Short version: HereLore has no user accounts and shows no ads. We don't sell
your data. Your location and photos are sent only when you use a feature that needs them, and
only to produce the story you asked for. Your saved places stay on your phone. We keep short-lived
technical logs (up to 7 days) to keep the service running and fix bugs.
1. Who we are
HereLore ("the App") is a mobile app that tells the history of the places around you, as text and
narrated audio. It is published by Dragos Coman, an independent developer based in Romania
("we", "us"), who is the data controller for the processing described here.
Contact: dragos.coman25@gmail.com.
2. What we process and why
2.1 Location
What: your device's coordinates (precise or approximate, as you allow) and the
street or place name derived from them.
When: only when you ask for something that needs it: a story about where you
are, the nearby places list, the map, a photo scan, Time Machine or a walking tour. The App does
not track your location in the background.
Why: to find the places near you and tell their history.
2.2 Photos (Scan)
What: a photo you take of a building, monument or artwork, plus the direction
the camera was pointing.
When: only when you press the shutter on the Scan screen.
Why: to recognise which place is in the photo.
Storage: the photo is sent over HTTPS to our server, which passes it to the
recognition services listed in section 3. We do not store your photos. Photos also stay on your
phone only if you save them yourself.
2.3 Anonymous install ID
What: a random ID created when the App is first installed. It is not linked to
your name, email or phone number.
Why: to apply the daily free limits without an account, to count how many
people use the App each day, and to tell apart error reports from different installs.
2.4 IP address
Our server sees the IP address of each request, as every web server does. We use it only to
stop abuse of the free limits (a daily cap per network). The full address is kept in a counter
that expires at the end of the day (UTC). Our logs keep only its first two parts
(for example 81.196.x.x).
2.5 Subscriptions
Purchases are handled by Google Play. We never see your card details, name or
billing address.
To unlock Premium, the App sends us the purchase token Google gives it. Our server checks it
with Google and returns a signed pass that unlocks Premium on your phone. We use
Google Play Integrity to check that requests come from the genuine App.
2.6 Diagnostics and usage statistics
Firebase Crashlytics (Google) collects crash reports and error details:
device model, Android version, App version, and the steps that led to the error.
Firebase Analytics (Google) collects anonymous usage events, such as which
screens are opened and whether a story played to the end. Advertising IDs are disabled in
the App.
Our server records anonymous statistics about scans and stories (for example which method
recognised a place, and whether you corrected it with "Not this place?"), linked to the install ID.
2.7 What we don't collect
No name, email, phone number or password: there are no accounts.
No contacts, calendar, messages, microphone or browsing history.
No advertising ID, and no tracking across other apps or websites.
No location history: we only see the location of the request you just made.
2.8 Legal basis (EU/EEA users)
We process this data because it is necessary to provide the App you asked for (Art. 6(1)(b) GDPR),
and for our legitimate interests in keeping the service secure, preventing abuse and fixing errors
(Art. 6(1)(f) GDPR). Location and camera access are always subject to the permissions you grant
in Android.
3. Services we use
The App and our server rely on these providers. Each receives only what it needs for its task:
Provider
Purpose
Data it receives
Cloudflare (Workers)
Our server, cache and logs
Everything the App sends to our server (see section 2)
The providers process this data to deliver their service to us. Under their API terms, Anthropic
and OpenAI do not use it to train their models.
4. How long we keep it
On your phone: saved places, stories, settings and cached audio stay until you
delete them or uninstall the App.
Server logs: up to 7 days. They contain the request details listed above
(rounded coordinates, install ID, partial IP, App version, errors).
Story cache: stories are cached for up to 7 days, and place-name translations
for up to 30 days. Both are keyed by place, narrator and language, and contain no personal identifiers.
Daily limit counters: until the end of the day (UTC).
Anonymous statistics: up to 3 months.
Firebase: as set by Google (Crashlytics keeps crash reports for 90 days).
Providers in section 3: according to their own policies, linked above.
5. Your rights
You have the right to access, correct or delete your data, to object to or restrict its processing,
and to data portability. Because there are no accounts, most of your data exists only on your phone:
Delete local data: uninstall the App, or use Android Settings → Apps → HereLore →
Storage → Clear data. This also creates a new install ID.
Server-side data: logs expire on their own within 7 days, and statistics within
3 months. Clearing the App's data also breaks the link to you, because the App then gets a new
install ID. For any other request, email us.
Location and camera: you can revoke these permissions at any time in Android
settings. The features that need them will stop working, but the rest of the App keeps working.
Subscriptions: manage or cancel them in Google Play → Payments & subscriptions.
Complaints: you can contact the Romanian data protection authority
(ANSPDCP) or the authority in your own country.
6. Children
The App is not directed at children under 13, and we do not knowingly collect data from them.
If you believe a child has sent us data, contact us and we will delete it.
7. International transfers
Our providers process data in the United States and other countries outside the EU/EEA. These
transfers rely on the providers' Standard Contractual Clauses or on the EU–US Data Privacy Framework.
8. Security
All traffic between the App and our server uses HTTPS. Access to logs and to the provider accounts
is limited to the developer.
9. Changes to this policy
We may update this policy when the App changes. The "Last updated" date at the top shows the current
version. We will announce significant changes in the App.