Privacy Policy

The short version

• The app works without an account and without internet. An account is needed only for backup and for sharing or publishing a place.
• Backup is off until you turn it on. When it is on, or when you back up or publish a single place, your scanned places are copied to our server, each with where it is. Nothing else is.
• Anything you say to the app stays on your iPhone. Voice control is optional, and your speech is turned into text on the device — never recorded, stored or sent anywhere.
• Camera vision is optional and runs on the device. What it looks at is never uploaded or saved, and what the camera remembered never leaves your iPhone, even with backup on.
• A published place is public. A code on a wall can be scanned by anyone who sees it, so the map behind it can be downloaded by anyone who sees it.
• A paired device sees where you are only if you pair it. Nothing is shared until you do; then where you are inside the place you are navigating — and, only if you also turn them on, your GPS location while the app is open and the place itself — goes straight to the devices you paired, never to us.
• We never ask for medical or diagnostic information.
• We do not sell your data, and we do not run advertising.

Backup — off until you turn it on

ICIDO can keep a copy of the places you have scanned on our server, so that a lost or replaced iPhone does not mean losing your maps, and so that you can share a place with someone else. This is off when you install the app and stays off until you switch it on in Settings. Nobody is opted in. You can also back up a single place, or publish one as a code, without switching backup on; that sends only that place.

Each place sent to our server carries:

• The place itself — its geometry and layout, the rooms and tagged spots in it, and the names you gave them.
• Where the place is — the location stamped on it when you scanned it, so a place restored onto a new iPhone can still be found nearby. This is the location of the building, recorded once at scan time. It is not a record of where you go.

That is the complete list. Backup does not include the picture ICIDO keeps with each place, anything you have said to the app, anything the camera remembered, your visit history, trails or heat maps, or your location at any time other than the moment a place was scanned.

Turning backup off deletes every place this iPhone sent to our server. A deleted place — whether you deleted one or switched backup off — stays recoverable for seven days, in case you deleted the wrong one, and is then removed permanently. Deleting your account removes everything at once. None of this touches the places on your iPhone.

Your account

An account is needed only for backup and for sharing or publishing a place. You can sign in with Apple, or with an email address and password. Here is everything we hold about an account, apart from the security log and consent records described below:

• An account identifier, so we can tell your places from someone else’s.
• An email address — the one you typed if you signed up by email; if you used Sign in with Apple, either your real address or the private relay address Apple gave us, depending on what you chose in Apple’s sign-in sheet.
• Your name, only if you used Sign in with Apple and chose to share it, or if you add it on this website. Apple sends it once, the first time you sign in, and we keep what it sent.
• If you signed up with an email address, your password — stored only in a one-way scrambled form, never as the password itself.
• A record of each sign-in session: when it began and ended, the IP address it was opened from, and the browser or app that opened it. Deleted twelve months after the session ends.
• Anything you add yourself on this website’s account pages: your details, accessibility preferences and email preferences. Nothing is added unless you save it there, and you can change or remove it there at any time.

To delete your account: in the app, go to Settings → Account → Delete account. This removes the account and every place held in backup for it, immediately and completely — there is no waiting period and no request to send. The places on your iPhone are not affected. You can also delete an account from this website, or by emailing us.

Places you publish

You can publish a place as a code — a QR code and a short web address — so that other people can scan it and get the map. A code on a wall is readable by anyone who walks past it, so the map behind it is effectively public. Publish buildings, not homes. Publishing never happens on its own; it is a separate action you take for one place at a time.

• Anyone who scans the code downloads that map. They need no account, and nothing about them — not their routes, their history, their location, or their camera — is sent to ICIDO or to you.
• Our web server records, for each request it receives, the requesting IP address, the time, the address requested and the browser or app that asked. Those logs are kept for fourteen days and then deleted. We keep a count of how many times each code has been fetched and when it was last fetched; that count carries no information about who fetched it.
• Unpublishing stops the code working immediately. If you re-walk a place and back it up again, the same code hands out the new map — codes already printed keep working.

