Privacy Policy — WhereAmI
Last updated: 3 September 2026
Applies to: the WhereAmI Android app (earth.whereami.app) and the website at whereami.earth
The short version
WhereAmI shows you where you are. To do that, it has to know where you are.
Your coordinates go to our server, which asks two other companies to turn them into an address and an elevation, then sends the answer back to you. We don't have accounts and we don't run ads. There is no analytics or tracking software of any kind in the Android app.
The website counts page views. It uses no cookies, stores nothing on your device, and records nothing that identifies you — and it is kept entirely separate from the locations you look up. It's described in full below.
We keep almost nothing. The four exceptions are described below, and none of them identifies you.
Who is responsible
Jens Rijks
Netherlands
We are the data controller for the processing described here. If you're in the EU or UK and think we've handled your data badly, you can complain to your national supervisory authority. In the Netherlands that's the Autoriteit Persoonsgegevens.
What we process, and why
Your location
What: Latitude and longitude from your device, plus the accuracy figure your device reports, plus your device's two-letter language code (so we can show the address in your language).
Why: It's the entire function of the app. Without it there is nothing to show.
Lawful basis: Your consent, under Article 6(1)(a) GDPR. You give it through your operating system's location permission prompt. You can take it back at any time in your device settings, and the app will simply stop showing an address.
How long: Not stored against you at all. Your coordinates are used to answer your request and are then gone. The exceptions are the cache, share links and location requests below.
A note on accuracy: If you grant only "Approximate" location on Android, the app deliberately shows less — your neighbourhood instead of your street, with the postcode partly hidden. It doesn't try to guess past what your device actually knows.
Your IP address
Our hosting provider sees your IP address when your device contacts our server, as any web server does. We use it only to deliver the response and to keep the service from being abused. We don't combine it with your location data, and we don't build profiles from it.
Because our server makes the calls to the address and elevation providers on your behalf, those companies see our server's address — never yours.
The same holds for the map on a share card. We fetch the picture ourselves and serve it from whereami.earth, so nobody who opens a link you sent is exposed to the map provider either — and they never chose this app at all.
Keeping the service usable
Turning coordinates into an address costs us a paid lookup, and the day's allowance is shared by everyone using the app. Making a share link costs storage instead: every link sits on our server until it expires, and so does every location request. To stop one script from spending either, our server keeps a count of how many lookups each caller has asked for recently, a running total of lookups for the day, how many share links each caller has made recently, and how many location requests.
What: a number, filed under a short code that stands in for "one caller today". Your IP address is not stored. It's used to generate that code, and the code is built with a fresh secret every day, so the same connection cannot be recognised from one day to the next.
What isn't: anywhere you have been. The counters record how many times something was asked, never what was asked. Nothing joins a counter to a place, a coordinate, a share link or a location request.
Why: without it, one loop exhausts the day's address lookups for every real user of the app, and fills our storage with links nobody will ever open.
Lawful basis: Our legitimate interest under Article 6(1)(f) GDPR in keeping the service working for everyone and our costs predictable.
How long: until the next night's clean-up, which deletes counters once their period has passed.
What you'd notice: almost certainly nothing. If you did reach the lookup limit — by having the app open in a moving car for a long stretch, for instance — it keeps showing your coordinates and elevation and stops showing an address until the count resets. The sharing limit is dozens of links within a few minutes, far more than sending someone a place takes; past it, no new link is made until the count resets. Asking people where they are has its own, smaller limit — thirty in a few minutes, which is more asking than anyone does by hand.
Page views on the website
Where this applies: the website at whereami.earth only. There is no analytics in the Android app.
What: When you open a page on the website, we count the visit using Vercel
Web Analytics. Each page view records the time, which path you opened (/,
/privacy and so on), the page that sent you there if there was one, your
country, region and city, your device type, and your browser and operating
system version.
What it doesn't do: It sets no cookies and stores nothing on your device. Your IP address isn't recorded — it's used to generate a hash that stands in for "one visitor", and that hash is discarded and regenerated every 24 hours. It can't be traced back to you, and it can't be used to follow you from one day to the next, or from this site to any other. We can see that a page was opened a certain number of times. We can't see who opened it.
It is not joined to your location. The coordinates you look up are never sent to analytics. These are two separate systems and nothing connects them, and no page view record contains a location you searched for.
Codes are stripped before counting. A share link has its code in the
address, and that code is the only thing protecting it. We remove the code in
your browser, before the page view is sent, so it is recorded as /s/[id] and
nothing else. We can see that someone opened a share page. We cannot see which
one, and the code never reaches Vercel's analytics.
