นโยบายความเป็นส่วนตัว

Last updated 21 October 2026. Published at https://explorer.place/privacy.

Explorer is made by Teetouch Satithamajit, an individual (sole proprietor) in Bangkok, Thailand ("we"), who is responsible for the personal information described here (its data controller). This policy explains what happens to your information when you use the Explorer app.

The main promises, in plain words, are on one page: Your data.

The short version

Explorer has no ads, doesn't track you across other companies' apps and websites, and never sells your information.
Where your photos were taken stays on your iPhone and never reaches Explorer's server (to recognise the places in them, your iPhone asks Apple Maps about the area around them, as any map in the app does), and so does your location history unless you turn on its backup to your account, where it's encrypted with a key Explorer never has. While you're signed in, your trips and saved places are also kept with your Explorer account, so they're on every iPhone you sign in on; nobody else sees them unless you share a trip.
To find places, show maps and plan routes, Explorer uses Apple Maps: what you search for and the area you're looking at go to Apple.
Plan with AI sends what you type to it to Explorer's trip-planning server, which asks an AI model to write the plan: open-weight models (OpenAI's gpt-oss and Alibaba's Qwen3), run by Scaleway in Paris (in the EU), which keeps no prompts or answers. Some plans are made on your iPhone with Apple Intelligence instead, and those stay on the device.
An Explorer account is optional. If you create one to follow friends and share trips, posts and stories, your profile, what you share, your comments and your chat messages are stored on Explorer's server and shown to the people you choose. Photos you post are uploaded without their location, and the place on a post is one you pick, never where your phone is. Stories are shown for 24 hours; then they're kept in your private story archive, which only you see, unless you turn the archive off.
Leaderboards are optional. If you join one, only that board's number goes to Explorer's server (for steps and calories, your average a day over the last week), and everyone on the board sees it with your name and photo.
Once a day the app can send anonymous counts of which features were used. Nothing in them identifies you, and in the EU and UK you're asked first.
Payments are handled by Apple in the app, and by Paddle, our reseller, on explorer.place; in Thailand you can also pay in baht through Opn Payments. We never see your card details. Premium belongs to your Explorer account.
You can delete everything Explorer has about you, on your iPhone and on our server, with one button: You → Your Data → Delete All My Data.

Information that stays on your device

Explorer works out which countries, provinces and counties you've been to on your iPhone, using maps built into the app. This data is stored only on your device:

Location history, if you turn on location logging. It's recorded in the background, including when the app is closed. Each point keeps its altitude when the iPhone knows it to within 50 m, for the timeline's climbs. It stays on your iPhone unless you turn on its backup to your account (below), which never includes altitudes. With detailed logging, to draw your line along the roads you took between GPS readings, your iPhone asks Apple Maps for directions between pairs of your own logged points, as for any route in the app; Apple handles those requests under its own privacy policy. The matched roads are kept on your iPhone for today and yesterday only and are never sent to us.
Off-Road recordings (Premium), if you start one for a hike or a ride: your route at the iPhone's finest location setting, with its altitude and the barometer's pressure readings, while the recording runs. They stay on your iPhone: they aren't sent to us, aren't part of the location history backup, and the Live Activity on your Lock Screen shows only the numbers, never where you are. A picture or video of a route goes only where you share it (the map in it is drawn by Apple Maps, as any map in the app). Delete All My Data erases them.
Photo locations and dates, if you allow photo library access. Explorer reads only the location, altitude and date saved with each photo, and when it was added to your library, so photos others send you (by AirDrop or Messages, for example) don't count as places you've been unless you choose them. Which photos you chose stays on your iPhone. A photo is uploaded only when you share it in a trip, post or story, and then without its location. To recognise the places you've been from your photos, your iPhone compares them with the sights built into the app and asks Apple Maps about the points of interest around where they were taken; Apple's answers stay on your iPhone for up to 29 days, and nothing about where your photos were taken goes to Explorer's server.
Imported location history (a Google Maps Timeline export, or a GPX file) that you choose to import. Imported points older than the time you choose for detailed history become day recaps, like logged ones, and Delete Imported History removes them together with those recaps.
Exploration, if location logging is on: the ground you've covered, worked out on your iPhone from your logged points as squares about 200 m across with the days you explored them, and each day's area; the places Explorer suggested to you in the last month (so it doesn't suggest them again); and a new area waiting to be shown to you. Nearby suggestions and "new area" alerts are notifications your iPhone makes itself: no notification service is used and nothing is sent to make them. So that nearby suggestions stay quiet near home, Explorer also works out your home area on your iPhone (your home province, your city's whole urban area and anywhere within about 50 km of home), from where you spend your nights or, until it knows that, where you take the most photos; your home is kept only on your iPhone, rounded to about a kilometre, and is never sent anywhere. All of it is deleted with your location history and by Delete All My Data, and it isn't kept with your account, in the location history backup or in Back Up Everything.
Calendar events during your trips, if you allow calendar access and use "From Calendar". If you turn on Calendar Sync for a trip, Explorer adds the trip's days, stays and timed stops to your calendar and keeps those events up to date; if you allow full access for that, it changes or removes only the events Explorer added. This all happens on your iPhone and nothing about your calendar is sent to us.
The camera (Things to Do and the Today card): a photo you take to read a sign, translate it or find the sight in front of you is looked at on your iPhone, against the sights built into the app, and isn't saved or sent to us. Translation and Visual Look Up are Apple's and work as they do anywhere on your iPhone (Apple may download a language, or look up what's in the photo, under Apple's privacy policy).
Trips, saved places and settings. While you're signed in, your trips, saved places, the places you mark or hide on the map and Plan with AI's preferences are also kept with your account (below); your other settings stay on the iPhone.
Trip videos and 3D replays: made on your iPhone from the trip, its places and the photos you pick; the map in them is drawn by Apple Maps, as any map in the app. They go only where you save or share them.
Trip recaps: for a trip that's under way or over, the photos and videos in your library from its days, shown by day and on a map, and the places you took them, which are added to the trip. The places are named from maps and a list of sights built into the app, not by any online service. Like every map in the app, the recap map loads Apple Maps imagery for the area on screen; your photos and where they were taken aren't sent anywhere.

You can delete this data at any time in You → Your Data (Delete All My Data deletes it together with everything on our server), or by deleting the app. Files you export or back up are made on your iPhone and go only where you save or share them; Explorer receives nothing. Export Your History (You → Import & Export) makes Google Timeline JSON, GPX, KML, GeoJSON or CSV files holding your location history, where and when your photos were taken (not the photos themselves) and the regions you've visited; a GPX file also holds altitudes unless you turn them off on the export page. Back Up Everything makes one file with your trips, saved places, location history (with altitudes, and each day's climb), photo places, activity and hidden places, for a new iPhone or a new version of Explorer.

