Effective: 2026-08-11
Midnight Tracer ("the Service") is an anonymous community that does not require registration. This policy explains what information we process and how.
• Anonymous account identifier (user_id): an account ID automatically generated for authentication and content ownership without requiring separate registration details
• Device identifier (device_id): a stable pseudonymous value used for anonymous posting, deletion, and blocking. Where available, it is produced by SHA-256 hashing an app-scoped OS device identifier (such as IDFV) with a per-installation secret salt; a temporary value is used where no such identifier is available
• User-generated content: posts, comments, optional photos/videos, nicknames
• Location data: when you tap the current-location control on the haunted-spot map, the device's current location is used to show your location dot and recenter the map. Merely launching the app or a detection tool does not read your current location. Tapping the control alone does not store that location on the Service's servers. However, if you then select and submit that map position as a haunted spot, the selected position is converted to and stored as the center of an approximate regional cell. See §4 for separate map-SDK processing
• Haunted-spot registration data: when you place a spot on the map, we store the approximate location you designate (the center of a regional cell ranging from hundreds of meters to several kilometers depending on the place type), together with the title, description, attached content, an authoring identifier, and the time of posting. The designated place may be based on a map position reached using the current-location control, but it is stored only after you explicitly open and submit a spot report. GPS and other location metadata in attached photos/videos is stripped on-device before upload
• Microphone (audio): some detection tools use the microphone for sound analysis, and that analysis is processed entirely on-device and not transmitted. However, if you use the manual screen-recording feature, microphone audio may be saved into the recorded video file, and if you choose to upload or share that video, the audio embedded in it may be transmitted along with it. The Ghost Box and Spirit Board voice-recognition features use your device OS's speech-recognition service (Apple/Google), and depending on your device and language settings, audio data may be sent to that OS provider's servers for processing
• Service-use records: anonymous account/post/date records used to deduplicate views, plus statistics such as category view counts
We do not collect direct contact identifiers such as name, email, or phone number. IP addresses are not stored directly at the application server level, but infrastructure providers (Supabase, Cloudflare, etc.) may process access logs for security and reliability according to their own policies.
• To provide the Service (posting, displaying, deleting content)
• To prevent abuse (rate limiting, report handling, auto-hiding)
• Anonymous analytics (popular categories, active users)
We do not use collected information for any purpose beyond the above.
• device_id: until account deletion or the processing purpose ends. A device identifier subject to a restriction (ban) may be retained separately and minimally, apart from the account and content, to prevent restriction evasion; it is deleted when the restriction or purpose ends
• Posts, comments, spots, and media: hidden immediately when individually deleted. On account deletion, ordinary content and linked data are deleted or anonymized
• Retention exception: material needed for child-safety or other illegal-content investigations, serious reports, evidence holds, legal claims, or disputes may be blocked from public access and retained in minimized, account-separated form until the applicable purpose or legal retention period ends, then deleted
The Service may entrust processing to the following overseas infrastructure vendors, and data is transferred internationally on an ongoing basis over secure network connections whenever you use community, diagnostics, or anti-abuse features:
• Supabase, Inc. (United States, https://supabase.com/privacy): database, authentication, and anonymous account management. Data may include device_id, posts, comments, nicknames, reports, blocks, and moderation metadata. Retention: until the period set in §3 (Retention) of this policy, or until the processing purpose ends or you request deletion, whichever is sooner (backups at the vendor may cause a short additional delay before full erasure)
• Cloudflare, Inc. (United States and other regions, https://www.cloudflare.com/privacypolicy/): R2 media storage, Turnstile anti-bot checks, security, and delivery infrastructure. Data may include uploaded media, media keys, device/browser signals, and access logs. Retention: until the content is deleted or the account restriction is lifted (backups at the vendor may cause a short additional delay)
• Functional Software, Inc. d/b/a Sentry (United States, https://sentry.io/privacy/): crash/error diagnostics. Data may include device/OS information, error logs, and app state. We intentionally do not include direct contact identifiers such as name, email, or phone number. Retention: until the diagnostic purpose is served; detailed retention follows Sentry's own policy
• Google LLC (United States, https://cloud.google.com/terms/cloud-privacy-notice): automated content moderation of photos/videos uploaded to the community (blocking clearly inappropriate content such as explicit material before it is published), using the Google Cloud Vision API and Video Intelligence API. Uploaded images/videos are transferred and processed for pre-publication screening, and any temporary copies held for screening are deleted immediately after processing. Retention: until screening is complete
• Hugging Face, Inc. (United States, https://huggingface.co/privacy): when you download an on-device AI model file, your IP address, request/access logs, and device or network information may be sent directly to Hugging Face. Your photos and analysis content are not sent. Retention follows Hugging Face's own policy
• GitHub, Inc. (United States, https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement): used for operational alerts about serious reports and to host public legal documents. Server-side alerts sent to a private operations repository contain only the report ID, target type/identifier, reason code, status, and received time—not report content, images, or free-text details. Access logs may be processed when you visit public legal documents
• Resend, Inc. (United States, https://resend.com/legal/privacy-policy): used to email serious-report alerts to the operator. Only the operator's email address and the limited report metadata listed above are transmitted; report content, images, and free-text details are not included. Retention follows Resend's own policy
[Map service] The haunted-spot map is rendered using the Google Maps SDK. When the map loads, data such as your IP address, device signals, and map interactions may be sent to and processed by Google directly. If you use the current-location display or recenter feature, the map viewport and interaction data may reflect your current or nearby area. This is not entrusted processing by the Service; Google processes it independently as a separate controller under its own Privacy Policy (https://policies.google.com/privacy). Use of the map is also subject to the Google Maps/Google Earth Additional Terms of Service.
You may object to international transfer, but some or all community upload, diagnostics, or anti-abuse features may become unavailable. Contact iconic.app.official@gmail.com for refusal or deletion requests; we will respond without undue delay, generally within 10 days absent exceptional circumstances. Photos and videos uploaded to the community are screened by Google Cloud automated moderation before publication; by contrast, the paranormal tools' photo analysis runs entirely on-device and is not transmitted externally.
We do not sell or share your information with third parties. Tool photo analysis runs entirely on-device, so your photos are not sent to any external AI. We may comply with valid government or legal requests as required by law.
You have the right to:
• Delete your content (via in-app delete or password)
• Delete your anonymous account and ordinary associated data in Settings > Delete Account
• Block other users (menu > block)
• Report content (menu > report)
• Request inquiries/responses: iconic.app.official@gmail.com
This Service is not intended for users under the age of 14. We do not provide a verifiable parental-consent flow for children under 14, so those users may not use the Service. In jurisdictions with higher consent ages, we follow local law.
Material changes to this policy will be announced in-app 7 days in advance. Continued use of the Service after changes constitutes acceptance of the updated policy.
Contact: iconic.app.official@gmail.com