Privacy

• Your Timeline file is processed in memory and never written to disk. Only the derived result is stored.
• That result is a set of map cells about 174m across, with how many times you were in each — not your raw GPS trace, and not timestamps of individual movements.
• Stored locations are encrypted, with the key held outside the database.
• Nothing of yours is shared until you switch it on, and the switch is per history — once for a single game, or for a group you can leave at any time.
• You can also upload a friend's export under your account, so they can play without one. Do that only with their permission: it stays unshared unless you change that, and you delete it when they ask.
• Anyone you share with sees the places your rounds are drawn from. Over many games that adds up to a real picture of where you go.
• You can download everything held about you, or delete your account and all of its data, at any time and without asking anyone.

What is collected

When you upload a Google Timeline export, the file is read in memory and never written to disk. What is kept is the derived result: a set of map cells roughly 174 metres across, each with a count of how many times you were in it and which years those were.

That is deliberately much less than what you uploaded. Your raw GPS trace is not kept, and neither are the timestamps of individual movements — there is no record here of where you were on a particular afternoon.

For your account itself: the identifier Google gives us for you, your email address, and your display name.

What is thrown away

Interpolated flight paths are dropped, since they are places you passed over rather than stood in.

Places with no Street View coverage are never playable and are not drawn from.

Who can see it

By default, only you. A history you upload belongs to your account and nobody else can draw a game from it.

There are exactly two ways that changes, and both are things you switch on yourself. You can lend your history to a single game in a room, which lasts for that game and no longer — a room stops working after 6 hours. Or you can lend it to a group, which lasts until you switch it off or leave. Group membership is per-group: lending to one group does not lend to any other.

Being in a room or a group is not the same as lending to it. Turning up to play shares nothing.

Be clear-eyed about what lending means. Nobody is handed your history as a list, a map, or a file — but every round they play shows a real place you have been, and the game deliberately draws from across your whole history rather than the few places you go most. Over many games that adds up to a meaningful picture of where you go. Lend to people you would tell.

Switching a share off stops any further rounds being drawn. It cannot un-show a place somebody has already seen.

An account can hold several histories — your own, and ones you upload for friends who play locally with you and have no account of their own. Upload someone else's export only with their permission. A hosted history follows the same rules as yours with one difference: it starts unshared, so it appears only in games you start yourself until you deliberately lend it to a room or a group. The person it belongs to has no login to manage it with, so their rights run through you: delete it when they ask.

How it is stored

Stored locations are encrypted at rest. The key is held outside the database, so a copy of the database on its own does not reveal anywhere anyone has been. Cells are indexed under a keyed one-way value rather than the location itself, which is what lets two people who stood in the same place be recognised as such without either location being readable.

Who else is involved

Signing in uses Google. We receive an identifier, your email address and your name; Google is told that you signed in here.

Street View imagery and the guess map are loaded by your browser directly from Google, so Google can see that a map was loaded and which panorama was shown.

When a history is processed, the coordinates derived from it are sent to Google's Street View metadata service to find out which of them have imagery. That is a lookup against places, not an upload of your file, and it is not tied to your account — but those coordinates do leave this server.

The service runs on Fly.io, in San Jose, California.

Nothing is sold, and there is no advertising or analytics.

How long it is kept

Your history is kept until you delete it. Deleting your account removes it, along with your account and every game it appeared in.

Rooms and their membership are deleted 6 hours after the room opens. Group invites stop working after 7 days.

What you can do

You can download everything held about you, decrypted and readable, at any time. An export you cannot open is not portability.

You can withdraw consent, and you can delete your account and all of its data. Both are immediate, neither requires asking anyone, and deletion is real rather than a flag.