Privacy
Updated September 21, 2026
What the app records
When you record a walk, the app saves a video from the camera, the camera's position and orientation for every frame, your GPS route with compass heading, and, on phones with a LiDAR sensor, a depth map about once a second. It records no audio and never reads your photo library. Nothing leaves your phone until you tap Submit.
What Submit sends
Submit uploads that video, the camera measurements, the depth maps and the GPS route to the project's storage, tagged with your account. There is no advertising identifier.
Your account
Submitting a walk needs Sign in with Apple. We ask Apple for no name and no email address, and we receive neither. We keep a random account id, which carries your chosen name, and a one-way hash of the identifier Apple gives this app for you, which is how we count walks (twenty a day). Neither can be turned back into your Apple ID. Exploring the city and the walk map needs no sign-in.
You can delete your account in the app under your name. That removes your name from every walk you submitted, removes Paint Ithaca from your Apple ID, and signs you out on every phone. The walks themselves stay in the city model as anonymous contributions, and nothing links them to an account you make later.
What is public
The GPS route of every submitted walk is shown on the walk map with the name you chose in the app, or as Anonymous. The 3D model is built from the video and published for anyone to explore and download. People and vehicles are left out of the model. The video itself is never published.
What is kept
The uploaded video, depth maps and camera measurements are deleted 14 days after you record the walk, once the model has been built from it or the walk has been rejected. A walk still waiting its turn keeps its upload until then. The points built from it, the route and the walk's date are kept as part of the city model. Deleting a walk in the app removes only the copy on your phone.
Your name
The name is optional. It belongs to your account, so changing or clearing it changes every walk you submitted, from any phone. Names are public. Offensive names are replaced by Anonymous.
People in the video
Faces and licence plates in the uploaded video are not blurred. That is why it stays private, is used for nothing but building the model, and is deleted after two weeks.
Removing a walk
To have a walk, a route or a name removed, write to [email protected] with the date and place of the walk. The route comes off the walk map when we delete the upload, and the next nightly rebuild takes the walk out of the model.
Location
Location is used only while the app is open, to place your walk on the map and to show your position in the model. Recording works without it.
Paint Ithaca is a community project, not a company. There is no tracking, no analytics and no sale of data.