on your phone.
• What "Delete everything on our side" does not erase: reports about you from other players and a moderator's hiding mark (they protect other players); nightly database backups already made (up to 12 months) and the archive before a progress reset (up to 6 months), which are replaced and deleted on schedule; the nightly duplicate of the copy is removed the same night.
• Separately: switching off the leaderboard deletes your row and avatar; "Leave the game" deletes your territory; deleting a friend or a group walk deletes it for everyone.
• Data on your phone is deleted walk by walk ("Delete the walk") or together with the app.
• Note photos and videos saved by earlier versions in iCloud: iPhone Settings → your name → iCloud → Storage → Unbeen.
• A copy of your data: write to support@unbeen.app with your nickname; we will send it as a file.
• If you have already deleted the app and data remains on the server, write to support@unbeen.app with your nickname: we will delete it and confirm by email.
• Your email address from the website is deleted on request to support@unbeen.app or via the link in any email.

All the ways to delete your account and data, in the app and without it, are on one page: unbeen.app/en/delete-account.

We answer any request within one month.

The supervisory authority in Portugal is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1º, 1200-651 Lisboa, geral@cnpd.pt; complaints can be filed at cnpd.pt. You may also contact the supervisory authority of your own country.

11. Children

The app is not directed at children under 13, and we deliberately do not collect children's data. If you believe a child has given us their data, write to us and we will delete it. In countries where the age of digital consent is higher than 13, the leaderboard and friends are available from that age.

12. Changes

If this policy changes, the new version will appear on this page with a new date. If a change affects email addresses already collected, we will say so by email.

13. Contact

Maksim Efimov · support and data questions: support@unbeen.app · general: hi@unbeen.app