Health & Activity, and your timeline's recaps

Both are off until you turn them on in Settings, after a notice that says what is collected. Health & Activity never leaves your iPhone, unless you join the steps or calories leaderboard, and then only that board's one number (see Leaderboards, below); your timeline doesn't leave it either, unless you turn on its backup.

Health & Activity: steps, walking and running distance, flights climbed and active calories are read from Apple Health (Explorer only reads; it never writes to Health), or from Motion & Fitness when Health isn't available, and your altitude from the iPhone's sensors while Daily Activity (Record → On the Road) is open. They're kept on your iPhone as each day's totals until you delete them (Delete Activity History). They are never sent to Explorer or to anyone else, except that one number if you join those leaderboards; they're never used for advertising, and used for nothing but the daily recaps you see and the leaderboards you join.
Location logging and the timeline: detailed points stay on your iPhone for 1 week, 1 month (the default) or 3 months, as you choose; after that each day becomes a recap (a simplified route, the distance, the day's climb with its lowest and highest points, and one point per county) and the detailed points are deleted. Delete Location History removes all of it at any time. None of it leaves your iPhone unless you turn on the location history backup (below).

You can use the map, your photos, location logging, stats and your own trips without an account. An account is needed for trip plans from Explorer's AI and for sharing. You can sign up in the app or on explorer.place with an email address and password, or with Google or Apple, and link more than one of these to the same account. The first time you use Google or Apple, we email a code to that account's address, to confirm it's yours before connecting it. Explorer's server stores:

Your account: your email address and whether you've confirmed it; your password, stored only as a salted hash that can't be turned back into the password; the user IDs Google, Apple or LINE give Explorer if you sign in with them (never your password there), and Facebook's for an account that connected Facebook before Facebook sign-in was paused on 20 October; the version of these terms you agreed to, and when.
Codes we email you to confirm your address, sign in or reset your password. They're stored only as hashes and expire after 15 minutes.
Your profile: name, username, bio and profile photo, and whether you accept follow requests automatically.
Your city or country (optional, off by default): if you add them, a city name you pick or type and/or a country (never your address, and never worked out from where you are), shown on your profile to your followers or to everyone, as you choose. Only people 18 and over can show them. Set to everyone, they also appear on your web profile if that's on. Removing them, or deleting your account, deletes them; they're in your data download.
Trips you share: title, destination, dates (unless you hide them), caption, the places and notes you planned (with a mark on a place for adults only, such as a bar or a nightclub, set on your iPhone from the place's kind, so that people who aren't confirmed adults don't see the trip), the trip's cover photo as its thumbnail (a photo of the destination from Wikimedia Commons with its credit, or a photo you picked), how many people the trip is for, if you say, and the photos you choose. When you save a trip you choose who can see it: Only Me (the default: the trip isn't posted, and only you see it), your followers, or everyone. Your location history and the locations of your photos are never shared.
The country of each trip you share, so Discover can show trips by country, its tags (up to five, such as "Road trip"), and whether it's past, upcoming or undated (always undated while you hide its dates, so nobody can tell whether you're away now). To suggest tags, when you share a trip, and when you add a plan Explorer's AI wrote to your trips, the trip's places (what kind of place each is, and the names of places from open sources such as Wikipedia, never a place you found on Apple Maps or one of your own), its title and its caption (or the plan's summary) go to Explorer's server and its AI model in the EU (Scaleway, Paris; see Plan with AI below). Nothing about you goes with them: no account, installation ID or dates, and our server keeps no copy linked to you; your IP address is only counted for the day, to limit abuse. For your other trips, tags are suggested on your iPhone.
Posts: the photos you choose, from your camera or your library, a caption, the place you pick, and any of your shared trips you attach. You choose for each post: your followers, or everyone.
Stories: a photo or a video with its sound (up to 30 seconds, or a minute with Premium), a short caption, the place you pick and, if you like, one of your trips, for your followers, everyone, or your Close Friends (only the people on your Close Friends list who follow you). A story is shown for 24 hours after you post it. Then it goes to your story archive, which only you can see (Social → Me → Social Settings → Save Stories to Archive, on unless you turn it off; for people under 18 it starts off, and they can turn it on; to set this, your iPhone sends the same yes/no answer once, which isn't kept or logged); with the archive off, the story and its photo or video are deleted after the 24 hours instead. You can delete an archived story at any time. A story you add to a highlight is shown on your profile, to the people it was for (your followers or everyone), until you take it out of the highlight or delete it. Stories you posted before the archive came (17 October 2026) are still deleted after 24 hours, as we said when you posted them. Your archive and highlights are in your account's data download, and deleting your account or Delete All My Data deletes them. A video's location and other details saved in the file are removed on your iPhone before it's uploaded, and our server refuses a video that still has a location in it. We don't record who sees a story. You can also share a story to Instagram from your iPhone's share sheet: that goes straight from your iPhone to Instagram, not through Explorer.
Photos you post have no location in them. The app leaves the location out when it uploads a photo, and our server removes any location data that's left. On your iPhone, a photo's location may be used to suggest a place to tag, but it isn't sent.
The place on a post or story is one you pick from Explorer's own places: a sight (from Wikidata) or a region (from the app's maps), with its province, and whether it's a place for adults only (a mark set on your iPhone from the place's kind, never from your age; people who aren't confirmed adults don't see the post or story). It's never your phone's location or a photo's.
Likes and comments on posts, and comments and tips on trips; people you follow and who follow you, trips you save, people you block, and reports you make.
Tips at a place (when Explorer turns them on; writing them is for people 18 and over): a short tip you write on a place's page, with the place's open-data id (never your location) and, if your iPhone says so, the tip's language and that the place is for adults only. It's shown with your name and profile photo to everyone signed in to Explorer (never to people you've blocked or who've blocked you), with how many found it helpful; we keep who marked which tip helpful but don't show it. Tips are kept until you delete them, write a new one for the same place, or delete your account or use Delete All My Data, and they're in your account's data download.
Stories Nearby, two switches that are both off until you turn them on:
"Show My Public Stories Nearby" (kept with your account): stories you share with everyone are also shown to people in the province they're from, two hours after you post them, so nobody sees where you are right now. Stories for your followers never are. Turning it off hides them from Nearby straight away.
"See Stories Near Me" (kept on your iPhone): your iPhone works out which province you're in, from your location, and sends only the province's name to fetch its stories. It goes inside the request, not in the web address, which servers and networks often record. Our server compares it and doesn't keep or log it.
Premium, if you buy it: which plan belongs to your account and until when it's paid. For a purchase in the app, that's the App Store's transaction ID, the plan and the expiry date, plus a random token Apple adds to your purchases so they're linked to your account; Apple tells our server when the subscription renews, ends or is refunded. For a purchase on explorer.place, it's the IDs Paddle gives the purchase and you as its customer, the plan, the expiry date and whether it renews; Paddle tells our server when it renews, is cancelled or refunded. For 30 days we also keep which account started each checkout on the website, so a payment reaches the right account. For a payment in baht through Opn Payments, it's Opn's ID for the charge, the plan, the way you paid (PromptPay, a wallet, a bank app or a card), the amount, whether it's paid, failed, expired or refunded, and when; Opn tells our server when it's paid or refunded, and our server reads the charge back from Opn before anything is credited. These are one-off payments, so there's nothing to cancel. We never see your payment details. Deleting your account removes all of this and cancels a subscription bought on explorer.place; cancel one bought in the app in your iPhone's Settings.

