Privacy policy

Who runs PHI

PHI is run by [operator name, address]. For any privacy question or request, write to [contact address].

No name, no profile; an email only to post

You never give us a name, phone number or birthdate. Browsing needs no account at all. The first time you like or report a photo, or start to confirm your email, we create an anonymous account for that device: a random internal number, kept in a secure cookie on that device for up to 400 days. That number is never shown to anyone. An anonymous account that does nothing (no photo, like or report) is deleted after 7 days.

To post a photo you need to confirm an email address (see "Your email"). Liking and reporting work without one.

People on PHI have no public identity. Each photo gets its own random display number (like #4829173). It is not linked to you or to your other photos.

Your photo

Before upload, your device turns the photo upright, applies any crop and the blur you added, and shrinks it. The original, unblurred and uncropped picture never leaves your device.

On our server every photo is decoded and saved again as a new image. This removes all hidden data: camera and phone details, GPS position, dates, editing history and colour-profile data. The file name from your device is never stored.

Every photo is checked by a moderator before anyone else can see it. Once approved, it appears on the globe. Only the day your photo was shared is shown, never the time. Because a photo appears soon after it is approved, someone watching the globe could notice roughly when it appeared.

Location: your city, nothing finer

You choose a city from a list. We never ask for your device location, never read GPS from your photo, and store only the city you picked. Photos are shown at the centre of that city, never at a point inside it.

What is public

For an approved photo: the image, your caption if you wrote one, the city, region and country, the weekly prompt, the photo's display number and the day it was posted.

Each public photo has its own page (/p/ followed by a random code) that anyone with the link can open. We ask search engines not to index these pages. When a link is shared in a chat app, that app may show a preview with the image, the city and the prompt, never the caption, number or date. A preview another app already made can keep showing the image after the photo is removed; we cannot delete copies held by other services.

Never public: who posted a photo, any of your other photos, how many likes a photo has, reports, or a photo's moderation status.

Likes and reports

A like is stored as a link between your anonymous account and the photo. Only you see which photos you liked. The person who posted a photo can see, privately, how many likes it has, never who gave them.

A report stores the reason, your optional note and your anonymous account, so that one person counts once. The person who posted the photo never sees who reported it. When three different people report a photo, it is hidden until a moderator looks at it.

Your email

Posting a photo needs a confirmed email address. We send you a 6-digit code and you type it on the device that asked; the code works for 15 minutes. There is no password. The same email lets you see and delete your photos on any device.

Why we ask, and on what basis: we need the email to provide what you asked for, posting and managing your photos (contract), and to keep PHI safe, for example so a moderator can stop someone who keeps breaking the rules from posting again with a fresh device (legitimate interest). We do not rely on your consent for it, so you can stop using it only by deleting your account.

What we keep: the address itself, stored by our sign-in provider (Supabase) with your account. We never show it to anyone else (you see only a shortened form, like m…@example.com), never put it on a photo or a public page, never show it to moderators, and never use it for newsletters or marketing. We send only sign-in and confirmation codes. Those emails are delivered by Resend, which processes the address and the message for us. Our own logs never contain it.

Important: because your email sits with the account that owns your photos, PHI can connect that address to every photo on the account and the city each was posted from, including photos that were not approved, were removed, or that came from this device before you added the email. So can anyone who can legally compel PHI to hand over data, such as a court or the police, or anyone who broke into our systems. Photos are never shown with your email or with each other, and every location is a city, never a point inside it. If you do not want that connection to exist, do not post.

Moving photos from this device: if you continue with an email on a device that already has photos, we ask before doing anything. If you agree, that device's photos, likes and reports move into your email account and the device's anonymous account is deleted. Anyone who can read that email can then see and delete those photos. If you cancel, nothing moves and that device cannot post.

Kept until you delete your account. Phase 1 has no way to change or remove the email while keeping the photos; deleting the account is the way to remove it.

"Forget this device" signs this device out. Your photos stay with your email and you can continue with it again any time. Photos on a device that never added an email cannot be reached again by anyone, including you, once it is forgotten.

If a moderator stops an account from posting

A moderator can stop an account from posting new photos, for repeated or serious breaks of the terms. The block stores the account's internal number, a short note by the moderator about what was done (never shown to you, and written about the conduct, not about you), the day, and the number of the photo it was made from. It does not change your photos, likes or reports.

If a blocked account is deleted, we keep, instead of the account, a keyed one-way code made from its email address (never the address itself), so the same address cannot simply post again. That code is deleted when a moderator lifts the block, or 12 months after the account was deleted, whichever comes first. A lifted block is kept without any link to you for 12 months as our moderation record, then deleted. Accounts that were never blocked leave no such code.