Paired devices — nothing is shared until you pair one

You can pair ICIDO with another iPhone running ICIDO — someone you are with, or someone helping you — or with an ICIDO Companion robot, so that you can find each other. Nothing is shared with a device until you pair it: in Settings → Paired devices → Pair another device, one of you taps the other’s device and the other taps Allow. An older Companion robot instead asks for itself, with a four-digit code that your iPhone and the robot both say. Pairing turns on “Share where I am with paired devices”, which you can switch off at any time. A paired device can reconnect without asking only by proving it is the same device, with a secret your two devices made when you paired them.

While that switch is on and you are navigating a place in ICIDO, your iPhone sends each device you paired:

• where you are inside the place, and which way you are facing;
• the place’s name and the date it was scanned, so the other device knows it holds the same map;
• the name you gave your iPhone on the pairing screen (or “iPhone” if you gave none), the ICIDO version, and a random identifier for this installation.

A paired iPhone sends you the same about itself. ICIDO shows it on your maps and in the camera view, with the way it went over the last few minutes, and tells you where it is. After it disconnects, ICIDO keeps where and when it was last seen — in memory only, never stored and never sent — until you close ICIDO or remove the device.

That is the complete list for this switch; what follows adds to it only if you turn it on or allow it. It goes directly from your iPhone to the other device, over an encrypted connection between the two devices using Wi-Fi or Bluetooth nearby. It does not pass through our servers, and we never receive it. Nothing else is sent: no camera images, nothing you say, no routes and no history.

Find each other anywhere — off until you turn it on. With this on as well, your paired devices can find you outside saved places too, on any screen, while ICIDO is open. Your iPhone also sends them:

• your GPS location, about once a second: latitude and longitude with their accuracy, and your altitude, direction of travel and speed when your iPhone has them;
• what they need to measure, by ultra wideband, the distance and direction between your iPhone and theirs, where both have it.

A paired iPhone sends you its own only if its owner has turned this on too. For this, ICIDO asks iOS for your precise location, and iOS asks you first. It all stops when ICIDO is closed or in the background, when the other device disconnects, or when you switch it off.

Sending the place you’re in. When a device you paired doesn’t have the place you are navigating, it can ask for it. A Companion robot gets it only if you have turned on “Send the place I’m in”. For a paired iPhone, ICIDO asks you first, each time, unless that switch is on. Once ICIDO has found you there, your iPhone sends that place: the same file Share makes, with the place’s shape and layout, the names and tags you gave it, and where it is. Never a photo. Only the place you are in, never your others, at most once each time it connects, and ICIDO tells you every time. The other device keeps that place until someone deletes it there, as any device you share a place with would; removing it in ICIDO does not delete it. In the same way, ICIDO can ask a paired iPhone for the place it is in, and a place it sends you is added to your places.

Where is …? While that screen is open, ICIDO uses your iPhone’s location and compass to show which way a paired device is. Both stay on your iPhone; this sends neither.

Your position inside a place stops when you leave navigation; everything stops when you switch it off or leave ICIDO. Nearby devices running ICIDO or the Companion app can see that your iPhone is available, under the name you gave it, while the pairing screen is open, while sharing is on and you are navigating, and, with “Find each other anywhere” on, whenever ICIDO is open. You can remove a device you paired at any time in Settings → Paired devices, and it then has to ask again.

What the app records — on your device only

• Camera & LiDAR — used live to scan rooms and to recognise where you are inside a saved place. Camera frames are processed on the device in real time and are not recorded, with one exception: when you save a place, ICIDO keeps one picture from the camera with it, shown beside the place in your list of places. Our server never keeps that picture. Older versions of the app send it along when you back up, publish or share a place, and our server discards it as it arrives; newer versions leave it out of everything they send, including files you share. If you turn on Camera vision, ICIDO can optionally keep the text descriptions it produced — never the pictures. See Camera vision below.
• Location (optional) — if you grant it, an approximate location helps identify which saved place you are in more quickly, and is stamped on each place when you scan it. It is stored on the device. It leaves only with the place it belongs to, if you back up or publish that place; your location at other times is never sent to us. The one other way a position ever leaves your iPhone is pairing a device, above, which sends where you are inside a place — and, only with “Find each other anywhere” on, your GPS location while the app is open — straight to the devices you paired.
• Motion & barometer — used to detect when you change floors. Processed on the device only.
• Microphone (optional) — used only while you are actively holding a voice conversation with the app. Audio is transcribed on the device and is never recorded, stored or transmitted. See below.
• Your maps and history — scans, tagged spots, rooms, buildings, trails and heat maps are held on your iPhone. Trails and heat maps never leave it. Scans, rooms, buildings and tagged spots leave it only if you back them up or publish them.