Your profile on the web and trip links (optional, off by default). Everything above is seen only by people signed in to Explorer, unless you choose otherwise:

Show my profile on the web: your name, @handle, photo and bio (and your city or country, if you show them to everyone), the trips and highlights you share with Everyone, and the places you've marked Been here for Everyone (by name only, never when you went) appear at explorer.place/@yourhandle for anyone, without an account. Show my map on my profile, a separate switch, adds how many countries, provinces and counties you've been to and their names, never when you went or how they were found. Both are for people 18 and over, places for adults only never show there, and turning a switch off removes the page at once.
Trip links: for a trip you choose, you can make a link that anyone who has it can open, until it ends (a day, a week, a month or until you turn it off) or you revoke it. It shows the trip's places and days as you shared them (hidden dates stay hidden), never your name, your notes or times; a place you found on Apple Maps shows as "A place on Apple Maps". Deleting or unsharing the trip, Delete All My Data or deleting your account ends its links at once. Only a coded form of each link is kept.
These pages are kept out of search engines. To limit copying, our server counts views from each network address that isn't signed in, for that day only. Your switches and your links (not their codes) are in your account's data download.

Your age range, on your iPhone only. On iPhones that can share an age range from your Apple Account (iOS 26 and later), Explorer asks for it when you sign in, at launch while you're signed in, and when you tap the Nightlife filter in Things to Do. It uses the range only on your iPhone, at that moment: to set safer defaults for people under 18 (follow requests always reviewed, posts and trips for your followers by default, Stories Nearby off), and to decide whether places for adults only (bars, pubs, nightclubs, casinos and the like) and the Nightlife filter are shown, which they are only when your shared range says you're 18 or over. The range isn't stored on your iPhone, isn't sent to our server and isn't logged; a plan asked for with the Nightlife preference tells our server only that preference, never an age. If you share no range, nothing changes, except that places for adults only stay hidden.

Other Explorer users see what you share with them, your profile, and your comments on trips and posts they can see. Reports go to Explorer for review; content reported by three people is hidden automatically until then (a comment or a story is deleted). For each report we keep who made it, what it's about and the reason, and a copy of what was reported (its words, not its photos), so it can still be reviewed if it's deleted. If you report something and your account has a confirmed email address, we email you what we decided. If something you posted is hidden or removed after reports, we email you what happened, which rule it broke and how to ask us to look again. Nobody is told who reported them. To delete your account and everything you've shared, go to You → Account & Sign-In → Delete Account, or sign in on your account page at explorer.place and choose Delete. It's removed from the server straight away: your profile, trips, posts, stories, photos, likes, comments, tips and tags. If you signed in with Apple, we also ask Apple to revoke that sign-in, as we do when you unlink Apple in Account & Sign-In. And if you stop using Sign in with Apple for Explorer in your Apple Account settings, or delete your Apple Account, Apple tells our server: we unlink Apple from your Explorer account and sign you out everywhere; the account itself stays. Delete All My Data in You → Your Data does the same and also clears everything on your iPhone.

Automatic screening of what you post. Every photo you upload (for a post, a story, a trip, a trip cover, a chat or your profile picture) is checked by an automatic service before it's stored, and captions, comments, tips at places and profile texts are checked as they're saved, for sexual content, sexual content involving minors, graphic violence, hate, harassment and self-harm. A photo that fails is refused and never stored; a text that fails isn't saved. The check sees only the photo or the text, never your name, account, address or location. It's done by Sightengine (Sightengine SAS, Paris, in the EU; it keeps nothing), and when Sightengine can't be reached, by Microsoft's Azure AI Content Safety in the EU (a Microsoft Azure resource in France; Microsoft doesn't keep or train on it). Texts in German, and texts in Arabic letters, go to Azure AI Content Safety first. Texts in languages neither check reads (Thai, Japanese, Chinese and others) get only our word filter and aren't sent to either service. Our own server also refuses scams (asking people for money or for their codes and passwords, or sending them elsewhere to earn or pay) in what you post, and the plainest of them in chat messages, and threats of violence against a person in what you post; those checks run on our server alone and keep nothing. If neither service can be reached, the photo is stored and checked again within the hour; a photo refused then is deleted, and what showed it is hidden while we review it, as reported content is, and you're told by email. We keep only the verdict (never the photo or text behind a refusal) so refusals can be counted.

Emails with codes are sent through Resend. If an email we send to your address bounces or is marked as spam, we keep a scrambled form of the address (never the address itself) for up to 30 days, so we stop sending to it. The server runs on Cloudflare, which stores the data on our behalf. See Cloudflare's Privacy Policy.

Your trips and saved places with your account

While you're signed in, the app keeps a copy of your plans with your Explorer account, so they're on every iPhone you sign in on and come back after a reinstall: your trips (title, destination, dates, notes, tags and who can see them, and their stops and stays with their days, times, notes and how you travel between them), a cover you picked for a trip (uploaded without its location), your saved places, the places you marked as visited or hid from the map, Plan with AI's preferences, and what you note you've spent on a trip (What I've Spent: each amount with its currency, the day, and which trip and stop it's for; never a note, a place name or a position). A place you found on Apple Maps is kept only as Apple's ID for it, never its name, address or position; your iPhone looks it up again. Your location history, your photos and where they were taken, and your health numbers are never part of it. Why: so your plans are the same wherever you sign in. The basis is providing the service you signed in for. Where: on our server, run by Cloudflare. How long: until you delete them, delete your account or use Delete All My Data, which removes them from our server straight away; a trip you delete leaves only a marker without its contents for 90 days, so your other iPhones learn it's gone. Nobody else can see them: trips you don't post stay private, nothing is derived from them, and they're never shared, sold, used for advertising or sent to the AI model. While you're signed out nothing is kept with an account, and what's on your iPhone stays there.

Your stamps and badges with your account. While you're signed in, the app also keeps with your account the regions you've been to (Explorer's own names for the countries, provinces and counties, never a position or an address), with the date of your first visit to each and how Explorer found it (from a photo, location logging, an import or your own mark), and the badges you've unlocked with their dates. Why: so a reinstall or a new iPhone doesn't celebrate them as new again. The basis is providing the service you signed in for. Where: on our server, run by Cloudflare. How long: until you remove a region from your map ("I Haven't Been Here"), delete your travel history, delete your account or use Delete All My Data; a removed region leaves only a marker for up to 90 days, so your other iPhones learn it's gone. Nobody else sees them, nothing is derived from them, and they're never shared, sold, used for advertising or sent to the AI model.

