Privacy Policy for Then & There

Last updated: 14 September 2026

Controller

E-mail: ttthenandthere@gmail.com

No data protection officer has been appointed; there is no legal obligation to do so. Please direct all privacy matters to the contact address above.

Summary

Then & There shows you photos from your library taken on this day in earlier years and derives trips and places from them. Your photos never leave your device. There are no user accounts, no registration, no advertising, no analytics or tracking services. The only data that leaves the device are coordinates of place centres for place names and map requests to Apple Maps, both only when you use the map or place features.

What the app processes

Photos and metadata

The app reads your photo library exclusively on the device. From each photo and video it uses only the capture date, the capture location (if stored in the photo), the media type, the duration and the favorite flag. From these it builds an index stored locally in the app’s storage. The images themselves are only loaded for display. There is no upload, and the app writes nothing to your library: no albums, no favorites, no changes.

Place names (reverse geocoding)

For trips and places the app groups located photos into areas of about ten kilometres. To name an area it sends the centre point of the area (coordinates) once to Apple’s geocoding service (MKReverseGeocodingRequest, a system service). The result is stored on the device and not requested again.

Apple acts as an independent controller; Apple’s privacy policy applies: https://www.apple.com/legal/privacy/. We send no photos, no contact data and no user or device identifiers of our own. Technically, your device’s IP address is visible to Apple with every request. The app itself stores no location history and never requests your device’s current location; it only uses the locations already stored inside the photos.

Transfers to third countries

Geocoding and map tiles run through Apple system services. Apple also processes data outside the EU, including in the USA, and states that it bases such transfers on the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Where data is transferred to a country without an adequacy decision there is a risk that authorities access the data without legal remedies comparable to EU standards. Only area centre coordinates and map regions are transmitted.

App Store

The app is distributed through Apple’s App Store. When you download or update it, Apple processes data (e.g. Apple Account, time of download, device data) under its own responsibility. Apple’s privacy policy applies.

Settings and reminders

Filters, home, minimum distance and the reminder time are stored locally on the device (UserDefaults). The daily reminder is a local notification scheduled on the device; no push service is involved. All of this is deleted when you delete the app.

Legal bases

• Reading the library, index and settings on the device: processing takes place exclusively locally and serves the function you requested - Art. 6(1)(b) GDPR. You grant library access via the iOS system dialog, which is also consent under § 25(1) TDDDG for accessing information on your device. You can revoke it at any time in the iOS Settings.
• Transmitting area centres and map regions to Apple: Art. 6(1)(b) GDPR, because place names and maps cannot be shown without these requests. They only happen when you open the trip, place or map screens.
• Notifications: consent via the iOS system dialog - Art. 6(1)(a) GDPR; revocable in the iOS Settings or via the switch in the app.
• Access logs of this website: see “Hosting of this site”.

Retention

We operate no servers and store none of your data. The index, the place-name cache and the settings stay on your device until you delete the app or re-index the library in Options. How long Apple keeps access logs is determined by Apple. If you e-mail us, we delete the message once your request is settled and no statutory retention obligations apply.

Sharing photos

When you pass on a photo or video via the share function, this happens through the iOS system share sheet with the photo’s original data. You decide where to share; the chosen service is responsible for that transfer.

Permissions

• Photos (All Photos): to read the library. With “Selected Photos” the app cannot build look-backs and shows a notice.
• Notifications: only if you turn on the daily reminder.

The app requests no location access and no camera access. Every permission can be revoked in the iOS Settings. You are under no legal or contractual obligation to grant them; without photo access the app simply cannot show anything.

Data sharing and tracking

There is no tracking. Data is not used for advertising, not merged with third-party data and not passed to data brokers. There are no analytics SDKs and no third-party libraries.

Hosting of this site

This section concerns this website, not the app. The site is served via GitHub Pages, a service of GitHub, Inc. (88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA), a Microsoft company. When you open the site your browser transmits technically necessary data to GitHub, in particular your IP address, date and time of the request, the requested address and details of your browser and operating system. GitHub states in its documentation that it logs and stores visitors’ IP addresses for security reasons.

We have no influence on the scope and duration of this logging; GitHub acts under its own responsibility. Details in GitHub’s privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide this mandatory information reliably, securely and without running our own server. You may object under Art. 21 GDPR.

Transfers to the USA: GitHub also processes data in the United States and states that it bases such transfers on the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) and on the EU-U.S. Data Privacy Framework.

This site sets no cookies, embeds no external fonts, scripts or graphics and uses no analytics or tracking tools. It is served over HTTPS.

Children

The app is not directed at children and collects no personal data about them.

Your rights

You have the right to access the personal data processed about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where you have given consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR).

Practical note: The app creates no user accounts and no server-side database with us. All data created in the app lives exclusively on your device; you can inspect and delete it there yourself, at the latest by deleting the app. Since we cannot identify you from this data, under Art. 11(2) GDPR we are not obliged to store additional data merely to fulfil these rights. If you write to the e-mail address above, we process the details in your message - the rights apply in full there.

Right to lodge a complaint

You have the right to complain to a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

Changes

This policy is updated when functionality changes. The version published at this URL is authoritative.