Privacy Policy

Where Things Are · last updated 5 September 2026

Where Things Are is a small app for remembering where your belongings are kept. This page says plainly what it stores, where that goes, and how to get rid of it.

What is stored

• Your email address and a password hash. The password itself is never stored — only a scrypt hash of it, which cannot be turned back into the password.
• Your catalog. The things you record, the places you keep them, tags, quantities, notes, dates, and the history of changes to them.
• Your photographs. Pictures you take of things and places, stored as files on the server.
• A count of the scans you have run, so free trial scans and rate limits can be enforced.

There is no analytics package, no advertising identifier, and no tracking across other apps or websites.

Where it is kept

All of it lives on a single server run by Fly.io in the United States, on an encrypted volume. Nothing is sold, rented, or shared for advertising.

Who else sees it

• Anthropic — when you scan a photograph, that one photograph is sent to Anthropic's Claude API to be read, and the list of things it finds comes back. It is sent for that request only. See Anthropic's privacy policy.
• Resend — your email address, when you ask for a password reset link. See Resend's privacy policy.
• RevenueCat, Apple and Google — if you subscribe. They handle the payment; this app never sees your card details. RevenueCat is told an anonymous account identifier so it can tell the server that your subscription is active. See RevenueCat's privacy policy.

Shared catalogs

If you create a shared catalog and pass on its invite code, everyone who joins can see and change everything in it, including photographs, and can see which member made each change. Leaving a shared catalog stops your access to it but does not remove what you added — that belongs to the catalog and stays with the people still in it.

Deleting your account

Open Account → Delete my account in the app, or use the same control on the web at wherethingsare.app. That removes your login, your own catalog, and every photograph no other catalog still refers to. It cannot be undone, and there are no backups from which it could be restored. A subscription bought through the App Store or Google Play is cancelled through that store, not here.

Children

The app is not directed at children under 13 and no account is knowingly created for one.

Changes and contact

If this policy changes in a way that matters, the date at the top changes with it. Questions, or a request to have your data removed by hand: support@wherethingsare.app.