What a trip cost (optional). After a trip you can tell Explorer what it cost: an amount with its currency, how many people it was for and, if you like, how many days. You can report it on a trip you posted, or on one of Explorer's own trips ("Made by Explorer") that you took. On your own trip it's shown with the trip only if you choose that, to the people who can see the trip; otherwise nobody else sees it. On Explorer's own trips it's counted anonymously: other people see only a typical cost per person (the middle value, in US dollars) and a typical party size, and only once at least five people have reported on that trip, so it's never your figure alone, and never your name or account. Our server converts the amount to US dollars with the day's exchange rate to work this out. It's kept until you delete it, is in your account's data download, and is deleted with Delete All My Data or your account (the typical cost is then worked out again without it). It's never shared, sold, used for advertising or sent to the AI model.

Places you mark "Been here". While you're signed in, each place you mark goes to our server by its open-data ID (from Wikipedia, Wikidata, Foursquare's open places or OpenStreetMap), with who may see it: only you (the default), your followers, or, if you're 18 or over, everyone. A place you found on Apple Maps never leaves your iPhone, and no date or position is kept with a mark; places near where you usually spend the night aren't sent at all. Places Explorer finds for you, from where your photos were taken or where you stayed, are sent only if you choose Followers or Everyone for them ("Places Found Automatically Are Shown To"; with Only Me, the default, they stay on your iPhone): the same way, by the place's open-data ID with who may see it and a note that it was found automatically, never the photo, its position or the stay, and never a place in your private areas (around where you sleep, your regular places, and any place you keep private). If you're under 18, your marks are only for you. Your followers see that you've been somewhere only if you chose followers or everyone, and only on that place's page. If you chose everyone, anyone signed in to Explorer can also see your name, @handle and photo among the people who have been there (and your web profile can show the place, if you've turned that on); people you've blocked, or who blocked you, never do. No date or position is ever shown. Your marks are in your account's data download and are deleted with Delete All My Data or your account; nothing is derived from them, and they're never shared, sold, used for advertising or sent to the AI model.

Booking emails (optional). If you turn on your Explorer trip address and forward a booking confirmation to it from your account's email address, Cloudflare receives that email for us and our server reads it straight away. We keep only the bookings in it (flight numbers, airports and times; hotel names, addresses and dates; the last 4 characters of a confirmation code) until you add them to a trip, or for at most 30 days, never the email itself, and nothing about the other people it names. Mail from any other address is dropped unread. If it can't be read automatically and you've allowed Explorer's AI, its text, without the email's headers, addresses, links, phone numbers or signatures, goes once to the AI model (Scaleway, Paris) and isn't kept. The bookings are in your account's data download and are deleted with Delete All My Data or your account; turning the address off stops it at once.

Location history backup (optional)

If you turn on location logging and are signed in, the app can back your timeline up to your account, so it survives a reinstall or a new iPhone. It's off until you turn it on, and the app tells you what is collected when you do. Location history in your account's backup is encrypted on your iPhone with a key kept in your iCloud Keychain, which Explorer never has: Explorer's server stores it, and deletes it when you ask, but can't read it. Another iPhone signed in to the same Apple Account can restore it. If the key is lost (iCloud Keychain off and your iPhone gone), no one can restore the backup, Explorer included. The server still sees your account, which days the backup covers, how many parts each day has, how big they are and when they were sent. What's kept, encrypted, on our server: your logged points (time, position to about a metre, the accuracy, and whether your route breaks there) for the period you choose, 1 week, 1 month (the default) or 3 months; our server deletes points older than that every day. After that only each day's recap stays: a simplified route, the distance, and the regions visited (Explorer's own region names, never an address). Why: only to restore your timeline. The basis is your consent, which you withdraw by turning the backup off (You → Location Logging → Backup): it asks whether to delete the copy on our server too, and turning logging off only pauses it. You can also turn the backup on while logging is off, to bring your timeline back to a new iPhone; it then only downloads. Delete Location History removes every point and recap from the server at once, separately from your account, and deleting your account removes them too. When you remove a place from your map ("I haven't been here") while signed in, it goes from the backup too. So that your other iPhones remove it as well and an older copy can't bring it back, our server keeps a record of the removal, which isn't encrypted: the place's name and a point inside it, from Explorer's own map data, when you removed it, and the times (without positions) of the points it removed. While a removal is under way, the parts of your routes it keeps are held for up to a day. Delete Location History deletes all of this; only a marker that your backup was deleted, without any location, stays until you delete your account, so an iPhone with an older copy can't upload it again. Nothing is derived from this data, it isn't shared with anyone, it never reaches the AI model, and it isn't used for advertising or analytics. Health numbers never leave your iPhone (see above).

You can let friends (people you follow who follow you back) see roughly where you are. It's off until you turn it on, for each friend or for the people on a trip with you, and you choose how long: until you turn it off, for the trip, for 1 hour or for today; people under 18 can choose only 1 hour or today. Explorer asks for Face ID, Touch ID or your passcode before it starts, and the app shows who can see you; the Dynamic Island and the Lock Screen show that you're sharing. While you share, and only while location logging is already on (sharing never tracks you by itself), your iPhone sends its latest position, rounded to about 50 metres, with the time it was taken, at most once every 2 minutes. Our server keeps only that one latest point and who may see it: each new point replaces the last, and a point is deleted an hour after it was taken. There is no history: no route, no list of places, nothing in your backup, your timeline or your account's data beyond the current point. Your friends see the point on a map with how long ago it was ("5 min ago"), and nothing once it's an hour old. Either of you can stop it at any time, and it ends at once: that friend can't see you any more, and once nobody can, the point is deleted from our server. Unfollowing and blocking end it the same way; signing out, Delete All My Data and deleting your account delete the point straight away. Stop and Report also reports the person to us, without your location. Location sharing isn't available in South Korea: if you open it there, Explorer stops everything you share and deletes your last shared point, and doesn't keep a record of where you opened it. Why: only to show your friends where you are, because you asked. The basis is your consent, which you withdraw by stopping. The point is never used for anything else: not for ads, analytics, the AI model or notifications.

Leaderboards (optional)

Leaderboards rank the people who chose to join them. Each board is its own switch, off until you turn it on, and the app tells you first exactly what that board shares. While a board's switch is on, the app sends that board's one number, and updates it when it changes:

Countries, provinces and counties: how many you've visited, worked out from your map.
Explored: the square kilometres you've explored, from location logging.
Steps and active calories: your average a day over the last week, from Health & Activity. This is health information, so it's sent only after you agree to it on that board's screen, and nothing else from Health ever leaves your iPhone: no daily numbers, no history.

