Your journal.
Your decisions.

Use Hoedex without an account, or save your journal to your account to restore it when you change phones. You decide what your friends can see.

Updated 18 October 2026

Hoedex is now available on the App Store.

Who operates Hoedex

David Santacruz operates Hoedex and is responsible for its handling of personal data. Contact [email protected] about privacy, access, correction or deletion requests. Our support page explains the controls available in the app.

The journal on your device

Encounters, dates, nicknames, notes and stamp positions are stored on your device. The map works offline and does not request your location. The app protects the local file and lets you lock access with Face ID, Touch ID or your device passcode on iPhone and iPad, and with your fingerprint, face or screen lock on Android. On Android, the journal is stored in the app's private storage and excluded from Google backups.

Without an account, your journal stays only on this device and is excluded from system backups. If you delete the app or change phones, those encounters are not restored automatically.

Your journal saved to your account

When you sign in, the app privately syncs your complete encounters: nationalities, nicknames, notes, dates and stamp positions. Achievements are calculated from those encounters. On another phone, sign in with the same account and provider to restore what has been saved. Apple and Google create separate accounts, even if you use the same email address.

You can keep using your journal offline. Pending changes are sent when the app reconnects; before changing phones, check the save status in Settings. Deletions sync too. If you make conflicting edits to the same encounter on two phones, both versions are kept for you to review.

The server stores your journal encrypted and only returns it to sessions signed in to your account. This copy is separate from your shared profile: hiding a field from friends does not remove it from your private journal. Encryption uses keys held by the service; it is not end-to-end encryption. App lock and appearance are configured separately on each phone.

An account for Friends

When you sign in with Apple or Google, the service verifies your identity and stores the identifier supplied by that provider. Hoedex does not store your Apple or Google email address, name or photo in your profile. You choose your own nickname and an avatar from the app.

The server stores your profile, privacy settings, sign-in sessions, requests, friendships and blocks. For Apple sign-in, it also stores an encrypted credential that allows the service to revoke authorisation when you delete your account.

Apple and Google process the data needed to provide their sign-in services. These providers have their own practices, even though Hoedex does not save those accounts' email addresses, names or photos in your profile. See Apple's privacy information and Google's privacy policy.

The Google Sign-In component included in Hoedex declares that it may process names, email addresses, phone numbers, coarse location and user identifiers for app functionality. It also declares user and device identifiers, other usage data and other data types for analytics of its service; other data types may also be used for app functionality. These categories are linked to the user and are not declared as used for advertising tracking across apps or websites.

Google explains that it may use the user identifier to manage authorisations and the IP address to estimate a general location and prevent fraud. This does not mean that the map requests access to your GPS location. See Google's information about sign-in data.

On Android, Google sign-in uses Android Credential Manager and Google Play services. Hoedex only receives the identity token that the server verifies. Android does not offer Sign in with Apple, so a journal saved with an Apple account can only be opened on iPhone and iPad.

What your friends can see

Your profile nickname and avatar are shown to friends and when exchanging requests. Everything else starts hidden. In Settings → Privacy, you can turn each of these on or off separately:

When you save an enabled option, the app sends those fields to the server to show them to all your accepted friends, including friends you accept later. This includes current and future encounters. The “View as a friend” preview shows the shared copy that has been saved.

Notes and other details may contain intimate information about you or other people. Review their content before sharing, and avoid including identifying details that those people do not want you to share.

Changing your mind

When you save a disabled option while online, that field is removed from the shared copy. If the connection fails, the app lets you know and keeps the last confirmed settings. Journal edits and deletions update your profile when they can be sent; you can retry using “Update shared content” in My profile.

Only accepted friends can view a profile. You can remove friends, block people and turn off new requests. Renewing your code makes the previous code unusable. None of these actions can erase screenshots or copies that someone has already made.

Reports and support

If you report a friend's shared content, the service stores the report identifier, your account identifier, the reported account identifier, your selected reason and a copy of the specific field that is still visible to you when the server records the report. A report does not include hidden profile fields or either person's private journal. The service operator can read that report to investigate and record a decision; it is not shared with other friends.

In the active database, reports become unavailable 90 days after submission and are deleted by the next service cleanup, which runs at startup and every five minutes. If either account starts account deletion, reports associated with that account are also deleted. The service can hide an account's shared content without deleting its private journal. Read the shared-content rules. Contact support to request a review of a decision.

If you email support, we receive your email address and the message and attachments you choose to send. These are used to respond to your request. Avoid sending passwords, access codes or your complete journal. Support and report information is linked to the requester and is not used for advertising tracking.

Signing out or deleting your account

Signing out hides that account's journal on the device, but keeps its local file, the copy in your account and what you have shared. Pending changes remain associated with that account and sync when you sign in again. Signing in with another account does not mix the journals.

In My profile → Delete account, you can delete your private journal, shared profile, friendships, requests and sessions from the server. Encounters on this phone are kept without an account, and you can delete them separately in Settings. You will no longer be able to restore the deleted account copy on another phone.

If Apple cannot complete revocation at that moment, the profile is hidden and the app lets you retry deletion. The service temporarily keeps what is needed to finish that process.

Hoedex Pro and the images you share

Hoedex Pro is unlocked with a one-time purchase handled by the App Store. The app checks your purchase entitlement through StoreKit on the device and lets you restore it with the same App Store account. Hoedex does not receive your payment card details or send transactions to its server. The App Store account used for the purchase is separate from the Apple or Google account used for your journal.

On Android, Hoedex Pro is a one-time purchase handled by Google Play. The app checks the purchase on the device with the Google Play Billing Library and lets you restore it with the same Google Play account. Hoedex does not receive payment details or send transactions to its server.

Insights, Rewind and shareable images are generated on the device. Images include totals, nationalities and the selected period; a one-day period can associate its totals with that day. They do not include nicknames, notes, account names or identifiers, or individual encounter dates. Review the preview before sharing. Sharing a passport collection includes all its pages.

Opening the share sheet creates protected temporary files that are excluded from system backups. The app attempts to remove them when the sheet closes and removes leftover files older than 24 hours when you next open Exports. You choose where to save or send the images. Copies you keep or share are controlled by the destination you choose; deleting the journal or account does not remove them.

The service and this website

Hoedex is hosted on a Hetzner server. Cloudflare handles DNS and HTTPS traffic. Communication with the API is encrypted in transit. The server also processes the fields you choose to share so it can show them to your friends.

Hoedex includes no advertising or advertising tracking tools. It does not use its own analytics to measure journal use. The Google sign-in component declares the analytics described above.

Analytics on this website is optional and separate from the app and your journal. Only if you choose Accept do we load Google Analytics 4 to measure visits and use of these pages. Google receives technical visit data and may store analytics cookies (_ga and _ga_*) in this browser for up to one year. The tag does not send notes, encounters or account data, and it excludes page URL query strings and fragments from measured page URLs. We do not enable advertising features in the tag. See Google’s privacy policy.

Before you accept, or if you reject, we do not load the Google tag or send data to Analytics. We save your choice in browser local storage for one year so we do not ask on every visit. You can change or withdraw it through Analytics preferences in the footer of any page. Withdrawal stops future sends and removes this website’s analytics cookies. Hosting and network providers may process technical connection information under their own terms.