The five-line version
- Original photos and videos never leave your device. The app reads the capture time and coordinates inside them and does its work on the phone.
- No account is needed to rebuild a trip, edit it, or export a PDF or slideshow. Until you sign in, our servers hold no record of you.
- With an account, the server keeps trip metadata (times, coordinates, stop names) and 512 px thumbnails of the photos in a trip, so trips sync between devices and share links can open.
- Delete your account inside the app or from the Delete account page; server data is purged within 24 hours.
- No ads, no selling of data, and no third-party tracking SDK in the app. Anonymous measurement counts actions, not people, and can be switched off.
Who is responsible
Resmoir is offered under the trade name AIoT Solutions and run by two individuals: Nguyen Tue Lam (the iOS app on the App Store) and Nguyen Ba Tu (the Android app on Google Play). Website and servers: [[to fill in: operator]]. Contact address: [[to fill in: address]]. In this policy they are "we". Questions about your data go to help@resmoir.com.
This policy covers the Resmoir app on iOS and Android, the resmoir.com website and the trip share pages.
Data that stays on your device
Once you grant photo library access, the app builds a photo index on the device: for each photo or video it records the capture time, coordinates (when present), media type, dimensions, favourite flag and modification date. It also counts faces, entirely on the device (Apple Vision on iPhone, Google ML Kit on Android); that number is only used to pick photos for a Story and never leaves the phone. The ML Kit library may send Google anonymous usage and performance metrics about itself, never the photos or the counts.
From that index the app suggests date ranges when you were away from home, infers where home is from where you take photos at night, groups photos into stops and joins them into a route. Saved trips, your edits, the places you name (home, a stay, a place you visit), your home history and settings (language, theme) all live in the app's database on the device.
You can wipe all of it by uninstalling the app. Your places are always stored as private names: a public share replaces the names of your home and stays with the name of the commune or ward.
Original photos, videos and the PDF or MP4 files you export leave the device only when you tap share or save using the operating system's own features. That is your action, through the iOS or Android share sheet, not through our servers.
What reaches our servers without an account
A few things need a server even when you have no account. In every case below the server does not know who you are and stores nothing tied to your device.
| Task | What is sent | Why | Kept on the server |
|---|---|---|---|
| Map | Coordinates of the map tiles on screen | Load the basemap from our own tile server (OpenStreetMap data) | Ordinary technical access logs |
| Naming places | Rounded coordinates (cells of about 150 m) of stops, in batches | Look up the commune, ward or landmark through a Nominatim or Photon instance we run | Lookup results per coordinate cell, not tied to a user |
| Routes | Coordinates of two consecutive stops | Compute the distance with a self-hosted OSRM | Route segments per coordinate pair, not tied to a user |
| Story chat | Stop names, coordinates, times, photo counts, your notes and the sentence you type | Rewrite captions and narration | No conversation is stored; see third parties |
Test builds may resolve place names through the public Photon service (photon.komoot.io). Release builds use our own servers.
When you create an account
An account is optional. It syncs trips between devices, opens share links on the web and renders video on the server. You sign in with Google or Apple: we receive your email address and display name from the sign-in provider, never a password. The server issues Resmoir's own session and records the device name of each session so you can recognise it when signing out.
When syncing, the app uploads:
- Trip metadata: title, date range, stops (name, coordinates, arrival and departure times, order), vehicle per leg, notes you wrote, your Story edits.
- Metadata of the photos in the trip: the on-device identifier, capture time, coordinates, media type, the stop it belongs to.
- 512 px thumbnails of those photos (about 40 KB each; the server rejects anything over 256 KB). Original photos and videos are never uploaded.
The server has a field for a home location, but the current app does not send it. The index of your whole library, photos outside trips, face counts and the places you named stay on the device.
Server data sits in a database with row-level access control: every query sees only the data of the signed-in owner, enforced both in the database and in the application layer.
Push notifications. If you allow notifications, the app sends the server this device's notification token (issued by Apple or Google, not a device serial) with the platform and language, solely to tell you when a server-side render finished or failed. The token is deleted when you sign out; a token that stops working is marked disabled.
Pro plan. When you buy a plan through the App Store or Google Play, the store sends the server a transaction certificate: product id, transaction id, purchase date, expiry date and purchase environment. The server keeps it to know which account is Pro and to restore purchases on another device. We never receive card numbers, bank names or billing addresses; those stay with the store.
Third parties that receive data
We run the application server, database, thumbnail storage, map server, place lookup and routing ourselves. The parties below are the only ones that receive data from Resmoir, and each receives exactly what is listed.
| Party | What they receive | When |
|---|---|---|
| Anthropic (Claude API) | Trip metadata: stop names, coordinates, times, photo counts, your notes and what you type in the chat box; if you use AI photo selection, 512 px thumbnails as well. Never original photos, never your email or account identifier | When you ask the AI to draft a Story or type in the Story chat |
| Microsoft Azure Speech | The text of captions and narration to be spoken | When you pick a high-quality voice instead of the system voice, or render a video on the server |
| Google, Apple | Your sign-in request; they return your email and display name to us | When you sign in |
| Apple (APNs), Google (FCM) | Your device's notification token and the notification text: the trip title of the video that just finished or failed | When a server-side render ends, if you allowed notifications |
| Apple App Store, Google Play | Your Pro plan purchase; they return a transaction certificate to us (product id, transaction id, expiry date) | When you buy, renew, cancel or restore a plan |
| Google (Google Sheets via Apps Script) | The email you enter in the launch-notification form, the language and the page | Only on the form on resmoir.com |
| Sentry (crash reporting) | Error traces: error name, code stack, app version, device model and OS version. File paths and coordinates are stripped before sending; no email, no photos | Only when the app hits an error, and only in builds with crash reporting enabled (the current build has it off) |
The default voice in the app is the operating system's voice, running on the device. Video rendered on the phone sends nothing to the server.
