Privacy policy
Proof Of Fun is a record of the places you have been. That means it holds things that are genuinely yours: where you went, who you went with, and what you thought. This page says exactly what is kept, what is never kept, who else sees any of it, and how to delete the lot. It is written against the code that runs the service rather than around it.
1 · Who runs this
Proof Of Fun is an independent iPhone app built and operated by Naseem Raad. The app talks to one server, at api.proof-of-fun.com, and that server is the only place your account data lives. There is no company behind it selling anything on the side.
For anything in this policy, write to [email protected].
2 · Your account
Accounts are Sign in with Apple only. There is no password to choose and none for anybody to steal.
When you sign in, Apple hands the app a signed identity token. The app sends it to the server, which verifies it against Apple's public keys and then keeps:
- Apple's stable identifier for you (Apple calls it the
sub). It is specific to this app and cannot be used to identify you anywhere else. - Your display name and an
@handle. Apple sends your name only on the very first authorisation; if it sends none, the account starts as "New friend" and you name it yourself. - Your email address, if Apple shares it. Hide My Email relay addresses work. The email is kept on the private side of your record: it is never included in the data any other person's app receives, and it is not shown on your profile.
- An identifier for the device you signed in from, and a session token. Up to ten sessions are kept per account; the oldest is dropped after that.
3 · What you put in
Everything in this section exists because you created it, and all of it goes when you delete your account.
- Marks. The place, which of the four marks you gave it (LOVED, LIKED, OKAY, NOPE), whether you would go back, any vibe tags, the one thing worth remembering, the date, and who you were with if you said.
- Places. The identifier and a snapshot of the place: name, category, address, neighbourhood, city, country and its coordinates. Places are discovered on your device through Apple's MapKit, and the snapshot is what lets the server show the place to a friend who has not been.
- Saves, lists and trips, including their names and their visibility settings.
- Asks and answers. The question you asked, the city or coordinates it was about, and the replies your friends left.
- Photos you attach. See section 6.
- Friendships, in both directions, and your invite code.
- Your profile: name, handle, bio, and whether you allow other people to find you by handle or by phone number.
- Your year of birth — the year only. You enter a date when you sign up so the app can check you are old enough; the date itself is checked on your phone and never leaves it, and only the year is sent. A full date of birth is one of the strongest identifiers there is, and holding an age floor does not need one.
- The questions you ask in AI mode, and the answers, kept as a thread so follow-ups make sense — up to ten exchanges per conversation. Section 9 covers what is sent to Google to compose them.
- Anything you report: a bug report and its attachments, or a report about somebody else's content and the reason you gave. Section 10 covers both.
4 · Location
The app asks for location while you are using it, and only for that. iOS shows you the reason in its own words: "Proof Of Fun uses your location to show places near you."
Your coordinates are used on the device to search for nearby places, and are sent to the server with a nearby or search request so it can answer. The server does not keep a location history. There is no background location, no significant-change monitoring, and no trail of where you have been beyond the places you deliberately marked. Declining the permission leaves search, friends, lists and trips working normally.
5 · Contacts and your phone number
This is the part of the app most worth reading closely, because it is the part that could have been done badly.
No phone number is ever stored on the server. Not on your record, not in a backup, not in a log line. Only a salted hash, and it cannot be turned back into a number.
Finding friends from your address book
If you choose to match contacts, the phone numbers in your address book are normalised and hashed on your device. Only the resulting hashes are sent. The server compares them against the hashes of numbers other people have verified, and answers with the accounts that matched. Nothing else about your contacts is transmitted: no names, no email addresses, no numbers, and no record of the contacts that did not match.
For the technically minded, the whole algorithm is a normalisation to E.164 followed by sha256(number + ":" + secret), and it is implemented identically on the device and on the server so that neither side ever needs the number itself.
Verifying your own number
Adding your own number is optional, and it exists for one reason: so friends who already have you in their address book can find you. You will be sent a six-digit code by SMS. The code is good for ten minutes and five attempts, and you can request at most three in an hour. Once verified, the number is hashed the same way and the raw number is discarded. Other people only ever learn that you have a number on file, never what it is.
You can turn off discovery by phone number, or by handle, in the app at any time.
6 · Photos
Photos you attach to a mark are uploaded and stored as files; section 13 says where. iOS asks for photo access with its own prompt, and the app only ever reads the photos you pick.
How a photo is protected, precisely. Every photo is served from a web address ending in a long random identifier — something of the form …/uploads/up_7k2m9x4qd8v3ba.jpg. That address is the key to the photo. Before serving one the server checks that the photo still exists; it does not check who is asking for it. The app only ever hands the address to people who are allowed to see the mark it belongs to, but anyone who comes by the address some other way — it was forwarded, pasted into a message, or copied out of a browser — can open the photo. Treat a photo link the way you would treat any unlisted link.
The random part is fourteen characters, so an address cannot be guessed or found by trying, and where photos are held in a storage bucket that bucket is private: its contents cannot be listed or browsed, and it serves nothing to anybody directly.
