Privacy Policy

Effective: October 4, 2026

This policy explains how the Timeline Visualize mobile application (the “App”), operated by Barbarda (“we”), handles information. Using the App requires accepting the Terms of Use and this policy on the App’s welcome screen (“I’ve read and accept”); the App asks again at the first launch of each new version.

Timeline, photo, and location data

The App processes the Timeline JSON files, photos and videos you select, the trips it finds in your photo library, and routes and places you add manually. For photos, it reads capture time and GPS information from EXIF metadata when available, and you can review or correct the proposed place and time. Parsing, customization, previewing, and video rendering run on your device. Your journeys, and the photos of the trips found in your photo library, are also saved to the cloud, as described next.

Cloud saving of your journeys

Saving your journeys to your account in the cloud is part of the service described in the Terms of Use. It covers every journey you create or keep in the App: imported Timeline JSON files, including a Timeline file the App could not read (up to 50 MB, saved so the import can be fixed for that file's format; it is never restored to your device); precise route coordinates, places, dates and times; titles and editable project settings; manually added places; reduced JPEG copies of the photos in a journey (embedded EXIF is removed from the copy, and the EXIF-derived location and time are stored with the journey record); the video clips you add to a journey (a clip of up to 25 MB as recorded, a larger one as the reduced copy the App made for its preview) and the videos the App creates (up to 60 MB, unchanged); and reduced copies of the photos of every trip the App finds in your photo library, kept or not, as described under “Auto trips”. Video files are not re-encoded, so recording details embedded in a clip, such as its capture time and location, stay in the saved file. Found trips and trip summaries from Auto trips are described in the next section.

When it is on. When you accept the Terms of Use, cloud saving and trip sharing are switched on, unless you had turned cloud saving off earlier, in which case it stays off. Some versions of the App instead ask about cloud saving as a separate choice (“Turn on free backup” or “Not now”), at the end of the welcome tutorial and later before sharing a video, until it is on. Videos are included once you have accepted a text that lists them (these terms, or the backup notice of September 19, 2026); under an earlier backup notice your photo backup continues and videos join once you accept a newer text.

What it is used for. Backing up and restoring your journeys; providing the App’s features; reproducing failed or incomplete imports; diagnosing map, photo and video problems; improving compatibility; and developing the App.

How it works. Uploads run in the background over encrypted transport from a queue in private App storage, and retry after interruptions while the App can run or when it is opened again; on iPhone the App may keep uploading briefly after you leave it. Content is stored in Google Firebase (Cloud Storage and Firestore) in the United States under a pseudonymous Firebase installation identifier rather than a name or email. The same identifier is attached to your RevenueCat customer record and used as the analytics user ID (see below). This limits direct identifiers, but photos and precise routes can themselves identify people or places. Restoring depends on keeping the same installation identity; restoring on a new device or after losing that identity is not guaranteed.

Your choices. You can turn cloud saving off at any time in Settings (Privacy & analytics). What you add or change afterwards is then kept on your device only; items already waiting to upload may still finish, and copies already saved stay until you delete them (see “Retention and deletion”). We do not sell this data, use it for advertising, or use it for cross-app tracking.

Auto trips

Auto trips runs when you open Find my trips and allow photo-library access (iPhone and iPad). The App reads, on your device, the capture date and location that your photo library stores for each photo and video and groups them into trips and, near home, days out; with limited access it reads the items you allowed. Your keep and skip choices are stored on your device. A trip you keep becomes a journey and is saved to the cloud like any other journey: its photos, and the videos you put in its video.

