Privacy Policy

Where Is Alex · last updated 24 September 2026

Where Is Alex helps a small group of friends see when their travel plans overlap. It is not advertising-supported. Nothing is sold, rented, or shared for marketing, there is no analytics or tracking SDK in the app, and no third-party code runs inside it.

This policy describes what the app stores, who else can see it, and how to get rid of it. It is written to be read rather than to be survived.

Who is responsible

The data controller is the operator of Where Is Alex, contactable at support@whereisalex.ai. That address reaches a person, not a ticketing system.

What is stored

Who you are — your display name, and the identifier Sign in with Apple or Sign in with Google gives us. If Apple shares an email address, including a private relay address, it is stored too; Google always shares the address of the account you choose, and it is stored.
Your character — the face you draw for yourself in the Me tab. Your crews see it.
Your trips — a city and a date range. You choose which of your crews can see each trip; a crew you leave out sees nothing at all, not a redacted version.
Your flight, if you share a landing time — the airline and flight number, the airports it leaves from and lands at, the day and time it lands, and the terminal. It is shared per flight with the crews you pick, and only with the people who were in those crews when you shared it; a crew you leave out sees nothing. It is deleted the day after the flight lands. A boarding pass also carries your legal name and your booking reference, and neither is ever stored: the app has nowhere to put them.
Your crews — which groups you belong to and who else is in them.
What you say in a crew chat — the messages you send to a crew, and who sent each one. Everyone in that crew can read them; a crew you are not in cannot. They are deleted 90 days after they are sent, and deleting your account deletes yours immediately.
Where you live — a home city, if you set one. It is how the app works out when you are at home rather than away, and it is shown to everyone who can see you: your crews, and anyone whose follow you accepted. Unlike the city you share, it has no per-crew control — it is either set or it is not, and you can clear it at any time.
How you play in a crew’s card game — the hands dealt to your table, the moves made, and — when somebody asks the table to end a game — who asked and how each seated player voted. Everyone in that crew can see it. It is kept while the crew keeps playing, and deleting your account deletes your part of it.
How you play a crew’s minigames — your scores, by crew and by week, and in the drawing game the drawing behind each score. The crew sees the weekly board, and whoever’s best drawing scores lowest that week wears it as their face until somebody does worse. Deleting your account deletes your scores and drawings.
Your city, if you turn it on — city-level only, and per crew, so you can share it with some crews and not others. The app never records or shows a live position by default: a pin is drawn at the centre of a city, not where you are.
Exact location, only when you say yes to a specific person — they ask, you grant, and the grant expires automatically one hour later. Once you have no active grants, the coordinates are deleted from the database rather than merely hidden.
If the app crashes or freezes — a technical report from your iPhone (Apple’s MetricKit): which part of the app was running, the type of failure, your iPhone model and iOS version, and the app version. Nothing you typed, saw, or shared is in it. It is tied to your account so a problem can be traced, it goes only to our own server, and it is deleted after 90 days.
What you say to the assistant, and its replies, so it can follow a conversation.
A push notification token for your device, so alerts can reach your phone. Removed when you delete your account.
Plus subscription. If you subscribe, Apple handles the payment and we never see your card. We keep the App Store's transaction id, which product, and when it renews or expires, so the app knows you are on Plus; Apple tells our server when a subscription renews, is refunded or lapses. Removed when you delete your account.
Blocks and reports. Who you have blocked, so they can be kept out of your view (they are not told, and you are not told who blocked you). And any report you file about a person: who, the reason, and what you wrote. Blocks are removed when you delete your account. Reports are kept after either account is deleted, because a report has to outlive the account it is about; they are read by the operator and by nobody inside the app.
Usage counts — which model or provider answered each request (an assistant turn, a boarding-pass read, a drawing judged, a flight-schedule lookup), how many tokens it took and what it cost, so running costs can be totalled and capped per person. No message content, no picture, no flight details.

Location: While Using only. This version of the app asks for location only while it is open, to work out which city you are in. It never asks for “Always” and cannot use your location while it is closed.

Travel Assistant (not in this version). A later update may add a feature that notices you have landed somewhere new so the orb can ask where you are headed. It would be off until you switch it on, and switching it on would mean granting Always location — the only part of the app that could use your location while it is closed. When it arrives, this policy will say so before the app asks.

What it does with that: your phone watches for arrivals at airports near you and nothing else, and the check happens on the device — no continuous trail of your movements is sent anywhere or stored by us. Nothing reaches the server until you answer the orb, and what gets stored then is an ordinary trip. Turning it off in Settings stops it completely and breaks nothing else.

Boarding passes, stated plainly. When you share a boarding pass with the app, your iPhone reads it itself — the barcode and the printed text — and the picture goes nowhere. That is where every pass starts, and for most passes it is where it ends.

If the phone cannot finish, the card offers a button that says Let the orb read it, and says beside it that the picture will be sent. Only if you tap that button is the whole image sent to Moonshot AI (or to MiniMax, if Moonshot AI cannot read it), with everything printed on it: your name, your booking reference, your seat, a frequent-flyer number if there is one, and the flight. Our server holds the picture only for the length of that request and never writes it anywhere; what comes back is the flight, the date and the airports, which you then check before anything is saved. Your name and booking reference are not among the fields the model is asked for and are not stored. What the AI providers keep of a request is governed by their policies, not ours — treat the picture as you would a message to the orb.

When a pass prints no landing time, the app asks the airline’s published schedule through AeroDataBox. That request carries the flight number and the date and nothing else — no name, no booking reference, no account — so the provider learns that somebody asked about a flight, not who is on it.