Explorer's server keeps only that number and when it last changed. Everyone on the board sees it with your name, @handle and profile photo; people you've blocked, or who blocked you, don't. Turning a board off deletes your number from it at once, deleting your account deletes all of them, and a number that hasn't been updated for 30 days drops off the boards. There are no prizes. If people report numbers as fake, we can take them off the boards, and we email you why.

Chats

You can chat with people you follow who follow you back, for example to plan a trip together, and with people who join a chat through its owner's invite link (below). A chat holds the messages its members send (text, photos, polls and their votes, places from a trip or from Explorer's open data, and "I'm here" with a place of the trip, never your phone's own position) and the people in it. Messages are stored on Explorer's server, encrypted on the way there and in our database (see How we protect your data), but not end to end, so that every member's iPhone gets them. They're read only by the chat's members (someone who joins sees the messages from then on) and by our moderators only when a message is reported, together with the 10 messages before it. The word filter checks every message. A photo you send in a chat is checked and stored like every photo you upload (without its location; see the screening below), is seen only by the chat's members, and is deleted with its message or when the chat ends; a poll shows its members who voted for what, and leaving a chat takes your votes out. A place found on Apple Maps is kept only as Apple's ID for it, and the app looks it up again.

Your Close Friends list is seen only by you; the people on it aren't told they're on it, and leaving it or unfollowing you takes them off. It's in your data download and goes with your account.

Costs you share in a trip chat. In a trip chat you can add a cost you paid and who shares it: its amount, currency, title, day and who's in it, seen by the chat's members, who can see who owes whom. It's removed when you delete it, when the chat ends, or with your account; it's in your data download.

Planning a trip together in a trip chat. The chat's owner can share a trip's plan with the chat: its name, destination, dates and stops (the place names, or for a place from Apple Maps only Apple's reference to it, and a rounded position), and who shared it. Members can suggest changes, and agree or disagree with them, and the plan changes when enough members agree (the owner chooses how many). Your suggestions, with when you made them and what became of them, and your votes, with when you voted, are stored on Explorer's server and seen by the chat's members, except that people who have blocked each other don't see each other's votes. The plan, its suggestions and votes are deleted when the owner stops sharing it, deletes the trip, or the chat ends. If you leave the chat, your votes are deleted and your open suggestions withdrawn; if you delete your account, your votes are deleted and your suggestions stay in the chat without your name. They're in your data download.

Arrival alerts (optional). If you turn them on for a trip chat (people 18 and over, until a date you choose), your iPhone posts "arrived" with the place you're staying and the time to that chat when it finds you at one of the trip's stays. The chat's members see it and get a notification that doesn't say where. The arrival lines are deleted when the alerts end: on your date, or when you turn them off or leave the chat. Nothing else about where you are goes to our server, and there's no history of arrivals. Not available in South Korea.

Invite links. A chat's owner can make a link that lets someone join who isn't a friend yet: anyone signed in to Explorer who opens it within 48 hours can see the chat's name, its trip, who made the link and how many are in it, and after joining, the members and what's sent from then on. Invite links are for people 18 and over: when you make, email, open or join one, your iPhone tells our server only whether you're an adult, from your Apple Account's age range, never your age, and we don't keep or log that answer. The owner can turn every link off at any time, and a link stops working if its maker stops being the owner or blocks the person. Our server keeps only a coded form of each link, never the link itself, and deletes it when it runs out or the chat ends.

Premium shared with a trip. If you have Premium, you can share its trip features (Off-Road on the trip's days and Re-plan Today) with the people in a trip's chat, for one trip at a time. Our server keeps which chat it's for, the trip's first and last days and when you started or stopped sharing, and tells the chat's members (the first 15) that they have Premium for that trip thanks to you: they see your name and @handle, the trip's name and destination as the chat shows them, and its days. A Re-plan Today a member asks for on those days counts as one of your plans. It ends when you stop or move it, leave the chat, the chat ends, your Premium ends, or a week after the trip's last day; the record goes 30 days later, or with your account. It's in your account's data download.

Notifications (optional). If you allow notifications, the app registers your iPhone's push token (an identifier Apple gives the app for that iPhone) with our server while you're signed in. We use it for three things only: to tell your iPhone that a chat message arrived (the chat's name and "<name> sent a message", never the message's words, which the app fetches when you open it), that you and someone are now friends because they followed you back or accepted your follow request (their username, at most once a day for the same person), and that Premium bought on explorer.place has been added to your account. The notice goes through Apple's push service, which delivers it (Apple's own privacy policy applies to that delivery). The token is deleted when you sign out, when you delete your account, and when Apple tells us it's no longer valid; we keep when a notice last went out per chat so a burst of messages is one notice, nothing about what they said.

A message is kept until its sender deletes it ("Message deleted" stays in its place), until the chat ends when its last member leaves, or until its sender's account is deleted. Explorer doesn't keep who read what: your read marker only counts your unread messages for you.

Anonymous usage counts

Once a day, the app can send our server how many times each feature was used the day before (for example how many trips were created or plans asked for), roughly how long the app was open that day and how long ago it was installed (both as ranges, such as "5–15 minutes"), the app's version, and whether you have Premium (so free and Premium are counted in separate totals). Nothing that identifies you goes with it: no account, no device ID, no location, nothing you typed, and our server doesn't keep your IP address. It only adds the numbers to totals for that day, which tell us which features people use and whether they come back. If you're in the EU, the EEA, the UK or Switzerland, the app asks before sending any. Elsewhere it's on, and you can turn it off in You → Your Data → Share Anonymous Usage Counts. Once a week, it also sends which features were used for the first time that week (just their names, such as "trips"), so we can count how many iPhones use each feature in a week, again with nothing that identifies you. The totals can't be linked to you, so there's nothing of yours in them to delete.

Reports and suggestions

If you send a report or a suggestion (You → Report a Problem or Send a Suggestion), Explorer's server receives what you write, the email address you give for a reply (if you give one), and, unless you turn it off, the app's version, the iOS version and your iPhone's model. It also receives the random installation ID, and your account if you're signed in, so we can answer you and so Delete All My Data can find it. Never your location, photos or trips. Resend delivers a copy to our support inbox. We use it only to answer you and to improve Explorer, and keep it until we've dealt with it, at most two years.

