Effective date: September 21, 2026
This Privacy Policy explains how Cityscribe (“we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use the Cityscribe iOS and iPadOS application, cityscribe.com, and our related services (together, the “Services”). It also explains your choices and privacy rights.
You can contact us about privacy at support@cityscribe.com. Nolan Fuchs, Cityscribe’s Co-founder and CEO, is our privacy contact.
1. INFORMATION WE COLLECT
Information you provide
Account and authentication information. We process information used to create, secure, and manage your account, including your email address, username, name, account identifiers, sign-in credentials, verification information, and authentication preferences. If you enable text-message authentication, we also process your phone number to deliver verification messages. If you choose an available third-party sign-in option, such as Apple or Google, we receive the account identifier and profile information that provider makes available to us, which may include your name and email address. The provider processes your sign-in under its own privacy policy.
Profile and social information. We collect your profile photo and biography if you add them, as well as information about the people you follow, your followers, and accounts you block.
Lists and saved places. We collect the lists you create, their names, descriptions, cover images, and visibility settings; the places you save; notes you attach to saved places; places you mark as visited and the associated dates; and related activity such as when you create or update content. Saved places and notes can reveal interests and locations associated with you, even when you have not enabled device location access.
Photos. When you upload a profile image, list cover, or place photo, we process the image and information needed to associate, store, and display it, such as the relevant account, place or list, upload time, image dimensions, and visibility settings. Place-photo submissions also include your attribution choice and moderation status. An image itself may contain personal information about you or other people. Our current place-photo upload flow prepares a new image without the source file’s embedded GPS metadata; this does not remove location information visible in the photo or the place you associate with it.
Reports and communications. If you report a user, place, list, or photo, we collect the report type, reason, explanation, the content or account involved, and information needed to investigate and act on it. We may keep a copy or snapshot of the reported content. If you contact us, we receive your contact information and the contents of your message and any attachments you provide.
Some account information is necessary to provide an account and keep it secure. Profile descriptions, photos, notes, and device permissions are optional, although a feature may not work without the information it needs.
Information collected when you use the Services
Device and operational information. We process technical information such as IP address, app and operating-system version, device type, language, time zone, installation or device identifiers, request times, authentication and security events, and service errors. Our servers and infrastructure providers process connection information to receive requests, deliver content, and protect the Services.
Usage and diagnostics. We collect information about app sessions, screens viewed, feature interactions, and whether actions succeed, together with crash and error information. Depending on the service, these records can be associated with a device identifier or your internal Cityscribe account identifier. They are not necessarily anonymous. Section 4 explains our analytics and diagnostic tools and the available controls.
Notifications. We process notification preferences, permission status, and, when available, a device push token to manage notification delivery. This can occur before you enable alerts. Notification content may concern activity involving your account or content. Notifications are displayed according to your device permissions, and you can control available notification settings through the app and your device.
Local storage. The app stores information on your device to keep you signed in, remember settings, cache images and other content, and manage uploads and analytics events awaiting transmission. Signing out does not necessarily remove all cached content or pending-upload files from the device.
Location and search information
With your device permission, Cityscribe accesses location while you use the app to support features such as nearby places and relevant search results. Depending on your device settings, this can include precise latitude and longitude or a less precise location. We do not use continuous background location tracking. Searches can also use a location you select or an area you view on a map.
We process the search terms, filters, coordinates or search area, and place identifiers needed to fulfill these requests, and store recent searches, including searched-for places and users, to provide search history. Relevant request information may be sent to our mapping and place-data providers. We also store coarse location information, such as city, region, country, and approximate coordinates, for device records and recommendations. Our analytics provider can infer approximate location from IP address. Turning off device location access does not prevent approximate IP-based location processing or processing of places and locations you enter yourself.
You can change Cityscribe’s location permission and precise-location setting in iOS or iPadOS Settings. Features that depend on your current location may then be unavailable or less accurate.
Information from other sources
We receive place details, maps, photos, and related information from providers such as Apple, Foursquare, and Tripadvisor, and images from providers such as Unsplash. We also receive information from other users when they interact with your profile or content or submit a report, and from the sign-in providers you choose to use.
