Your places deserve care.

Who this policy covers

This policy applies to the Pee Passport website, installable web app, and any official mobile app that links to it. In this policy, “Pee Passport,” “we,” and “us” refer to the operator of the Pee Passport service.

Information we collect

Account and profile information

When you create an account, we collect your email address, display name, handle, and password. We store a salted password hash rather than your readable password. Your profile can also include initials, avatar color, home description, and bio.

Stamps and location information

When you create a stamp, we collect your device's current latitude and longitude, GPS accuracy when available, device-reported movement speed when available, the capture date and time, terrain type, visibility setting, note, and place information such as neighborhood, city, region, or country. A stamp is always captured from your device's live location after you grant browser or device permission — a stamp cannot be placed on a chosen map spot or given a past date. A stamp captured without connectivity is stored on your device and syncs later with its original capture time. Movement speed is used only to reject obvious in-vehicle territory captures and may be retained with the stamp and a qualifying territory event.

Territories beta

Territory captures are enabled when a new account is created and can be turned off in Passport settings. While enabled, a recent foreground GPS stamp with adequate accuracy can be converted on our server into a fixed game-zone identifier and boundary. We store the current holder, capture and defense times, capture count, and limited capture-event records used for cooldowns, abuse prevention, moderation, and reliable game state. Stale, inaccurate, and offline-queued stamps — and older stamps created before live capture became required — do not capture a territory. Pee Passport does not collect background location for Territories. Browser-provided GPS information can be inaccurate or manipulated, so web Territories is an unranked beta rather than proof that someone physically visited a place.

Social and usage information

We store friend requests and accepted friendships, blocks, reactions, comments, reports, and basic dates associated with accounts, sessions, stamps, territories, and interactions. Comments can be attached to a visible stamp or territory-takeover activity. A report can include its category, your description, the reported profile, stamp, territory, or comment, a snapshot needed to review the issue, review status, and moderator notes. To operate the service, moderators can also view a directory of account display names, handles, join dates, and stamp counts; it never includes stamp locations or coordinates. We also use time-windowed rate-limit counters to prevent abuse. Sign-in and registration counters use a network-derived key; territory and comment counters are tied to the account, reset for a new time window, and are removed when the account is deleted.

Device, network, and local data

Our hosting and map providers may receive standard technical information sent with requests, such as IP address, browser or device type, requested page, and time. The website stores a secure session cookie to keep you signed in for up to 30 days. The official mobile app instead uses a random bearer session token. On iOS, the token is stored in the Apple Keychain; on Android, it is protected with Android Keystore-backed encryption. The native networking layer adds it to requests without exposing it to the embedded web content. Our server stores only a one-way hash of that token together with your account, mobile platform, app build, creation and last-use times, expiration, and any revocation time. Native sessions also expire after up to 30 days and can be revoked by signing out.

Your selected map style is stored locally on your device. The installable web app may cache an offline fallback page.

Optional Flow Challenge

If Flow Challenge is made available for your mobile app build, it is an optional, native-only feature for adults. After you separately confirm that you are at least 18 and consent to the challenge, the rear camera analyzes frames transiently on your device. Pee Passport does not save or upload a photo, video, frame, thumbnail, audio recording, precise location, exact duration, or model-confidence score from a Flow attempt.

A qualifying attempt sends only a capped badge tier, limited app and analyzer information, and cryptographic proof needed to check the result. We retain your consent version and consent, adult-confirmation, update, and withdrawal times; limited device-enrollment verification records such as a hashed credential, platform, app identifier and build, revocation times, and verification state; and pending hashed single-use setup challenges whose validity expires after no more than 30 minutes. An accepted setup challenge is deleted atomically. Replaced, withdrawn, logged-out, expired, or legacy challenge rows are removed by the applicable account action or later database cleanup. An accepted badge challenge is replaced by a tier-independent one-way replay receipt with no timestamp, plus a next-attempt cooldown deadline. We also keep capped, time-windowed verification-attempt counters containing the account, enrollment-or-badge purpose, count, and reset deadline so repeated invalid proofs cannot overload Apple or Google verification. If you earn a badge, we keep only your highest tier, achievement time, analyzer version, and platform. The badge is private and exact duration is never stored.

