Lugar is a place-first social app. You leave memories at real places, and other people standing there can read them. Because the product is built on where you are, this policy is mostly about location: what we collect, how precisely, who can see it, and for how long.
This policy covers the Lugar mobile app and the Lugar API. In it, “we” means the developer of Lugar; contact details are at the end.
What we collect
| Data | Why | Kept |
|---|---|---|
| Your email address, and either your name and profile picture from Google Sign-In, your name from Sign in with Apple (on iPhone; the email may be an Apple "Hide My Email" address), or the password you chose if you signed up with email | To create and identify your account. With Google or Apple we never see your password there. With email, your password is never stored: only a salted, one-way hash of it, which can check a password but can't be turned back into one. | Until you delete your account |
| Date of birth | To make sure everyone on Lugar is old enough to use it. Asked once after sign-up and never shown to anyone. | Until you delete your account. If it shows someone is under 13, the account is deleted straight away. |
| Approximate location: a small area about 10 metres across | To place a memory, to show what is near you, and to tell whether you are inside a named spot. Your phone uses GPS to work out where you are, but before any position leaves it, the app rounds it to the centre of the small area (a “cell”) you are in. Our servers never receive or store your exact GPS position. The one exception is claiming the day's treasure, which uses a smaller cell, about 4 metres across. | The cell attached to a memory lasts as long as that memory. Visit records are kept while your account exists. Positions saved before 13 October 2026 were stored as the app sent them then. |
| Memories: text, photos, video, audio, and the cell you left them in, with how accurate your phone's GPS was | This is the content of the app. | Until you delete the memory or your account. A deleted memory is hidden from everyone at once and erased, with its photos, videos and audio, 90 days later. |
| Echoes: private messages between two people, including attachments and voice notes | To let you talk to someone about a place. | Until either participant deletes their account. A message you unsend is hidden at once and erased 90 days later. |
| Spot chat: messages and photos in a spot's group chat | To let people at a place talk to each other. | Shown for 24 hours, then hidden from everyone. Kept for 90 days in case a message is reported, then erased with its photo. |
| Presence: the named spot you are currently at | To show friends where you are, if you leave that turned on. | Held in temporary storage and expires automatically minutes after you leave |
| Device notification token | To deliver push notifications through Firebase Cloud Messaging. | Until you sign out, uninstall, or delete your account |
| Likes, comments, saved spots, event RSVPs, reports you file | To make those features work and to review reported content. | Until you delete your account |
| Feedback you send (what you write, the kind of phone and its system version, and whether we may email you) | So the team can fix problems and improve Lugar. Your email is shown to the team only if you allow it. | Until you delete your account |
Permissions the app asks for
- Location (while using the app). Required, because a memory in Lugar always belongs to a place. Lugar does not request background location and does not track you when the app is closed.
- Wi-Fi in range (Android). Indoors, GPS is often tens of metres out. To recognise a spot you are in anyway, the app notes which Wi-Fi networks it can detect at spots you visit. It keeps a one-way code made from each router's address, and how strong its signal was; never network names, never anything sent over them. This stays on your phone, is never sent to us, and is erased when you sign out. Lugar never connects to these networks.
- Where GPS reads at your spots, and whether the phone is moving. Indoor GPS tends to be wrong in the same way each time, so the app notes where your phone's GPS reads while you are in a spot, to recognise it next time. It also uses the phone's motion sensor (no permission needed) to tell when you are sitting still, so a wandering GPS signal does not move you out of the place you are in. Both stay on your phone, are never sent to us, and the GPS notes are erased when you sign out.
- Camera and microphone. Only when you choose to capture a photo, video or voice note.
- Photo library. Only for the specific items you pick.
- Notifications. Optional. Declining it costs you nothing but the alerts.
Who can see what
- Memories are public to the place. Anyone using Lugar who is near that place can read them, along with your display name and picture, unless you turn on Hide my name in Settings, which credits everything you post, past and future, to “Someone”.
- Presence is friends-only, mutual and coarse. Friends see the name of the spot you are at, never your raw coordinates, and only while you are there and for a few minutes after. It can be turned off in Settings, and turning it off takes effect immediately.
- Show me on the map is friends-only and off unless you turn it on. Friends see your picture on their map within an area about 25 metres across, never your exact position. When you stop using the app it stays where you were last seen, greyed out.
- What I do is public to people near you. If you add services you offer (for example software engineer or tailor) under What I do, anyone searching for them in or around your territory sees your username, picture, those services, the line you wrote and roughly how far they are from where you saved them (rounded to 50 metres or more, never your live position), and can message you. Remove them at any time; they are not shown while Hide my name is on.
- Anyone can message you. Messages from people who are not your friends are listed apart, under Others. Until you reply, they can send you at most three messages, words only (no photos, videos or files). Blocking someone stops their messages completely.
- Echoes are private to the two people in the conversation. They may be read by a moderator if one of those two people reports the conversation.
- Reports are public, but never with your name. What you send in the Report chat appears in Happening now straight away, rewritten by AI into a short, neutral line, marked as unverified until other people at the spot report the same thing or confirm it. It never shows your name, picture or account: only the text, the spot, when, and how many people reported or confirmed it. People at the spot can answer "Is this happening?" with Yes, No or Not sure; those answers are counted, never shown with names. The location of a report (its 10-metre cell) is kept for 30 days, then reduced to about 100 metres. You can delete your reports at any time; if others reported the same thing, it stays up for them.