The same is done for location requests, where it matters more: the page a
requester keeps has a token in its address, and that token is the only way to
read the answer. Those pages are recorded as /r/[id] and /r/[id]/[token] —
the shape, never the code. We also ask your browser not to pass either address
on when you follow a link away from one of these pages.
One button is counted. A share page has one button on it, the one that offers to look up where you are. When it is pressed we record that a press happened, and nothing else — no share code, no location, no note of which share page it was pressed on. The address is stripped exactly as it is for the page view above, by the same code. We can see how many of the people who opened a share link went on to look themselves up. We cannot see who, or from which link.
Why: So we can tell whether anyone is using this, and which pages are worth keeping. That is the entire purpose.
Lawful basis: Our legitimate interest in understanding basic use of our own website, under Article 6(1)(f) GDPR. We rely on this rather than asking for consent because the measurement is cookieless, stores nothing on your device, and produces only aggregate counts that can't be linked back to you.
Don't want to be counted? Any content or script blocker will stop it, and the site works exactly the same without it.
The address cache
When we look up an address, we save the result in our database so we don't have to ask again. The entry is filed under the coordinates, rounded to roughly an 11-metre or 1.1-kilometre square depending on how precise the original fix was.
What's in it: a place and its rounded coordinates.
What isn't: any identifier for you. Nothing records who asked, or when, from where, or on what device. The cache cannot be used to work out that any particular person was anywhere.
How long: Indefinitely. It's a reference table of what exists at a location, much like a map is.
Address corrections you make
When the address we show is wrong — a neighbour's house number, or the wrong business in a building with several — you can pick the right one from a short list of nearby places. We remember that choice so you don't have to make it twice.
Where it's kept: on your device, and nowhere else. In your browser's local storage on the website, and in the app's own storage on Android. It is never sent to us, so we never see it.
What's in it: the address you chose, filed under a coordinate square rounded to roughly 110 metres. No identifier of any kind, and nothing about when you chose it.
How long: until you remove it. On the website, clearing site data does it, or the Clear remembered corrections button — in the sign's settings drawer, and on the deletion page. In the app, the same button in the same drawer, and uninstalling.
Your saved spot
You can save the position you're standing in — parking, a campsite, a tent, a trailhead, wherever you'll want to find your way back to. We remember it until you clear it.
Where it's kept: on your device, and nowhere else. In your browser's local storage on the website, and in the app's own storage on Android. It is never sent to us, so we never see it.
What's in it: the coordinates you saved. No identifier of any kind, and nothing about when you saved them.
There is one. Saving again replaces it — nothing is added to a list, and no list exists. This is not a location history.
How long: until you clear it. The Clear button beside it, in the sign's settings drawer on the website or in the app; clearing site data on the website; uninstalling the app.
The home screen widget
If you add the widget, the app keeps one address on your device: the one the widget is showing, already written out the way you see it, together with the coordinates it came from so the app can tell whether you have moved.
There is one. A new address replaces the old one — nothing is added to a list, and no list exists.
While the widget is there, your phone looks up an address in the background after you move about 250 metres. That is the same lookup the app makes when it is open, described above, and it sends nothing else.
Remove the widget and both the stored address and the background lookups stop, immediately. Uninstalling the app removes them too.
Your appearance choice
The sign follows your device's light or dark setting on its own. You can also pin it to one of them, from the settings drawer at the top right of the sign. If you pin it, we remember which.
Where it's kept: on your device, and nowhere else. In your browser's local storage on the website, and in the app's own storage on Android. It is never sent to us, so we never see it.
What's in it: one word — light or dark. Nothing else, no identifier of
any kind, and nothing about when you chose. Leaving it on Auto stores nothing at
all.
How long: until you set it back to Auto, which removes it. On the website, clearing site data also does it. In the app, uninstalling does.
Your share card choice
When you send a link, the preview that appears in the chat is a card we draw. There are six designs and you can pick which one, from the same settings drawer. If you pick one, we remember it and use it for every link you send afterwards.
Where it's kept: on your device, and nowhere else. In your browser's local storage on the website, and in the app's own storage on Android. It is never sent to us on its own — only along with a link at the moment you make one, so the card can be drawn.
What's in it: one word — the name of a design. Nothing else, no identifier of any kind, and nothing about when you chose. Leaving it on the default stores nothing at all.
How long: until you set it back to the default, which removes it. On the website, clearing site data also does it. In the app, uninstalling does.
Your language choice
The app is written in six languages and picks one from your browser or your phone. You can choose a different one from the same settings drawer.
Where it's kept: on your device, and nowhere else.
