Privacy Policy

Effective 2026-10-19

Soapstone lets you leave short messages at real places for other people to find, like the messages in the Souls games. It's built to work without an account. This policy explains what the Soapstone app and soapstoneapp.com collect, why, how long we keep it, and what you can do about it.

Soapstone is run by Matthew Wilson and Michael Mason. Questions go to [email protected].

The short version

You don't need an account. We never ask for your name, email, phone number, or contacts.
Messages are public. Anyone can read a message and see where it was left, from anywhere in the world.
We never show who wrote a message.
No ads, no trackers, and no analytics about you. We send only anonymous performance data (like how fast the server responds) to keep Soapstone running. We don't sell or share your data.
Our server logs don't record IP addresses or your location.
You can delete your messages, or all your data, from the app at any time.

What we collect, and why

Your anonymous identity

The first time you open the app, it receives a random secret code (a "token"). The app keeps it in your device's secure storage (the iOS Keychain) and uses it so the app can recognize your messages and votes. If you use iCloud Keychain, the app also keeps a copy there, so a new Apple device signed in to your Apple Account can share the same anonymous identity. iCloud Keychain is end-to-end encrypted by Apple, and we never see your Apple Account. Our server stores only a scrambled, one-way version of the token, plus when it was created and last used. The token isn't linked to your name, email, Apple ID, or any device identifier. If you restore an encrypted backup to a new phone, the token comes with it, so your messages stay yours.

Checking the app is genuine

To stop automated fake installs, the app uses Apple's App Attest to show our server that it's the real Soapstone app on a real Apple device. This involves Apple's servers, under Apple's privacy policy. It happens silently, and if it can't be done (an older device, an outage), the app still works, though it may have lower limits on how much it can do. We store only that the check passed, when, and on which platform, plus a scrambled, one-way fingerprint of the app's check key, so that one key can't be used for many identities. The key is created by the app and is used only for this check. We never receive or store a device identifier.

Messages you write

When you leave a message, we store:

the message itself, built from the in-app phrase list, and which game's phrase list you used
the location where you wrote it, as precisely as your device reports it
when you wrote it
to place it accurately, the location's accuracy and, when your device provides them, your altitude, compass direction, and floor level

What's public: the message text, its location, the date (not the time), and how many times it has been rated ("appraised").

What's never public: who wrote it, and the extra placement details (accuracy, altitude, direction, floor).

Because locations are public and precise, don't leave messages that point to where you live or anything else you'd rather keep private.

Votes

We store the votes ("appraisals") you cast on messages. Other people see only the total number of votes on a message. The author of a message also sees how many were positive and how many negative. To cast a vote, the app sends your current location so we can check you're near the message. That location is used only for that check and is never stored.

Messages you find

When you open a message while you're at its location, we record that you found it (not your location itself) so you can see your collection and how you compare with other explorers. Only you can see it. It's kept until you delete your data.

Reports and blocks

Reports: when you report a message, we keep your report (and a reason, if you give one) along with a copy of the reported message's text and location, so we can review it. We keep these copies even if the message is later deleted, so moderation decisions can be checked, for up to one year after we've reviewed the report. Messages you report stay hidden from you. We keep a record of which messages you've hidden until you delete your data or the message is deleted.
Blocks: when you hide an author's messages, we store which message you blocked and the area around it, so we can hide that author's messages there from you. Blocks are private: no one else, including the author, is ever told.

Browsing the map

To show you messages, the app sends us the part of the map you're looking at, or your current position for the "around you" list. We use it only to answer that request. We don't store it or log it.

Location on your device

The app asks for location access only while you're using it. It uses your location to show messages near you and to let you write and vote where you are. Soapstone doesn't track your location in the background.

Network information

Everything the app and website send reaches our servers through Cloudflare, our network and security provider. Cloudflare handles every request on its way to us, including your IP address and request details such as the map area you're viewing. Our server logs don't record IP addresses, or the locations inside requests. To stop abuse, our server briefly holds IP addresses in memory to count requests. If someone goes over a limit, we log only a shortened network prefix, never the full address. Server logs are kept for about two weeks and aren't backed up.

