MapCrumbs
Privacy Policy
This policy explains what MapCrumbs does with personal data. It applies to the mobile app MapCrumbs - Travel Diary (iOS, and Android on Google Play as app.mapcrumbs) and to the private share links the app creates.
The app is a free travel diary. You can mark cities you have visited, save favourite spots as Crumbs, add notes and photos, look back at a timeline, and share a trip or a map with a private link. There is no public feed.
Who is responsible
The data controller is Michael Ganchas, an individual in Portugal. Portugal is in the European Union, so the GDPR applies.
Contact: mapcrumbs.contact@gmail.com.
There is no separate data-protection officer. Write to that address for privacy requests, including access and export. To delete an account, use the delete option in the app’s settings or profile, or follow the account deletion page.
Account and identity
The app signs you in with Firebase Authentication when it opens. The first session is anonymous, so a diary can be saved before you add a login. You can also sign in with Google, email, phone, or Sign in with Apple on iOS.
Depending on the method you use, Firebase stores:
- a user id
- email address, if you use email or Google, or if Apple provides one (Apple can provide a private relay address)
- phone number, if you use phone sign-in
- the name and profile photo from your Google account, if you use Google
We use this to tell your diary apart from other people’s, to keep you signed in, and to answer a support or deletion request. We do not use a separate MapCrumbs password store for Google, Apple, or phone sign-in. Those providers check the login.
Diary content
When you use the diary, we store what you save, against your user id:
- cities you have visited or marked, including city name, country, map coordinates, visit dates, and notes
- Crumbs (saved places): name, category, coordinates, notes, whether you marked it as a favourite, and similar place details you enter
- photos you attach to a Crumb or a city visit, and metadata such as size and order (the store listing allows up to 10 photos on each)
- categories you create
- suggestions computed from your map, such as a traveller profile stored on your account
A saved place can also include a phone number for that place, if one is stored with it. That is the place’s number, not your account phone number.
City and place records, visit notes, and photo metadata are stored in Supabase. Photo files you upload are stored in cloud file storage. We have confirmed user-photo files in Supabase Storage. The app is also set up to use Firebase Storage; treat both as places a photo may live until a deletion request removes the copies we can find.
The app also uses Cloud Firestore and Cloud Functions for account and app features that are not in the Supabase diary tables (for example sign-in support and other account data). We could not re-read the app source while writing this policy, so this page does not invent a field-by-field list for Firestore.
Location, camera, photos, and notifications
The app asks for these device permissions. You can refuse them. Refusing a permission limits the feature that needs it. The operating system, not MapCrumbs, shows the permission prompt.
- Precise and approximate location. Used while you are using the app, to show where you are and to help you save a place. We do not describe background location tracking. Turn location off in system settings at any time.
- Camera. Used when you take a photo for a Crumb or a visit.
- Photo library. Used when you attach an existing photo.
- Notifications. If you allow them, Firebase Cloud Messaging stores a push token for your install so the app can send a notification. Turn notifications off in system settings to stop that.
The app does not ask for access to your contacts, and it does not read or upload your address book.
Private sharing, crew, and backup
You can share a Crumb, a city, or a trip with a private link. The link is not a public profile. The link itself carries a preview so the recipient can see what was shared: for a Crumb or a city, that can include the name, area, map coordinates, an optional note, and an optional display name. Anyone who has the link can read that preview. Send it only to people you trust. If you share a journey invite, the link can also carry an id for that invite.
The app may also let you back up your diary, or share a trip with a crew of people you choose. We could not find separate crew or backup tables in the diary database. If you use those features, they use the diary content you include, for the people you invite or for the restore you ask for. They do not publish you to a public feed.
Hotel search and booking
Hotel search and booking is provided by Nuitée Travel Limited (LiteAPI), a company in Ireland. When you book, LiteAPI receives the guest name and email address needed to make the reservation, and the stay details (hotel, dates, and price).
