Privacy Policy

Who we are

MapPal is operated from Prague, Czech Republic, and is the data controller for the information described here. For anything in this policy, including requests to access or erase your data, contact michalseneca@gmail.com.

What we collect

• Account: your email address, and — if you sign in with Google or Facebook — the name and profile photo that provider gives us. Signing in by email link gives us only your email address.
• Profile you create: bio, languages, travel style, budget, optional gender, optional year of birth, and any photos you add. We store the year and show other travelers your age, never the year itself or a full date of birth.
• Home city, if you give one: the city you live in, and — only if you switch it on — your consent to appear on that city's page so visitors can message you, along with any guide you write. Setting a home city never lists you; the listing is a separate choice you can reverse at any time.
• Trips you publish: destination city, dates, and intent.
• Activity: join requests, meetings and their confirmations, friendships, waves, destination subscriptions, and memory notes you write.
• Messages: the content of chats you send to other travelers.
• Approximate location: the destination city of a trip you publish. This is the basis of matching, so it is required to use the core feature.
• Precise location: only if you start a live-location share inside a chat. That shares your exact coordinates with the one traveler in that conversation, updates while it runs, and stops automatically after the window you set. It is entirely optional and off unless you turn it on.
• Device: a push-notification token, if you allow notifications.
• Usage analytics: which pages and features are used, via Google Analytics, Vercel Analytics and Microsoft Clarity. Clarity also records how pages are used — clicks, scrolling and navigation — so we can find where the app confuses people. Text content is masked before it leaves your device: your messages, bio and email are not recorded, and we never send Clarity your name, email or user id.

How we use it

• To match you with compatible travelers — same destination, overlapping dates, similar style.
• To run the safety features: verification, reporting, blocking, live-location sharing, and meetup confirmation.
• To send notifications you asked for — join replies, message replies, trip reminders — by push and, when push is unavailable, by email.
• To send sign-in links you request.
• To improve the product based on aggregate, non-identifying usage patterns.

What we share

Your profile and trip become visible to other MapPal travelers as part of matching. Chat content is shared only with the traveler you are messaging. A live-location share is visible only to that one traveler, only while it is running. We do not sell your data, and we never post on your behalf.

We use a small number of processors to run the service:

• Google Firebase — database and push notification delivery.
• Vercel — hosting, plus page-performance and usage analytics.
• Resend — sending sign-in links and notification emails.
• Google Analytics — usage measurement.
• Microsoft Clarity — anonymous session replay and heatmaps, with text masked.
• Google and Facebook — only if you choose to sign in with them.

Your controls

• Edit or remove profile details any time in your settings.
• Delete a trip, which removes it from matching.
• Stop a live-location share at any moment; it also expires on its own.
• Block travelers — they are hidden from you and not notified.
• Turn off any notification category without losing safety alerts. Turning a category off silences both push and email for it.
• Delete your account, and everything tied to it, from Settings or at mappal.app/delete-account. No email required.

Your rights

If you are in the European Economic Area or the UK, you have the right to access your data, correct it, erase it, export it, restrict or object to how we use it, and to withdraw consent for anything you opted into — such as notifications or location sharing — at any time. Deletion is available in the app without contacting us; for anything else, email the address above and we will respond within 30 days. You may also complain to your local data protection authority; in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).

We process your data to provide a service you asked for, and on your consent for the optional parts — notifications, precise location, and analytics.

Data retention

We keep your data while your account is active. When you delete your account we remove your profile, trips, messages, join requests, meetings, friendships, waves, subscriptions and sign-in tokens. Some records may persist briefly in backups before being purged. Live-location points are not retained after a share ends.

Children

MapPal is not intended for anyone under 18. We do not knowingly collect data from minors.

Where our city list comes from

The city search is answered from a copy of the GeoNames database held on our own servers, licensed under CC BY 4.0. We chose that over a geocoding service on purpose: it means what you type into a city box is never sent to a third party.

Contact

Questions, data requests, or anything else: michalseneca@gmail.com.