Privacy policy

The short version

• We use your location only while the app is open — to stamp a place and to keep the right places on your phone — and never in the background.
• Your username is the only name other people see. Your email address is never shown.
• No ads, no advertising trackers, no analytics tools, and we don't sell your data.
• You can delete your account at any time in the app, and with it the location data from your visits. How to delete your account.

What we collect

Your account

Sign-in is handled by Firebase Authentication, a Google service. If you sign in with Google, Firebase receives your email address, name and profile photo from Google; if you sign in with an email and password, it holds your email address and a protected form of your password. Our own servers store only the Firebase ID that links your sign-in to your PiliPins account — not your email address or password. When we email you (to confirm your address or reset your password) or you email us, those emails are kept in our mailbox.

Your profile

The username you choose, your home province, the avatar you pick, whether your profile is public or private, and the time you confirmed you are 13 or older and accepted the terms.

Your location — only while the app is open

The app uses your location on your phone to show places near you. While the map is open and you have a signal, it also sends your rough position (to about a kilometre) to our servers, at most every five minutes, to find out which province you're in, so the places stored on your phone for use without a signal are the right ones; we don't save it, though it can appear in our server logs (below). When you stamp a place, the app sends us the location readings it took during that visit — latitude and longitude, accuracy, altitude, speed and direction, the time of each reading, and whether your phone reported a simulated (mock) location — together with your phone's clock, the time since it last restarted, your phone model, its operating system version and the app version. We use these to confirm you were really at the place and to detect cheating. The app never collects your location in the background.

Your stamps and progress

Which places you stamped and when, the pins they earned, and visits still being checked. If you mark the provinces you've been to before, we keep that list too: it only shows on your own map, never to other people, and earns nothing.

Your photo memories — only the photos you add

If you add photos of a place as a memory, we store those photos with the date you give them and any words you write, so you can look back at them. Only the photos you pick are sent. Before a photo leaves your phone, the app shrinks it and strips the details stored inside it, including where it was taken; our servers strip them again before storing it. We keep only the time the photo was taken. Your memories are private: they never appear on your profile, your share pages or to other players.

Your tips — shown to everyone once approved

If you write a tip about a place, we store it with the place and the time you wrote it. A reviewer reads every tip, and every edit, before other people can see it. Once approved, it's shown to anyone who opens the place, in the app and on the web, with your username and whether you've stamped the place — or as “Anonymous user” if your profile is private. You can edit or delete your tip at any time.

Your reports and suggestions

If you report a tip or a place, or suggest a missing place, we store what you sent — the reason, your note, and for a suggestion its name and the spot you marked — with your account and the time. Only our reviewers see who sent a report; the person whose tip you reported never does. Marking a spot with “Use where I am” reads your location once, only when you tap it.

Device integrity

To confirm visits come from the genuine app on a real device, the app uses Firebase App Check with Google Play Integrity. Google processes information about your device and app for this and gives us a pass or fail token; we don't receive the underlying device details.

Technical logs

Like any online service, our servers log requests, including your IP address, to keep the service running and secure. These logs are deleted after about 30 days.

On your phone

The app keeps a copy of places, your account details, your stamps and any visits waiting for a signal on your phone, so it works offline, and it caches the photos you've viewed. It's removed when you delete your account or sign out, or when you uninstall the app.

What we don't collect

No photos from your phone other than the ones you choose to add as memories, and no contacts, messages, advertising IDs or location history: we don't keep a record of where you've been beyond the places you stamp.

How we use it

• To run your account and your map: your stamps, provinces and pins.
• To keep your photo memories and show them to you.
• To show your approved tips to other players, so they know what to expect at a place.
• To review your reports and suggestions, and fix or add places and take down tips because of them.
• To verify visits and keep the game fair.
• To show your public profile and the pages your share links open, if your profile is public.
• To answer you when you contact us, and to handle deletion requests.

What other people can see

If your profile is public, anyone with the link can see your username, avatar, home province, when you joined, and the places you stamped and when. These pages are kept out of search engines. If your profile is private, none of this is shown to other people. Share cards show only what's on them, and only when you choose to post them. When a card says you were among the first explorers of a place, it counts everyone's stamps but reveals no one else.

Who processes your data

We don't sell or rent your data. We use these service providers to run PiliPins:

• Google — Firebase Authentication (sign-in), Firebase App Check and Google Play Integrity (device checks); Google Cloud (our servers, our database on Cloud SQL, photo storage and logs, in Singapore); and Google Workspace (our mailbox, support@pilipins.ph, which sends your sign-up and password-reset emails, receives your messages to us, and keeps a copy of both).

Your data may be processed outside the Philippines by these providers, under their own security and privacy commitments. When you share a card to Facebook, Messenger, Instagram or another app, that app's own privacy policy applies to what you post.

How long we keep it

We keep your data while you have an account. When you delete your account, we delete your sign-in, your identifying details, the location readings from your visits, your photo memories, the provinces you marked as visited before, your tips and your reports, as set out on the account deletion page. Your stamps remain only as anonymous records that can't be linked back to you. Deleted data can stay in database backups for a short time, up to 7 days, before it's gone from those too. Emails between you and us stay in our mailbox until we no longer need them to answer you; ask us and we delete them.

Our website

pilipins.ph — the map, share pages and these pages — uses no cookies for tracking, no analytics and no ads. Its server keeps the same request logs as the app's. Our team's sign-in to the admin pages is handled by Firebase Authentication.

Your rights

Under the Philippine Data Privacy Act of 2012, you have the right to be informed, to access your personal data, to correct it, to object to its processing, to have it erased, and to receive a copy of it. In the app you can change your username, home province, avatar and profile visibility, and delete your account (a suspended account is deleted on request, within 30 days — see deleting your account). For anything else — a copy of your data, a correction, a question — email us at support@pilipins.ph. If you believe we've mishandled your data, you can also complain to the National Privacy Commission.

Children

PiliPins is for people aged 13 and over; you confirm this when you create your account. We don't knowingly collect data from children under 13. If we learn that we have, we delete the account.

Security

Data travels encrypted between the app and our servers. Access to our systems is restricted, and passwords are handled by Firebase and never reach our servers.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. If a change affects how we use your data in a way you'd want to know before it happens, we'll tell you before it takes effect — by email or in the app.

Contact

The developer of PiliPins (see our Google Play listing) — support@pilipins.ph. Questions about your personal data, and requests under the Data Privacy Act, go to our data protection officer at the same address.