How we use information

• Provide accounts, stamps, territory game state and authorized takeover activity, maps, passport statistics, rankings, friendships, comments, blocks, reports, and reactions.
• Turn coordinates into broad place names and return place-search results.
• When you opt in to Flow Challenge, verify the app and device, prevent replay or fabricated results, and provide your private capped badge.
• Protect accounts, prevent abuse, troubleshoot failures, and maintain the service.
• Respond to support, privacy, safety, and deletion requests.
• Comply with legal obligations and enforce our Terms and Community Standards.

What other people can see

Your profile visibility can be public, friends, or private. Public profiles show their profile details broadly; friends-only profiles show full details to accepted friends; private profiles show full details only to their owner. A limited identity may still appear when needed to manage a direct pending friend request. Rankings are enabled for new accounts by default and can be turned off in Passport settings. While enabled, signed-in and signed-out visitors can see your display name, handle, avatar, usage badge, and aggregate place counts—including a number of distinct neighborhoods. Those counts may include private stamps, but neighborhood names, private stamp details, and private coordinates are not shown to other people. Owners of public stamps can otherwise be anonymized when their profile is private.

Crossed Streams compares stamp coordinates on our server and identifies accepted friends whose shared stamps are within 50 meters of one of yours. Your Passport names those friends when their qualifying stamp is public or friends-only; their private stamps never qualify. While both people appear in rankings, a Crossed Streams pairing can also appear on public ranking profiles, but only when both qualifying stamps are public. We do not identify which stamps, place, time, or distance matched. Because the connection itself is visible and public profiles can show softened pins, someone may sometimes infer a possible general area. Turning off rankings removes your public pairings. Pairings are recalculated and can disappear after a qualifying stamp is deleted or made less visible, a ranking setting changes, either person blocks the other, or the accepted friendship ends.

First flags mark the first stamp our server ever recorded inside a geographic area, such as a continent, country, state or region, county, city, town, or neighborhood, and they stay with the account that earned them. Your own flags are always visible to you. Other people can see one of your first flags only while the stamp that earned it is visible to them, so flags earned by private stamps stay private to you, and deleting the earning stamp hides its flag from everyone but you. A flag shows the place name and its level, never the stamp itself, its coordinates, or its exact time. Blocks hide flags in both directions. Because first place is decided by when our server received the stamp, back-dating a stamp cannot claim a flag.

You select a visibility level for each stamp:

• Private: visible only to your signed-in account.
• Followers: visible only after a friend request has been accepted. A pending request does not unlock these stamps.
• Public: visible to anyone using the service, including signed-out visitors.

Comments inherit the audience of the stamp or territory activity they are attached to and never make the parent content more visible. A comment also keeps the audience that applied when it was posted, so a later change cannot unexpectedly broaden it. Everyone who can see a comment can see its text, author display name, handle, avatar, and hour-level posting time even when the author's profile is otherwise private. Authors see the exact posting time of their own comments. Blocks hide comments and comment counts in both directions. Comment authors can delete their comments; stamp owners can also remove comments from their own stamps, and moderators can remove reported comments.

Territories has separate capture and holder-identity controls. Captures start enabled for new accounts and can be disabled at any time. Holder identity starts Private: only you see that you hold a zone and everyone else sees a neutral held zone. With Friends, accepted friends can see your identity and eligible territory-takeover activity in their Circle. With Public, anyone can see that you currently hold a zone, while takeover activity remains limited to the Circle feed for accepted friends. When these settings authorize someone to see your holder identity, they may view your currently visible zones together on the map and see their zone count and combined acreage. Neutral zones whose holder identity is hidden are not attributed to you in that summary. A takeover activity can name a former holder only when that person's own territory-identity setting allows it. Blocks override these choices in both directions. Takeover activity uses day-level timing and does not expose the zone or cell identifier, exact capture time, raw GPS reading, accuracy, linked stamp, or capture coordinates.

