1The short version
StampStory has no accounts and no server. The countries you mark, your name and your avatar live on your phone and nowhere else.
If you turn on welcomes, or tap the location button, the app uses your phone's location on the phone itself, to tell which country you are in and to show you on your globe. Your location never leaves your phone.
Two things leave your device. For Gold, the app asks RevenueCat whether Gold is active and what it costs, under an anonymous identifier made for that install, and a purchase sends the store receipt along. And the app counts how it is used, such as when it is opened, which share button is tapped and when the Gold screen shows, under a random identifier made for that install. Neither carries your name, your countries, how many you have marked or anything you made.
2Who we are
StampStory is made by Itay Blokh (shoopi), an independent developer based in Singapore. For anything in this policy, or to make a request about your data, email stampstory-support@shoopi.dev.
3What stays on your device
All of this is written to your phone's local app storage. It is never transmitted, and I have no way to read it. The one exception is the random identifier for usage counts, described below, which goes with each count.
| What | Why it exists |
|---|---|
| The countries you marked | The whole point of the app |
| The day you marked each one | So the app can tell you what is new since your last visit. You are never asked for a date |
| Your name | Printed on the passport card and its machine-readable strip |
| Your avatar and theme | How your passport looks |
| Whether Gold is active | An offline copy of your purchase status, so the app works without a connection |
| Whether you finished onboarding | So it is not shown twice |
| Whether welcomes are on, and whether you were offered them | So the offer is shown once and your choice is kept |
| The country the app last saw you in, and the day it welcomed you to each country | So a welcome comes once a stay, and not again within a month. Only the two-letter country code is kept, never a position |
| A random identifier for this install | So usage counts can tell one install from another. It is made by the app, linked to nothing about you, and gone when you delete the app |
4Location and notifications
Both are optional and off until you turn them on. The app asks for them only when you turn on welcomes (from the sheet on the globe, or the switch in Profile) or tap the location button, and you can turn either off at any time in your phone's settings.
Welcomes. When your phone arrives in a country that is not on your map yet, StampStory shows a notification inviting you to stamp it. There is no server, so your phone itself has to notice the arrival:
- On iPhone, with location set to Always, iOS wakes the app when you move a significant distance (a new cell tower, a landing). The app looks up which country that position is in, on the phone, against the map it ships with. With location set to While Using, or off, it checks again when you open the app, and in the background now and then using your phone's time zone.
- On Android, welcomes use no location at all: the app reads the country code of the mobile network your phone is on, and your time zone, both of which Android shares with apps without a permission.
- Notifications are created by the app on your phone. No push service is involved, and nothing is sent to learn when to show one.
The location button and the "You" bubble on the globe use your approximate position, while the app is open, to show where you are. That position is kept in memory only, never written to storage, and forgotten when you close the app or turn location off.
Your position is never sent to me or to anyone else, never logged, and never put on a share image.
5What leaves your device
Three things, and no more.
- Gold. When the app starts, and when you open the Gold screen, it asks RevenueCat whether Gold is active on your store account and what it costs, so a refund or an ended subscription switches Gold off and the prices shown are your store's. Buying or restoring Gold goes through Apple or Google, and RevenueCat validates the receipt on my behalf. RevenueCat receives an anonymous identifier it generates for that install, the store receipt when there is one, and basic device and app version information. It does not receive your name, your countries, or anything else from the app. RevenueCat's own privacy policy applies to that data.
- Usage counts. The app counts what is done in it, to learn what to make better: when it is opened and put away, when onboarding is finished, when a share sheet opens and which share button sends a card (with the kind of card and its style, never what is on it), which theme is picked, when the Gold screen shows and what opened it, when Gold is bought or restored and which plan, when welcomes are turned on or a welcome is tapped, and when the rating page shows. Each count carries the random identifier made for that install, whether Gold is on, your theme, your phone's system and model, the app version, your language and your time zone. Counts never carry your countries, how many you have marked, your name or your position. They go from your phone to PostHog, in its EU cloud. PostHog works out roughly where a count came from, its country, city and area, from the internet address it came from, and then discards the address without storing it.
- The image you share. When you tap Share, the passport image is handed to your phone's share sheet and goes wherever you send it. That is your action and your choice of destination; it does not pass through me.
6What the app never collects
- No account, email address, phone number or password
- No location history. Location is used on your phone only, as described above, and never leaves it
- No contacts, camera, microphone or photo library reads. If you choose Save Image in the share sheet, iOS asks your permission and the app writes that one image; it never reads your library
- No advertising identifier and no tracking across apps, so no App Tracking Transparency prompt
- No crash SDK, session recording or heat maps. Usage counts never include your countries, as described above
7What this website collects
These pages are served from shoopi.dev, which uses Vercel Analytics and Speed Insights. Those measure page views and load performance in aggregate and do not use cookies to identify you or follow you across sites.
8Legal bases
If you are in the EEA or the UK: processing a purchase is necessary to perform the contract you enter when you buy Gold (Article 6(1)(b) GDPR). Validating receipts to stop fraudulent unlocks, and checking at launch whether Gold is still active, rest on legitimate interests (Article 6(1)(f)), and so does counting how the app is used, to learn what to make better. Everything else never reaches me, so there is nothing to have a basis for.
10How long things are kept
- On-device data: until you delete it in the app or delete the app itself.
- Purchase records: kept by RevenueCat, Apple and Google for as long as they need to honour a restore and to meet their own tax and accounting obligations.
- Usage counts: kept by PostHog for as long as the plan StampStory is on keeps them.
11Your rights and your choices
Deleting the app removes everything StampStory stored on your phone. There is no server-side copy of your map to request, correct, or export, because there is no server.
Usage counts are filed under a random install identifier, not under you, so I cannot find yours from your name or email. Deleting the app ends them: a new install gets a new identifier.
For the purchase record held on my behalf, you can ask me to access or delete it. Email stampstory-support@shoopi.dev from the address you use with your store account and tell me what you need. If you delete the purchase record, restoring Gold may no longer work.
If you are in the EEA or the UK you also have the right to complain to your local data protection authority.
12Children
StampStory is not directed at children under 13, or under the age of digital consent where you live, and does not knowingly collect anything from them. There is nothing to collect: the app has no account and no messaging. If you believe a child has bought Gold, contact Apple or Google for a refund and email me.
13Security
Your travel data never travels, which removes most of the risk. Traffic to the stores, RevenueCat and PostHog is encrypted in transit. No system is perfect, and I will not pretend otherwise.
14Changes to this policy
If the app starts doing something new, this page changes before that version ships, and the date at the top moves. Material changes will also be noted in the app's release notes.
15Contact
stampstory-support@shoopi.dev - I read everything and aim to reply within a few days.