Performance data

We send anonymous performance data (which kinds of requests, how long they took, error rates) to Grafana Labs to keep Soapstone running. It contains no IP addresses, locations, or message content.

Feedback

If you send feedback, we keep what you write, any email address you give us, and the app and device details you choose to include, to read it and reply. It's never published. It's kept for up to a year after we've handled it, or until you delete your data. Feedback sent from the website isn't linked to your device, so Delete my data can't remove it; email us and we'll delete it.

Email to us

If you email [email protected], we receive your email address and message and use them only to reply.

The website

soapstoneapp.com uses no cookies, analytics, or trackers. Maps on our website are images loaded directly from Apple Maps, so Apple receives your IP address and the approximate area the map shows (to about 100 meters), but not which page you're on. Message share pages publicly show a message's text and location, just like the app.

Messages from the original app

Messages written with the original Soapstone app (2015) are still on the map. The original app stored an anonymous device ID with each message. We keep only a one-way, keyed fingerprint of it, so that if you still have the original app's data on your device, you can reclaim your messages after updating. It can't be turned back into the device ID, and until a message is reclaimed, it isn't linked to anyone.

How long we keep things

Messages: until you or a moderator delete them.
Your anonymous identity: until you delete your data in the app.
The app check: with your identity. After you delete your data, we keep the record that the check passed and the scrambled key fingerprint with the internal random ID described below, so the same key can't be used again. It isn't linked to you.
Votes and blocks: until you remove them or delete your data.
Messages you've found: until you delete your data, or the message is deleted.
Reports: up to one year after we've reviewed them.
Which messages you've hidden by reporting them: until you delete your data or the message is deleted.
Feedback: up to a year after we've handled it, or until you delete your data.
Server logs: about two weeks.
Backups: our database is backed up nightly. Copies on our own server are access-restricted and kept for 14 days, and off-site copies are encrypted and kept for 30 days, so deleted data fully disappears from all backups within 45 days.

Your choices

Delete a message from the app at any time.
Delete my data in the app's settings. This permanently removes your token, your votes, the messages you've found, your blocks, which messages you've hidden, and feedback you sent from the app, and, if you choose, all your messages. If you choose to keep your messages, they stay public but are no longer linked to anyone. We keep an internal random ID in place of your identity so other people's blocks keep working; it isn't linked to you. Reports you made are kept for moderation as described above. If your other Apple devices share the identity through iCloud Keychain, they start fresh too.
Location access can be turned off in your device's settings. You can still read messages anywhere; writing and voting need your location.

Because Soapstone is anonymous, we can't look up "your" data from an email or a name. The data is tied only to the token on your device, which is why deletion happens in the app. If you need help, email us.

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to how it's used. The in-app tools cover deletion. For anything else, contact [email protected].

We don't sell your data or share it for advertising. We use a few service providers to run Soapstone:

Cloudflare: network, security, and domain services. It handles every request to Soapstone, including IP addresses and request details, under its own privacy policy.
Apple: app distribution, the maps shown in the app and on our website (Apple Maps), and App Attest, which checks the app is genuine.
Fastmail: our email provider.
Grafana Labs: monitoring. It receives only anonymous performance data, as described above.
Hosting: private local server during beta.

We may disclose information if the law requires it, for example in response to a valid legal order.

Where your data is stored

Our servers are in the United States.

Children

Soapstone is for people 13 and older. We don't knowingly collect information from children under 13. If you believe a child under 13 is using Soapstone, contact us and we'll help remove their data.

Security

We use encrypted connections (HTTPS), store only scrambled versions of tokens, encrypt our off-site backups, restrict access to everything on our server, and keep IP addresses out of our logs. No system is perfectly secure, but we collect as little as possible so there's little to lose.

Changes to this policy

If we change this policy, we'll post the new version here with a new effective date. For significant changes, we'll also let you know in the app.

Contact

[email protected]