Found trips in the cloud. While cloud saving is on, the photos of every trip the App finds (kept, skipped, or not looked at yet) are also saved to the cloud as a backup of those trips: reduced JPEG copies made from your photo library’s picture without its embedded metadata (a small copy of up to 480 pixels and a copy of up to 1,920 pixels on the longer side), together with a record of each trip: its dates and number of days, its number of photos and videos, whether you kept or skipped it, its place name when the App has one, and for each photo its photo-library identifier, capture time and location. Videos are saved only for trips you keep, as part of their journey; days out near home only when you keep them. Each photo is saved once. This runs in the background at low priority, on Wi-Fi or mobile data: it pauses whenever the App needs the connection itself (pictures being shown, a trip’s map being prepared, purchases), sends one copy at a time while journey uploads or copies of kept trips are running, and only starts new copies while the App is open; a copy on its way when you leave the App may finish shortly after. The Find my trips screen shows how many of these photos and trips are backed up, or why the backup is waiting. It is part of cloud saving: turning cloud saving off stops it (a copy already on its way may finish), and deleting your cloud data deletes these copies and records too. They are stored with the pseudonymous installation identifier, in the United States.

The same on-device results are also used for memories: the App may show a trip or day out from an earlier year on its home screen (“a year ago this week”) and, while notifications are allowed and you have no paid plan or trial, schedule at most one memory notification a week. These notifications are scheduled and shown by your device itself; nothing is sent to a server to create them. Looking at a memory shows your photo library’s own thumbnails and copies and adds nothing to what is saved: a trip’s photos are saved as described above whether or not you look at its memory, a day out’s only once you keep it, and only a memory you keep becomes a journey. Days out are not part of the scan summary described below. To name a trip or day out (“Town, Country”) the App uses Apple’s place-name lookup (the iOS geocoder): the coordinates of the centre of that trip’s or day’s photos, and the App’s language, are sent to Apple, which returns a place name. The App adds no photo, date or account identifier to that request; Apple’s privacy policy applies to the lookup. When no name comes back, the dates are used instead. While trip sharing is on, the App also saves a summary of each scan to the cloud: for each trip, its dates, its number of photos and videos, its number of days, its distance from home rounded to 10 km, the centre of its area rounded to about 10 km, and whether you kept it or made a video from it. Trip sharing is part of cloud saving under the Terms of Use: it is switched on when you accept the Terms of Use together with cloud saving, and summaries are saved only while cloud saving is on. Summaries of earlier scans wait on your device and are saved once sharing is on. Turning cloud saving off (Privacy & analytics or Manage storage) turns sharing off too; it is switched on again only when you next accept the Terms of Use together with cloud saving, not when you turn cloud saving back on from a journey backup offer. Versions of the App up to 1.4.1 also asked about sharing on the Find my trips screen, where you could turn it off on its own. Deleting your cloud data deletes the summaries too. Summaries are stored with the pseudonymous installation identifier, in the United States.

Public journey links

From the journey screen or the export result screen, you can create an optional public web page for a single journey. Creating a link uploads reduced, EXIF-stripped copies of that journey’s photos together with its route, timestamps, distance, point and photo counts, and each photo’s caption and location, and makes that journey’s photos, locations, and dates visible to anyone who has the link; a link can be forwarded by anyone who receives it. When a stop has a video clip, a short public copy is uploaded alongside its photo too — only the part you kept after trimming, and without sound if you muted it. The page is not listed and is not indexed by search engines; only the journey you choose to publish is visible through it. Creating a link is chosen separately for each journey and is independent of cloud saving. Published journey data is stored on Firebase (a Google service) in the United States. You can remove a link at any time with Remove public link in the same sheet, which deletes the uploaded photos, any video clips, and the journey record from the same installation that created it; if that installation is no longer available, email support@barbarda.com with the link to request removal. The public page loads vector map tiles from OpenFreeMap (see the OpenFreeMap Privacy Policy) through the MapLibre GL library, falling back to plain OpenStreetMap raster tiles when a device cannot show them, and the Leaflet map library — both loaded from unpkg.com.

Usage analytics

To run the App and keep improving it, we record how it is used with Google Analytics for Firebase, provided by Google. Usage analytics is on by default and you can turn it off at any time in Settings (Privacy & analytics) without losing any feature.

