Privacy Policy

NODIS, LIMITED LIABILITY COMPANY (合同会社Nodis, "we", "us") handles information in the Stoodmark iPhone app and on the website stoodmark.com (together, the "Service") as described below.

1. In short

• Your photos are never sent to any server. The iPhone app reads the information attached to your photos (when and where they were taken) on your phone only, to find the countries and World Heritage sites you have stood in. Nothing analyses what is in your photos.
• An account is optional. Without one, your record stays on your device and we receive nothing.
• If you sign in, we store your email address and the sites you have stood at (site number and year-month), the sites you want to visit, and the countries you have been to (country codes). Never photos, coordinates or times of day.
• A public passport is published only if you turn it on. It is off by default.
• The website measures usage anonymously with PostHog (EU), storing nothing on your device. The app currently has no usage analytics.
• We do not track you for advertising and we do not sell your information.

2. What stays on your device (we never receive it)

2.1 iPhone app: your photo library

If you allow photo access, the app reads the following on your phone:

• Nothing, AI included, analyses what is in your photos.
• Photos in the iOS Hidden album are never read.
• If you allow access to selected photos only, only those are read.
• If you allow access to all photos, the app checks photos taken since the last check in the same way, on your phone, when you open it (at most once every 12 hours), and tells you if it finds something new.
• Photos, their locations and their on-device identifiers (local IDs) never leave your phone.

2.2 iPhone app: your record on the phone

Stored only in the app's storage on your phone (what is sent when you sign in is in section 3):

• Seals: site number, year-month, time of the first and last photo of that visit, on-device IDs of the chosen photo and candidate photos, number of photos
• Countries: country code, first month and time of entry
• Sites you want to visit
• One place per day: the latitude/longitude of one photo per day, rounded to two decimals (about 1 km), used only to calculate how far you have travelled
• The name you type for share images, your "home country" setting, the time of your last scan
• If signed in, the session token that keeps you signed in

Whether this is included in device backups (such as iCloud Backup) depends on your device settings.

2.3 Share images

Images made with "Share to Stories" are created on your phone and handed to the destination you choose in the iOS share sheet (for example Instagram). We do not receive them. If your public passport is on, share images show its address, stoodmark.com/@name. The destination's own terms and policies apply.

2.4 Website: your record in the browser

On the website, your record (sites with year or year-month and the time sealed, sites you want to visit, countries, home country) is kept in your browser's local storage. The browser also keeps the session that keeps you signed in (if you sign in), the newsletter choice you made before signing in (removed once sign-in completes), and when you chose "Later" on the sign-in invitation. If you use your location on "Nearby", it is used inside your browser only and is never sent or stored. Export and import of your record use a file and no server.

3. What we receive

3.1 Account (optional, only if you sign in)

You sign in with your email address (a 6-digit code in the app, a link on the web). Your account then stores:

Never sent: photos, on-device photo IDs, coordinates, times of day, the one-place-per-day data, your home-country setting. Your share-image name is stored in your account only when you turn on a public passport, as its name.

Database row-level security lets only you read and write your own records. The only exception is what a public passport shows (section 3.2), which anyone can read.

We do not send any newsletter yet. Before we do, we will add the disclosures the law requires, such as the sender's address.

We may show, per site, how many people have stood there or want to go. These are totals across all users and identify no one.

3.2 Public passport (optional, only if you turn it on)

If you pick a name (3–30 characters: a–z, 0–9, "." and "_") in your account settings and turn on "Make it public", anyone can see the page stoodmark.com/@name. It is off by default.

What is public:

• the name you chose
• the sites you have stood at, with year and month (the page shows the year). Seals made in the last 30 days, and visits whose month falls within the last 30 days, are left out, so up to about two months are never shown
• the countries you have been to (once they have been in your account for 30 days, plus the countries of the sites above)

Never public: your email address, home-country setting or home, photos, coordinates, exact days, sites you want to visit, your newsletter preference.

To stop publishing, turn "Make it public" off in your account settings in the app or on the website. From that moment the public data is no longer served, and the page usually disappears within a few minutes. Deleting your account has the same effect. We cannot remove copies that other people saved or reposted before you turned it off.

3.3 Visiting the website

When you open the website, our hosting provider (Vercel) receives your IP address, browser type (user agent), the URL, the referrer, the time and your language setting, and keeps them in its logs for a period. The language setting chooses the Japanese or English version. When you create a share image, its URL contains the site number, year and your home country (for a year recap: the year and the list of site numbers for that year), and the image is generated on the hosting provider's server. We do not store these per user.

3.4 Website analytics (PostHog)

To improve the website, we send the following to PostHog (EU cloud):

• A random ID kept in memory only, for as long as the browser tab stays open: moving between pages inside the site keeps the same ID, and closing or reloading the tab ends it. Nothing is stored on your device (no cookies, no local storage). It is not linked to your name, email address or account
• The page path and language (ja/en)
• Named actions with details: seal (site number, country code, bulk or not, dated or not), want to go (site number), share (site number, sealed or not), year recap shared (year, number of sites), sign-in email requested (success, newsletter chosen or not, which screen), sign-in invitation shown or postponed (reason, number of seals)
• Because of how the internet works, your IP address and browser type reach PostHog. Our code tells PostHog not to derive a location from the IP address (GeoIP disabled) and sends events with the IP address field left empty

The app currently has no analytics. If we add them, we will update this policy first.