We keep a booking record on your account: hotel, city, dates, status, price, and confirmation details. The MapCrumbs booking table has no column for a card number. The booking partner processes payment. We do not sell hotel bookings as advertising.
Read their policy at liteapi.travel/privacy.
Advertising
The app shows ads with Google AdMob. AdMob can use your device’s advertising ID (IDFA on iOS, the advertising ID on Android), your IP address, and similar technical data to choose an ad, limit how often you see it, measure it, and reduce fraud. Your notes, photos, and city list are not sold to advertisers and are not used as the profile for those ads.
Personalized ads use the advertising ID to pick ads from your interests and activity across apps. Non-personalized ads are not based on that kind of profile. They can still use context, such as coarse location, and Google may still use the advertising ID to cap frequency, to produce aggregated reports, and to fight fraud. See Google’s privacy policy and AdMob’s policies.
In the European Economic Area, the United Kingdom, and Switzerland, where a consent choice is required, the app asks through Google’s User Messaging Platform (UMP) before it uses the advertising ID for personalized ads. If you agree, ads can be personalized. If you refuse, ads are requested as non-personalized. You can change that choice when the consent message is shown again.
You can also opt out on the device. Menu names vary slightly by version.
- iPhone: Settings → Privacy & Security → Tracking, then turn off tracking for MapCrumbs, or turn off “Allow Apps to Request to Track”. The advertising ID is then unavailable and ads are not personalized.
- Android: Settings → Privacy → Ads, then delete the advertising ID or opt out of ad personalization. A deleted advertising ID is sent as zeros, and ads are not personalized.
Diagnostics, analytics, and app configuration
We use these Google Firebase services, and Sentry, to run and improve the app:
- Firebase Analytics — to see which parts of the app are used, in aggregate. This can include an app instance id and device data.
- Firebase Remote Config — to deliver app settings to an install.
- Firebase App Check — to make it harder for unauthorised clients to call the backend. This uses an attestation from Apple or Google, not your diary.
- Sentry — for crash and error reports. A report can include device model, operating system, app version, and an error trace. It is not meant to include your diary notes or photos. We could not re-check whether a report also includes an IP address or user id.
Google Maps is used to show the map. Use of the map sends technical data such as coordinates you ask the map to display to Google, under Google’s privacy policy.
City descriptions and spoken city stories in the catalogue are about the place, not your account. Preparing that catalogue has used DeepSeek, Google (including Gemini and WaveNet text-to-speech), and Qwen. Those jobs are not your private diary.
Who we share data with
We do not sell your personal data. We share it with processors who host or support the app, and with a booking partner when you book a hotel. Each processor is limited to the job described here. Their own policies apply as well.
- Google Privacy Policy — covers Firebase Authentication, Firestore, Cloud Functions, Cloud Storage, Analytics, Remote Config, Cloud Messaging, App Check, Google Maps, and AdMob. See also Firebase privacy and security.
- Supabase privacy policy — diary records (places, city visits, photo metadata) and related files. The MapCrumbs database project is hosted in London, United Kingdom (eu-west-2).
- Sentry privacy policy — crash and error reports.
- Apple privacy policy — Sign in with Apple, and Apple push or device checks when you use an iPhone.
- Nuitée Travel Limited (LiteAPI) — hotel search and booking, including guest name and email when you book.
A private share link is a disclosure you make by sending the link. We do not control what the recipient does with it.
We may also disclose data if the law requires it, or to protect you, other people, or the service against abuse or a legal claim.
Why we are allowed to do this (GDPR)
- Contract (Article 6(1)(b)). Providing the diary you ask for: account, cities, Crumbs, notes, photos, sync, private share links, notifications you allow, and a hotel booking you request.
- Legitimate interests (Article 6(1)(f)). Keeping the app reliable and secure (crash reports, App Check, abuse prevention) and understanding which features are used. These interests are overridden where your privacy should come first. You can object. Where analytics or advertising identifiers need consent under ePrivacy rules, we do not treat legitimate interests as a substitute for that consent.