What is recorded. In-app events: each screen, sheet and dialog opened; taps and choices in menus, sheets and dialogs; the steps of the welcome screens (terms viewed, links opened, accepted; tutorial pages viewed, skipped or finished); the steps of every paywall (which paywall, the plans and offer shown, plans tapped, buy and restore taps, the store’s result such as purchased, cancelled or pending, how and after roughly how long it was closed, and your answer if you choose one in “What held you back?”); imports (for a Timeline file the App cannot read, also the names of its fields, never their contents), exports, sharing (including the kind of destination chosen, such as saving to Photos or a messaging app), reopening and editing projects; and a summary of each visit (its length, screens seen and the furthest step reached). Events carry categories, counts and coarse ranges, for example a photo-count range or a time range. Google Analytics also records automatic app lifecycle, session and first-open events, device and app information (model, operating system, app version, language), and an approximate region that Google derives from a masked IP address. We set a pseudonymous user ID — the RevenueCat app user ID, which is the installation identifier once cloud saving has linked it — and user properties such as app language, Free or Full access, and yes/no or range values such as whether cloud saving and notifications are on. The Firebase app-instance identifier is also passed to RevenueCat so purchases and renewals appear in analytics.

Why. To understand how the App is used and where people get stuck, to find and fix problems, to measure the tutorial, paywall and pricing, and to run product experiments (for example two versions of the welcome screen).

Retention. Event-level analytics data is kept for 14 months (the Google Analytics data-retention setting); aggregated reports may be kept longer. Turning analytics off stops collection on the device and clears the user ID and user properties there; data already collected is kept for the retention period unless you ask us to delete it (see “Retention and deletion”).

Analytics is not used for advertising or cross-app tracking and is not sold. Review Firebase Privacy and Security.

Permissions

The App needs no live-location permission, Google account, contacts access, advertising identifier, or broad storage permission. The photo feature uses the operating system picker to access photos you deliberately select. Depending on the operating system version and picker behavior, photo-library permission may be shown for that selection. Auto trips asks for photo-library access when you start it, to read photo dates and locations as described above; you can allow full or limited access, or decline and keep using the picker. On Android, before you first pick photos, the App asks for Android’s permission to read the location stored in photos (Android removes it from the photos it hands over otherwise); it is used only for the photos and videos you pick, which the App copies into its own storage on your device, and if you decline, the App asks you where each photo without a location was taken. The operating system share sheet controls any destination you choose for an exported video. The Instagram, TikTok, WhatsApp and KakaoTalk buttons hand the video file to that app on your device; on iPhone, Instagram and TikTok first save it to your photo library, with the permission to add to Photos, and KakaoTalk is reached through the share sheet, which carries the video and its suggested caption. Once an app has the video, that app’s own privacy policy applies to it (for KakaoTalk, Kakao’s). The App records only which button you used and whether the app opened, as described under analytics.

Map tiles

The App requests visible basemap tiles from CARTO, using OpenStreetMap data. CARTO may receive standard network information such as IP address, device request headers, and requested tile coordinates, which can reveal the general map area being displayed. Review the CARTO Privacy Notice and OpenStreetMap Foundation Privacy Policy.

Purchases

Apple App Store or Google Play processes payments. RevenueCat manages purchase entitlement and restoration. These providers may process transaction identifiers, an app-scoped user identifier, platform/device information, purchase state, the Firebase Analytics app-instance identifier while analytics is on, and the pseudonymous installation identifier. We also store customer attributes with RevenueCat: app language, platform, access tier and plan, last session time, coarse import and export details, the home-screen and welcome-screen experiment versions you see, and which Terms of Use version you accepted and when. We do not receive payment-card details. Review RevenueCat’s Privacy Policy.

Crash diagnostics

Firebase Crashlytics processes crash stack traces, relevant application and device state, and pseudonymous installation identifiers so we can find and fix reliability problems. Review Firebase Privacy and Security.