The metadata does not travel with them. Your phone writes the exact coordinates and the capture time into every photo it takes. Before a photo leaves your device the app re-encodes it, which keeps the picture and discards everything else attached to it — the GPS tag, the timestamp, the camera details. A photo of a café already says roughly where you were; the precise spot it was taken from does not need to go with it. A smaller copy is made at the same moment and on the same terms, so a feed can draw a thumbnail without fetching the full image.
A profile picture is optional. If you set one it is stored and served exactly as above, and its address is shown to anyone who can already see you in the app — your friends, and anyone who finds you by handle. Replacing or removing it deletes the previous file. Without one the app draws your initials, which is the default.
What deleting removes. Deleting your account deletes the photo records and the image files themselves, and every one of your photo addresses stops working at once — see section 14. Deleting a single mark is narrower than that: it removes the mark, but the photo you attached to it stays stored and its address keeps working until you delete your account. If you want one photo gone sooner, write to [email protected] and we will remove it.
7 · Who can see your marks
Friendship in Proof Of Fun is mutual and has to be accepted. One person asking is not a connection: a pending request grants nothing at all, not your marks, not your lists, not your trips, not even the rows on your profile.
Every log, list and trip carries its own visibility, so anything can be for your friends or for nobody but you. Nothing you write is public to the internet, nothing is indexed by search engines, and there is no feed of strangers.
8 · Other companies involved
The service is deliberately small, and this is the complete list of third parties that can receive anything.
- Apple handles sign-in, and Apple Maps supplies place data. Place searches you run may reach Apple's Maps Server API. Apple's own privacy policy governs what Apple does with that.
- Google receives an Ask question when you use that feature (see section 9). If the service is configured to use Google Places rather than Apple Maps for place data, place searches reach Google instead.
- An SMS provider (Twilio, or Sent) receives your phone number and the six-digit code, once, at the moment you ask to verify a number. This is the only time your number is transmitted to anyone, and it is not stored afterwards.
- Cloudflare holds the hourly backup of the whole dataset, and uploaded photos where the service is configured to keep them in an R2 bucket rather than on the server's own disk. A backup is not photos-only — it contains your account, your marks and your notes. Section 13 says where it sits and on what terms.
- Sentry receives server errors, and only server errors. Section 11 sets out exactly what an error report contains and what is deliberately kept out of it.
Nobody is paid to receive your data, and none of it is sold, rented, or handed to advertisers or data brokers. There is no such arrangement and there will not be one without your explicit consent.
9 · The Ask feature
When you ask the app a question in the AI mode, the following is sent to Google's Gemini model to compose an answer, with Google Maps grounding enabled: your question, the relevant context from your friends' places (which includes their display names and the notes they wrote), your display name, and your current coordinates when the app has them. Your account identifiers, your email address and your phone hash are not part of that request.
Your question and the answer are also stored on this service's own server as a thread, so a follow-up question makes sense; the thread goes when you delete your account. If you would rather no question of yours reached Google, do not use the AI toggle: asking your friends directly works without it, and so does ordinary search.
10 · Reporting a problem
Under You › Edit there is Report a problem. Nothing is sent unless you write something and press send, and the sheet shows you the whole attachment before you do — every field, and every error line, in full.
A report carries what you wrote, the screen you were on, and a short technical block: the app version and build, your iOS version, your device model (“iPhone17,2” — never the device name, which people put their own names in), which server the app is talking to, your units and locale, and whether you are signed in. It also carries the last ten failed requests the app saw, as lines like “10:14 GET /v1/map/pins → 500”. That list lives only in memory on your phone, is never sent on its own, and is gone when you close the app.
You may attach screenshots. Those are uploaded like any other photo, with the same metadata stripped.
There is also a form on the support page of this website, for anyone who cannot use the in-app one — because they have no account, cannot get past the sign-in, or are not on their phone. It is a plainer thing: it keeps what you wrote, whether you called it a bug or feedback, the email address and @handle you chose to give (both optional — and with no address there is simply no way to reply), and your browser's user-agent string, truncated. It takes no attachments, sets no cookie, and is not tied to any account, so it is not removed when an account is deleted. Ask at [email protected] and a message you sent will be deleted.
Reports are stored so they can be acted on, and are readable by the operator. They may be forwarded to a chat tool the operator uses — a Slack or Discord message — so a report is seen rather than sitting in a log. Deleting your account deletes your reports with it.
11 · Crash and error reports
When something breaks on the server — an unhandled error, the kind that shows you a failure and would otherwise be invisible to us — a report of it is sent to Sentry, an error-monitoring service. This is the one thing on this page that reports automatically, without you doing anything, and it is worth being exact about what it is.
What an error report contains: the programming error and where in the code it happened, the route that was being served (“POST /v1/logs”), and your account id.
What is deliberately kept out of it: the request body, so nothing you wrote — no note, no question, no place, no message — is in it; the request headers and cookies, so your session token is not in it; and your IP address. The setting that would have attached all of that is off, on purpose. Your name, handle, email and phone are not sent either. The account id is there so that if something is broken for you specifically, it can be found; it is a random string and means nothing outside this service.