On the website it is a cookie named NEXT_LOCALE. It is the only cookie this
site sets. It exists so that opening whereami.earth tomorrow gives you the
language you chose today rather than starting over — it holds two letters, it
is never read by anyone but this site, and it takes no part in the page-view
counting described above. In the app it is a single entry in the app's own
storage, beside a second one holding the quick settings tile's caption written
out in that same language. Android draws that tile itself, so it needs the words
where it can reach them.
What's in it: one language code — en, nl, lt, fr, es or pt, and
on Android the tile's caption in that language. No identifier of any kind, and
nothing about when you chose.
How long: a year on the website, or until you clear site data. In the app, until you uninstall.
Why there's no cookie banner: a cookie that does nothing but remember a setting you chose yourself is exempt from the consent requirement — it is strictly necessary to provide what you asked for, and it cannot be used to follow you. Asking permission to remember your own choice would be a banner about nothing.
Why this isn't one of the exceptions above: those are records — about you, or about the places you looked up. This is a preference about how a screen looks. We describe it anyway, because the app does write it to your device, and that ought to be written down somewhere.
Share links
If you tap Share, we save the resolved place and its coordinates in our database
under a random 10-character code, and give you a link like
whereami.earth/s/k7x2p9m4qd.
If you added a detail of your own — "3rd floor, flat B" — that line is saved with it, exactly as you typed it. It is the only thing in the record we did not write ourselves, and whoever opens the link sees it, marked as your words rather than ours.
We also save which of the six card designs you chose, so the preview that appears when the link is pasted into a chat looks the way you picked. Five of the six include a small map of the place. We draw that map on our server and serve it from whereami.earth, so the person opening your link is not handed to anyone else to fetch it.
Please understand what this means:
- Anyone with the link can open it. There is no password and no sign-in.
- The code is random and long enough that it can't realistically be guessed, but a link is only as private as the people you send it to. If it's forwarded, posted, or screenshotted, whoever has it can see the location.
- These pages are marked so search engines don't index them, but that is a request to search engines, not a guarantee.
- Whatever you write in the detail line is published along with the location. We keep it for the same 30 days and show it to everyone holding the link. Don't put anything in it you wouldn't hand to a stranger.
- If you're sharing where you live, you are publishing your home address to everyone who ends up holding that link. That is the point of the feature. It's still worth saying plainly.
What's in it: the address, coordinates and elevation, your detail line if you added one, and the name of the card design you chose. Not who created it. We don't store your IP or any device identifier alongside it.
How long: 30 days, after which the link stops working and the record is deleted.
Lawful basis: Your consent, given by choosing to create the link.
Changed your mind? Email us at prikkiecompany@gmail.com with the link and we'll delete it straight away.
Location requests
You can also ask somebody else where they are. You make a link, send it to them, and they open it in a browser — no app, no account, nothing to sign up for — and tap once. Their location comes back to you.
This is the one place where a location we hold was not put there by the person it describes, so it is worth being exact about.
What's in it: the line you typed for them to read, if you typed one; and once they answer, the place their tap produced — the same address, coordinates and elevation any lookup gives. Not who asked, not who answered. No IP address and no device identifier is stored alongside either half.
Two links, and they are not the same. The one you send carries a short random code. The one you keep carries that code and a second, much longer secret. The link you send can be used to answer, and cannot be used to read an answer. Only the link you keep can read one, and we store only a fingerprint of that second secret — so if you lose the page, we cannot recover it for you, and neither can anybody who reads our database.
Please understand what this means:
- Anyone holding the link you sent can answer it, including somebody it was forwarded to, and a later answer replaces an earlier one. There is nobody to check it against, because nobody signed in.
- Anyone holding the link you kept can see the answer. Treat it the way you would treat the answer itself.
- The person answering is told, before they tap, what the button does and who is asking in their own words. Their tap sends one position and nothing else. It does not start anything, and there is nothing to turn off afterwards.
The list is on your device, because it cannot be on ours. We keep only a fingerprint of the second secret, so if you closed the page you kept there would be no way back to the answer at all — not for you, and not for us either. So your browser writes down the requests you have made and shows them on the ask page; the app does the same in its own storage.
What's in it: for each request, its code, the secret that reads it, when it runs out, and the line you typed. What isn't: any answer. The place somebody sent you is never written to your device, and an entry disappears from the list the moment it expires.
It is never sent to us — we cannot read it, and it is not a record we hold. On the website, clearing site data removes it. In the app, uninstalling does.
