Privacy Policy

Last updated: 20 October 2026

Prefer plain language?

Our Your data page explains what we store, why, where it goes and the switches you control, in everyday words. This policy is the full legal detail.

Controller

Marc Kaio Hasler, operating ymaplify as an individual, Siebenmatten 79, 5032 Aarau Rohr, Switzerland. Privacy contact: [email protected].

What we collect

Depending on the features you use: account email, display name and a password (stored only as a bcrypt hash); profile and social connections; saved places, maps, trips, notes, messages, uploads and bookings; search and parsing input; coarse or precise location when you grant permission; subscription status; the IP address and browser of each signed-in session; device, security, diagnostic and usage events.

Purposes & legal bases

We process account and travel data to provide the service and fulfil our contract with you; security and essential diagnostics for our legitimate interests in keeping ymaplify reliable and safe; optional product analytics only with your consent; and records where required by law. You can withdraw analytics consent in Data & privacy settings.

Your map data

Places you save stay tied to your account. You can delete pins and trips in the app.

Using ymaplify without an account

You can look around ymaplify without an account. We then keep no account, name or email address for you, but a few things still happen. The free link: without an account you can turn one TikTok, Instagram or Google Maps link into pins. The link is read by the same services as any other link (see AI parsing & voice), and the places it finds stay only in your browser's local storage until you create an account; your first sign-in then saves them to your map. Once a link has produced places, our server gives your browser a signed receipt that only records that this browser has used its free link, and when. It contains no IP address, no link and no browser details. Your browser keeps it in local storage and in one first-party cookie, ym_guest_parse (HttpOnly, kept for one year). To keep costs bounded, free links are counted per internet connection, at most 20 a day, using a salted hash of your IP address instead of the address itself, and all free links together stop at 200 a day in total. Notes and pins: notes and pins you add without an account are saved only in this browser, not in our database. Measurement: the activity log and Cloudflare Web Analytics described under Analytics & diagnostics also run without an account. To remove what ymaplify keeps in your browser, clear this site's data in your browser settings.

AI parsing & voice

Links, text, images and voice recordings you submit are sent to third-party AI providers, never with your name, email or account id. Since 19 October 2026 Anthropic (Claude Sonnet) reads the text of links and runs the chat assistant in the app and the replies of our Telegram bot. Apify opens the link so it can be read, and for a TikTok link our server also asks tikwm.com, an unofficial TikTok reader, for the post's caption and images. Google (Gemini) reads videos, photos and PDFs for place names, and Groq (Whisper) transcribes voice input; Groq also reads text when Claude is not available. We keep the places we extract and your chat with the assistant; please don't submit sensitive personal data. When a TikTok or Instagram post has a cover image, or shows a place in one frame of its video, our server copies that one image into your private storage on Cloudflare R2 and shows it on the pin with a credit to the creator; a still from a video is cut by Cloudflare's media service. A place a bot stages for you and you never confirm is deleted after 7 days. When the Telegram bot asks you a question, it remembers the open question for 48 hours; it also keeps a short log of what it did in your chat, such as how many places it saved, so it can understand your next message, and that log is removed when you delete your account.

Analytics & diagnostics

Optional PostHog product analytics runs only when you turn on Product analytics; turning it off immediately stops sending further measurements, and PostHog runs without cookies. Separately, Cloudflare Web Analytics, a feature of our host Cloudflare, counts page views on every page of the site, with or without an account and without asking for consent, on the basis of our legitimate interest in knowing how much the site is used and how fast it loads: which page was opened, the page you came from, your browser and device type, your country and how fast the page loaded. It sets no cookies and is not linked to your account. We use no Google Analytics and no advertising trackers. We also keep a first-party activity log of which screens are opened and for how long, which named buttons are tapped, which sign-in or setup errors you were shown, and which steps you reach while getting started and using the app (such as finishing the tour, opening a city and which city, starting a Magic search with its kind and how many places it found, saving your first pin and how long that took, or connecting Telegram), to run and debug the service, on the basis of our legitimate interest in a reliable app. It never records what you type, where on the screen you tap, or your location. It runs for everyone, also without an account and without analytics consent. Each entry carries a random id for your browser tab, the page address and your browser's user agent (browser and device type), plus your account id when you are signed in. It is kept data-minimal: any text in an entry is shortened, and note contents are never stored in it. The person running ymaplify can read your account's error reports and activity log as a timeline, to help when something breaks and to see where the app is hard to use. Sentry processes limited technical diagnostics needed to find and fix crashes, in its German region. We never sell analytics data.

Storage

Your account, map pins, trips, notes and messages live in our Neon Postgres database in Singapore (ap-southeast-1). Photos, voice notes and uploaded documents live in Cloudflare R2 (Asia-Pacific). Row-level security in the database limits every query to the rows that belong to you. Nightly database backups are kept for up to 90 days.

Payments & who sells Premium

For web purchases, Premium is sold by Stripe as the Merchant of Record (the seller of record), not by ymaplify directly. For those purchases Stripe acts as an independent controller of the payment data it needs, your name, billing address, payment method and tax details, and processes it under its own privacy policy to take payment, calculate tax, issue receipts and handle refunds. From that flow we receive only your subscription status and the billing alerts we need to run your account. Purchases made through an app store are sold by the relevant store under its terms.