Microphone and speech

ICIDO has an optional voice control feature. When you tap the microphone button, ICIDO listens so you can ask it to guide you somewhere, tag the spot you are standing on, scan an area, or describe your surroundings.

Your speech is converted to text entirely on your iPhone. ICIDO uses Apple’s on-device speech recognition and explicitly requires it: if your iPhone cannot recognise speech locally, the voice feature is switched off rather than sending your audio anywhere. ICIDO does not use, and cannot fall back to, server-based speech recognition.

• Audio is never recorded to a file, never stored, and never transmitted.
• Audio is processed only while you are actively using the microphone button, and the microphone is released the moment the conversation ends or you leave the screen.
• The text of what you said is used only to carry out that one command. It is kept in memory for the length of the conversation so follow-up questions (“how far now?”) make sense, and is discarded when the conversation ends.
• Nothing you say is used for advertising, analytics, profiling, or training any model.

Understanding what you asked for is also done on your iPhone, using Apple Intelligence where the device supports it. On iPhones without Apple Intelligence, ICIDO matches your words against a fixed list of commands locally. In neither case does anything leave the device — and this is true whether or not backup is on.

You can decline microphone access, or withdraw it later in iOS Settings → ICIDO. The rest of ICIDO is unaffected: scanning, navigation, Find Me and everything else work exactly the same without it.

Camera vision

ICIDO can optionally answer questions about what its camera is looking at — “what do you see?”, “read that sign”. This uses a vision model that runsentirely on your iPhone.

• No image, video or frame that camera vision looks at is ever uploaded, transmitted or saved — whatever your settings. The only camera picture ICIDO keeps is the one saved with each place, described above.
• The model is a separate download of about 370 MB, delivered by the App Store the first time you turn the feature on, under the same terms as an app update. Downloading it tells Apple you are downloading it, and tells us nothing.
• Reading text (signs, labels, screens) uses Apple’s on-device text recognition, which is part of iOS. It needs no download and sends nothing anywhere.
• If ICIDO cannot identify something, it can offer a “Look this up” button. That opens the standard iOS share sheet with the camera image so you can send it to an app of your choosing. ICIDO transmits nothing itself — the image leaves your iPhone only if you tap that button and then pick a destination, and what happens next is governed by that app’s terms, not ours.
• You can remove the model at any time in Settings → Camera vision.
• Everything else in ICIDO works without it, including all questions about where you are and how far away things are, which are answered from your own saved map.

Remembering what was seen — off unless you turn it on

ICIDO can optionally keep the descriptions it produced, so you can later ask “where did I leave my keys?”. This is a separate switch in Settings → Camera vision, and it is off by default. When it is on, ICIDO stores, on your iPhone only:

• the text description the model produced,
• the question you asked,
• which place and room you were in, and roughly where you were standing,
• the date and time.

No images are kept — only text. This record is never uploaded, is excluded from iCloud backup, is kept until you delete it, and “Clear” in Settings erases it completely. With the switch off, each answer is spoken and forgotten, and nothing is written down at all. This record is never included in backup. It is a written account of the inside of your home, and it stays on the device that made it.

Information you give us — only if you register on this website

None of this is needed to use the app. If you choose to create an account here — for the newsletter, beta testing, or joining as a developer or organization — we ask for:

• Name — so our replies can address you properly.
• Email address — to identify your account, verify it, send a welcome message, and contact you about your account.
• Country, state or region, and city — for language and regional defaults, and to understand where ICIDO is used, in aggregate.
• Preferred language — so we write to you in your language.

Everything else is optional and clearly marked as such. You may skip all of it, and you can change or remove it later at any time:

• User type, intended uses, and goals for using ICIDO
• Mobility preferences — as preferences only, never a diagnosis
• Community participation, beta testing, and newsletter choices
• Developer details and organization details, if you are joining in those capacities

The Data Collection Policy lists every field individually, with its purpose and how long it is kept.

