Privacy Policy

Last updated 8 November 2026 (Murmur 1.1)

Murmur has two parts: threads on the map, which need an account and are stored on our server; and your daily trail, which stays on your iPhone and, as in 1.0, is never sent to us. This policy explains what we collect, why, how long we keep it and who else receives it.

In short

Threads are anonymous. Other people only see your little picture and name in that thread (such as “🦦 Sea Otter”, a different one in every thread). They can’t see who you are or which other threads you’ve posted.
Where you start a thread is blurred to about 150 m, and the thread shows up only after 0–3 minutes. Your precise location is never stored.
24 hours after a thread melts, it is permanently deleted from the server. Reported content is the exception: a snapshot is kept for up to 90 days for review.
Before anything you write is published, its text is checked automatically by an AI model from Anthropic. Only the text is sent.
No ads, no tracking, and we don’t sell data.

What we collect, and why

Your account (Sign in with Apple): When you sign in with Apple, we receive the user identifier Apple gives Murmur, which is how we recognise your account. The app doesn’t ask for your name or email address. Apple also gives us an authorisation token. We keep it for one purpose only: to revoke Murmur’s access with Apple when you delete your account.
Age confirmation and account status: When you confirmed that you are 18 or older and agreed to the Terms of Use and Community Guidelines, when your account was created (new accounts can post less in their first 7 days), and your account status: active, muted or suspended (see the Terms of Use).
What you write: The text of your threads, up to 3 tags, how long each thread lasts (1 hour, 24 hours or 7 days), whether it is “View once”, the place name, and your replies. For each thread we record the order in which you first spoke there; the app turns that number into your little picture. Nobody else can see which account it belongs to. You can also choose your own emoji and name (up to 8 characters) in a thread; it is stored with that thread only and isn’t shown anywhere else.
Where a thread is: When you start a thread, the app sends that one precise location, and how accurate it is, to our server. The server uses it in memory only, to find the roughly 150 m square it falls in, and picks a random point inside that square. That random point is what is stored; your precise location is never stored or written to any log. A new thread shows up on the map only after 0 to 3 minutes. Replies carry no location.
Place names: When you start a thread, the app asks Apple Maps for the name of the place at the centre of that square (not your precise location), such as “Gongguan”. The name is stored and shown with the thread, and it is checked together with the text.
The map and lenses: When you look at the map or use a lens to find threads nearby, the area or lens centre the app sends is first rounded to the centre of a roughly 150 m square. The server uses it to find threads nearby and doesn’t store what you looked up. Your lenses themselves (centre, radius, time and tags) are kept only on your phone.
What you do: Likes and dislikes; follows (including muting, how far you have read and when you were last notified); blocks; and reports. Your block list only keeps the tag and the date of the thread where you blocked someone, never the text. A report stores the reason, any note you add, and a snapshot of the reported content (including the author’s account) for review. If the author chose their own emoji and name in that thread, the snapshot includes them.
Apple ID fingerprints of suspended accounts: When an account is suspended, we keep a one-way hash of its Apple account identifier, computed with a key that exists only in our database. It can’t be turned back and is used only to stop the same person signing up again with the same Apple ID. We don’t keep the identifier itself.
Push token: The notification identifier iOS gives this phone, used to tell you when a thread you follow gets a new reply. It is unlinked from your account when you sign out.
Moderation records: What a moderator did about a report (for example approving, removing or suspending), to which post, and when. When an account is suspended, muted or reinstated, we also record a code derived from the account that can’t be traced back to it, so we can handle appeals. These records contain no post text and no account IDs.

What we don’t collect

Your trail (see “Data that stays on your phone” below).
Your name, email address, contacts, photos or advertising identifier. The app contains no advertising, tracking or analytics code. We don’t sell data or combine it with other data.
Our own server code only logs the function name, a result code, how long it took and the thread’s ID. It never logs post text, locations, accounts or tokens. Like any online service, our hosting provider handles connection data such as IP addresses while it processes requests.
If you have turned on “Share With App Developers” in iOS Settings, Apple may pass on aggregated crash and performance reports. Those come from Apple and contain none of your threads or your trail.

Who can see what

Other people: the text of threads and replies, tags, place names, the blurred location, times, and your little picture and name in that thread. Not your account, and not the other threads you’ve posted. Until your thread appears on the map, only you can see it.
Us: when we handle a report or a post that was held automatically, we see that post and an opaque author code, which is not an account ID. If the law requires it, we may have to hand over data we hold. We also see any emoji and name the author chose in that thread; if a new thread carrying a chosen name is held, the name waits for our review with it.

Services that receive data

Supabase: Our database, sign-in, server code and live updates run on Supabase, in a data centre in Tokyo, Japan. All the server-side data listed above is stored there.
Anthropic: Each time you post a thread or a reply, before it is published, the text is sent to an AI model from Anthropic (Claude), which checks whether it breaks the Community Guidelines. Only text is sent: for a reply, its text; for a thread, its text plus one line of tags and one line with the place name. When you choose your own emoji and name in a thread, the line “emoji name” is sent (after the thread’s text, if you choose it as you start the thread). Your account, user ID, location and device information are never sent.
Apple: Sign in with Apple (signing in, and revoking access when you delete your account). Notifications go through Apple’s push notification service; a notification contains the replier’s little picture in that thread and the start of the reply (up to 60 characters). Apple Maps: the base map (Apple receives the area of the map you’re looking at), the place name looked up from the centre of the square when you start a thread, and the trail’s “Improve with Apple Maps” (see below). All of this is handled under Apple’s privacy policy.
Cloudflare: Hosts this website. The pages have no cookies, no scripts and no third-party resources. Like any website, Cloudflare processes connection data such as your IP address to deliver them.

