Privacy Policy

Who we are

Stamp (“Stamp - Travel Map”) is an app for iPhone and iPad made by Enki Studios, LLC, a Delaware limited liability company. In this policy, “we” and “us” mean Enki Studios, and “you” means the person using Stamp. Enki Studios is the controller of the personal data described here.

This policy covers the Stamp app, its widgets and Live Activity, the Friends service behind it, and this website, usestamp.app.

Questions about privacy: support@madebyenki.com.

The short version

• Your passport stays on your device. Your countries, places, trips, stamps, medals, stats and wishlist are worked out and stored on your iPhone or iPad. We never receive them.
• Your photos and location are read on your device. Stamp never uploads them. The only pictures that leave your device are the postcards you send to a friend and the profile photo you choose for Friends.
• Friends is optional. You only create an account if you use it. Only then do we store anything about you on our server: your name, your email address, your profile photo, your friends, and the postcards and voice notes you send and receive.
• No ads, no analytics, no tracking in the app. The Stamp app has no advertising, analytics or tracking tools. Our website uses Google Analytics to count visits; in Europe only if you accept (see “This website”). We don’t sell or share your data, and we don’t use it to build a profile of you.
• You can delete it. Delete your Friends account in the app and everything on our server that belongs to it goes at once. Delete all your data in the app and your passport is gone from your device.

On your device

Photos (only with your permission)

Stamp finds the countries you’ve visited from your photos. If you allow access (to all photos or only the ones you pick), Stamp reads, on your device, where and when each photo was taken and the camera’s make and model. That’s how it tells a photo you took from one you saved or edited.

From this Stamp keeps only the country or territory, the day and the nearest town’s name, plus the identifier Photos gives the photo, so it can show it on that stamp’s page. Stamp doesn’t keep your photos’ coordinates.

• iCloud Photos: if you use “Optimize iPhone Storage”, some originals are only in iCloud. To check them, Stamp asks Photos to download them from your own iCloud account (on Wi-Fi by itself; on mobile data it asks first). That download is between your device and Apple. We never see it.
• Scanning in the background: a long scan can carry on for a while after you leave the app. It still runs only on your device.
• Widgets: to show “On this day” without opening the app, Stamp keeps small copies (360 pixels) of the next two weeks’ memory photos in a folder only Stamp and its widgets can read. They’re removed when you turn off Photos access or the photo leaves your library.
• Saving to Photos: if you save a card, Stamp adds that picture to your library.

You can change Photos access at any time in iOS Settings › Stamp › Photos.

Location (only with your permission)

If you allow location, Stamp notices which country you’re in so it can give you a stamp when you arrive. With “Always”, iOS can wake Stamp briefly in the background when you move a long way.

Your location is checked on your device against maps built into the app. Stamp keeps only the country or territory, the day and, with Precise Location on, the nearest town’s name. It doesn’t keep your coordinates or where you went inside a country, and it sends your location to no one. Stamp doesn’t use any online address lookup.

You can change or turn off location at any time in iOS Settings › Stamp › Location.

Things you add yourself

The trips you add, the towns you set, your home country, your wishlist and your settings are stored only on your device.

Notifications, widgets and the Live Activity

Arrival notifications are made by your device itself. The Live Activity while you’re abroad is updated only on your device. Notifications, widgets and Live Activities can show on your Lock Screen, where anyone holding your device can see them. You can turn them off in the app and in iOS Settings.

Backups

Stamp’s data is part of your device’s own backups (iCloud Backup or a backup on your computer) if you use them. Those are handled by Apple and you. Stamp has no sync of its own.

Friends (optional)

Friends lets you send postcards, with a voice note if you like, to people you’ve invited. It’s the only part of Stamp with an account. You’re only asked to sign in when you first use it. Everything else in Stamp works without an account.

Signing in

You sign in with Apple or with Google. We never see your Apple or Google password.