Deleting your account

In My submissions you can delete your account. All your photos are removed at once (leaving only the stubs described under "Deleting your photos"), and your likes, reports, private status links, the account itself and its email address are deleted. Abuse-limit counts hold no account number or address and expire on their own after about 25 hours. If the account was stopped from posting, only the keyed code described under "If a moderator stops an account from posting" remains, for at most 12 months. It cannot be undone.

One exception: if a photo from the account is under a legal hold (see "Illegal content and legal holds"), we keep a copy of the account's confirmed email address with that sealed case only, until the hold ends.

Private status link

For any of your photos you can make a private link. Anyone who has the link can see that photo's status (waiting, approved, not approved with the reason, hidden or removed), its city, prompt and the day it was shared, and the photo itself only once it is public. The link never shows your other photos, likes or anything about you.

We store only a scrambled (hashed) form of the link, so we cannot show it to you again. The secret part is after the # sign, which browsers never send to any server. The link stops working when you turn it off, make a new one, or delete the photo or your account. Keep it private.

Bot check (Cloudflare Turnstile)

When we create an anonymous account for a device (see above), we may ask Cloudflare Turnstile to check that you are a person. Browsing PHI never loads it. For the check, Cloudflare processes signals from your browser, such as your IP address, your browser's User-Agent and TLS fingerprint, and which website asked for the check. It may use cookies or similar browser storage that are needed for the check. Cloudflare does this on our behalf to tell people from bots. It also uses these signals as an independent controller to improve its bot detection, as described in the Cloudflare Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/). We do not store the check's token or its result.

Counting without tracking

PHI has no ads, no third-party analytics and no tracking cookies. We count only totals: how many times the share buttons were used each day, and how many people posted each week and how many of them also posted the week before. For that weekly count your anonymous account keeps one date: the Monday of the last week you posted. The share count is sent without any cookie.

Abuse limits and IP addresses

To limit spam we count recent actions (posts, likes, reports, sign-ins, code requests and wrong codes) per account, per network and per email address. A network or email address is stored only as a keyed one-way code made from it, never the address itself, and these counts are deleted after about 25 hours.

Our hosting providers (Vercel for the website, Supabase for the database, files and sign-in, Resend for sign-in emails) process IP addresses to deliver the service and may keep them in their own operational logs under their terms [retention to be confirmed]. Our own logs record error types only, never IP addresses, account numbers or photo details.

On your device, PHI may remember which globe style you picked (Clean, Satellite or Terrain). That setting stays on your device and is never sent to us.

Deleting your photos

You can delete any of your photos at any time in My submissions, whatever its status. We delete the image files at once (copies in internet caches stop being served within an hour) and keep only a stub with no image, no caption, no place and no link to you: the display number, the status, dates and the consent version you agreed to.

If a moderator does not approve a photo, it is never public. It stays visible only to you (with the reason) and to moderators, until you delete it.

Illegal content and legal holds

If a photo appears to show illegal content, such as child sexual abuse material, we may be required to report it to the authorities and to keep a sealed copy, even if the photo is deleted. That copy holds the image and the photo's details (place, prompt, caption, dates, report reasons without reporters' accounts) and the internal number of the account that posted it. It is kept for as long as the law or the authority requires: one year after a report to the US NCMEC, 21 days after a notice to Canadian police, or the period an order names (at most two years), and then deleted. Access to it is limited and logged.

While such a hold lasts, if that account's photos are moved into an email account, we also record that account's internal number for that case only. If that account is deleted during the hold, we keep its confirmed email address with the case (see "Deleting your account"). Both are deleted with the case.

How long we keep things

Photos, captions, likes and reports: until you delete the photo or your account (or we remove the photo after review), except under a legal hold. Email address: until you delete your account, except under a legal hold. A blocked account's keyed email code: until the block is lifted or 12 months after the account is deleted. Lifted blocks (with no link to anyone): 12 months. Private status links: until you turn them off or delete the photo or account. Anonymous accounts: until deleted or moved into an email account as described above; one that never liked, reported or posted is deleted after 7 days. Sign-in codes: 15 minutes. Abuse-limit counts (including a keyed one-way code of your email address, never the address): about 25 hours. Weekly and daily totals: kept, as they contain no personal data.

Your rights

You can see and delete your photos, and delete your whole account, yourself in My submissions. We can find your data only through your device's session or, if you linked one, your email address. For any other request, write to [contact address]. The legal bases are described under "Your email". [Counsel: legal bases for the rest, international transfers, supervisory authority and region-specific rights.]

Children

You must be 16 or older to post, like or report. Photos must not show any child who could be recognised.

Changes

If this policy changes, we will update this page and its date. [Counsel: notice of material changes.]