The app sends nothing to Sentry. There is no error-reporting SDK on your phone at all. If the app itself crashes, Apple's own crash reporting may send a report to us through App Store Connect — that is an Apple mechanism, controlled by the Share iPhone Analytics switch in iOS Settings › Privacy & Security › Analytics & Improvements, and turning it off stops it.
12 · What is never collected
- No third-party analytics or tracking SDKs in the app. The app on your phone ships with no analytics framework, no error-reporting SDK, no advertising identifier, and no attribution kit. Nothing on your device reports your behaviour to anyone. The server sends its own errors to Sentry, which section 11 sets out exactly; that is error monitoring, not analytics, and it is the only automatic reporting anywhere in the service.
- No product analytics. Nothing counts which screens you open, how long you look at them, or what you tap. There is no funnel tracking on you as an individual and no behavioural event stream. What the operator can see is the total shape of the service — how many people have accounts, how many places have been logged this week — counted from the records already in the app, not from watching anybody use it.
- No advertising, and no profiles built for advertisers.
- No sale or sharing of personal information in the sense the CPRA uses the words.
- No background location.
- No contact names, emails, or phone numbers from your address book.
- No reading of anything on your device beyond the photos you pick and the contacts you ask to match.
The server keeps short operational logs of the form "this request hit this path and returned this status in this many milliseconds". They exist to notice when something is broken. They are not used to build a picture of anyone, and they are not joined to your account.
The operator can reach an internal page showing those totals, alongside any bug reports people have sent. It is reachable only with a secret held by the operator, and it exists to answer "is this working and is anybody using it", which is a question about the service rather than about you.
13 · Where it is stored
Everything lives on a single server that we operate, in a Hetzner data centre in Nuremberg, Germany, along with a snapshot file that lets it survive a restart. Access is limited to the operator. Traffic between the app and the server is encrypted in transit with TLS.
There is also an off-site backup. Once an hour the server writes a copy of its whole dataset to the Cloudflare R2 bucket described below, and keeps the last fortnight of those copies. A backup is not photos-only: it contains everything section 3 lists — accounts and the email address on them, marks and their notes, asks, answers, lists and trips. It exists because one server's disk failing would otherwise take all of it at once, which is a worse risk to you than the copy is.
That bucket is Cloudflare R2, and it currently sits in Cloudflare's Western North America region. It holds the hourly backups above and, where the service is configured to keep them there rather than on the server's own disk, uploaded photos. The bucket is private. It is not published to the internet, its contents cannot be listed or browsed, and Cloudflare serves nothing out of it to anybody. Photos reach you only through the app's own server, at the addresses described in section 6: the server checks that a photo still exists before serving it — which is what makes a deletion take effect immediately — and it does not check who is asking.
What that means if you are in the UK or the EEA. The server itself, and so the live service, is inside the EEA. The backup copies are not: they are held in the Cloudflare region named above, which is outside it, and they contain the same data the server does. That transfer is made under our data processing terms with Cloudflare, which incorporate the European Commission's standard contractual clauses and the UK addendum. Ask us and we will send you the relevant terms.
Data is kept for as long as your account exists, because the point of the app is that the record is still there in five years. It goes when you delete the account, and not later — other than in the backup copies, which age out within a fortnight (section 14).
14 · Deleting everything
Delete your account from inside the app, under You. It removes your account, your marks, your saves, your lists, your trips, your asks and answers, your friendships, your sessions, your bug reports, and the photo files themselves — your profile picture and every photo you attached, wherever they are stored. It is immediate, and from the service itself it is not recoverable. The backups are the one exception, and they are described directly below.
The records go first, in a single database transaction, and that is what makes it immediate: the moment it completes, every address that pointed at one of your photos stops working, because nothing will serve a photo whose record is gone. The image files are then deleted from the storage they sit in.
The one exception is the backups. The hourly copies described in section 13 were taken before you deleted, so they still contain what you deleted. They are not part of the running service, nothing reads them unless the server has to be rebuilt from one, and each is deleted on a rolling basis — so the last copy holding your data is gone within a fortnight. If we ever did restore from a backup taken before your deletion, we would re-apply the deletion afterwards.
You can also revoke the app's access from your Apple account, under Settings › your name › Sign in with Apple. That stops future sign-ins; to remove the data as well, use the in-app delete or write to us and ask.
15 · Your rights
Wherever you live, you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Write to [email protected] and you will get an answer within 30 days.
If the GDPR applies to you, the lawful bases are straightforward: your account and your marks are processed to perform the contract of providing the app you asked for; contact matching and phone verification happen on your consent, which you can withdraw at any time by turning discovery off or removing your number; keeping the service running and free of abuse is a legitimate interest. You may also complain to your local supervisory authority.
If you are in California, the CPRA rights to know, delete, correct, and to opt out of sale or sharing all apply. There is nothing to opt out of, because nothing is sold or shared, and you will never be treated differently for exercising a right.
16 · Children
Proof Of Fun is not intended for children under 13, and accounts are not knowingly created for them. If you believe a child has an account, write to us and it will be removed.
17 · Changes
If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and the app will tell you before the change takes effect. Small corrections and clarifications are made in place.
18 · Contact
Questions, requests, or something in here that does not match what the app actually does: [email protected].
The companion document is the terms and conditions.