• Sign in with Apple gives us an identifier for your account and, the first time, your email address and, if you allow it, your name. If you choose “Hide My Email”, we get a private relay address that forwards to you.
• Google gives us an identifier for your account, your email address and your basic profile. We keep the email only if Google has verified it. Signing in with Google happens in a secure Google page, and your device talks to Google directly to finish it.
• An Apple account and a Google account are separate Stamp accounts. We never use your email to join them.

Stamp’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

What we store

On our server, for as long as you have an account:

• Your account: a Stamp user ID, the Apple or Google identifier, your display name, your email address (and whether it’s a Hide My Email address), the version of the Terms you agreed to, and when you joined.
• Your profile photo, if you add one. You choose it with the system photo picker, so Stamp doesn’t need access to your library for it. The app crops it to a square and removes its location, camera and date information before uploading it.
• Your friends, invites and blocks: who you’re friends with and since when, the invites you’ve made, and the people you’ve blocked.
• Postcards you send and receive: the front and back pictures, the place the postcard is from (a country or territory code), any reply it answers, when it was sent and when it was read. The note you write is drawn into the picture on your device, after the app checks it for offensive words there; we don’t store it as text. The app draws each picture fresh, without location, camera or date information.
• Voice notes: the recording (up to 60 seconds), its length and a small outline of its waveform for the player. Stamp uses the microphone only while you’re recording, after you tap Record.
• Your devices: the push notification token Apple gives your device, the app’s language, whether postcard notifications are on, and when the device was first and last seen.
• Your sessions: a hashed sign-in token for each device you’re signed in on, and when it was created and last used. Apple’s own sign-in token is stored encrypted, only so we can revoke it when you delete your account.
• Reports: the reports you file (the reason, an optional note, and the postcard if there is one) and the reports filed about you.
• IP addresses: for a few days we count the requests from each IP address, to stop abuse of sign-in and invite links (see “How long we keep it”).

We don’t have your passport, your stamps, your trips, your photo library or your location.

Checks on your device. The app checks a postcard’s note and your display name for offensive words on your device before they’re sent. If you’ve turned on Sensitive Content Warning or Communication Safety, the app also checks the pictures on postcards you receive with Apple’s Sensitive Content Analysis, which runs entirely on your device: a postcard that may show nudity arrives blurred until you choose to see it. Nothing about these checks is sent to us or to Apple, and the app keeps no record of them.

How we use it

• To run Friends: to sign you in, show your name and photo to your friends, deliver your postcards and voice notes, and send you notifications.
• Your email address is used only to contact you about your account, a report you filed or one about you, or a breach of the Terms of Use. It’s never used for marketing, and your friends never see it. If a later sign-in gives a newer address, we replace the old one.
• To keep Friends safe: to check display names and report notes against a word filter, to review reports, to remove content and hold or close accounts that break the Terms, and to limit abuse.
• To keep the service working and secure, and to meet legal obligations.

Legal bases (EU, EEA and UK)

• Our contract with you (the Terms of Use): to run Friends for you.
• Our legitimate interests: keeping Friends safe (the word filter, reviewing reports, holds), contacting you about a report, limiting abuse, and keeping the service secure. You can object to these; write to us.
• Legal obligations, where the law requires us to keep or hand over data.
• Your consent: Google Analytics on our website, for visitors in Europe (see “This website”). You can withdraw it at any time.

Who can see what

• Your friends see your display name, your profile photo and the postcards and voice notes you send them. They never see your email.
• Anyone with your invite link can see your display name, for example when they open the link in Stamp. There’s no search or directory, so no one can find you any other way.
• Blocked people see nothing new from you, and you see nothing from them.
• Us: we don’t browse your postcards. We look at a postcard, a voice note, a profile photo, a name or a report note only when someone reports it, to decide what to do, or when the law requires it.

Notifications

Postcard and friend notifications are sent through Apple’s push notification service. A notification carries your friend’s display name and the postcard’s place, and is put into words on your device. You can turn off postcard notifications in Settings › Account › Postcards from Friends, or turn off all notifications in iOS Settings.

On your device, for Friends

The postcards and voice notes you receive are kept in Stamp’s storage on your device so you can see them again. Your sign-in is kept in the device’s Keychain. Both are removed when you sign out or delete your account.