How we protect your data

Everything between the app or the website and our server travels encrypted: our server only answers secure (HTTPS) connections, and browsers are told to use nothing else. On our server, the personal details we must be able to read to run Explorer are also encrypted in our database, each one with its own key (AES-256-GCM), so a copy of the database on its own doesn't reveal them: your email address, the IDs Apple, Google or LINE give us when you sign in with them, your iPhones' notification tokens, what keeps Sign in with Apple connected, chat messages, the words of reports and suggestions (and the content a report points to), travel costs you report until they're counted anonymously, and booking emails you forward to your trip. To find your account when you sign in, the server looks it up by a keyed fingerprint of your email address rather than the address itself. The key is kept in our hosting provider's encrypted secrets, apart from the database, and a copy is kept offline by Explorer. What isn't encrypted this way, because it's public or the service needs it to work: what you've chosen to show other people (your name, username, profile, posts, shared trips and leaderboard entries), the IDs and dates that link your data together, and Explorer's own map and place data. Your location history backup is encrypted on your iPhone with a key we never have (above). Our database's backups from before 21 October 2026 still hold these details unencrypted until they expire, within 30 days.

Information sent to other companies

Apple Maps provides the maps, place search, place details and travel times. To do that, Explorer sends Apple:

the area of the map you're looking at, to load it
what you search for and the area you search in
the place whose details you open
the start and end points of each leg of a trip, to get travel times
the name or address of a trip stop that has no location yet, such as a hotel added from your calendar, to find it on the map
the area around groups of your photos, to recognise the places you've been (your photos themselves, and which ones they are, aren't sent)

Explorer doesn't send Apple your location history or your photos. A shared trip keeps only Apple's ID for a stop found on Apple Maps, and the app looks the place up again when the trip is shown. See Apple's Privacy Policy.

Scanning tickets happens on your iPhone: Apple's Vision reads the text and barcode, Explorer reads the flights and dates from them, and Apple Intelligence works out the other details. The picture isn't kept or sent anywhere. To put the trip on the map, the place the ticket takes you (an airport, station or venue) is looked up on Apple Maps.

Descriptions in Things to Do come from Wikipedia: Explorer finds the Wikipedia article about each place, and Explorer's AI model, through Explorer's server, shortens its opening to a line or two. We send only Wikipedia's text, with the installation ID (or your account, if you're signed in) so the daily limit can be counted. If that isn't available, Apple Intelligence shortens it on your iPhone.

Wikipedia / Wikimedia provides free photos and short descriptions of destinations and well-known places, and the places "Plan with AI" chooses from; Wikivoyage's travel guides add places where Apple Maps has few. Since 14 October the app asks Explorer's own server for these instead of Wikimedia (phones asking dozens of times a screen were being refused), and for Plan with AI the server asks Wikipedia where the destination is, which well-known places lie around it and whether the places a plan names exist, and, for a plan written in another language, asks Wikidata what that language calls its places (the articles' titles and the language, nothing else). For a trip shared with Everyone, it asks Wikipedia and Wikidata for the names of the trip's province, city and places in the languages Explorer is in, so a search in any of them finds the trip (the places' titles and Wikidata ids, nothing about you). To show the names of places in the languages Explorer is in, the names of places you view (from open sources, never one you found on Apple Maps) may be sent, by their open-data ID and name only, to Wikidata and to Explorer's AI model in the EU (Scaleway, Paris); nothing about you goes with them, and the results are kept on our server for everyone. The server asks Wikipedia, Wikidata and Wikimedia Commons once per place and keeps the answers for up to a month. It receives the name of a destination, the title of an article, the position of a place or sight you're looking at, or the words you search for in Things to Do with the area you're browsing (used only to answer that search, never kept); a place of your own (a logged spot or a photo's location) only as the area around it, rounded to about a kilometre, and never to look for photos taken there; a place you found on Apple Maps never by its name or Apple's ID: to find the same place in the open data, so its name can be shown in your language, the app may send only the area around it, rounded to about 100 m. Nothing says who asked: no installation ID or account goes with these requests, and your IP address is only counted for the day, to limit abuse, and deleted the next day. The photos themselves still load from Wikimedia's servers, and your iPhone still asks Wikivoyage, Wikidata and Wikipedia directly for a few things (a travel guide's sections, a province's sights, Stats for Nerds, and a place's name in its own language when you tap its name or its speaker, asked by the place's Wikidata ID and kept on your iPhone), sending the region's or the place's name or ID, never anything about you. See the Wikimedia Privacy Policy. Restaurants, cafés, bars, markets, shops and hotels near a place come from Foursquare's Open Source Places, Overture Maps and OpenStreetMap, copies of which sit on our server: Explorer never contacts them, and the copies hold no information about you. Stats for Nerds asks Wikidata and Wikipedia for the facts and weather of the region or place you're looking at, and keeps them on your iPhone for up to 60 days.

Opening hours of the places in a plan ("Open until 22:00", "Closes at 17:00") come from OpenStreetMap (© OpenStreetMap contributors, under the Open Database Licence), Wikivoyage and Wikidata. Explorer's server keeps its own copy of OpenStreetMap's opening hours and asks Wikivoyage and Wikidata about places by their names, positions and Wikidata items. For a day you plan yourself, the app asks Explorer's server for the opening hours of its places, sending each place's name, position and Wikidata item. It does this only for places from open sources (Wikipedia, Wikivoyage, OpenStreetMap, Foursquare's open places). For a place found on Apple Maps, it sends only the area around it, rounded to about a kilometre, gets back the open-source places with opening hours there, and finds the matching one on your iPhone: Apple's name and position for the place aren't sent. The answers stay on your iPhone for 30 days. Your trip's dates, your account and your location don't go with these requests. Opening hours change, so check before you go.

Your travel style (You → Your Travel Style) is worked out on your iPhone from your trips, your saved places, the regions you've been to, the kinds of trip you pick in Plan with AI, and the trips you open and save in Discover (their tags), and it stays there. It decides which countries Explore suggests and what a travel guide shows first. It isn't sent to us or to anyone else. If you tap Share on your traveller type, the app makes a picture of its card (the type's name, its line and the names of your strongest styles; no points, places or countries) and hands it to the iPhone's share sheet, so it goes only where you choose to send it, and nothing reaches Explorer.

Your Feed's order. Your Feed can be ordered by what you like (For You), or sorted by newest, most liked or most saved, and filtered (people you follow or everyone, posts, stories or trips, a kind of trip, near you). The For You order is worked out on your iPhone, from the trips and posts you open, like and save there and the kinds of trip in your travel style; each item can say why it's there ("You like Temples · You follow Mai"). Our server only sends a larger set of recent posts and trips that you're allowed to see, with their public counts and tags; it doesn't work out or keep a score or a profile of you, and nothing about the order is sold or shared. Choose Newest to see everything in time order.

Travel guides on the page of a country, province or county are written from Wikipedia, Wikivoyage and Wikidata, by Explorer's AI model through Explorer's server, or by Apple Intelligence on your iPhone when that isn't available. To find a province's or county's sights, Explorer asks Wikidata about that area (where the area is, not where you are). Our server receives the region's name, those texts and its list of sights, with the random installation ID so a daily limit can be counted; the AI model's host (Scaleway, as for Plan with AI) receives only the texts and the sights. A guide is the same for everyone: nothing about you goes into it. When Explorer shows you a new area you've just explored, it asks for that area's guide in the same way, by the area's name. Because that follows a visit, its timing could hint at where you are, so our server keeps only the day's count for your installation and the area's guide, never which area an installation asked about.