Being told when an answer arrives is done by your own device too. If you ask for it, the website raises a browser notification and the Android app raises a banner — but only while that page or that app is still running, because it is its own check that spots the answer and its own notification that says so.
There is no push. We do not use Firebase or any other push service, we store no device token, and nothing on our server ever sends anything to your phone uninvited. That is why the app can ask for the notification permission without this policy changing: the permission lets your device talk to you, not us.
The cost of doing it this way, said plainly: if Android has closed the app, or you closed the tab, nothing will tell you. The answer waits on the page, and the list on the ask page is how you find it.
How long: 24 hours. Not thirty days — a request is a same-day thing, and the shorter life is the point. After that it stops working and the record is deleted.
Lawful basis: Your consent for making the request, given by creating the link; and the answering person's own consent, given by their operating system's location prompt and by pressing the button.
Changed your mind? Cancel it on the page you kept. That deletes the record immediately, answer and all. If you no longer have that page, the 24 hours will do it.
Who else touches your data
| Who | What they get | Where | Why |
|---|---|---|---|
| Geoapify GmbH (Germany) | Coordinates and a language code, from our server | EU data centres | Turning coordinates into an address, and drawing the map on a share card |
| Open-Meteo | Coordinates, from our server | EU | Ground elevation |
| Vercel | Your IP address, as our host; anonymous website page-view counts | Frankfurt, Germany | Running the website and API, and counting page views |
| Supabase | The cache, share records, location requests and abuse counters | London, United Kingdom | Our database |
All processing happens inside the European Economic Area, with one exception: our database is hosted in the United Kingdom. The UK holds a European Commission adequacy decision, renewed in December 2025 and running to December 2031, which means personal data may move there from the EEA as freely as it moves within it. No additional transfer safeguards are required.
None of these companies is given anything that identifies you, and none of them is permitted to use what they receive for their own purposes.
We do not sell your data. We do not share it with advertisers. There are no advertisers.
What we don't do
- No accounts, no email addresses, no passwords.
- No advertising, no ad networks, no ad identifiers.
- No analytics in the Android app at all, and no crash reporting SDKs. On the website, anonymous page-view counts only — no cookies, no fingerprinting, and nothing that follows you between days or between sites.
- No background location unless you create the exception yourself. The app asks where you are only while you have it open and in front of you. The home screen widget is the single exception, because it cannot refresh without it — which is why adding it sends you to Settings to grant "all the time" by hand. No widget, no background location. Remove the widget and it stops.
- Nobody is signed up by being asked. A person who opens a location request and taps has no account, is not counted as a user, is not tracked, and leaves nothing behind on their device. One position is sent, once, and that is the whole of it.
- No selling, renting or trading of anything.
- No push notifications, and no device token. The app can raise a banner when an answer to your request lands, but its own check is what noticed — there is no Firebase, nothing of yours is registered with a push service, and our server never sends anything to your phone.
- No tracking cookies, and only one cookie of any kind. The website sets
NEXT_LOCALE, which remembers the language you chose and nothing else. The page-view counting is cookieless and has no part in it.
Your rights
Under the GDPR you can ask us to show you what we hold about you, correct it, delete it, restrict how we use it, or hand it over in a portable form. You can withdraw your consent whenever you like.
In practice, for most people, the honest answer is that we hold nothing about you — there is no account to look up and no record tying any location to any person. The things we can act on are the ones you hold a code for: a share link, and a location request. Send us either link and we'll delete the record; a request you still have the page for you can cancel yourself.
One uncomfortable point, said plainly rather than left to be discovered. If you answered somebody's request, you cannot ask us to delete that answer, because you hold nothing that identifies it — no account, no code, nothing we could match you to a record with. The person who asked can delete it, and it deletes itself within 24 hours regardless. That short life is there precisely because the person with the least power over the record is the one it describes.
Email prikkiecompany@gmail.com. We'll reply within 30 days.
Children
WhereAmI isn't aimed at children and we don't knowingly process data from anyone under 16. There are no accounts, so we have no way to verify age. If you believe a child has shared a location through the app, or answered a request through it, email us and we'll remove it.
Security
Everything travels over HTTPS. The database is access-controlled, and the tables holding cached addresses and abuse counters are not readable by the public at all, and neither is the one holding location requests — every read of it goes through a check on the code or the token in the address. Share records are readable only by someone who already has the exact link.
No system is perfectly secure, and we won't pretend otherwise.
Attribution
Address data comes from Geoapify and OpenStreetMap contributors. Elevation data comes from Open-Meteo, licensed CC BY 4.0.
Changes
If we change how any of this works, we'll update this page and the date at the top. If the change is significant, we'll say so in the app.