A Flow Challenge badge is private. It does not appear on your public profile or in rankings, and other users cannot see it.

Service providers and disclosures

We use service providers to operate Pee Passport. They process information under their own terms and privacy practices:

• Railway provides application hosting and database infrastructure.
• OpenStreetMap Nominatim receives coordinates or place-search text from our server to return place information. We cache those results to reduce repeated requests.
• Map providers may include OpenFreeMap, OpenTopoMap, Esri, and MapTiler. Your device requests map styles or tiles from the provider used by the map, which exposes normal network information to that provider.
• Apple App Attest may process cryptographic app-integrity and request-binding information for a Flow Challenge on iOS so we can check that a request came from a legitimate instance of the app.
• Google Play Integrity may process request data, app metadata, licensing status, and device-integrity information for a Flow Challenge on Android so we can check that a request came from the recognized app and device environment.

We may disclose information when reasonably necessary to protect users or the service, investigate abuse, comply with law or valid legal process, or complete a merger, financing, acquisition, or transfer of the service. If ownership changes, this policy continues to apply until users are told otherwise.

We do not currently sell personal information, share it for cross-context behavioral advertising, or use third-party advertising trackers.

Retention and deletion

Account and stamp information remains while your account is active unless you delete it or it is removed for safety, legal, or operational reasons. Web and native sessions expire after up to 30 days, although signing out or deleting your account ends the current session sooner. Cached geocoding results are not linked to your account and may remain after account deletion.

You can delete only your private Flow badge without withdrawing consent. Withdrawing Flow consent immediately revokes active Flow enrollment, deletes pending challenge records, and deletes your private badge. A versioned consent record that includes the withdrawal time, a revoked enrollment verification record, tier-independent one-way replay receipts with no timestamp, the next-attempt cooldown deadline, and any verification-attempt counter and reset deadline remain with your account to document your choice and protect the challenge from abuse. Expired counters may remain until later database cleanup. Deleting your account removes those Flow records as well.

Deleting your account removes your profile, account credentials, active sessions, stamps, friend relationships, blocks, reactions, and authored comments from the active database. Deleting a stamp also deletes its comment thread. Account deletion releases territories you hold and detaches your identity from retained capture-event records, making associated takeover conversations inaccessible when no authorized parent activity remains. Limited report records and evidence may be retained when reasonably needed for safety, abuse prevention, legal compliance, or an audit; direct account references are detached when the account is deleted, but a report's target identifier or content snapshot may remain. Hosting providers may also retain limited backups or security logs for their normal operational cycles before deletion is complete in every copy.

Visit Delete account to delete a signed-in account immediately or request help when you cannot sign in.

Security

We use measures such as salted password hashing, HTTP-only session cookies, one-way hashing of native session tokens on our server, device secure-key-store protection for the bearer value, same-site and native-origin request checks, cryptographic app-integrity checks for Flow Challenge, and access controls. No internet service can promise absolute security. Use a unique password, protect your device, and contact Support if you suspect unauthorized access.

Children

Pee Passport is not directed to children under 13, and they may not create an account. If local law requires a higher minimum age to consent to online services, that higher age applies. A parent or guardian who believes a child provided personal information should contact Support so we can investigate and delete it.

Your choices and rights

You can deny device location permission (stamping stays unavailable until you allow it), change stamp visibility, turn rankings off, choose a separate territory identity setting, turn territory captures off to release zones you hold, delete a private Flow badge, withdraw Flow consent, sign out, or delete your account. The Flow controls are available inside the Flow Challenge panel when the feature is enabled. Depending on where you live, you may also have rights to access, correct, export, restrict, object to, or delete personal information, or appeal a privacy decision.

To make a privacy request, visit Support. We may need to verify your identity before acting. You may also have the right to contact your local data-protection authority.

Changes and contact

We may update this policy as Pee Passport changes. We will post the new effective date here and provide additional notice when a change is material and the law requires it.

Questions about privacy can be sent through Support.