Purchases (Stamp Pro)

Stamp Pro is bought through Apple’s App Store. Apple handles the payment. We never see your payment details or your Apple Account. The app asks the App Store on your device whether you have Stamp Pro. Apple gives us sales and subscription numbers in App Store Connect that don’t say who you are. Buying Stamp Pro doesn’t need a Friends account and isn’t linked to one.

Service providers

We use a few companies to run Stamp. They handle data only to provide their service to us.

Provider	What for	What it handles
Cloudflare, Inc. (USA)	The Friends server, its database and file storage; this website; the email that sends each report to us	Everything listed under “What we store”, IP addresses of requests, and the contents of reports
Apple Inc. (USA)	Sign in with Apple, push notifications, App Store purchases, iCloud Photos and Apple Maps; iCloud Mail, which holds our support inbox and the report emails	Your Apple sign-in, push tokens and notification contents, purchases, under Apple’s privacy policy; report contents (the reason, the note, the reported person’s display name and user ID) and anything you email us
Google LLC (USA)	Sign in with Google, if you choose it; Google Analytics on this website	Your Google sign-in, under Google’s privacy policy; website visits, as “This website” describes

Cloudflare processes data for us under its Data Processing Addendum. Apple’s iCloud Mail holds our mail, and Google processes website visits for us under its terms for Google Analytics. Apple and Google run sign-in and push notifications as independent companies, under their own privacy policies.

Where data is stored

Friends’ database and files are stored with Cloudflare in the United States. Requests are handled in Cloudflare data centers around the world, so your data may be processed outside the country where you live.

If you’re in the EU, the EEA, the UK or Switzerland, your data is transferred to the United States. Cloudflare, Apple and Google are certified under the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. framework), and their data protection terms include the European Commission’s Standard Contractual Clauses.

How long we keep it

Data	How long
Your account, name, email and profile photo	Until you delete your account. A replaced profile photo is deleted at once.
Postcards and voice notes on our server	12 months after they’re sent, then deleted by a daily job. Sooner if both you and your friend delete the postcard, or either of you deletes your account. A reported postcard is kept until the report is reviewed, and never past the 12 months.
Friends and blocks	Until you remove the friend, unblock, or delete your account
Invites	Usable for 7 days or 5 uses. The invite’s record is deleted 30 days after it expires or you revoke it.
Sessions	Until you sign out, or 90 days after the device last used Stamp
Push tokens	Until you sign out, delete your account, or Apple tells us the token no longer works
IP address counters	Up to about 3 days
Reports	Kept as a record of moderation. When you delete your account, your user ID is removed from the reports you filed, and your user ID and name from reports about you. The reason, the note and the dates stay, for 2 years after the report is closed.
Report emails in our inbox	Up to 2 years. They aren’t deleted when an account is deleted.
Emails you send us	As long as we need them to help you, and no more than 2 years
Server error logs	Error messages only, without the contents of postcards, voice notes or emails: up to 7 days
Website analytics (Google Analytics)	2 months

Copies on your friends’ devices aren’t on our server. A postcard your friend has opened stays on their device until they delete it, sign out or delete their account.

Deleting your data

• Your Friends account: Settings › Account › Delete Account. It’s immediate. From our server it removes your account, name, email, profile photo, friends, invites, blocks, sessions, devices and every postcard and voice note you’ve sent or received. We also ask Apple to revoke Stamp’s access to your Apple sign-in. If you used Google, you can remove Stamp in your Google Account settings. If a file can’t be removed at that moment, the daily job removes it within a day. Reports stay as described above, without your user ID.
• Through Apple: if you stop using Sign in with Apple for Stamp in your Apple Account settings, or delete your Apple Account, Apple tells us and we delete your Stamp account the same way.
• Signing out removes your sign-in, push token and saved postcards from that device. Your account stays.
• Your passport: Settings › Data › Delete all my data erases your trips, stamps, towns, wishlist, medals, scan records and the widgets’ copies on this device. Deleting the app also removes its data from the device.
• Export: “Export my passport” makes a file of your trips, towns, wishlist and settings (without photo identifiers or coordinates) that you can keep or send wherever you choose.