What we never ask for

ICIDO does not request, and you should not send us, medical diagnoses, clinical records, disability certifications, or any special-category health information. Where registration asks about mobility, it asks only how you would like the app to behave — never why.

Security log

For any account, we keep a security and support log of account events: account created, email address confirmed, signed in, a place backed up, published, unpublished or deleted, profile or email preferences changed, consent accepted, password reset requested or completed, account deleted. Each entry records what happened, when, and the IP address the request came from. Every attempt to sign in with an email address is recorded too, whether or not it succeeded, with the address that was typed and the browser or app used. We use it to keep accounts secure, to diagnose problems you report, and to produce aggregate counts. It is not used for advertising or profiling, and it is not sold.

Consent records

When you create an account, on this website or in the ICIDO app, or sign in to one in the app, you accept the Terms of Service, this Privacy Policy and the Data Collection Policy: on this website by ticking them, in the app by turning on “I agree” before you sign in. We store which version you accepted and the moment you accepted it, and the IP address and the browser or app it came from: for this document, the identifier privacy-3.7. If your account hasn’t accepted the current version, for example because you made it in the app before 18 October 2026, there is no record of it until you accept it in the ICIDO app.

Email

If you register by email, we send a welcome email, and account-related messages such as email verification and password resets. Product news and newsletters are opt-in only, and every one carries an unsubscribe link. Turning off the newsletter never affects your account.

Where your data is stored, and for how long

Our server runs on Amazon Web Services in the United States (the us-east-1 region, in Virginia). Everything sent between the app and the server, and between your browser and this website, is encrypted in transit.

Backed-up places are stored as files on that server. They are kept outside the web server’s reach, under names that cannot be guessed, readable only by the software that serves them, and there is no address anywhere that lists them. A published place can be fetched only through its own code, which is 32 random bytes long and cannot be walked or enumerated. We do not currently encrypt these files at rest on the disk, and we would rather say so than claim a protection that is not there.

Account information is kept for as long as your account exists. Backed-up places are kept until you delete them. A place you delete from backup is recoverable for seven days and is then removed for good. When you delete your account, your account, your places and your consent records are erased at once. Copies in our nightly database backups are deleted within sixteen days. Security log entries are deleted after twelve months, and web server access logs are deleted after fourteen days. Anonymous aggregate counts that cannot identify you may remain in our totals.

Your locally stored maps are governed by your iPhone. If you use iCloud device backup, they may be included in your own encrypted Apple backup, under Apple’s control — that is separate from ICIDO backup and happens whether or not ICIDO backup is on.

Your rights

Whether you have an app account or a website account, you can at any time:

• Turn backup off, which deletes every place this iPhone sent us
• Delete a single place from backup, or unpublish a code
• Delete your account, from inside the app or from this website
• Stop sharing with paired devices, or remove a device you paired, in the app’s Settings → Paired devices
• See and correct everything in a website profile
• Change your communication preferences, including the newsletter
• Request a copy of your account data, by emailing us

Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA — including objecting to processing and lodging a complaint with your data protection authority. Write to us and we will help.

Sharing

We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers to operate the service — cloud hosting and email delivery — and they process data only on our instructions. Beyond that, we share information only if the law requires it.

Separately, you can share a place. You can export it as a .spacemap file through the standard iOS share sheet, which goes only where you send it; or you can publish it as a code, which anyone who sees the code can use. And once you pair a device, your iPhone shares where you are inside the place you are navigating — plus, if you turn it on, your GPS location, and, when you allow it, the place itself — directly with the devices you paired. All three are always started by you.

Children

ICIDO is not directed at children, and we do not knowingly create accounts for children under 13 (or the minimum age in your country). If you believe a child has registered, contact us and we will remove the account.

Changes

If this policy changes, the version, effective date and identifier at the top will change. If you have an account, the ICIDO app asks you to accept the new version, once on its Home screen and again the next time you share or publish a place. Nothing waits on your answer: scanning, navigating and sharing carry on either way.

Contact

Questions, requests, or complaints about privacy: Nader@schoolfablab.com

This document is written in plain language for clarity. It is not legal advice, and it has not been reviewed by a lawyer.