Your photos are NEVER uploaded.
PinPassport does not send your travel photos to our servers, third parties, or AI systems. This rule does not change for any feature.
Privacy
Your photos NEVER leave your phone.
PinPassport does not send photo files, GPS data, photo metadata, or vision analysis outputs to remote services to build your travel memory. Analysis runs on device. Synced data is limited to computed summaries such as country count, city count, and trip count.
Photos are not uploadedGPS stays on phoneVision analysis stays on phoneAI uses safe summaries
GPS and photo metadata NEVER leave.
Date, time, GPS coordinates, and photo metadata are used only on device to build trips.
Vision analysis outputs stay on phone.
Vision cluster data, labels, and local analysis outputs created for Food Memories and Sightseeing Memories are not sent to remote services.
AI does not see photos.
AI Memo Buddy and AI Travel Memo work only with computed and user-approved safe travel summaries.
On-device analysis
PinPassport’s core analysis runs on iPhone.
The app reads metadata such as date, time, and location from the photo library on device. It uses this data to create trips, countries, cities, days, routes, and core stats. Vision analysis also runs on device and creates local clusters for Food Memories and Sightseeing Memories.
During this analysis, the photos themselves, GPS coordinates, photo metadata, and vision analysis outputs are not sent to remote services. They are not shared with AI systems either.
On-device analysis
Photos · GPS metadata · Vision analysis
NEVER leave ↓
PinPassport local analysis
Trips · Countries · Cities · Routes · Food/Sightseeing clusters
computed summaries only ↓
Remote sync
Counts · Scores · Friend stats
Data that stays on phone
Photo files, metadata, GPS, and vision outputs do not go remote.
Photo files, photo metadata, GPS coordinates, vision analysis outputs, local food/sightseeing clusters, and raw route signals stay on the phone. These are not sent to remote sync, friend profiles, global rankings, or AI memo flows.
| Data | Status | Note |
|---|---|---|
| Photo files | Stay on phone | NEVER uploaded |
| Photo metadata | Stay on phone | Date, time, EXIF |
| GPS coordinates | Stay on phone | No remote raw GPS |
| Vision clusters | Stay on phone | Food/Sightseeing |
| Local route details | Stay on phone | No raw GPS |
| Non-AI input data | Not shared | No photo/metadata/vision |
Remote sync
Only computed summary data goes to remote services.
PinPassport may sync computed or user-created summaries such as country count, city count, trip count, visited country/city lists, scores, friend relationships, and profile privacy settings to power social features and leaderboards.
This sync never includes photo files, photo metadata, GPS coordinates, or vision analysis outputs.
| Data | Sync | Purpose |
|---|---|---|
| Country count | Yes | Profile/leaderboard |
| City count | Yes | Profile/leaderboard |
| Trip count | Yes | Profile/leaderboard |
| Visited countries | Yes | Profile/friends |
| Visited cities | Yes | Profile/friends |
| Scores | Yes | Leaderboard |
| Friend relationships | Yes | Social features |
| Profile settings | Yes | Public/private control |
| Yes | Beta notification |
Social visibility
Social visibility is controlled by the user.
Friends can see only computed travel summaries and information the user chooses to share. This includes country count, city count, trip count, visited countries, visited cities, shared travel memos.
If the profile is not public, non-friends cannot see any details.
On a private profile, non-friends cannot see profile details, trip lists, user photo, or personal information. In global rankings, names appear hidden or anonymous.
Public profile makes only summaries visible.
If the user makes the profile public, selected profile information and computed travel summaries may be visible. A public profile still does not make photos, GPS data, photo metadata, or vision analysis visible.
AI privacy
AI does not use your photos or metadata.
AI Memo Buddy and AI Travel Memo do not access the photos themselves, photo metadata, GPS coordinates, or vision analysis outputs. These are not shared with AI systems.
AI uses only the safe trip summary.
The safe trip summary includes photo-separated and reviewable information such as country/city names, travel stats, user-selected place names, ratings, hotel details, and user-added notes.
The user stays in control before sharing.
The AI-generated Travel Memo is not shared automatically. The user sees it, edits it, deletes it, or shares it as is.
AI does not analyze photos in the background.
AI Memo Buddy does not access the photo library or run new vision analysis. It uses only the safe summary data that PinPassport computed on device.
Deletion and permissions
You can close your account and delete your data.
When the user chooses to close the account, PinPassport deletes account, profile, friend, score, and computed sync data stored remotely. Local PinPassport data inside the app can also be cleared. This does not delete original photos in the iPhone Photos app.
Why is photo permission requested?
Photo permission is requested to analyze trips and memories on device. This permission is not used to upload photos to servers.
Why is notification permission requested?
Notifications may be used for beta updates or app reminders requested by the user. Marketing notifications should not be sent without user consent.
Why is email collected?
Email is used for TestFlight slots, beta access, and important release updates. The user must be able to unsubscribe.
Privacy FAQ
Common privacy questions.
No. Photos do not leave the phone for any feature, analysis, sync, social sharing, or AI flow.
No. GPS coordinates are used on device to create trips and routes. Raw GPS data is not sent to remote services.
Vision analysis uses visual signals in photos to create Food Memories and Sightseeing Memories clusters. This analysis runs on device and its outputs are not sent to remote services.
No. AI Memo Buddy does not access the photo library and does not perform metadata or vision analysis. It works only with computed safe travel summaries.
If your profile is not public, non-friends cannot see any details. In global rankings, names and user photos appear hidden.
Your account, profile, friend, and computed sync data stored remotely is deleted. Your original photos in the iPhone Photos app are not deleted.