2. HOW WE USE INFORMATION
We use personal information to:
• Create and authenticate accounts, maintain sessions, manage preferences, and secure access.
• Provide search, maps, place information, lists, notes, photo uploads, and content synchronization.
• Support following, discovery, recommendations, and notifications, using relevant information such as saved places, social connections, and location or search context.
• Apply content visibility and attribution settings and deliver the content you choose to share.
• Review photo submissions and reports, investigate abuse, enforce our rules, and protect users and the Services.
• Understand use of the app, diagnose errors, and improve reliability and features.
• Respond to support and privacy requests and send necessary account, security, and service communications.
• Meet legal obligations, resolve disputes, and establish, exercise, or defend legal claims.
To personalize recommendations, we derive preferences from the places you save, including places in private lists, their categories, and geographic patterns. We store the resulting preference information and suggested places. Private-list visibility restricts access by other users; it does not exclude those saved places from this personalization.
We do not currently send marketing or newsletter emails. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.
3. WHAT OTHER PEOPLE CAN SEE
Profiles and social activity
Your username, display name, profile image, biography, and information about your public content may be visible to other users. Depending on the feature, other users may also see follower or following information, account activity counts, and notifications about your interactions with them. A private list does not make your profile private.
Public and private lists
Public lists: Other users may view a public list’s name, description, cover, saved places, and the notes associated with those places. Public lists may appear in profiles, discovery features, or content shared through links. A note on a public list is not a private note.
Private lists: Access to a private list and its saved-place details is restricted to its owner in the app. Cityscribe and the providers involved in operating the service still process that information to store, synchronize, secure, and support it.
List cover images: Setting a list to private does not currently make its cover image private. A person who obtains the image link may be able to view the cover independently of access to the list. Avoid including sensitive information in a list cover.
New lists are public by default, including the Recents list created for a new account. Review each list’s visibility before saving information you do not want others to see. Changing visibility affects access through Cityscribe; it cannot recall copies or screenshots someone already made.
Place photos and attribution
When submitting a place photo, you choose its visibility and whether to show credit. The upload form initially selects public sharing and credit, so review these choices before submitting. A photo selected for public sharing is subject to moderation before it appears publicly. Approved public photos may appear with the associated place and elsewhere in the Services. If you enable credit, we may display your profile information with the photo. Choosing not to show credit hides the credit displayed with the photo; it does not make the photo private or guarantee anonymity. Other information associated with an image may still identify its uploader.
Private place photos are available to their owner through the app and are still processed by Cityscribe and its operational providers. The public/private setting for a place photo is separate from the setting for a list containing that place.
You retain ownership of your photos; Cityscribe’s rights to use submitted photos are governed by the Photo Submission Terms (https://www.cityscribe.com/photo-submission-terms). Section 7 below explains the current retention behavior and how to request removal.
Reports
Reports are processed for investigation and moderation rather than published as user content. We may disclose relevant information to providers or others where necessary for those purposes or as described in Section 5. We cannot promise that a report or the circumstances behind it will remain completely confidential.
Public content may be copied, saved, or shared by other people outside Cityscribe. We cannot control their copies.
4. ANALYTICS, DIAGNOSTICS, AND IMAGE DELIVERY
Amplitude. We use Amplitude for product analytics. Information sent can include app sessions, screen and feature activity, interaction outcomes, device and app information, approximate location derived from IP address, an analytics device identifier, and your internal Cityscribe account identifier when signed in. We also send limited account properties, such as whether you have a profile photo, your onboarding status, and counts of lists, saved places, followers, and accounts followed.
Our analytics implementation is designed to exclude your email address, name, username, passwords, verification codes, photos, precise GPS coordinates, and the contents of searches, notes, and other free-text fields. For example, an event may describe a search’s length without containing the search text. We do not use session replay to record your app screens.
Product analytics is currently enabled by default. You can turn off Share Product Analytics in Settings → Privacy → Analytics, or through the privacy option on the sign-in screen. This preference applies to the app installation where you change it. Turning it off stops new product analytics collection through this integration. A transmission already in progress may finish, and previously queued events may be sent if you turn analytics on again. Opting out does not itself delete information already received by Amplitude; contact us to request deletion.