If you record your own voice for a Story, the app uses the microphone only while you hold the record button, and the recording stays on the device. When you share a Story with a recorded voice, the app mixes the voice with the background music into one audio file and uploads it so the share page can play it; that file is stored with the trip's Story in the cloud and is deleted when you remove the Story from the cloud, delete the trip from the cloud or delete your account.
AI conversations are not kept on the server beyond one reply: the chat history lives in the app on your device. Anthropic processes data under its commercial terms and does not use it to train models.
Anonymous measurement
To learn which features get used and where people give up, the app counts eight actions: granting photo access, the number of suggested trips, opening a trip, editing, exporting, sharing, buying a plan and turning on Story. Each event carries only the action name, a time and a few numbers or preset values (for example “export: pdf”). The server rejects a whole batch if it contains an unexpected field, so coordinates, trip titles, place names or photo identifiers have no way in.
Events travel with an install id, a UUID the app generates itself, not the operating system's device id; uninstalling and reinstalling yields a new one. It is not tied to an account. Events are batched on the device and sent every 60 seconds or when you leave the app, kept on the server for 180 days and then deleted.
The switch Account → Usage data → Send anonymous usage data turns all of this off: the batch waiting on the device is dropped and nothing further is sent. Turning it back on counts from that moment.
How long we keep things
| Data | Retention |
|---|---|
| Synced trip metadata and thumbnails | Until you delete the trip or the account |
| Videos rendered on the server | 30 days after rendering, then deleted automatically |
| Sessions | Refresh tokens expire after 30 days without use; signing out revokes them immediately |
| Share links | Until the expiry you set, until you revoke them, or when the trip or account is deleted |
| Place lookup and route results | Kept long-term per coordinate cell, not tied to a user |
| Anonymous usage events | 180 days from the moment the server receives them, then purged in batches; you can turn them off with a switch in the app (see Measurement) |
| Push notification token | Until you sign out on that device or delete the account; a token that stops working is marked disabled |
| Pro plan transaction certificates | Until the account is deleted; expired transactions are kept to restore purchases and to reconcile refunds with the store |
| Launch-notification email | Until the app ships and one notification is sent, or until you ask us to delete it |
Your rights
- See and correct: everything that syncs is visible and editable in the app.
- Export: a trip exports to PDF, JSON or video from the app itself, no request needed.
- Delete a trip: delete it in the app; the server copy and its thumbnails go with the next sync.
- Delete the account: Account → Delete account, or follow the Delete account page. The server marks the account at once, revokes every session and purges all data within 24 hours. Signing in again within those 24 hours cancels the deletion.
- Ask or complain: help@resmoir.com. We answer within 30 days.
You have the rights granted by Vietnam's Personal Data Protection law and, if you are in the EU or the UK, by the GDPR: access, rectification, erasure, restriction, objection and portability. We process data to provide the service you asked for, and with your consent where the app asks explicitly.
Permissions the app asks for
| Permission | Used for | If you decline |
|---|---|---|
| Photo library (read) | Reading times and coordinates inside photos to rebuild trips. Limited access (a selection of photos) works too | The app cannot build trips; saved trips still open |
| Photo library (write) | Saving a rendered trip video to your library, and removing coordinates from photos when you confirm (see below) | Videos can only be shared, not saved to the library |
| Location while using the app | Only when you tap the locate button on a map or “where I am standing” while naming a place. Never in the background, never sent to the server | You pick the point on the map instead |
| Notifications | Telling you when a server-side render finished or failed. Never used for reminders or marketing | You open the app to check; the app polls the server periodically instead |
Removing coordinates from photos. Inside a stop you can drop the location of a few photos from the trip. If you also turn on the switch to remove it from the device's Photos library, the app asks again in a dialog that says this cannot be undone, and only writes to the photo after you agree. This is the only place the app edits photo metadata in your library: it only removes coordinates, never adds anything.
Children
Resmoir is not directed at children and does not knowingly collect data from anyone under 13. In Vietnam, users under 16 need a parent's or guardian's consent to create an account. If you believe a child has created an account, tell us and we will delete it.
Security
Connections between the app, the website and the server are encrypted with TLS. The server stores only hashes of session tokens, so a database leak lets nobody sign in as you. Thumbnails are served through signed, expiring URLs. Servers are located in [[to fill in: country or region of the production servers]]; if you are in Vietnam, this means the data you sync is stored outside Vietnam, under the safeguards above and the cross-border transfer procedure that Vietnamese law requires.
Changes to this policy
When this policy changes in a way that affects you (a new third party, a different retention period, measurement turned on), we update the effective date at the top and tell you in the app before the new version applies. Earlier versions are kept in the project's source history.