- Consent (Article 6(1)(a), and ePrivacy rules for identifiers on the device). Device permissions you grant (location, camera, photos, notifications). Personalized ads, and storing or reading the advertising ID where consent is required, rely on the choice you make in Google’s UMP message. You can withdraw that choice when the message is shown again, and you can opt out in device ad settings. Refusing personalization does not turn ads off; it switches them to non-personalized ads.
- Legal obligation (Article 6(1)(c)). Keeping hotel booking records where tax, accounting, or a legal claim requires it.
How long we keep it
We keep account and diary data for as long as the account exists. When you delete the account, or we verify a deletion email, we delete that data from active systems without undue delay and aim to finish within 30 days.
Exceptions:
- Hotel booking records are kept after account deletion so a stay, cancellation, refund, dispute, or tax and accounting duty can still be handled. In Portugal, accounting records of a paid transaction are generally kept for up to 10 years. We have not found an automatic purge of these rows, so that is the outside period we will apply.
- Backups held by the hosting providers can keep a residual copy until the backup expires. We do not use backup copies to run the app after a deletion.
- Crash reports already sent to Sentry are deleted if we can match them to you. A report that has no user id may remain until Sentry’s own retention removes it.
- A share link you already sent cannot be pulled back from someone else’s device.
- Catalogue content about a city (stock photos, city stories, map reference data) is not your account and is not deleted when you delete yours.
Anonymous accounts are covered on the deletion page. Uninstalling the app removes it from the device. It does not, by itself, erase diary data already stored under that anonymous user id.
International transfers
Michael Ganchas is in Portugal. The Supabase project that holds the diary database is in London, United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom.
Google (Firebase, Maps, and AdMob), Sentry, and Apple can process data in the United States and in other countries where they operate. Nuitée Travel Limited processes booking data in Ireland, and its own providers may be elsewhere. Where a country does not have an adequacy decision, those companies state that they use Standard Contractual Clauses or equivalent safeguards. We did not re-check a signed copy of each contract while writing this page.
We could not find a second Supabase project in the United States. We also could not confirm the Google Cloud region used by Firebase.
Your rights
If the GDPR applies to you, you can ask us to:
- Access the personal data we hold about you
- Correct data that is wrong
- Delete it, including by the steps on the account deletion page
- Export a copy in a common format (data portability)
- Restrict processing in the cases the GDPR allows
- Object to processing based on legitimate interests
- Withdraw consent where processing was based on consent, without affecting processing that happened before the withdrawal
Email mapcrumbs.contact@gmail.com from the email on the account, or include your user id. We may need to confirm that the request is yours. We reply within one month, unless the request is complex, in which case the GDPR allows an extension and we will tell you.
You can also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority where you live.
You can edit or delete individual cities, Crumbs, notes, and photos in the app. That does not close the account. To close it, use delete account in the app’s settings or profile. The deletion page also explains how to ask by email.
Children
MapCrumbs is a general travel diary. It is not directed at children under 13, or under 16 in the European Economic Area. We do not knowingly collect personal data from those children. If you are a parent or guardian and you believe a child has given us personal data, email us and we will delete it.
Security
Diary data is sent over encrypted connections. Supabase and Google encrypt stored data at rest. Access to your account depends on Firebase Authentication. Firebase App Check is used to reduce calls from clients that are not the real app. No online service can promise perfect security. If we learn of a breach that puts your data at serious risk, we will notify the people and the authority the GDPR requires us to notify.
Some photo files are stored in buckets that are marked public, which means someone who already has the file address can open the image. The app does not publish a directory of those files. A private share link is only as private as the people who receive it.
Changes
If this policy changes, the new version will be posted on this page with a new effective date. For a change that needs consent, we will ask for it.
Contact
Michael Ganchas · mapcrumbs.contact@gmail.com