Why we are allowed to store it

For users in the UK and EEA, the legal basis under UK/EU GDPR is performance of a contract (Article 6(1)(b)) — the app cannot tell you when you overlap with a friend without knowing your trips.

Precise location is special-category-adjacent and always consent-based (Article 6(1)(a)): it is never collected unless you grant a specific person access to it, and consent is withdrawable at any moment by revoking the grant, which takes effect immediately.

Who else sees it

Your crews see the trips you chose to show them, your character, and your city if you switched it on for that crew. They never see your conversation with the assistant.
Moonshot AI (Beijing, China) processes the assistant's requests, because that is what answers you. This is the most important sentence in this policy, so it is stated plainly below.
MiniMax — operated by Nanonoble Pte. Ltd., a Singapore company, part of a group headquartered in Shanghai, China — is the standby for the assistant. It receives assistant requests only while Moonshot AI is unreachable or refusing traffic, and it receives exactly what Moonshot AI would have received. It is also the second reader of a boarding-pass picture, when Moonshot AI could not read it. And it is the judge in the drawing game: the doodle you draw of a friend’s cartoon face is sent to it to be scored, together with a description of that cartoon face. No name, no trip and nothing from your assistant conversation goes with a drawing.
AeroDataBox, a flight-schedule provider reached through the RapidAPI marketplace (United States), answers when a flight lands. It receives a flight number and a date, and nothing about you.
Apple handles sign-in and delivers push notifications.
Google handles sign-in if you choose Sign in with Google, and tells us your name, email address and an account identifier. Nothing else goes back to Google.
Vercel (United States) runs the server and Turso stores the database.

That is the entire list. There is no other recipient, and no data broker, advertiser or analytics provider anywhere in it. Nobody outside it ever receives a boarding pass, a drawing, or a message to the assistant.

About the assistant, stated plainly. When you talk to the orb, it is not only your typed message that is sent to Moonshot AI. To answer a question like “who is in Lisbon in March?” it is also sent the relevant part of your crew’s state — names, cities and trip dates of the people whose trips you can already see.

Moonshot AI is based in China, so this is a transfer of personal data outside the UK/EEA. If you would rather your crew’s travel details were not processed there, do not use the assistant: every other part of the app — the map, the runway, crews, logging a trip by hand — works without it and sends nothing to any AI provider.

There are two AI providers, not one. When Moonshot AI is down or overloaded, the same request goes to MiniMax instead, so that the assistant keeps working. You are not asked at the time and there is no setting to prevent it — choosing to use the assistant is choosing both. MiniMax’s international service is run by a Singapore company, but the group behind it is Chinese, and its published policy does not say which country your request is stored in or whether staff in China can reach it. We cannot tell you what it does not say. Treat a message to the orb as a message that may be read in China.

Where data is held, and transfers

The database and server are hosted in the United States. Assistant requests go to Moonshot AI in China, or — when that provider is unavailable — to MiniMax, whose service is operated from Singapore by a group based in China. A boarding-pass picture you choose to send follows the same route, and a drawing in the drawing game goes to MiniMax. Flight schedules are looked up through RapidAPI in the United States. All of these are transfers outside the UK/EEA. We rely on your explicit choice to use the assistant for the AI providers; for the hosting, the standard protections offered by those providers apply.

If we ever add or swap an AI provider, that is a change to who reads your messages, so it gets a new entry in this list and a new date at the top — not a silent substitution.

How long it is kept

Data	Kept for
Trips, crews, display name, character	Until you delete them, or delete your account
Exact location coordinates	Until the one-hour grant expires, then deleted automatically
Your city	Until you turn sharing off
Flight number and landing time	Until the day after the flight lands, or until you stop sharing it, whichever is first; then deleted automatically
Boarding pass picture	Not stored. Held by our server only while the read you asked for is in progress
Game scores and drawings	Until you delete your account, or the crew is dissolved
Conversation with the assistant	90 days after your last message, then deleted automatically
Crew chat messages	90 days after they are sent, then deleted automatically
Your home city	Until you clear it or delete your account
Card game hands, moves and end-game votes	Until you delete your account, or the crew is dissolved
Push notification token	Until you delete your account
Usage counts	Kept, with the link to you removed on account deletion

Deleting everything

The Me tab has Delete my account. It removes your trips, your flights and landing times, your crew memberships, your location records, your crash reports, your push token, your sign-in identity, everything you said in a crew chat, and your whole assistant history from the server. It cannot be undone and nobody can restore it for you. If you run a crew that still has other people in it, hand it to someone else first, so the crew is not orphaned.

Usage counts survive deletion with the link to you removed, because they are model and token totals rather than anything about you.

Your rights

If you are in the UK or EEA you have the right to access your data, correct it, delete it, receive a copy in a portable form, object to processing, and restrict it. Deletion and correction are built into the app — the Me tab edits your name and character, and deletes the account outright. For anything else, including a copy of your data, email the address above and you will get a reply within 30 days. You may also complain to your local supervisory authority; in the UK that is the Information Commissioner’s Office.

If you are in California, the app does not sell or share personal information as those terms are defined by the CCPA/CPRA, and it does not process it for cross-context behavioural advertising.

Security

Traffic is encrypted in transit. Sessions use signed tokens, sign-in identities are verified against Apple directly, and one person’s trips are filtered out of another person’s view on the server rather than hidden in the app. No system is perfect; if you find a problem, the contact address above is the fastest way to reach someone who can fix it.

Children

The app is not directed at children and is not intended for anyone under 13. If you believe a child has given us data, email the address above and it will be deleted.

Changes

If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and the app tells you the next time you open it. Older versions are visible in the project’s public commit history.

Contact

Questions, a request for your data, or you want something removed by hand: support@whereisalex.ai