3.5 App updates (Expo)

At launch, the app asks Expo (EAS Update) whether a fix is available. This request includes a random ID created per installation (EAS Client ID), the platform (iOS), the app's runtime version and your IP address. If the app crashed on its previous launch, the error message (up to 1,024 characters) is also sent.

3.6 Email

• Sign-in emails: we send a sign-in code and link to the address you enter, using Supabase's mailer or Resend (sending from stoodmark.com).
• Contacting us: mail to hello@stoodmark.com is received by Resend and forwarded to our representative's mailbox. We receive your email address, subject, message and attachments, and use them to reply and keep a record.

4. Why we use it

1. To store your record and sync it between your devices and the web (account)
2. To show your public passport (only if you turned it on)
3. To send sign-in emails and confirm it is you
4. To send the newsletter (only if you asked for it; none is sent yet)
5. To understand and improve how the Service is used (anonymous analytics)
6. To prevent abuse, fix faults and keep the Service secure
7. To answer your enquiries
8. To produce and show statistics that identify no one (for example, how many people stood at a site)

We will tell you before using information for any other purpose and ask for consent where the law requires.

5. Sharing

We do not give personal information to third parties except: with your consent (including publishing the data in section 3.2 when you turn on a public passport); where the law requires or permits; and to the service providers in section 6, to the extent they need it to work for us.

6. Service providers and international transfers

These providers act on our instructions under contracts (data processing agreements or terms of service) that require protection consistent with Japan's Act on the Protection of Personal Information (APPI). The United States has no comprehensive federal privacy law; some states have their own (for example the California Consumer Privacy Act). Japan's Personal Information Protection Commission recognises the EU and the UK as having an equivalent level of protection. On request, we will tell you what measures each provider takes.

7. Data sent directly from your device to other companies

Wikimedia, Google, Booking.com and GetYourGuide are not our service providers; their own privacy policies apply. The links carry no referral code and nothing that identifies you.

8. How long we keep it

9. Deleting your record and account

• Deleting your account: at any time, in the app (Passport screen, account section, "Delete account") or on the website ("Record" tab, account section, "Delete account"). Your email address, sites, wishes, countries, public passport and newsletter preference are all deleted, and this cannot be undone. The record on your phone or in your browser stays (see below to erase it). Authentication logs disappear after the period each provider sets.
• App record: "Erase all records on this phone" erases countries, seals, wishes and the one-place-per-day data on the phone. If you are signed in, it signs you out and your account keeps its record. Your photos are not touched.
• Website record: clearing your browser's site data removes the record kept in the browser.
• If you cannot do this yourself, email hello@stoodmark.com.

10. Your rights under Japanese law (APPI)

You or your representative may ask us to tell you the purpose of use; disclose the personal data we hold (including records of provision to third parties); correct, add or delete it; stop using or erase it; or stop providing it to third parties. Email us at the address in section 14. To confirm your identity we may ask you to write from your account's email address. There is no fee.

11. If you are in the EEA or the UK

Under the EU General Data Protection Regulation (GDPR) and the UK GDPR:

• Controller: NODIS, LIMITED LIABILITY COMPANY (contact in section 14). EU and UK representative: under consideration; we will name them here once appointed. Until then, please use the contact in section 14
• Legal bases
  • Account, sync and sign-in emails: performance of a contract (Art. 6(1)(b))
  • Public passport: consent (Art. 6(1)(a)), which you can withdraw at any time by turning it off
  • Newsletter: consent (Art. 6(1)(a)), which you can withdraw at any time
  • Website analytics: legitimate interests (Art. 6(1)(f)) in improving the Service; nothing is stored on your device and nothing is linked to you. You can object via the contact in section 14
  • Access logs, abuse prevention, app updates: legitimate interests (Art. 6(1)(f)) in providing the Service securely
  • Legal obligations: Art. 6(1)(c)
• Information processed only on your device, such as photo locations, is not sent to us and we do not process it.
• Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawing consent. You may also complain to the supervisory authority where you live.
• Transfers: transfers from the EEA and the UK to Japan rely on the European Commission's adequacy decision for Japan and the UK's adequacy regulations. For personal data received under that decision we follow the Japanese Personal Information Protection Commission's Supplementary Rules. Transfers to US providers rely on the EU-U.S. Data Privacy Framework (and UK Extension) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing agreement.
• Automated decisions: candidate sites are found on your phone, and you decide what to seal. We make no automated decisions with legal or similarly significant effects.

12. Age

The Service is not intended for children under 16. If you are under 16, do not create an account. The app and the website work without one.

13. Security

Encrypted connections (HTTPS); row-level security in the database; administrative keys kept out of published code and stored only in restricted secret storage; least-privilege access. We use providers in Japan, the United States and the EU (Germany), as listed in section 6.

14. Contact

NODIS, LIMITED LIABILITY COMPANY (合同会社Nodis), Japan
Email: hello@stoodmark.com
Our address and the name of our representative are available on request without delay.

15. Changes

When we change this policy, we will announce the change and the date it takes effect in the Service, and ask for consent again where the law requires.