Privacy at findme

findme is built for private crews. It needs location and nearby-device access to do its job, and it uses online services when a connection is available. This page explains those boundaries plainly.

Last updated: 16 October 2026

Information findme handles

• Your chosen name and crew membership. No phone number, email address, contact list, or social account is required. Secure crews use a random anonymous Firebase account so the service can enforce membership.
• Your location. While sharing is active, findme reads precise location and shares encrypted position updates with your crew. Location can continue updating with the screen off: iOS shows its location indicator. On Android, the location foreground service has a notification whose visibility depends on notification permission and system settings; Android also provides an active-apps control. Pause sharing immediately stops location collection, publication and finding radios on this phone, and remains paused after restart until you choose Resume. Friends may still have the last-known position while your phone is offline. Leaving is a separate membership-removal action.
• Nearby-device signals. Bluetooth detects crew members at close range. Ultra-Wideband can measure distance, and on supported hardware direction, during an active finding session. The camera is used only when you choose to scan an invitation QR code.
• Operational service data. The service necessarily handles random account and membership identifiers, request timing, network information such as IP address in infrastructure logs, and encrypted app records. Crew names, member names, locations, and meeting points are encrypted before storage, so the service stores ciphertext rather than their readable contents.
• Optional aggregate usage totals. If this feature is activated, findme first shows an in-app notice and offers a control to disable it. Uploads contain bounded daily counters and categories, platform and app release, a production or test label, and an unrelated receipt for retry protection. Only a receipt hash is retained separately; reports contain totals. They exclude names, locations, crew or member IDs, invitation contents, raw web addresses, advertising IDs, exception text, and event histories. New/returning-use flags remain on your phone and describe visits, not identified people.

Invitations

A crew invitation is a secret. Anyone who receives it may be able to request access to that crew until it expires or is revoked, so share it only with people you trust. HTTPS invitations put the secret after the # in the address. Browsers do not send that fragment to this website. The invitation page uses no analytics, remote fonts, advertising, or third-party scripts. Firebase Hosting may still process ordinary web request data for the generic /join page, such as IP address and user agent; that request does not include the fragment.

Online and offline behavior

GPS can calculate your own position without mobile data. Admitted members retain encrypted saved crew information and the meeting point after an offline restart. Nearby Bluetooth or supported Ultra-Wideband can help while both phones keep findme active. A complete offline map is not included by default: map availability depends on the active provider and its cache rules. Sharing updated positions between phones, creating or joining a new crew, venue search, optional provider downloads or walking directions, and account deletion require a working data connection. Congested or absent service can delay updates, so findme displays when a position was last seen rather than promising continuous live tracking.

Retention and deletion

Secure invitations expire after seven days. Secure position records expire after 24 hours, and short-lived Ultra-Wideband coordination records expire after five minutes. Membership remains until it is left or the crew is deleted. Aggregate usage totals, if activated, are retained for up to twelve months; receipt hashes used to reject duplicate submissions are retained for eight days. Local crew secrets are stored in protected device storage and are removed when you leave. Android backup and device transfer are disabled for findme data, and iOS secrets are restricted to the device.

Use Privacy & usage → Delete account and data to remove the automatically created guest account and associated service records. This needs a connection and confirmation. Crews you organize are deleted for all members; memberships in other crews and your own associated records are removed. The phone clears its crew secrets, preparation snapshots and analytics-only history after deletion is confirmed. An interrupted deletion keeps a limited cleanup job until it can finish. After completion, a hashed account reference and hashed recovery receipt are scheduled for deletion after 90 days so a retry can confirm success without recreating the account. A temporary access-denial marker is scheduled for removal after two days. Cleanup runs periodically, so removal can follow the expiry time. Deletion cannot erase information another member already received or anonymous totals that cannot be linked back to the account. See account deletion and support requests for the external request route.

Use Leave crew in the app to remove your membership; a secure crew requires a connection to confirm this operation. An organizer can delete a secure crew. Pause sharing is available while offline. Leaving removes this phone's crew secrets and encrypted preparation snapshot; it cannot erase information another member already decrypted. You can turn optional aggregate usage reporting off in the app, which stops collection and deletes queued batches and analytics-only local history. Unsent batches expire within seven days. For a privacy request or if the app cannot complete deletion, contact support@innovaapps.ai.

Service providers and sharing

To protect crew access, Firebase App Check uses Apple attestation on iOS and Google Play Integrity on Android. For Android integrity requests, Google collects app and licensing information, a device key-attestation certificate and a device-attestation token. Google uses this information for integrity and abuse prevention, encrypts it, and deletes it after its fixed retention period. See Google Play Integrity data handling. Network addresses and approximate network location may also be processed for service security even when location permission is denied.

findme uses Google Firebase for hosting and operational app services. The protected crew and reporting databases run in Europe; global authentication, attestation and delivery services may process operational metadata elsewhere. Apple and Google distribute the mobile apps. By default, map tiles and venue searches use OpenStreetMap Foundation services, including Nominatim search. These providers receive the viewed map tile area or search text, your network address and request metadata. Tile coordinates can reveal the area you are viewing, including a map centered on your position. Managed maps and venue search use Stadia Maps only when configured; the active map provider is identified in the map attribution. These services have their own OpenStreetMap Foundation and Stadia Maps privacy policies. These requests are separate from encrypted crew sharing. Provider tile caching is bounded below 100 MB on each phone, and search-result lists are not permanently archived. Information is shared with other members of your chosen crew as part of the feature; it is not sold and is not used for third-party advertising or cross-app tracking.

Optional walking directions

When walking routes are available and you choose Get directions, findme sends your current coordinates and the destination coordinates to Geoapify using its European routing endpoint and OpenStreetMap data. The destination may be a friend's last-known position or a meeting point. The app explains this before the first request in each guidance screen. Names, crew identifiers, invitation secrets and analytics identifiers are not included. These requests are separate from encrypted crew sharing and aggregate usage reporting. Geoapify processes the route request and operational data such as IP address, headers and timing. Its privacy policy states that successful request records are generally retained for no longer than 24 hours; this is not a guarantee for every request. The service uses EU data centers and infrastructure providers for delivery and security.

Directions are held only in memory and are cleared when you switch to Direct, stop guidance, pause sharing, leave the screen, or when the route becomes outdated. Updated routes require an explicit request; findme does not send every GPS update to the routing service. Direct guidance, Bluetooth and supported Ultra-Wideband finding do not require a routing request. A route follows mapped walking paths and may not reflect current closures, barriers or crowds.

Provider retention after deletion

Deleting an account starts provider cleanup; it does not instantly erase every infrastructure backup or security log. Firebase describes authentication IP logs lasting a few weeks, Realtime Database network metadata lasting a few days, and removal of authentication information from live and backup systems within 180 days after deletion is initiated. See Firebase privacy and security for service-specific details. OpenStreetMap and optional map/routing providers retain their request records under their own policies.

Changes and contact

We may update this policy when findme changes. The date above identifies the current version. Questions can be sent to support@innovaapps.ai.