Privacy

Using Go Here needs no account. What makes a city yours is a key, an unguessable link, held on your device. Hold the key and the city is yours. Hand a link out and whoever holds it sees what that link was cut for, and no more. Keeping a friend’s list and following someone need no account either.

Only a public profile, a page at gohere.studio/@you, needs one, and you sign into it with your email address and a code sent to it. There are no passwords. Your address is for signing in and for nothing else: it is never shown to anyone, and we never write to you except to send a code you asked for.

Your keyring: the keys to the cities you own and the links you have kept. A name, if you have given one (a display name, not a username). Which way the lights are. And a cache of what you have already looked at, pages and map tiles and pictures, so a list opens where there is no signal. In the iPhone app the keyring is mirrored into the phone’s Keychain as well, so the browser’s housekeeping can never take the only copy.

None of it leaves the device unless you send it: a recovery code and Link a device both carry the keyring across, and say so as they do. Clearing the site’s data in your browser, or deleting the app, removes all of it.

A city you publish, and everything anyone adds to it, lives on our server so that a link can open it: the city’s name and its keys; each spot’s name, coordinates, address, hours, note and rating, whether it is gatekept, and the name of the collaborator who added it, if they gave one; the pictures attached to spots; and, if you take a recovery code, a copy of your keyring under that code. A device code made under Link a device parks the keyring for ten minutes at most and is deleted the moment it is claimed.

One more key, a keeper, is made with your first city and held on your device beside the others. It opens nothing. It names which cities are one person’s, so the free spots can be counted across them, and it is what a Go Here Pro subscription attaches to: the plan, the day it runs out, and Apple’s own number for the transaction, so that a renewal or a refund finds it. Apple takes the payment. We never see your card, your Apple ID or your name.

If you make a profile: your account (the email address, when it was made, and whether it has been confirmed by a code), and while you are signed in a session record with the IP address and the browser name it was opened from, which is what keeps you signed in; your profile (its handle, the name and the line you gave it, which of your cities are on it, and when you agreed to the community guidelines); and the recovery code your keyring is kept under, so that signing in on a new device brings your lists back.

A follow is kept on the follower’s device, beside the lists they keep. On our server it is one row with a number on it, so that a profile can say how many follow it: it records nobody’s name and no device, and nothing says who follows whom. A report keeps what was reported, the reason, and the words and the email address its sender chose to add, and not who sent it.

That is the whole of the database. Apart from a signed-in session, there is no IP address and no device identifier, and nothing is written down about how you use the app.

Showing a list to whoever holds a link to it. That is the only use. Nothing is sold, nothing is shared for advertising, nothing is used to build a profile of anyone, and nothing is used to train anything.

One thing is shared, on purpose. A business you find through the Google lookup and confirm joins the place directory every search runs against, so the next person in that city simply finds it. What joins is its name and its street address, and nothing about you or your list. A pin you drop by hand never does, and a gatekept spot never does.

The keys are the whole of the access control. An owner link shows everything, gatekept spots included, and can change anything. A collab link shows the list without its gatekept spots and lets whoever holds it add to it. A view link only shows. Gatekept spots are held back on the server, not hidden on the page: a friend’s browser never receives them.

Your name, if you set one, is shown to anyone holding a link to your city, and a collaborator’s name to anyone holding a link to the list they added to. A link you regret handing out can be replaced from the share panel; the old one stops answering for everyone who holds it.

A profile is public: anyone can open it, see its handle, name, line and follower count, and open the cities on it, without their gatekept spots. A city you leave off your profile stays as private as its links. Your email address is never on it.

On Neon, in AWS’s us-east-2 region in Ohio, United States: Postgres for the rows and a private bucket for the pictures. The site itself runs on Vercel. Both act only on our instructions, under their own terms, and both keep the request logs any host keeps (an IP address, a URL, a browser’s name) for a short while. Pictures are served through signed links that expire, so a picture’s address does not stay open.

A few things this app does are questions put to other services. They are asked from our server, so the other side sees our server, not your device.

Searching for a spot sends what you typed, and which city, to a place directory we host, and to Photon, an OpenStreetMap geocoder run by komoot in Germany: as a hint for ranking, and as the whole answer for a city we haven’t loaded.

Look it up on Google, when you press it, sends the same text to Google’s Places API. Nothing Google returns is written down except the name at the coordinate you then confirm, and the address for that is asked of OpenStreetMap, not Google.

Send → sends the city’s name, your name if you set one, and the names and notes of its non-gatekept spots to Anthropic’s API, for Claude to arrange into a message. Import → sends the text or the screenshot you pasted, for Claude to read the places out of. We keep nothing of either exchange, and Anthropic handles what it is sent under its own API terms.

A YouTube video shared to Go Here goes to Google twice: its link to the YouTube Data API for its title and description, and the link with that text to Google’s Gemini API, which watches the public video to find the places in it. What was said about each place then goes to Anthropic for the notes. Nothing about you goes with any of it. What comes back, the places and the moments they appear, is kept by video and shown to anyone who shares the same one; the description is never stored, and the title and channel are kept thirty days at most. To count new videos a day, the server keeps your device’s keeper, or a one-way hash of your address when there is none, with the day and a number, and nothing else.

Directions hands a spot’s coordinates to Apple Maps, and nothing else.

Signing into a profile goes through Neon’s sign-in service, the same company as our database, which keeps the account in our database and sends the code to your email address.

Two things come straight to your browser from elsewhere, so those services see your IP address and what was asked for. The map tiles come from CARTO, which therefore knows which tiles, which is to say roughly where on the map you were looking. The typeface comes from Adobe Fonts, which knows which page.

There are no analytics, no advertising and no fingerprinting, and the page never asks where you are: the lights’ auto setting takes its bearings from the clock’s time zone, not from your location. The one cookie is the one that keeps you signed into a profile, and it is set only once you sign in.

On iPhone, the camera opens only when you choose Camera to add a picture to a spot, and the photo picker hands over only the pictures you pick; nothing else in the library is read. A picture you attach is kept in the private bucket above and shown to whoever holds a key to that city.

Go Here is not made for children under 13 and does not knowingly keep anything about them. If you believe a child has published a list, write to us and it will be deleted.

For as long as the city exists, and no longer. Delete a spot and it goes, pictures with it. Delete a city you own from the keyring and every spot, every picture and every link it carried are deleted at once; the dialog says so. A friend’s list is only ever forgotten on your device; the list itself is theirs. Clearing the site’s data, or deleting the app, removes everything held on the device.

A profile and its account are deleted from inside the app, under Profile →: the page, the handle (held back from others for thirty days, so an old link never opens a stranger’s page) and the account with its email address all go at once. Your lists stay on your device.

A recovery backup is kept until you ask for it to go. There is no button for that yet, so write to us with the code, or with the owner link of a city in it. Anything else you want found and deleted can only be found by the key or code it sits under, so include the link.

Wherever you live, you can ask what is held under a key, have it corrected or deleted, take a copy of it (Send → and the view link already do that), or object to how it is used. Write to dylan@gohere.studio and you will hear back within a month, and usually within days. If you are in the EU, the EEA or the UK you can also complain to your data protection authority.

When this page changes, the date at the top changes with it.

Go Here is made and run by one person. dylan@gohere.studio