Privacy policy
Draft · Last updated October 26, 2026 · Florence Care Inc.
Wave is an accessibility map of San Francisco made by Florence Care Inc. (“we”). This policy covers the Wave iPhone app, this website (wave.florence.care) and the Wave waitlist on florence.care/wave.
What we collect
- Photos you post of entrances and street barriers, with the tags, category and note you add. The app re-saves each photo before uploading it, which removes its location and camera details (only size and orientation remain); it reads the photo’s date first to show how recent it is. Where the website lets you post (signed in, entrance photos you choose from your device), your browser does the same: it reads the photo’s date, then re-saves the photo before uploading it, so its location and camera details never leave your device. An entrance post from the website doesn’t use your location; the place you post it on is its location. Posting a street barrier from the website (from a phone’s browser, with a photo you take then) asks your browser for your precise location right after you take the photo. We send that location and how accurate it is with the report and store it as for a post from the app: where the photo was taken is kept to prevent fake reports and isn’t shown to others; the pin you choose is public. The website doesn’t read your location for posting otherwise.
- Places you add. If you add a place that isn’t on the map (on the website), we store its name, kind and the pin you place with your account. The pin starts where your browser says you are; that reading isn’t sent, only the pin you confirm. The name, kind and pin are public once the place’s entrance photo is posted. If you delete your account, the places you added are no longer linked to you. Such a place is public only while it has a live entrance photo from someone else; otherwise it’s hidden, with its name, kind and pin kept, and a later photo from someone else can make it public again.
- Your location, while the app is open. To show the map and nearby places, and to search, the app sends your precise location to our servers. We store it only with a report you post: the spot the report is about, and where your phone was when you took the photo and how accurate that reading was (to prevent fake reports). The app never tracks your location in the background.
- Your location on this website. When you open the map, your browser may ask to share your location. If you allow it, the map starts there; that location stays in your browser and isn’t sent to us (a street barrier post, above, is the one exception), though the map then asks our servers for the reports in that area, as it does for any area you look at. If you’re signed in, the needs you choose on your profile (for example a wheelchair, a cane or a stroller) are kept in your browser too and never sent to us. The website’s map shows every place whatever your needs, so they don’t change what it asks our servers for.
- Your account: a sign-in identifier (an anonymous account, or your Apple ID if you sign in with Apple; we don’t ask Apple for your name or email; or your Google account if you sign in with Google on the website; or your phone number if you sign in with it on the website), your handle, your points, and the posts, confirmations, flags and blocks you make. Our sign-in provider (Google Firebase) records when your account was created and when you last signed in; we use those times only as totals, for example how many people came back after a week. If you sign in with Google, Google shares your account ID, name, email address and profile photo with Firebase, which keeps them with your sign-in record until your account is deleted; Wave’s own database doesn’t store them, and the only one we use is the email address, to check it against the waitlist when you post from the website (see Waitlist).
- Your phone number, if you sign in with it on the website. Google Firebase, our sign-in provider, texts a one-time code to the number you enter and keeps the number with your sign-in record until your account is deleted. Google also keeps the number you enter to fight spam and abuse across its own services. Wave’s own database doesn’t store it; it travels inside the sign-in token your browser sends with each request, which our servers check to know it’s you, and we don’t use it for anything else: we never text or call you, and we don’t share or sell it. Before a code is sent, Google reCAPTCHA checks the request (see below). Texts cost us money, so we count how many sign-in codes the website sends each day (a total only, with no numbers in it); the count is deleted after about two days. Phone carriers reassign numbers: if you give up your number, delete your Wave account first (or email us), because whoever gets the number next could sign in to it.
- Signing in on the website. When you sign in at wave.florence.care, your browser keeps a sign-in token in its own storage (IndexedDB) so you stay signed in, until you sign out. The sign-in code comes from Google Firebase and only loads on the sign-in page or once you’ve signed in in that browser, so Google sees your IP address then; visitors who never sign in don’t load it. If you sign in with a phone number, your browser loads Google reCAPTCHA on that step, which sends Google signals about your device and sets a security cookie, to check that the request comes from a person before a code is texted. Apart from that cookie the website sets no cookies, and it uses no analytics or advertising trackers. Signed in, the website shows your posts and lets you report or block posts, delete your posts, unblock everyone, or delete your account; your blocks apply on the website as in the app. A route you ask for while signed in counts against an hourly limit on your account; the count is kept for about two days and holds no locations.
- Your profile on this website. You can change your handle there; your new handle replaces the old one on the leaderboard. Your profile shows the email address your sign-in provider gave us (Google shares one; Apple doesn’t, because we don’t ask), read in your browser from your sign-in record. It also travels inside the sign-in token your browser sends with each request, which our servers check to know it’s you; Wave’s database doesn’t store it, and its only other use is the waitlist check (see Waitlist). The look you pick for your character and the looks you’ve unlocked are kept in your browser, not sent to us.
- Your needs (how you get around, e.g. wheelchair or stroller) and your route settings are saved only on your phone. If you say yes to coloring hills for your mobility type, the app sends that type (for example “power wheelchair”) with each hill-map request so we can pick the right slope limits; we don’t save it, log it or tie it to your account. If you say no, nothing about your needs is sent for hills.
- Step-free routes (beta, for invited testers). When you ask for a route, the app sends the start and end points and your route settings (your mobility type, whether a step is OK, the narrowest path you can use). We don’t save the route or these settings with your account, but they are part of the request address, so they appear in our server request logs (see below).
