Privacy Policy

Clio: City History Walks · Last updated October 16, 2026

Clio is a location-based audio narrator: you walk, and an AI voice tells you the history of the places around you. Providing that experience requires processing your location and, if you speak to the narrator, your voice. We also collect limited usage events to improve the app. This page explains what happens to this data.

Who is responsible

The data controller is Octavian Cristea, Romania. Contact: c.z.tavi@gmail.com.

What we collect and why

• Precise location (GPS): used to find the place you're in, research its history, and trigger narration as you move. Sent to our server only while you use the app.
• Voice audio: only when you unmute the microphone to talk to the narrator. Processed in real time to understand what you said.
• Conversation content: the narration session (what was narrated, your questions) exists in memory for the duration of your session and is discarded when the session ends.
• Photos you choose are read on your device. Clio can use the photo’s GPS coordinates separately to suggest nearby places and bias manual place search. Nearby places are not identification of what the image shows. Visual identification is a separate, optional choice, off until you enable it in the photo flow or Account. It sends a resized JPEG through Clio to Anthropic (Claude) to identify visible landmarks, even when a photo already has GPS. Source GPS and camera metadata are stripped from the image; GPS is used separately by Clio and place search and is not sent in the image prompt. Your previous missing-location choice does not enable this new feature. You can continue with manual search. Turning identification off stops pending work, but cannot undo an image already sent. Enabling it in Account applies to the next new photo selection. AI suggestions may be wrong and require your confirmation. Older versions, including build 19, ask for separate confirmation for each attempt before sending a resized JPEG through Clio to Anthropic (Claude). Clio processes uploads in request memory and does not keep a saved copy. Anthropic processes images under its applicable terms and retention policies. We do not promise zero provider retention. You can always search manually instead. You must confirm a suggested place before a story is made. When you share a fact card, the card goes to whichever app you pick, not through us.
• App usage: after you accept the app's data disclosure, we collect feature actions, connection outcomes, estimated listening time, and app/OS versions. A random installation ID connects repeat walks from the same installation. Usage events do not contain location coordinates, location grid cells, place names, voice recordings, or conversation text.

Clio has no user accounts, shows no ads, and does not sell or share data for advertising or tracking across other companies' apps and websites.

Services that process your data

Clio is powered by third-party AI and infrastructure services. During a session, data is shared with:

• LiveKit: carries the mobile app's live audio and session messages between your device and our voice agent. Their privacy policy.
• Deepgram: converts your speech to text when you unmute the microphone in the mobile app. Their privacy policy.
• Cartesia: converts the mobile narrator's responses to audio. Receives the text to be spoken. Their privacy policy.
• ElevenLabs (US): runs the web preview's conversational voice agent. Receives location context and your voice when you speak in the web preview. Their privacy policy.
• Anthropic (Claude) (US) prepares research and photo stories and generates the narrator's conversational answers. It receives location-derived research material, questions and transcribed speech. When you enable visual identification, it also receives a resized selected photo, including photos with GPS. GPS is not sent in the image prompt. Clio is an AI narrator built on Claude by Anthropic. Their privacy policy.
• Exa (US) researches places using web search. It receives place names and research queries derived from your location, never your identity. Their privacy policy.
• Firecrawl (US): performs web searches about the place you're in. Receives place names derived from your location, never your identity. Their privacy policy.
• Anara (US) keeps a cache of research results about places, never about people, so a place someone has already asked about can be told again quickly. Receives place names derived from a location, never your identity.
• Mapbox (US): renders the map in the app. Their privacy policy.
• OpenStreetMap / Nominatim: converts coordinates to place names. Their privacy policy.
• Vercel and Railway: host our website and backend services.
• PostHog (US region): processes app usage events to help us understand feature use, connection failures, and repeat walks. Screen recordings and automatic location enrichment are disabled. Their privacy policy.

Retention

Our own servers keep session data in memory only: it is deleted when your session ends or shortly after. We do not retain databases of conversations. If you opt in to Walk diagnostics, we separately store walk location records as described below. Third-party providers retain data according to their own policies linked above.

Usage events are retained separately in PostHog according to the project's configured retention period. The random installation ID remains on your device across app restarts. It is not a user account.

Walk diagnostics (optional beta)

Tester builds offer a separate opt-in for Walk diagnostics. With your consent, Clio records precise GPS points, timestamps, accuracy and operational events only during walks you explicitly start with Play, including while your iPhone is locked or Clio is in the background. iOS displays its location indicator. Records are stored on your iPhone for up to 14 days and uploaded to Clio's server for up to 30 days under a random diagnostics ID, without your name or email. Uploaded records may be removed from the phone earlier. These diagnostics are not shared with PostHog or AI providers. Recording stops when you stop the walk, turn off diagnostics, lose location permission, reach four hours, or the app is closed by iOS or force-quit. Clio never automatically resumes it. Account settings let you turn diagnostics off, share a route export or delete your walk data. Turning diagnostics off stops recording and record uploads; deletion requests retry when a connection is available. Minimal deletion markers contain no route coordinates and prevent old queued records from being uploaded again.

AI-generated content

The narration is generated by AI. It is storytelling grounded in real research, but it can contain inaccuracies: treat it as a companion, not an authoritative historical record.

Your rights

Under the GDPR you have the right to access, correct, delete, or object to the processing of your personal data, and to lodge a complaint with your supervisory authority (in Romania, the ANSPDCP). Write to c.z.tavi@gmail.com about your data, including usage analytics.

Changes

If this policy changes materially, the app will show the disclosure screen again before any data is shared under the new terms.