Locals
Last updated: October 14, 2026 · Effective: July 8, 2026
Locals is a location-based social app that lets you discover Places of Interest, share visits with photos and ratings, follow other people, comment, and curate lists. This Privacy Policy explains what information we collect, how we use it, when it is shared, and the choices and rights you have. By creating an account or using Locals, you agree to this policy.
Locals (“Locals,” “we,” “us,” or “our”) is an independently developed iOS application, created and operated by Iván Hernández Ramos, an individual developer established in Las Palmas de Gran Canaria, Spain. For the purposes of the EU General Data Protection Regulation (GDPR), Iván Hernández Ramos is the data controller for the personal data described below.
For any privacy question or request — including exercising your rights under section 8 — you can reach us at hello@explore-locals.com.
| Data type | Why we collect it |
|---|---|
| Email address | Account creation, sign-in, account recovery, and notices about your account's security, its deletion, and moderation decisions about your content |
| Name (username; optional full name, which may come from Apple or Google if you sign up with them) | Your public profile, social features, and letting people find you in search |
| Photos (posts & profile picture) | Shown on your posts and profile |
| Precise location | Nearby places, add-visit suggestions, area rules |
| User-generated content (captions, comments, ratings) | Core social functionality |
| User ID | Identifies your account across the app |
| Push notification token | Delivering notifications you enable |
| Usage & diagnostic data (only if you allow it) | Improving the app (aggregate analytics) |
| Crash reports & app-stability data (not linked to your account) | Finding and fixing crashes |
Legal bases. We process your information to provide the service you signed up for, including your account's security emails (performance of a contract, GDPR Art. 6(1)(b)); to meet our legal obligations (GDPR Art. 6(1)(c)), such as telling you why we restricted something you posted (EU Digital Services Act, Art. 17) and confirming that your account has been deleted (GDPR Art. 12(3)); for our legitimate interests in keeping Locals safe and working, such as reviewing reports, moderating content, crash reports, the technical details sent with feedback and aggregate counts of account activity (GDPR Art. 6(1)(f)); and on your consent where we ask for it: usage analytics, which you can withdraw at any time in the app's Settings, and location access and push notifications, which you can withdraw at any time in iOS Settings (GDPR Art. 6(1)(a)).
Locals is a social app, so some information is visible to others by design. Your username, your full name (if you add one), profile picture, bio, posts, ratings, comments, and follower/following counts can be seen by other users, and other users can find you by searching for your username or full name. If your profile is public, people who browse Locals without an account can see it too: your username, full name, profile picture, bio, follower/following counts, posts and ratings, but not the comments or likes on your posts, and they cannot search for you. The spots on the map can also be seen without an account. If you set your profile to private, your posts are visible only to people whose follow request you have approved; your username, full name, profile picture, and bio remain visible to other users, but not to people without an account. People you block cannot see your content, and you will not see theirs.
Spots are shared. Everyone using Locals, with or without an account, can see a spot’s name, category, location on the map, average rating, number of visits and cover photo. Anyone with a spot’s link can also see its name, category, average rating, number of visits and cover photo on its page at explore-locals.com, without the app, and search engines may index that page. Other users can see your username as the person who added a spot you add, even if your profile is private. A spot’s cover photo only ever comes from a post on a public profile, so a private profile’s photos never appear there; posts from private profiles do count toward a spot’s average rating and number of visits, without showing who they are from.
We share data with vendors that process it on our behalf to run the app — principally Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, and Crashlytics) and Google Analytics for Firebase. These providers are bound to use the data only to provide their services to us. See Google's Privacy Policy and Firebase's privacy information.
We use Resend to send the emails your account needs, such as a welcome, a link to confirm your email address, a link to reset your password, a notice about your account's security or its deletion, or a notice about a moderation decision. For each one, Resend receives your email address and what that email says, including any single-use link and, for a moderation notice, what we did, the kind of content (a post, comment or spot), the date it was posted, how it came to our attention and the rule it broke, never the post, comment or spot itself. Resend uses them only to deliver the email on our behalf. See Resend's privacy policy.
If you sign in with Apple or Google, they share the information described in section 2.1 with us under their own privacy policies (Apple, Google).
We may disclose information if required by law, or where we believe in good faith that it is necessary to comply with a legal obligation, protect the rights and safety of our users or the public, or investigate fraud or abuse.
We do not sell your personal data, and we do not share it with third parties for their own advertising.
The app is built on Google Firebase. Your account data, posts, images, and related content are stored using Firebase services operated by Google. Google processes this data as our service provider under its own security and privacy commitments. Account emails, such as password resets, are sent through Resend (see section 4.2). We do not use any advertising or cross-app tracking SDKs.
Data is stored on Google Firebase infrastructure, primarily in the European Union
(region europe-west1). Because Locals is available internationally and relies
on Google's global infrastructure, your information may be processed in other countries;
where that happens, it is protected by appropriate safeguards. Resend may process your email
address and the content of account emails in the United States; that transfer is covered by
the European Commission's Standard Contractual Clauses. Data is encrypted in transit,
and access is restricted by server-side security rules so that people can only read and write
the data they are permitted to.
No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
We keep your information for as long as your account is active. When you delete your account, the associated data is deleted as described below. Aggregate or de-identified analytics that cannot reasonably be linked back to you may be retained to help us understand app usage over time. Crash reports, and the app-session data used to measure stability, are not linked to your account, so deleting your account does not remove them. Firebase Crashlytics keeps crash reports for 90 days and then starts deleting them automatically. Resend keeps a record of each account email it sends, including its content and whether it was delivered, for 30 days, to deal with delivery problems, and then deletes it. When you delete your account, we keep your email address, encrypted, only until the confirmation email has been sent (normally minutes); if it cannot be sent, the encrypted address is deleted automatically about 8 days after our last attempt to delete your account. To tell you when your password changes, we check every 15 minutes when each account's password was last changed; we never see or store the password itself. To stop abuse of the password-reset and verification emails, we limit how many each network address can ask for: we keep a keyed, one-way code derived from your IP address (never the address itself) for one hour, and our server logs may keep that code for up to 30 days. Our database backups, kept for 7 days so we can recover from mistakes, may still hold deleted data, including that encrypted address, until they expire.
Locals is not directed to children under 13 (or the minimum age of digital consent in your country, where higher), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.
Age checks required by law. Where the law requires apps to check their users' age (for example Texas, in the United States), Locals asks Apple for your age range, such as “13 to 15” or “18 or over”, never your date of birth. We use it only to comply with that law, and we don't store it: it stays on your device while the app is open. If Apple tells us you are under 13, we don't create an account, and we delete any existing Locals account and its content.
Mississippi and Tennessee. If you use the US App Store or tell us you're based in the United States, sign-up asks whether you live in Mississippi or Tennessee, and in Tennessee whether you're 18 or older. We use your answers only to decide whether an account can be created, and we don't store them.
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. For material changes, we may also ask you to review and accept the updated terms within the app before you continue using it.
If you have any questions or requests about this Privacy Policy or your personal data, contact us at hello@explore-locals.com.