- Server request logs. Like most websites, our servers log each request: the address requested (which can include map areas, your location for nearby places, what you typed in search, or a route’s end points and your route settings, including your mobility type), your IP address, browser or app version, and the time. These logs are kept for 30 days, aren’t tied to your account, and are used to run and secure Wave.
- Spam limits. To limit spam from accounts that aren’t verified yet, we count recent posts, votes and flags per network using a scrambled code made from your IP address. These counters aren’t deleted automatically yet.
We don’t use advertising tools or analytics of our own, and the website doesn’t set cookies of its own (Google reCAPTCHA sets one on the phone sign-in step, above). The Mapbox map in the app does send Mapbox its own usage data unless you turn it off (see “Who processes your data”).
Keeping Wave safe
Photos are checked automatically by Google Cloud Vision before they appear. A photo it flags is held, not published, until a person on our team reviews it. Notes and handles are checked against a list of offensive words. Flagged reports, held photos and new blocks send our team an alert containing the report or account ID, the reason, and for a block from the leaderboard the person’s public handle, nothing else. If you block someone, only you stop seeing their posts; they aren’t told.
What is public
Your posts: the photo, tags or category, location, date and note. Posts don’t show your handle. Your handle and points appear on the leaderboard. Please avoid faces and license plates in photos. When a newer post replaces yours as a place’s entrance photo, a small copy of yours stays visible on that place as an earlier photo for 12 months from its date, without your name or handle.
Waitlist
If you join the waitlist on florence.care/wave, we store your email address and the time you signed up. We use it to tell you when Wave opens near you, and to decide who can post from the website: posting from the website is for addresses we’ve approved, so when you’re signed in with Google, we check whether your Google email address is an approved one when the website loads your profile and each time you post. It is never sold or shared. A signup that hasn’t been approved is deleted within 13 months of signup, or sooner if you ask (info@florence.care). Once you’re approved to post from the website, we keep your address and when it was approved while that access lasts, until you ask us to delete it, which ends posting from the website. Deleting your Wave account doesn’t delete your signup, because you made it separately on florence.care; ask and we delete both. Deleted addresses also leave our database backups within 8 days. To block spam, florence.care, which runs the signup page, keeps a scrambled form of your IP address for up to 48 hours. The page on florence.care/wave counts visits with Plausible Analytics, which uses no cookies and doesn’t store your IP address or anything that identifies you; it records only totals such as page views, the referring site and your country. The Wave map at wave.florence.care doesn’t use it.
Invite codes
We sometimes hand out invite codes in person, for example at community events, so people can post from the website without waiting for the waitlist. If you use one, we record which code you used (and so which event or group you got it from) and when, with your Wave account. We use that to let you post from the website and to review posts that came through a code, for example if a code is misused. We keep it while your account exists and delete it with your account. The code isn’t sold or shared. To stop guessing, we count failed tries for an hour per account and per network (using the scrambled code made from your IP address), and delete those counts within about two days. An invite link keeps the code after a # sign, which browsers don’t send to our servers; if you type a code into an address instead, it’s in our server request logs (see above).
Who processes your data
- Google Cloud and Google Firebase host Wave: the database, photo storage, sign-in (in the app and on the website), photo checks and server logs. Google also handles Sign in with Google on the website, sign-in by text message (it sends the code) and the reCAPTCHA check on the phone sign-in step.
- Mapbox draws the map in the app and on this website. Your phone or browser asks Mapbox for the map of the area you’re looking at, so Mapbox receives your IP address and that area. The Mapbox map also sends Mapbox de-identified location and usage data (“Mapbox Telemetry”) to improve its maps; you can turn this off with the ⓘ button in the corner of the map. See Mapbox’s privacy policy.
- Expo delivers app updates; when the app checks for an update, Expo receives your IP address, the app version and your phone’s platform.
- Apple handles Sign in with Apple, and TestFlight crash reports if you choose to share them.
- Slack carries our team’s moderation alerts (IDs, the reason and public handles only).
On this website, step-free directions send your start and destination to our servers only when you ask for a route, and they aren’t stored. If you tap Directions or “File with SF 311”, the app opens Apple Maps, Google Maps or the City’s 311 site with that location; their own privacy policies apply. We don’t sell your data or use it for advertising.
How long we keep it
- Posts stay on Wave until you delete them or your account, or until we remove them for breaking the terms. A deleted or removed post disappears from Wave at once and its photo is erased within about 3 days; the rest of its record (tags, note, location and the capture point) is kept, hidden, until your account is deleted.
- A held photo is kept until it has been reviewed.
- Server request logs: 30 days.
- Database backups: deleted data leaves our backups within 8 days.
Deleting your account
Delete your account in the app under Profile → menu → Settings → Delete account, or on the website under My posts → Delete account. Your posts, photos, points and account information are permanently deleted, normally within minutes (if a step fails it’s retried, and we aim to finish within 24 hours), and they leave our backups within 8 days after that. Two things stay, holding only Wave’s internal ID for your account: a record that the deletion was carried out (with your sign-in ID), and, on other people’s points history, a note that a confirmation from your account earned them points. Nothing you posted stays. If you signed in with Apple, the app or the website also asks Apple to stop Wave’s access to your Apple ID. You can delete a single post on the website under My posts. You can also email us to ask what we hold about you or to delete it.
Children
Wave isn’t meant for children under 13, and we don’t knowingly collect their information.
Changes
If we change this policy, we’ll update the date above and describe significant changes on this page.