Explorer asks first. Before any of Explorer's AI features sends anything to the AI model for the first time (Plan with AI, Let AI Help, Re-plan Today, translations, place descriptions, travel guides and trip tags), the app shows what each one sends, who runs the model and what happens to it, and asks you to allow it. Until you do, nothing is sent: place descriptions and travel guides come from Apple Intelligence on your iPhone or straight from Wikipedia. You can stop at any time in You → Shared with AI, and the features will ask again before sending anything.

Explorer's trip-planning server and its AI model write most "Plan with AI" plans. Explorer sends our server:

your messages to Plan with AI and the trip they describe (destination, length, interests);
the month you travel in, taken from your words or a dated trip's start date: our server uses it to fit each day into the daylight, and the AI model is told the month only when the days are short;
the preferences you've chosen in Plan with AI (the kinds of trip you enjoy, whether you're driving and how many hours a day);
the filters and budget you set in Plan with AI, if you set any: the pace, who's travelling, where you stay, meals (vegetarian, vegan, halal, kosher or street food), when your day starts, what to avoid, step-free access, and a budget for entry fees. They go only inside the plan request, to our server and the AI model, and are stored nowhere: the app keeps them on your iPhone, and they aren't kept with your account. A meals choice such as halal or kosher, or step-free access, can say something about your religion or your health. They're sent only because you chose them, so the plan can follow them, and you can clear them at any time;
the list of places from Wikipedia it plans with, including, when you plan from Saved, the saved places you pick (their names and where they are; a place you found on Apple Maps or Google Maps is sent only as its Wikipedia article, or not at all);
your account, so your plans are counted for it (5 a month on the free plan) and Premium is recognised;
a random ID made for this installation, which the app sends with its requests to our server.

Our server passes your message, trip, preferences, filters, budget and places (never your installation ID, account or IP address) to the AI model and keeps only counts of plans made. Your IP address is used to limit abuse and is forgotten within two days. The models are open-weight ones (OpenAI's gpt-oss for descriptions and guides, Alibaba's Qwen3 for trip plans), run by Scaleway in Paris; nothing reaches their makers. Scaleway doesn't keep what's sent after answering, except a request that fails or looks like abuse, which it may keep for up to two weeks to investigate and fix the problem; it keeps only anonymous usage figures (such as token counts) for up to six months, and never uses what's sent to train AI. See Scaleway's data privacy documentation. The same model, through our server, shortens place descriptions and writes travel guides from Wikipedia's and Wikivoyage's text.

Let AI help you plan (Premium) suggests changes to a trip you made yourself: a place for a light day, somewhere to eat, a better order, a stop that's closed that day, a day that's too long. When you open it, the app sends our server the trip's days and stops: places from open sources (Wikipedia, Wikivoyage, Foursquare's open places) by name and position, and a place you found on Apple Maps or Google Maps, or one of your own, without its name and with its position rounded to about a kilometre; the areas of the places you stay each night, rounded the same way; the trip's start date and when your day starts; and nearby places to suggest from. Our server works out the suggestions itself and asks the AI model only to word them: the model hears the names of places from open sources and, for your own places, only what kind of place they are (for example, somewhere to eat), never a position, a date or anything about you. Nothing about the trip is kept; a request is counted as one of your plans. You accept or dismiss each suggestion, and only one you accept changes your trip. During a trip, Re-plan the rest of today (Premium) does the same for the day's remaining stops from now: it also sends the time on your iPhone and where you are, rounded to about a kilometre, so the day can start from there. Our server uses that position only to work out the suggestions; the AI model doesn't get it, and nothing is kept.

Prices and visit lengths in plans come from public data. The app asks our server for facts about a plan's places (how well known they are, entry fees, World Heritage status) by their Wikidata IDs; our server asks Wikidata for them and keeps the answers for up to a month. For totals in your currency, the app asks our server for the day's exchange rates, which our server gets from the European Central Bank and from fawazahmed0's currency-api (a free public data set): the same table for everyone. Nothing about you goes to Wikidata, the European Central Bank or the currency-api. The app carries the World Bank's price levels by country (CC BY 4.0), credited in About with the European Central Bank and the currency-api. Prices in plans are estimates.

Apple Weather (WeatherKit) gives the monthly averages behind When to Go on a region's page where Wikipedia has no weather table, and, during a trip, the forecast at the places you planned for the coming days, so the app can say when rain or heat is on the way and suggest an indoor place instead. The app asks it about the region's position (its centre) or your planned places' positions rounded to about a kilometre, straight from your iPhone to Apple: never where you are, your trip's other details or anything about you, and nothing goes to Explorer's server. Apple Weather is credited wherever its numbers show. The reminders during a trip (a planned place closing within the hour, the evening recap) and the day's Live Activity are made by your iPhone itself, with no notification service, and send nothing. See Apple's Privacy Policy.

Apple Intelligence makes the remaining "Plan with AI" plans on your iPhone. Those messages are processed on the device and aren't sent to us. See Apple's Privacy Policy.

Translating posts and messages. Posts, comments, stories, shared trips' words and bios in another language show as they were written, with "See translation" under them; your iPhone works out which language they're in. When you tap See translation, those words, the language your iPhone thinks they're in and the language Explorer is in go to Explorer's server, which has Explorer's AI model in the EU (Scaleway, Paris, below) translate them. Nothing says who tapped: no account, installation ID or session goes with the request, and your IP address is only counted for the day, to limit abuse, and deleted the next day. Our server keeps each translation for everyone who asks for the same words, under a code made from the words (never the original words themselves, and never with a person), for 90 days after it was last asked for, and deletes it as soon as the post, comment, story, trip or bio it came from is edited or deleted. Your iPhone keeps translations in its cache so they needn't be asked for again, and Delete All My Data erases them. Chat messages are never sent: they're translated on your iPhone with Apple's Translation framework, which may first need a one-time download from Apple that your iPhone asks you about; Apple may collect usage figures (the app and the two languages, never the words), and chats' translations are kept only while the app is open. See Apple's Privacy Policy.

Book This Trip opens partner sites (Aviasales, Welcome Pickups, Intui.travel, EconomyBookings, Airalo, Klook and Tiqets) with your trip filled in: where it goes, its dates and airports (for a rental car or an airport transfer, also the times, worked out from your tickets), how many travellers, and the names of sights you've planned. To earn a commission if you book, Explorer's server asks Travelpayouts, an affiliate network, to turn each link into a partner link. It sends only the link, with the app's random installation ID to count a daily limit, never your name, account or location history, and keeps the finished link for a week to reuse it. The arrival kit's "Get an eSIM" links work the same way: our server turns the country's pages at Airalo, Yesim and Saily into partner links, sending only the country and the app's random installation ID. Once you open a partner's site, its own privacy policy and cookies apply; they record that you came from Explorer.

