Privacy Policy

Last updated: July 2026

Prefer plain language?

Our Your data page explains what we store, why, where it goes and the switches you control — in everyday words. This policy is the full legal detail.

Controller

Marc Kaio Hasler, operating ymaplify as an individual, Siebenmatten 79, 5032 Aarau Rohr, Switzerland. Privacy contact: info@ymaplify.com.

What we collect

Depending on the features you use: account email and display name; profile and social connections; saved places, maps, trips, notes, messages, uploads and bookings; search and parsing input; coarse or precise location when you grant permission; subscription status; device, security, diagnostic and usage events.

Purposes & legal bases

We process account and travel data to provide the service and fulfil our contract with you; security and essential diagnostics for our legitimate interests in keeping ymaplify reliable and safe; optional product analytics only with your consent; and records where required by law. You can withdraw analytics consent in Data & privacy settings.

Your map data

Places you save stay tied to your account. You can delete pins and trips in the app.

AI parsing & voice

Links, text, images and voice recordings you submit are sent to AI providers — Google (Gemini) to read links and images for place names, and Groq (Whisper) to transcribe voice input. We keep only the extracted text; please don't submit sensitive personal data.

Analytics & diagnostics

Optional PostHog and Vercel product analytics — and Vercel Speed Insights (web-performance measurements) — run only when you turn on Product analytics; turning it off immediately stops sending further measurements. Separately, we keep a minimal first-party activity log (which screens and actions are used) to run and debug the service, on the basis of our legitimate interest in a reliable app. It is kept data-minimal: free text you enter, such as search terms, is shortened, and note contents are never stored in it. Sentry processes limited technical diagnostics needed to find and fix crashes. We do not use advertising trackers or sell analytics data.

Storage

Data is hosted with Supabase (EU region), including your account, map pins, trips and any photos or voice notes you add to guides. Backups follow provider policies.

Payments & who sells Premium

For web purchases, Premium is sold by Stripe as the Merchant of Record (the seller of record), not by ymaplify directly. For those purchases Stripe acts as an independent controller of the payment data it needs — your name, billing address, payment method and tax details — and processes it under its own privacy policy to take payment, calculate tax, issue receipts and handle refunds. From that flow we receive only your subscription status and the billing alerts we need to run your account. Purchases made through an app store are sold by the relevant store under its terms.

Sub-processors

We rely on trusted providers to run ymaplify: Supabase (database, authentication, file storage), Vercel (hosting & analytics), Google Gemini & Groq (AI parsing and voice transcription), Apify (resolving media links), Stripe (payments — also the seller of record for web purchases, see above), Pexels (place photos), and PostHog/Sentry (analytics & error monitoring). Some map services load straight in your browser as you use the map, so they receive your IP address: CARTO, which serves the map's background tiles (it sees your IP and the map area on your screen); OpenStreetMap's Nominatim search, run by the OpenStreetMap Foundation, which powers city and place search (it sees your IP and what you type); and OpenRailwayMap, which serves the transit overlay tiles (it sees your IP and the map area on your screen). Separately, place-name geocoding runs on our server through Photon, operated by Komoot, so Komoot receives the search text but not your browser's IP address. Each processes data only to provide its service.

Sharing

We do not sell your data. Friends only see what you explicitly share (city visibility, trips).

Cookies

Session/auth cookies and local storage for preferences. No third-party ad cookies.

International transfers

Some providers may process data outside Switzerland or the EEA. Where required, we rely on recognised adequacy mechanisms or contractual safeguards such as standard contractual clauses.

Retention

Account and travel content is kept while your account is active. Diagnostic and analytics logs we store ourselves — error reports, session-activity and API-usage records — are scheduled for deletion once they are older than 90 days; analytics held by our providers follows their own retention. Operational billing alerts — the records we need to confirm a payment, refund or subscription was handled correctly — are an exception: we keep them indefinitely until they are manually cleared. Deletion requests have a 30-day undo period; legal, fraud-prevention or billing records may be retained where required.

Security

HTTPS everywhere, row-level security on database tables, secrets only in server environment.

Your rights

Depending on applicable law, you may request access, correction, portability or deletion, restrict or object to processing, and withdraw consent. Contact info@ymaplify.com. You may also complain to the Swiss FDPIC or your local data-protection authority.

Account deletion

You can schedule account deletion directly in Settings → Delete account. This starts a 30-day grace period, and you can undo the request in the app before the deadline. After the grace period, our deletion process permanently removes your account, saved pins, trips and profile. You can also contact info@ymaplify.com for help. Aggregated, non-personal statistics and data we're legally required to keep may be retained beyond that.

Children

ymaplify is for people aged 16 or older and is not directed at children. Contact us if a child provided personal data.

Changes

We may update this page; material changes will be noted here with a new date.