Sentry. We use Sentry to receive crash reports, error information, and related technical diagnostics so we can identify and fix problems. These reports can include device and app information, diagnostic context, and your internal account identifier when signed in. We configure filtering to reduce personal information in diagnostic payloads. Disabling product analytics does not disable Sentry or the operational and security processing needed to run the Services.
Image loading and caching. The app uses the Kingfisher software library to download and cache images. Kingfisher is part of the app, rather than a separate analytics service. Image requests go to Cityscribe’s delivery infrastructure or the third-party image host, which receives the connection information needed to serve the image, including IP address. Copies can be cached on your device for faster display.
Website. We do not currently use website analytics or cookies. App storage and the analytics and diagnostic practices described above are separate from our website practices.
5. HOW WE DISCLOSE INFORMATION
Operational providers. We disclose information to companies that help us provide the Services. These include Amazon Web Services for functions such as account authentication, hosting, databases, file storage, content delivery, and backend processing; Amplitude for analytics; Sentry for diagnostics; and services involved in delivering notifications. The app uses AWS Amplify to connect to AWS services, including Amazon Cognito for authentication. Amplify is the integration software, not an additional analytics provider.
Mapping, place, image, and sign-in providers. Requests to providers such as Apple, Foursquare, Tripadvisor, and Unsplash may include search terms, geographic search context, place or image identifiers, and technical connection information, depending on the feature and whether the request comes from your device or our servers. If you use Apple or Google sign-in, those providers also process information about the sign-in. Their own privacy policies apply to their services and independent processing.
Other users and your instructions. We disclose information through the public and social features described in Section 3, and when you choose to share content, open an external service, or otherwise direct us to do so.
Legal and safety purposes. We may disclose information when reasonably necessary to comply with law or valid legal process; investigate abuse or security incidents; enforce our agreements; or protect the rights, safety, or property of Cityscribe, users, or others.
Business changes. Information may be disclosed in connection with a proposed or completed merger, acquisition, financing, reorganization, insolvency proceeding, or transfer of all or part of our business, subject to applicable law.
6. YOUR CONTROLS
You can use available app settings to edit your profile, manage lists and saved-place notes, change list visibility, choose visibility and credit when submitting place photos, and control social interactions. You can review submitted place photos under Settings → Privacy → Place Photos. Removal of an approved public photo is subject to the limitation explained in Section 7.
Use your device settings to manage location, notifications, and access to photos. Choosing images through the system photo picker allows you to select the images to share. Changing a permission affects future access; it does not automatically delete information already submitted.
The product analytics control is explained in Section 4. To delete your account, open Settings → Account Settings → Delete Account. You can also contact support@cityscribe.com for privacy requests or if you cannot access your account. Uninstalling the app does not delete your Cityscribe account or information held by our service providers.
7. RETENTION AND DELETION
We retain personal information for as long as reasonably necessary for the purposes described in this policy. Account, profile, list, and saved-place information is generally kept while your account or the relevant content remains active. We retain reports and moderation records as needed to investigate issues, prevent repeated abuse, handle disputes, and meet legal obligations. Operational logs, analytics, diagnostics, and backups have separate retention settings. The relevant factors include the sensitivity of the information, whether it is still needed, security and recovery needs, and applicable legal requirements.
Account deletion removes your active account and associated list and profile records through our deletion process. Some information may remain in reports, moderation records, logs, provider systems, or backups until removed under their applicable retention processes or in response to a valid privacy request. Removing a direct account link does not necessarily make a record anonymous; retained content or other identifiers may still identify you.
Approved public place photos remain after account deletion. Their visible account attribution is removed, but the images and related records can be retained while maintained as public contributions to the place’s photo collection. The image itself and associated internal metadata may still contain personal information. Approved public photos cannot currently be removed through the app. Other place-photo submissions can be deleted through the available photo controls and are removed through the account-deletion process, subject to the retention limitations in this section. Contact support@cityscribe.com to request removal of a retained photo or exercise applicable deletion rights. Retention remains subject to the applicable Photo Submission Terms and your legal rights.