Sub-processors

We rely on trusted providers to run ymaplify: Neon (our Postgres database, Singapore), Cloudflare (site hosting on Pages, cookieless page-view statistics with Web Analytics, our login and API on Workers, file storage on R2 in Asia-Pacific), Resend (the confirmation and password-reset mails, and the note to the person running ymaplify when something is reported), Anthropic, Google Gemini and Groq (AI parsing, the chat assistant and voice transcription), Apify and tikwm.com (reading the links you paste), Google Places (place search and place photos), Stripe (payments, also the seller of record for web purchases, see above), Pexels (stock photos), Telegram (our bot, for the links you send it), AeroDataBox and Travelpayouts (flight status and price hints for your trips, asked by our server with the flight number, date or route only), and PostHog (product analytics, only with your consent) and Sentry (error monitoring). Cloudflare also cuts the still from a video for a pin photo (Media Transformations). Some map services load straight in your browser as you use the map, so they receive your IP address: CARTO, which serves the map's background tiles (it sees your IP and the map area on your screen); OpenStreetMap's Nominatim search, run by the OpenStreetMap Foundation, which powers city and place search (it sees your IP and what you type); OpenRailwayMap, which serves the transit overlay tiles (it sees your IP and the map area on your screen); and, when you open a city, OpenStreetMap's Overpass service (outlines and places of the area), geoBoundaries (region borders), Open-Meteo (the weather), Wikipedia (a short summary) and the photo servers of Pexels, Unsplash, Wikimedia and Google (pictures of places), each of which sees your IP address and what it is asked for, never your account. Separately, place-name geocoding runs on our server through Photon, operated by Komoot, so Komoot receives the search text but not your browser's IP address. When you paste a Naver Map or Kakao Map link, or send one to our Telegram bot, our server fetches that shared list or place from Naver or Kakao to read the place names and coordinates; it sends them only the link and the id in it, never anything about you. When public transport is switched on over Singapore, our server asks for the next buses at the bus stops in view, or at the stop you open: from LTA DataMall, the open data service of Singapore's Land Transport Authority, or, only when LTA does not answer, from the open community mirror arrivelah2.busrouter.sg; only the bus stop codes are sent, never anything about you. The map itself is drawn by CARTO from OpenStreetMap data, and the Singapore MRT and LRT lines and bus stops are built from OpenStreetMap data under the Open Database License and served from our own site, so switching on public transport sends nothing to OpenStreetMap. Claude connector: only if you connect Claude (Anthropic's assistant) to your ymaplify account, Claude can read your maps, saved places and trips and, if you allowed it, save places and create trips; what it reads goes to Anthropic. A connection ends after 30 days, you can disconnect it any time under Profile, and it ends when you delete your account. Each provider processes data only to provide its service.

Sharing

We do not sell your data. Friends only see what you explicitly share (city visibility, trips).

Cookies

We set no login cookie: your session is a bearer token kept in your browser's local storage, and your preferences are stored locally too. For the free link without an account, once it has produced places, our server sets the first-party cookie ym_guest_parse (HttpOnly, one year), which only records that this browser has used its free link (see Using ymaplify without an account). Product analytics, when you turn it on, runs without cookies, and so does Cloudflare Web Analytics. No third-party ad cookies.

International transfers

Your account data is stored in Singapore and your files in Cloudflare's Asia-Pacific region; our site and API run on Cloudflare's global network, so a request is answered close to you wherever you are. Providers such as Cloudflare (including Web Analytics), Stripe, Resend, PostHog, Sentry, Google, Groq, Anthropic and Apify process data in the EU, the United States or elsewhere. Where required, we rely on recognised adequacy mechanisms or contractual safeguards such as standard contractual clauses.

Retention

Account and travel content is kept while your account is active. If you ask for access to the beta with an address that is not a university address, we keep that address and when you asked until 90 days after the request was decided, or 90 days after you last asked when it was not; an approved address stays on the list of addresses that may sign up. Diagnostic and analytics logs we store ourselves, error reports, session-activity and API-usage records, are scheduled for deletion once they are older than 90 days; analytics held by our providers follows their own retention. Operational billing alerts, the records we need to confirm a payment, refund or subscription was handled correctly, are an exception: we keep them indefinitely until they are manually cleared. Places a bot staged for you and you never confirmed are deleted after 7 days, and an open question of the Telegram bot after 48 hours. A signed-in session expires 30 days after its last use; the session record, with the IP address and browser it was created from, is deleted a day after it expired, and so are expired sign-in codes and email links. Reports you file about other people's content are kept so we can act on them and are removed when you delete your account. Deletion requests have a 30-day undo period; legal, fraud-prevention or billing records may be retained where required.

Security

HTTPS everywhere, row-level security on database tables, passwords stored only as bcrypt hashes, sessions as bearer tokens that expire, secrets only in the server environment.

Your rights

Depending on applicable law, you may request access, correction, portability or deletion, restrict or object to processing, and withdraw consent. Settings → Download your data gives you a file with your profile, trips, maps, pins, guides, the messages you sent, your chat with the assistant, comments, friends, memberships, stories and bot links. For anything else, contact [email protected]. You may also complain to the Swiss FDPIC or your local data-protection authority.

Account deletion

You can schedule account deletion directly in Settings → Delete account. This starts a 30-day grace period, and you can undo the request in the app before the deadline. After the grace period, our deletion process permanently removes your account and everything tied to it: profile, pins, maps, trips, guides, messages, comments, photos and uploaded files, your Telegram link and your Claude connector connections; we delete your analytics profile at PostHog as well (by hand within 30 days where it is not automatic). You can also contact [email protected] for help. Aggregated, non-personal statistics and data we're legally required to keep may be retained beyond that.

Children

ymaplify is for people aged 16 or older and is not directed at children. Contact us if a child provided personal data.

Changes

We may update this page; material changes will be noted here with a new date.