Feedback

Feedback you send with Send feedback in the App’s menu (your message, an optional email address for a reply, any screenshots, photos or files you attach, and app and device details: app version, platform and operating-system version, app language, Free or Full access, whether cloud saving is on, and the pseudonymous installation and RevenueCat identifiers) is stored in Google Firebase in the United States to answer it and improve the App, and is deleted on request to support@barbarda.com.

Optional notifications

Journey reminders include local reminders and occasional feature tips and offers relevant to the current Free or Full access tier. We request notification permission when you enable reminders or when the App asks at launch. OneSignal then creates a pseudonymous push subscription tagged with app language, platform, access tier, and plan. If analytics is on, the same in-app events described above may also be mirrored to OneSignal. The RevenueCat App User ID is used as the OneSignal external ID and the OneSignal user ID is supplied to RevenueCat so subscription lifecycle events can keep segments current. Turning reminders off opts the device out of push and cancels local reminders.

Accounts, advertising and tracking

The App does not create a named account. Firebase Anonymous Authentication creates the pseudonymous installation identifier used for cloud saving, trip summaries and public links. The App contains no advertising SDK and does not use advertising identifiers or cross-app tracking.

International processing

Cloud-saved journeys, found trips, trip summaries and public links are stored and processed in the United States in a US-region Firebase project. Firebase, RevenueCat, OneSignal, Apple, Google, and their subprocessors may process other service data in countries outside your residence under their published data-protection terms and applicable transfer safeguards.

On-device storage, retention, and deletion

Imported archives, editable projects, selected photo copies, manually entered locations, and App-created videos remain in local App storage until removed by you or the operating system. Manage Storage can remove local archives, projects, photo copies, videos, and map cache. Local deletion is separate from cloud deletion: it marks that the source is no longer present locally but does not erase the cloud copy.

Home Screen widget (iPhone and iPad). While a Timeline widget is on your Home Screen (and for about 15 minutes after the App shows you how to add one, so a widget you add then shows your photos at once), the App keeps small copies of photos from your own journeys (all of them, or only the journeys you choose in the widget settings, never a journey you turned off with Show in widget; at most 60, taken from the photos in each journey’s video, never from a bundled sample), with each journey’s title and its first and last day, and for the My World widget the numbers of countries, trips and kilometres the App shows in your travel numbers and the cover photo of your latest journey, in a storage area on your device that only the App and its own extensions can read, so the widget can show them with the journey’s name and dates and open that journey when you tap it. Which journeys you chose is stored on your device only. The copies are reduced JPEGs without embedded metadata, are kept out of your device’s iCloud backup, and are not uploaded; the widget itself makes no network requests. They are deleted when the App finds no Timeline widget on your Home Screen (it checks when you open it), when you turn off Home Screen widget photos in Manage Storage, when you remove their journey, it is no longer one of the journeys you chose or you turn it off with Show in widget, and when you delete projects and photo copies in Manage Storage. A journey’s own photos are saved to the cloud as described under cloud saving whether or not you use the widget.

Cloud-saved data is retained until you delete it. Turning cloud saving off stops saving anything added or changed afterwards; items already waiting to upload may still finish, and existing cloud copies are kept until separately deleted. To delete cloud copies, use Manage Storage → Request deletion, which emails us your installation identifier; we then delete this installation’s saved Timeline files, routes, projects, photos (including the copies and records of found trips), videos, trip summaries, metadata, and Firestore records, and, on request, its RevenueCat customer record and its analytics data under the same user ID. You can also use the public deletion instructions with the installation identifier shown in the App. Deletion requests are normally completed within 30 days. Provider backups may persist for a limited period under Firebase’s backup and legal-retention practices. We may retain a deletion-request email and completion record for up to 90 days for security, abuse prevention, and audit purposes unless law requires longer retention. Apple and Google may independently retain store transaction records. Crash reports are kept for 90 days.

Children

The App is a general-audience utility and is not directed at children.

Changes

Material changes will be published on this page with a revised effective date, and the App asks you to accept the current version at the first launch of each new App version.

Contact

Privacy or support questions: support@barbarda.com.