Deletion and visibility changes may take time to reach cached copies. Limited information may need to remain for legal obligations, security, disputes, or other grounds permitted by law. Copies made independently by other people are outside our control. These limitations do not override any rights you have under applicable privacy law.
8. PRIVACY RIGHTS AND REQUESTS
Depending on where you live and which laws apply, you may have rights to confirm whether we process your personal information; access or receive a copy of it; correct it; request deletion; receive certain information in a portable format; restrict processing; or object to processing, including processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Some laws also provide rights concerning the sale of information, sharing or use for targeted advertising, certain profiling, and the use or disclosure of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. Precise location is treated as sensitive personal information under some laws; we use it for the location-related service features described in this policy.
Send requests to support@cityscribe.com. We may ask for information reasonably necessary to verify your identity and authority to make the request. Where permitted, an authorized agent may submit a request for you; we may need proof of authorization. We will respond within the period required by applicable law and explain any applicable exception or refusal. We will not discriminate against you for exercising protected privacy rights.
If applicable law gives you a right to appeal our response, email the same address with “Privacy Appeal” in the subject line. You may also complain to the privacy regulator or other appropriate authority where you live.
California and other US residents
The information described in Section 1 includes identifiers and account information; internet, device, and service activity; geolocation; images and other content you provide; social information; and information about interests reflected in your use of the Services. Account credentials that permit access to an account and precise geolocation may fall within legally defined categories of sensitive personal information. The sections above explain the sources, purposes, recipients, retention criteria, and available controls for these categories.
The rights available to you depend on whether the relevant state law applies to Cityscribe and your request. The request and appeal procedures above apply to rights available under those laws. We do not engage in sale or advertising-related sharing for a browser opt-out preference signal to stop. We do not use website analytics or advertising tracking; changing a browser’s Do Not Track setting does not change the app processing described in this policy.
EEA and UK residents
Where the GDPR or UK GDPR applies, the following information explains our purposes and legal bases for processing your personal information. We process account information and the information needed to deliver features you request to perform our contract with you. We rely on legitimate interests for proportionate security, abuse prevention, support, service reliability, and product improvement where those interests are not overridden by your rights. We rely on consent where required for optional processing, including where applicable rules require consent for analytics or access to device information, and on legal obligations where processing is required by law.
You may exercise the applicable rights described above and complain to the competent data protection authority, including in the EEA country where you live or work or where an alleged infringement occurred, or to the UK Information Commissioner’s Office.
Right to object. Where processing is based on legitimate interests, you can object for reasons relating to your particular situation by contacting us.
Swiss residents
Where the Swiss Federal Act on Data Protection applies, depending on the circumstances you may request information about our processing, correction of inaccurate information, deletion or cessation of unlawful processing, and the delivery or transfer of certain information in a portable format. You may contact the Swiss Federal Data Protection and Information Commissioner. Swiss rights are governed by Swiss law and are separate from rights under the GDPR.
9. INTERNATIONAL PROCESSING
Cityscribe uses infrastructure in the United States. Personal information may also be processed in other countries where our service providers operate. These countries may have privacy laws that differ from those where you live. Contact support@cityscribe.com for information about international processing.
10. SECURITY
We use technical and organizational measures designed to protect personal information, including controls for authentication, access, and secure communication. No service, transmission, or storage system can be guaranteed completely secure.
11. CHILDREN
Cityscribe is intended for people aged 13 or older, subject to any higher minimum age or parental-authorization requirement imposed by applicable law. Regional App Store age ratings and access restrictions may also apply. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information in violation of these requirements, contact support@cityscribe.com so we can investigate and take appropriate action.
12. CHANGES TO THIS POLICY
We may update this policy as the Services or our practices change. We will update the effective date and provide additional notice of material changes when required by law. Where a change requires consent, we will obtain that consent before applying the change to the relevant processing.
13. CONTACT
For questions or requests concerning this policy or your personal information, contact:
Cityscribe
Privacy contact: Nolan Fuchs, Co-founder and CEO
Email: support@cityscribe.com