- Keeping reports honest. To stop one person faking many reports, the app sends a random id for your installation of Lugar (not your phone's hardware id), and each report is weighed using signs that a location might be faked: a GPS reading that is impossibly perfect, a jump faster than anyone could travel, a new account, or an internet connection that appears to be in a very different place (from the rough location our hosting provider gives for every connection). These only change how much a report counts; they are not shown to anyone.
- Your email address is never shown to other users.
Who we share it with
Your account, everything you post and the photos, videos and audio you upload are kept on Lugar's servers. Lugar AI, our own system running there, rewrites each report for Happening now and tells whether it describes something already reported at that spot. It works from the text of the report, the spot's name and what was already reported there that day, and nothing that identifies you: no name, account, email or exact location.
Beyond our servers, we share data only with the service providers that make the app run:
- Google: Sign-In (authentication), Firebase Cloud Messaging (push notifications) and Firebase Crashlytics (crash reports). FCM receives your device token and the text of the notification. When the app crashes, Crashlytics receives what was happening in the app at that moment (the error, where in the code it happened, and the screens and tabs opened just before), your phone model and system version, and your Lugar account id. Never your name, email, messages or location. We use it only to find and fix crashes.
- MET Norway: the weather shown on spots. Our server asks for the weather at a spot's approximate location (rounded to about 1 km). MET Norway never sees your IP address, your account or where you are.
- Photon (by Komoot): name ideas when you create a spot ("Looks like you're at…", from OpenStreetMap). Our server sends the spot's location, rounded to about 10 metres; Photon never sees your IP address or account.
- OpenFreeMap: the street map's roads and place names (OpenStreetMap data). To draw the map, your phone downloads the map squares for the area on your screen, so OpenFreeMap sees your IP address and which area you are viewing, like any website you load. It receives nothing about your account. Turn the street map off in Settings → Appearance to use Lugar's plain map instead, which downloads nothing from them.
We may also disclose data where the law requires it, or where it is necessary to investigate abuse or protect someone's safety.
Safety and moderation
You can report a memory, a person, a place, a comment, an event, an echo, a spot chat message or a spot note from inside the app, and you can block another user. Blocking is mutual in effect: neither of you sees the other's content, and neither can message the other. Reported content is reviewed by a human, and reports are kept, along with the moderator's decision, after the content itself is removed, so decisions stay auditable.
When you delete something
Anything you delete in Lugar (a memory, comment, report, spot note, chat message, event or message) disappears from the app for everyone straight away. We keep it on our servers for 90 days, so a report about it can still be reviewed and a mistake can be put right, and then erase it for good, together with its photos, videos and audio. Each erasure is recorded in our audit log.
Deleting your account
Open Lugar and go to Profile → Settings → Delete account. You confirm by typing your own email address. Your account is deactivated immediately: your profile, memories and comments are hidden from everyone and notifications stop. It is erased for good after 90 days. Signing in again within those 90 days restores it.
You can also request deletion at https://lugarapp.xyz/delete-account or by emailing support@lugarapp.xyz.
What is deleted
Your account, profile, memories and their photos, videos and audio, echoes and their attachments, likes, comments, saved spots, events you created, notification tokens, presence and visit history, friendships and blocks.
What is not
Places you created (spots, area names and landmarks) remain on the map, reassigned to “A former member”. Other people's memories are anchored to those places, and deleting a place would silently delete their content too. After reassignment those places carry no link back to you. Moderation records are likewise retained without your identity, so past decisions remain reviewable.
Notifications
Lugar sends you notifications about things that happened to you, like someone liking your memory, a friend arriving, or an event you are going to starting soon. When someone pins a memory at the spot Lugar last recorded you at, it may tell you (at most once per spot every 3 hours and 3 times a day). New reports at the spot you were last at, or anywhere in a territory on your watchlist, reach you whenever they are sent, including at night, because they can be about your safety. A safety report also reaches people at spots within about a kilometre. If you share your presence, friends who are at the same spot when you arrive may be told you just got there (at most once every six hours, never at night). It may also send an occasional reminder (at most one a day), such as a nudge to report what is happening at a spot you usually visit at that time. None of these are sent between 10pm and 7am in your time zone. They are worked out from when you last had Lugar open at a spot, never from your location while the app is closed, and you can silence them alone under Reminders in your phone's notification settings. If you allow notifications, you also get the odd bit of news about Lugar itself (never ads). Notifications have one switch, your phone's: mute Lugar in your phone's settings to stop them, all or by kind.
If location is off, Lugar may show a blurred preview of reports near the city your internet connection appears to be in. That city is a rough guess our server makes from your connection, used only for that preview and never stored.
Security
All traffic between the app and the API is encrypted with HTTPS. Sessions use signed tokens. Media is stored under unguessable keys. No system is perfect, and we do not claim otherwise.
Children
Lugar is not for children under 13. Everyone is asked their date of birth after signing up, and an account whose date of birth shows someone under 13 is deleted straight away, with everything in it. If you believe a child is using Lugar anyway, email us and the account will be removed.
Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, and to object to certain processing. You can edit your profile and delete your memories or your whole account inside the app, and download a copy of everything Lugar holds about you in Settings, under Download my data. The file includes your account, what you posted, your conversations, the places Lugar has recorded you at, your reports and your notifications. For anything else, email support@lugarapp.xyz and we will respond within 30 days.
Changes
If this policy changes materially we will update the date at the top and notify you in the app before the change takes effect.