Our database is in Japan. Where Anthropic and Apple process data depends on their own services and may be outside Taiwan.

How long we keep it

Threads and replies: when a thread’s time is up, it melts and disappears from the map (a thread lasts at most 14 days). 24 hours after it melts, the thread is permanently deleted from the server along with its replies, tags, place name, likes, dislikes and follows. The deletion job runs every hour, so this happens within about 25 hours. A thread removed by a moderator is deleted the same way, 24 hours after removal; a removed reply is no longer shown and is deleted with its thread. A name you chose is deleted with its thread. If a moderator removes your reply, or approves your post without its name, your chosen name in that thread is cleared back to automatic; a suspension clears your chosen names in every thread. A name in a report snapshot is kept for as long as the report.
Reports: the reason, note and content snapshot are deleted 90 days after the report.
Moderation records: deleted after one year.
Push tokens: deleted when you sign out, when the token stops working, or when you delete your account.
Blocks: kept until you unblock, or until either person deletes their account.
Your account, Apple identifier and authorisation token: kept until you delete your account.
Apple ID fingerprints of suspended accounts: deleted when the suspension is lifted, and kept for at most 2 years.

Deleting your account

In the app, go to Me → Delete account. This works for every account, including ones that are suspended, muted or haven’t finished “Before you start” yet.

We first revoke Murmur’s Sign in with Apple access with Apple, then delete the account. If Apple’s side fails, the account is still deleted.
Deleted straight away: your account, Apple identifier and authorisation token, the threads you started (including other people’s replies in them), your replies, likes and dislikes, follows, the people you blocked and any blocks of you, and your push tokens.
Reports you made stay until their 90 days are up, but are no longer linked to you. Snapshots of your content that other people reported also stay until their 90 days are up, then are deleted.
Codes in the moderation records stay until their year is up, but once your account is deleted they no longer match anyone.
If your account is suspended, the one-way hash of its Apple account identifier stays until the suspension is lifted or 2 years have passed, so the same Apple ID can’t sign up again.
The app asks whether to delete the trail on this phone as well.

Data that stays on your phone

This data is never sent to us and isn’t included in iCloud or computer backups. It won’t move to a new phone or come back when you restore a backup.

Your trail

Location points, how you were moving and the places you stopped are stored inside the app on this iPhone, protected by iOS Data Protection.
You choose how long to keep it: 7 days, 30 days (the default) or forever. Older days are deleted automatically. Delete everything at any time in Trail settings → Delete all trail; deleting the app deletes the trail too.
When you switch today’s trail to “Map”, the base map comes from Apple Maps, and Apple receives the area of the map you’re looking at. Your trail itself is not sent to Apple.
“Improve with Apple Maps” is off by default. When it’s on, a few points along your route and the places you stopped are sent to Apple Maps to snap the route to roads and find place names; when it’s off, nothing is sent. Either way, your trail is never sent to us.
Only when you tap Share does Murmur draw that day’s snake as an image and hand it to the iOS share sheet. Where it goes is up to you.
“See a sample day” uses sample data built into the app and held in memory. It is never written into your trail.

Diagnostics

The app keeps a diagnostics log on this phone to help track down problems, such as why part of a day’s trail is missing: when the app opened, went to the background or was woken by the system, how the trail was recorded and how many points were written, the state of permissions, and which server calls failed (only their names and error codes). An exported file also starts with the app version, phone model, iOS version, time zone and a few settings. It never contains locations or coordinates, place names, what threads and replies say, tags, tokens, or account or user ids. The log keeps about 8 days and at most 2 MB, and isn’t included in backups. It leaves your phone only when you share it from Me → tap Version 5 times → Diagnostics → Export, and you choose where it goes. If you send it to us, we use it only to look into the problem you reported and delete it once that’s done.

Lenses and “View once”

The lenses you save, and which “View once” threads you’ve already opened, are recorded only on this phone. The server doesn’t record who read which thread.

What each permission is for

Location: Shows where you are on the map and gets your location once when you start a thread (“While Using the App” is enough). For the trail, “Always” lets it record all day, even while the app is closed. Starting threads and recording the trail both need Precise Location.
Notifications: Tells you when a thread you follow gets a new reply. You can turn them off in iOS Settings at any time.
Motion & Fitness: For the trail only: tells walking, running, cycling and riding apart. This is worked out on the phone.
Face ID: Optional. Locks the Trail tab. iOS checks it’s you on the phone; Murmur never receives any face data.

Security

Connections between the app and our server are encrypted. The app can’t read the database tables directly, only through the queries we wrote, and nothing sent back to the app contains an account ID.

Under 18s

Murmur is only for people aged 18 or over, and we don’t knowingly collect data from anyone younger. If you find someone under 18 using Murmur, report their posts or email us, and we will suspend that account.

Your rights

You can ask to see or get a copy of the data we hold about you, to correct or delete it, or to have us stop processing it. Most of this you can do in the app: delete your account, unblock, unfollow, or turn off permissions in iOS Settings. For anything else, email us; we will first confirm it’s you, then reply as the law requires.

Changes

When this policy changes, we’ll update this page and the date at the top.

Contact

w.yihhsuan@gmail.com