Flights (AeroDataBox, in Canada). Add a Flight (free): when you add a flight by its number, your iPhone sends that number and the date to Explorer's server, which asks AeroDataBox for its timetable (airports, times, terminals, aircraft) with only those two. Flight delays (Premium): for a flight in your trip, the server sends AeroDataBox only its flight number and date, to look up delays, new times, terminal and gate, from 24 hours before take-off until it lands. Never your name, account or booking details go to AeroDataBox. Each answer is shared by everyone who asks about the same flight and date and kept for at most 7 days, with nothing about who asked; our server only counts how many lookups your account made that day (the number, never which flights), to keep within a daily limit, and that count is deleted the next day.

Sightengine (Paris) and, as the backup, Microsoft's Azure AI Content Safety (in the EU) check the photos and texts you post, as described above under your account: only the photo or the text goes, nothing about you, and neither keeps it or trains on it. See Sightengine's privacy policy and Microsoft's.

Apple processes purchases in the app. We receive sales reports that don't identify you. See Apple's Privacy Policy.

Paddle (Paddle.com Market Limited, in the UK) sells Premium on explorer.place as our reseller and merchant of record: it takes the payment, works out and pays sales tax and VAT, sends your receipt, and handles cancellations and refunds. The checkout is Paddle's own page, opened over ours: what you enter there (your email, your card or PayPal details, your country and postcode) goes to Paddle, not to us. Explorer sends Paddle only your Explorer account's ID and the plan you chose, so the purchase reaches your account. To show prices in your currency, our server also tells Paddle the country your connection comes from (the country only, never your IP address). Paddle keeps its records of the sale as tax law requires, even after you delete your Explorer account. See Paddle's Privacy Policy.

Opn Payments (Omise Co., Ltd., in Bangkok) takes payments in baht on explorer.place for people in Thailand: PromptPay, TrueMoney Wallet, ShopeePay, Thai bank apps and Thai cards. For these, Explorer itself is the seller and Opn only moves the money. Our server sends Opn the amount, the plan's name, your Explorer account's ID and the plan (so the payment reaches your account), and the page to come back to. A card's details go straight from Opn's own form on our page to Opn, never to us; the PromptPay QR code is loaded from Opn; wallets and bank apps open their own apps or Opn's page. Opn, your bank or your wallet see the payment as they see any other, and Opn keeps its records of it as the law requires, even after you delete your Explorer account. See Opn's Privacy Policy.

We don't sell your information.

The explorer.place website

The website runs on Cloudflare, like Explorer's server. It uses no analytics, advertising or tracking cookies. If you pick a language, it keeps your choice in a cookie (explorer_lang) for a year, so the home page opens in that language; if you switch between light and dark, your browser remembers that choice. Neither is sent anywhere else or used to identify you.

Signing in with Google or Apple on the website sends you to Google's or Apple's own sign-in page and back; no Google or Apple script runs on our pages, and we receive only the signed-in identity they return (your name and email, or Apple's relay address). Signing in with Facebook is paused (since 20 October): nothing is sent to or received from Meta, and an account that connected Facebook before keeps only its Facebook user ID until you remove it in Account & Sign-In or delete your account. LINE Login on the website works the same way too: LINE (run by LY Corporation in Japan, a country the EU recognises as protecting personal data adequately) sends us your LINE user ID, your display name and, if you allow it, your email address; we keep the ID to recognise you next time, and LY Corporation learns that you signed in to Explorer; see LY Corporation's privacy policy. If you sign in on the website (your account page), it keeps you signed in with a cookie (__Host-explorer) that holds only a random key for your session, for 180 days after your last visit or until you sign out, and your browser remembers that you're signed in so the header can show “Your Account”. While you're on the site, your browser also keeps a note that you came from the app, if you did, and a one-time check value while you sign in with Google. Signing in with Google takes you to Google's own page and back; no Google script runs on the website. Only the two checkout pages load anything from another company: /pay loads Paddle's script and checkout, and /pay-th (paying in baht) loads Opn's script, card form and QR codes; both may use their own cookies to take the payment securely.

Children

Explorer isn't directed at children under 13, and we don't knowingly collect information from them. An Explorer account is for people 13 and over: on iPhones that share an age range (iOS 26 and later), an account whose shared range is under 13 is signed out and can't be used, and nothing about the range is kept. Explorer's social features (posts, chats, shared trips, leaderboards) are hidden from anyone whose range is under 13 and stay closed until a range of 13 or over is shared; when the range changes, Apple tells the app and they appear. In Australia (on the Australian App Store), the social features are for people 16 and over: someone whose shared range is 13 to 15 is treated as under 13 is everywhere else, so they're signed out of the social features, while their record, trips and plans stay on their iPhone as usual. Someone who thinks the age check got it wrong can tap Request a Review: the app opens an email to support@explorer.place that they write and send themselves. The app collects nothing for it, and we use the email only to answer it. People under 18 get the safer defaults described under your account, and never see places for adults only.

Your rights

Depending on where you live (for example under Thailand's Personal Data Protection Act, the EU and UK GDPR, or California's privacy laws), you may have rights to access, correct, delete or move your personal data, and to object to or withdraw consent for its use. Because your travel data is on your iPhone, you can view, export and delete it in the app yourself. You → Import & Export → Your Account's Data downloads, as one file, everything our server keeps about you: your account and profile, Premium and your purchases, what you've shared and written, the trips and saved places kept with your account, your stamps and badges, your votes in chat polls, the iPhones registered for notifications, who you share your location with and who shares with you (with your latest shared point, if one is kept), your location history backup (encrypted, as it's kept; the key stays on your iPhone, and your readable history is in the app's own exports), and your reports and suggestions, with links to your photos. What other people wrote or chose (comments on your posts and trips, who follows you) isn't in it, only counted, and neither are the secrets that protect your account. You → Your Data → Delete All My Data erases everything at once: on your iPhone (travel history, trips, saved places, settings) and on our server (your account and everything you've shared, the trips and saved places kept with your account, your stamps and badges, your location history backup, the usage counts kept for your installation, and your reports and suggestions). It doesn't touch the photos in your library. Deleting your account also cancels a Premium subscription bought on explorer.place; Paddle, or Opn for a payment in baht, keeps its own record of the sale, as tax law requires. Our database's backups keep deleted data for up to 30 days before it's gone for good. For data held by Google or Apple, use their privacy tools. For anything else, contact us.

Changes

If this policy changes, we'll update it here and change the date at the top.

Contact

Teetouch Satithamajit (Explorer), Bangkok, Thailand: support@explorer.place. A postal address is available on request.