Privacy Policy

Photos. If you allow photo access, or pick photos with your phone's photo picker, maplog reads only the location tag and the date of each photo to suggest places. The place is worked out on your phone from map data that ships with the app. Your photos and their coordinates are not uploaded.

Location. If you allow location access, maplog uses your position to suggest the country or city you are in. Only the place name is worked out, on your phone. Your coordinates are not stored by maplog and are not sent to us or to anyone else.

Google Maps Timeline. maplog cannot download Timeline from Google, and signing in with Google does not give us access to it. If you import Timeline, you export a file from Google Maps and choose it in maplog. The file is read on your phone to suggest places and is not uploaded.

Share cards and exports. Share cards and map exports are made on your phone and only go where you send them with your phone's share sheet.

Travel alerts are off until you turn them on. When they are on, maplog notices when you arrive somewhere that is not on your map yet and asks if you want to add it. To do this while the app is closed, maplog needs location access set to Always (Allow all the time on Android), and your phone's operating system wakes the app in the background when you have moved a long way. maplog asks for low-accuracy location (city scale) and sets a geofence of about 15 km around your last position, so the operating system can tell it when you leave that area.

Each position is checked on your phone against the map data inside the app. The coordinates are never stored by maplog and never uploaded. To decide what is new, maplog keeps a small file on your phone with the places already on your map, and a list of places you were already asked about, so it does not ask twice.

Notifications are local: your phone creates them itself. maplog does not use push notifications and does not register your device with a push service. If notifications are off, new places show as a popup when you open the app.

A place is only added to your map if you tap Add. You can turn travel alerts off in Settings in maplog, or remove location or notification access in your phone's settings.

Guest account. When you first open maplog, it creates a guest account for you. A guest account has a random identifier and no name, email, or phone number. Your map is stored under that identifier. Because it is not linked to you, a guest map cannot be recovered if you delete the app or lose your phone.

Backup with Apple or Google. If you back up your map with Sign in with Apple or Google, we receive the details needed to sign you in: an account identifier from Apple or Google, your email address (with Apple this can be a private relay address), and, when the provider shares them, your name and profile picture link. We use these only to sign you in, show your account in the app, sync your map across devices, and email you a code when you delete your account.

Your map. For each place you add: the kind of place (country, region, or city), its code and name, the country it belongs to, its status (visited), how many of your photos or Timeline visits matched it, and the first and last visit dates found.

Profile picture. If you choose a profile picture in the app, we store that one image, cropped square and reduced to 512 × 512 pixels, in private storage that only your account can read, so it shows on your other devices. Nobody else sees it. Changing or removing it deletes the previous image, and deleting your account deletes it too.

Photo links. When a photo scan matches a photo to a place, we store the photo's library identifier and the date it was taken, so the country page can show your own photos. The identifier only works inside the photo library on your phone. No image, thumbnail, or location from the photo is stored.

Import records. After a photo scan we store how many photos were scanned, how many countries were found, and the date of the newest photo, so the next scan can read only photos added since.

App use. When your account was created, how many times you have opened the app, and whether you have seen or dismissed the prompt to back up your map.

Your app settings (such as map theme, units, and which country list you use), the place cache, and changes waiting to sync are kept on your phone.

Supabase hosts our database and sign-in, and stores the data described under What we store. The database runs on Amazon Web Services in the United States (Northern California).

Cloudflare Turnstile. When maplog creates a guest account, it runs a Cloudflare Turnstile check in the background to confirm the request comes from a real device and not from an automated script. There is nothing to solve. Cloudflare processes technical information from your device for this check, such as your IP address and browser characteristics, under the Turnstile privacy addendum. Our sign-in service only receives a token that says whether the check passed.

RevenueCat. The maplog pro upgrade is a one-time purchase through the App Store or Google Play. We use RevenueCat to check the purchase and unlock maplog pro on your devices. RevenueCat receives your maplog account identifier, the purchase details from the store, and basic device information such as platform and app version. It does not receive your map, photos, location, name, or email. Apple or Google handles payment; we never see your card details.

Sentry (crash reports). When maplog crashes or hits an error, the app sends a crash report to Sentry: what went wrong in the code, the app version, your phone's model and operating system, and the last few taps and network requests before the problem. Reports do not include your name, email, account, map, photos, or location, and Sentry is set not to store IP addresses. Reports are stored in the EU and deleted after 30 days.

PostHog (usage statistics). maplog counts how the app is used with PostHog, for example which screens are opened and whether steps like finishing setup or sharing a map happen. Each install gets a random identifier that is not linked to your maplog account. No names, emails, map contents, photos, or locations are sent, there are no recordings of your screen, and PostHog discards IP addresses. Data is stored in the EU and deleted after one year.

Apple and Google handle sign-in when you choose them, under their own privacy policies. Signing in with Google does not give us access to your Google Maps Timeline, Gmail, contacts, calendar, Drive files, or other Google account content.

Website analytics (maplog.app only). Our website counts visits with DataFast in its cookieless mode: no cookies, no cross-site tracking, and visitor identifiers that reset daily. It records the page, the referring site, and the country and device type worked out from the request. The website also uses Google Analytics in Consent Mode, with advertising features and ad signals turned off. In the European Economic Area, the UK, and Switzerland, Google Analytics sets no cookies unless you accept the cookie banner; until then it only receives cookieless signals (such as the page viewed and basic browser information) that Google uses to estimate visits in aggregate. Elsewhere it sets analytics cookies by default. You can accept or decline anytime under Cookie settings at the bottom of every page. Neither runs in the app. When you tap the App Store badge, the link tells Apple which kind of site sent you (for example "web-google"), so App Store Connect can show us downloads per source in aggregate; nothing is stored on your device.

Sales figures. When someone buys or refunds maplog pro, our server tells DataFast the price in US dollars, the time, and a scrambled purchase reference, so we can see sales next to website visits. DataFast does not receive your maplog account, email, device, location, or the store's own purchase details.

Map tiles. The world map ships inside the app. When you zoom in further while online, maplog downloads the extra map detail from tiles.maplog.app, which Cloudflare hosts for us. Like any web request, this shows Cloudflare your IP address and which part of the map you are looking at. It does not include your location.

We keep your account and map until you delete them. Guest accounts that are more than 30 days old, have no places on the map, and haven't opened maplog in the last 30 days are deleted automatically.

To delete your account, open Settings in maplog, then Account & data, then Delete account. On iPhone and iPad, if you signed in with Apple, maplog asks you to confirm with Apple and then tells Apple to remove maplog's access to your Apple Account. On Android, you can remove that access yourself under Sign in with Apple in your Apple Account settings. Deletion removes your sign-in, your map, photo links, import records, and app use data from our database straight away. maplog then clears the copies on your phone, turns off travel alerts, and starts a new, empty guest map.

Deletion also removes your customer record at RevenueCat. Apple or Google keeps its own record of the maplog pro purchase, so you can still restore it with Restore purchases.

Deleted data can remain in our database provider's routine backups for a short time until those backups are replaced. It is not used or restored from there.

Before deleting, you can save a copy of your map with Export my map in Settings.

Crash reports are deleted after 30 days and usage statistics after one year. Usage statistics are not linked to your account, so deleting your account does not find them; turning off Share anonymous usage data stops any more from being sent.