CityShot

Updated 20 October 2026

Privacy policy

Who we are

CityShot is run by Magnus Mägi (Estonia). For questions about your data, or to use any of the rights below, write to support@magnusmagi.com.

What CityShot keeps, and why

Only what the app needs to work. We show no ads, sell no data, and don’t track you across other apps or websites.

Your account

You sign in with Apple. We receive your Apple account id, an email address (Apple’s private relay address if you chose to hide yours) and, the first time, your name if you share it; it becomes your display name, which you can change in Profile. Before you sign in, the app keeps your choices in an anonymous account.

What you create

So it follows you across devices, we store the spots and routes you save, your collections, the routes you plan, the walks you finish (the route, the day and how long it took), your trip albums and photos, journal text, your settings (skill, photo styles, language, units, appearance, alerts) and the cities you asked to hear about.

Photos

We upload a resized copy of each photo you add, without the file’s own metadata. Where and when it was taken is read from the photo on your iPhone and stored with it, privately, to place it on a spot and a day of your trip. Photos are private unless you share one to a spot’s gallery; other CityShot users then see it without your name, and without where or when it was taken. You can stop sharing or delete a photo at any time.

Location

CityShot uses your location only while you use it, never in the background. On your iPhone it works out walking times and your nearest city. When you plan a route, your position is sent to our server to choose where the route starts, and is not stored. During a walk, your iPhone asks Apple Maps for directions from where you are. Weather forecasts use the city’s location, not yours.

Community

We keep when you accepted the community terms and who you blocked. When you report a photo, we keep the reason and send it to our moderation without your identity.

Subscriptions

CityShot Pro is bought through Apple; we never see your payment details. RevenueCat tells the app whether your subscription is active, and knows your account by a random id, not your name or email.

Crash reports

Release builds send crash and error reports to Sentry: the error, the device model, iOS version and app version. They contain no name, email or account id.

Who processes data for us

Each gets only what its part of CityShot needs. Some process data outside your country; where the law asks for it, they are bound by safeguards such as the EU Standard Contractual Clauses.

Legal bases

For users in the EU and UK: we process data to provide the service you signed up for (contract); for crash reports and to keep the community safe (legitimate interests); and for location, notifications and photo access with your consent, given through iOS permissions, which you can withdraw in iOS Settings at any time.

How long we keep it

Your data stays on our servers while your account exists; you can delete single items at any time. Deleting your account (Profile › Delete account) removes your data and photos from our servers and ends CityShot’s access to your Apple ID. Crash reports are kept for up to 90 days. The app keeps a copy on your iPhone for offline use for up to 30 days, and clears it when you sign out.

Your rights

You can ask to see, correct, delete or receive a copy of your data, or object to how we process it: write to support@magnusmagi.com. You can also complain to your data protection authority.

Children

CityShot is not meant for children under 16, and we don’t knowingly keep their data.

Security

Data travels encrypted. Photos are stored privately and shown through links that expire. Your session is kept in the iPhone’s Keychain.

Changes

When this policy changes, we update the date above, and say so in the app when the change matters.