Hidden Mickeys: Privacy Policy

Effective November 4, 2026. Version 2: approved photos and comments are now shown publicly on the Hidden Mickey Spotter website.

Hidden Mickeys (Hidden Mickey Spotter on the App Store) is a small, free hobby app for sharing Hidden Mickeys, with a read-only public website at https://hiddenmickeys.incidentalfindings.org. This policy explains what it collects, why, and how to delete it. In short: it collects only what’s needed to run the app, it never sells or shares your data for advertising, and you can delete everything at any time.

What is collected

Your account - Your Sign in with Apple identifier and the email address Apple provides. You can choose Apple’s “Hide My Email”, in which case the app only gets a private relay address. - The display name you choose. It’s shown on the photos and comments you share. - The invite code you joined with, when you joined, and moderation details (for example how many of your photos were approved, or whether your account was banned).

What you add - Photos you submit (a close-up and an optional “surroundings” shot), the red circle you draw, and the details you enter (hint, park, land, venue and so on). - The map pin you place for each Hidden Mickey, which marks where the Hidden Mickey is. - Comments, thumbs-up, “I found it” and “Couldn’t find it” marks, favorites, reports you file, and people you block.

What is not collected - Your live location is never uploaded. Location is used only on your phone, to show what’s near you and to suggest where to place a pin. - Photos are stripped of their location and camera details before they’re uploaded, and again on the server when they’re approved. - There’s no advertising, no analytics or tracking SDK, and no tracking across other apps or websites.

Photos saved on your phone

If you take a photo with the in-app camera, the app saves a full-quality copy, including where it was taken, to your own photo library (you can turn this off on the Me tab). That copy stays on your phone and isn’t uploaded.

How it’s used

  • To run the app and website: show Hidden Mickeys, photos and comments to members and to the public, and keep counts like thumbs-up and finds.
  • To keep it safe: review submissions, act on reports, enforce limits and ban abusive accounts. New photos are checked automatically with Google Cloud Vision SafeSearch, which looks for adult or violent content; Google doesn’t keep the photos it checks.
  • Nothing is sold, rented or used for advertising.

Who can see it

  • Anyone, on the website and in the app: approved photos, the details and pin of each Hidden Mickey, approved comments, thumbs-up counts, and the display name on each photo and comment. The website shows only content from members who have agreed to this version of the terms.
  • Admins (the app’s moderators) also see pending submissions, held comments and reports.
  • Private to you: your finds, favorites, blocks and the reports you file. Your email address isn’t shown to anyone.

The website

  • The website has no ads, no analytics and no tracking cookies. Visitors don’t need an account, and nothing about them is collected by the site itself.
  • It remembers two settings in your browser only (whether photos are blurred, and which Hidden Mickeys you’ve revealed). They never leave your device.
  • The map is provided by Apple Maps (MapKit JS), so Apple receives the map requests your browser makes; see Apple’s privacy policy. The site is hosted on Google Firebase Hosting, whose servers may log technical information such as IP addresses.
  • Admins who sign in on the website use Sign in with Apple; the sign-in is kept in that browser’s storage.

Where it’s stored

Data is stored with Google Firebase (Authentication, Cloud Firestore, Cloud Storage and Cloud Functions), and photos are screened with Google Cloud Vision; Google processes this on the app’s behalf. Like most online services, Google’s servers may log technical information such as IP addresses. See Firebase’s privacy information.

How long it’s kept

Your content stays until you delete it, an admin removes it, or you delete your account. Rejected photos are deleted right away. When content is removed by an admin, a copy may be kept in a private log for moderation and abuse prevention.

Deleting your data

In the app, go to Me → Delete account. This permanently deletes your account and everything you’ve added: your photos (including Hidden Mickeys that only had your photo), comments, thumbs-up, finds, favorites, reports and blocks. It also removes the app’s access to your Apple ID. Only an anonymous count of what was deleted is kept. Copies in Google’s backups expire on their own schedule.

You can also ask for your data or its deletion at .

Children

The app is for people 13 and older. It isn’t directed at children under 13, and accounts found to belong to a child under 13 are deleted.

Changes

If this policy changes in a way that matters, the app will let you know.

Contact