Privacy Policy

1. Personal data we collect

At sign-up (required)

• Email address
• Nickname
• Date of birth — for age-policy enforcement

While using the service (collected automatically)

• IP address, device/browser information, access logs
• Cookies and similar technologies
• Anonymous usage stats (page views, country, device) via Vercel Analytics
• Error diagnostics via Sentry

When creating content

• Posts (text, photos, videos), comments, replies
• GPS coordinates — used only when you explicitly grant location permission
• Likes, bookmarks, follows (people and regions)
• Direct messages (DM) — only senders/recipients can read (enforced by row-level security)

Profile (optional)

• Avatar, bio, home region (administrative levels L1/L2)
• Push notification subscription tokens

When using social login (Google OAuth)

• Google account email and name
• OAuth tokens

2. Purposes and legal bases (for GDPR-covered users)

• Providing the service (account, posts, comments, DM, notifications) — Legal basis: Contract performance (GDPR 6(1)(b))
• Authentication, fraud prevention, security — Legal basis: Legitimate interest (GDPR 6(1)(f))
• Location-based content (GPS coordinates) — Legal basis: Your explicit consent (GDPR 6(1)(a))
• Service analytics and improvement — Legal basis: Legitimate interest (GDPR 6(1)(f)); opt-out available
• Push notifications — Legal basis: Your consent (browser permission + in-app setting)
• Legal compliance (handling reports, cooperating with law enforcement) — Legal basis: Legal obligation (GDPR 6(1)(c))

3. Third-party processors

We rely on the following processors to operate the service. Each is bound by a Data Processing Agreement (DPA) and, where applicable, EU Standard Contractual Clauses (SCC).

• Supabase Inc. (USA) — database, authentication, file storage
• Vercel Inc. (USA) — hosting, analytics (Vercel Analytics, Speed Insights)
• Cloudflare Inc. (USA) — video storage and delivery (Cloudflare Stream)
• Resend Inc. (USA) — transactional email (magic links, admin notifications)
• Functional Software, Inc. dba Sentry (USA) — error tracking
• Google LLC (USA) — social login (only when used)

4. International data transfers

Data may be stored on the servers of the above providers (primarily in the USA and EU). When personal data of EU/EEA residents is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCC) or applicable adequacy decisions to ensure an equivalent level of protection.

5. Retention and deletion

• Account data: retained while your account is active; deleted promptly upon account-deletion request
• Content (posts, comments, media): deleted when you delete your account (anonymized fragments may remain to preserve conversational context)
• Direct messages: deleted on either side's account deletion
• Data subject to legal retention obligations: kept securely for the required period, then deleted
• Backups: automatically expire within 90 days under our backup rotation

6. Your rights

Universal rights

• Access: see the data we hold about you
• Rectification: correct inaccurate data
• Erasure (right to be forgotten): request deletion of your data (subject to required processing exceptions)
• Restriction: pause specific processing
• Objection: object to processing based on legitimate interest
• Portability: receive your data in a structured format (GDPR)

EU/EEA residents (GDPR) — additional

• Right not to be subject to solely automated decisions (including profiling)
• Right to lodge a complaint with your local data protection authority

California residents (CCPA/CPRA) — additional

• Right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising.
• Right not to be discriminated against for exercising your rights
• Right to know what categories of personal information we collect and process

South Korean residents (PIPA) — additional

• Right to demand suspension of processing of personal data
• Right to appeal denials and to file mediation with the Personal Information Dispute Mediation Committee

We respond to rights requests within 30 business days via the contact below.

7. Protection of minors

Mapnews.app sets a worldwide minimum age of 16. Even where local law allows a lower threshold (Korea 14, EU 13–16 depending on member state, United States 13), users under 16 are not permitted to register for the Service.

We collect date of birth at sign-up to enforce this. Accounts and data found to belong to users under 16 will be deleted promptly.

8. Cookies and tracking

• Essential cookies: maintain login session, store country/language preference. Required for the service to function.
• Analytics cookies: Vercel Analytics (anonymous aggregates of page views, device, country). For EU residents, enabled only after explicit consent (cookie banner rollout planned).
• Tracking/advertising cookies: not used.

You can refuse cookies via your browser settings, but blocking essential cookies may break login and other features.

9. Security measures

• TLS encryption in transit (HTTPS)
• Row-Level Security (RLS) ensures users can only access their own data
• Secure password hashing (Supabase Auth)
• Regular security updates and dependency audits
• Anomaly monitoring via error tracking

No system can guarantee absolute security; we cannot warrant the security of transmissions over the public internet.

10. Policy changes

We may update this policy due to legal or service changes. Material changes will be notified in-app or by email. Continued use after such notice constitutes acceptance of the updated policy.

11. Contact and complaints

For privacy inquiries, rights requests, and complaints: contact@mapnews.app (response within 30 business days).

EU/EEA residents may lodge complaints with their local data protection authority. South Korean residents may file with the Personal Information Dispute Mediation Committee or the Personal Information Protection Commission. California residents may contact the California Attorney General's office.