Sharing what you choose

When you share a stamp card, a postcard, your map or a medal through the share sheet, the picture goes where you send it, and that service’s privacy policy applies. Stamp draws these pictures fresh and removes their location, camera and date information. The words on the picture are what you see on it.

Other Apple features

• Maps: Stamp’s map is drawn on your device. If you open the optional Apple Maps view, Apple Maps loads the map tiles from Apple. Stamp shows your places on it but doesn’t send Apple your location.
• Ratings: “Rate Stamp” uses Apple’s own review prompt; a rating goes to the App Store.
• Apple’s statistics: if you’ve chosen to share analytics with app developers in iOS Settings, Apple may give us anonymous crash and usage statistics in App Store Connect.

Links and contacting us

Some screens link to Wikipedia, Creative Commons, GeoNames, our website and Apple’s terms. Nothing loads until you tap a link, which opens Safari. Those sites have their own privacy policies.

“Contact us” opens your own email app with a message to support@madebyenki.com, including the app’s version and your iOS version so we can help. You can see and change the whole message before sending it. If you send it, we receive your email address and what you wrote. We use it only to answer you, and we never add you to a mailing list.

This website

usestamp.app uses Google Analytics to understand how many people visit and which pages they read. Google Analytics sets cookies (named _ga…) and receives your IP address, browser and device details, the pages you view and the site that sent you, and Google processes them for us. Google Signals and advertising features are off, and the data is kept for 2 months.

• In Europe (the EU, the EEA, the UK and Switzerland), Google Analytics loads only if you choose Accept in the banner. Until then, and if you choose Reject, it doesn’t load and sets no cookies. We tell where you are from your browser’s time zone, on your device; a browser that hides its time zone gets the banner too.
• Elsewhere, Google Analytics loads without a banner.
• Your choice is kept in your browser’s storage, not in a cookie. Cookie settings at the bottom of every page opens the banner again, so you can change your mind; Reject stops Google Analytics and removes its cookies. The site is hosted by Cloudflare, which handles your IP address and browser details to deliver the page and protect the site. An invite link (usestamp.app/i/…) opens the app if you have it. Without the app, the page reads the invite code in your browser and doesn’t send it anywhere.

Security

• Every connection between the app and our server is encrypted.
• Your sign-in is kept in your device’s Keychain, only on that device. Sign-in tokens on our server are stored hashed, and Apple’s token is stored encrypted.
• Postcards, voice notes and profile photos can only be loaded by the people allowed to see them, with a signed-in session.

No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.

Children

Stamp’s passport collects nothing from anyone, children included. Friends is for people aged 13 or older, or older where the law where you live requires it. We don’t knowingly collect personal data from children below that age. If you believe a child has a Friends account, write to us and we’ll delete it.

Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, get a copy of it, or object to or restrict how we use it.

• In the app you can see your name, email, photo, friends and postcards, change your name and photo, and delete your account.
• A copy of your Friends data: email us and we’ll send you what our server holds about you, in a common machine-readable format.
• For anything else, email support@madebyenki.com. We may need to confirm the account is yours. We’ll answer within the time the law requires.
• You can complain to your local data protection authority.
• Automatic holds: if several different people report an account, it’s held automatically (it can’t invite, accept invites, send postcards or change its photo) until we review the reports. A hold is temporary, a person always makes the final decision, and you can ask us to look again by email.

US state privacy laws (such as California’s): we don’t sell or share personal information for cross-context behavioral advertising, and we don’t use sensitive personal information to infer things about you. The categories we collect are the ones under “What we store”, for the purposes under “How we use it”.

Changes to this policy

If Stamp starts handling data in a new way (for example usage statistics, or syncing your passport through iCloud), we’ll update this page before that version ships and change the date at the top. If a change significantly affects your data, we’ll also tell you in the app.

Contact

Enki Studios, LLC · support@madebyenki.com