Your data

Your email address, your display name and your password. The password is kept only as a bcrypt hash, so nobody, us included, can read it back. If you ask for access with an address that is not a university address, we keep that address, when you asked and how often you asked, and nothing else about you.

So only you can get into your account.

Our own database, Neon Postgres in Singapore (ap-southeast-1). Confirmation and password-reset links go out through Resend, and so does the one email that tells you an access request was approved. Every sign-in also writes a session row: the session token, when it expires, the IP address the request came from and your browser name.

Kept while your account is active. A signed-in session expires 30 days after its last use, and its record, with the IP address and browser name, is deleted a day later; the links and codes we email can be used once and are deleted a day after they expire. A request for access is kept until the person running ymaplify has decided on it and is deleted 90 days after that decision, or 90 days after you last asked when there was none. An address that was approved stays on the list of addresses that may sign up.

Every pin, map, trip and note, plus any travel documents or booking PDFs you upload.

It's your content: saving, planning and sharing it is the whole app.

Neon Postgres in Singapore (ap-southeast-1); uploaded files live in Cloudflare R2 (Asia-Pacific). Row-level security in the database means a query can only ever reach your own rows.

Kept while your account is active. Notes and pins you make without an account stay in this browser only: at most 200, and each one is removed after 180 days.

Five things can read your device location. Four of them only when you tap them: "Use my location" ranks saved places entirely on your device. "Show my location" adds a marker to the open CityMap on your device and keeps it on the maps you open until you hide it or close the app. A "near me" Magic Search sends your coordinates in that one search request. The visit bonus sends them once to check whether you are within 250 m of a place. The fifth is opening the app: if you are signed in and have already allowed location for ymaplify, the globe reads your position once, rounds it to about 10 km and opens there. It never asks you for permission by itself.

So saved places can rank by your city, you can see yourself on an open CityMap, a "near me" search can look around your real position, confirming a real visit can earn a bonus Magic Search, and the globe opens where you are instead of where your time zone points.

Nowhere for the local ranking chip, the CityMap marker or where the globe opens: those stay on your device. The map then loads the tiles for that area, as for any place you look at. A "near me" search sends the coordinates to our own API, a Cloudflare Worker answering at the Cloudflare location nearest you, and, when a provider lookup is needed, to Google Places as a one-time location bias. The visit check sends them once to that same API for the comparison. Neither network path writes the coordinates to our database.

Never stored on our side. We keep no location history, search keeps only the places you choose, and a successful visit check records only that the place earned its bonus. The marker's last position stays in your browser's session storage, on your device, and is gone when you close the app.

Which pages you open and which steps you reach while getting started and using the app (product analytics). Separately, Cloudflare Web Analytics counts page views: which page was opened, the page you came from, your browser and device type, your country and how fast the page loaded.

So we can see what to fix.

PostHog processes product analytics in the EU, and only while your switch is on. It runs without cookies. Cloudflare Web Analytics runs on every page, also without an account and without the switch; it sets no cookies and is not linked to your account. There is no Google Analytics and no advertising tracker in the app, and we never sell what we measure.

PostHog and Cloudflare each keep it under their own retention.

When you paste a link or message a bot, we send that link's content, its caption, images or audio, to reading services to pull out the real places. We never send your name, email or account id.

That is how Magic search turns a link or a chat into pins on your map.

Anthropic (Claude Sonnet) reads the text of links and runs the chat assistant and the replies of the Telegram bot. Apify opens the link, and for a TikTok link tikwm.com, an unofficial TikTok reader, sends us the caption and images of the post. Google Gemini reads videos, photos and PDFs, and Groq (Whisper) transcribes audio and reads text when Claude is not available. A cover image or one frame of the video is copied into your private storage on Cloudflare R2 and shown on the pin with a credit to the creator.

We keep the places we extract and your chat with the assistant; each provider keeps what it processes under its own policy. A place staged by the bot and never confirmed is deleted after 7 days, and an open question the bot asked you after 48 hours. How many of your 3 free photo imports you have used, kept with your account.

The travel style you pick, your vibe, pace, budget and interests (your Travel taste).

So Magic search sorts places for your taste instead of showing one generic top list.

Neon Postgres in Singapore (ap-southeast-1); not shown to other people and never sold. A short summary of your taste goes along with a Magic search to the reading service, never with your name, email or account id.

Kept until you change or clear it, or delete your account.

When you buy Premium on the web, Stripe, as the seller of record, handles your name, billing address, card and tax. We never see or store your card number.

To take payment, calculate tax and send you receipts.

Stripe (web) or Apple (App Store). From them we only get your subscription status and the billing alerts we need to run your account.

Stripe keeps invoices for as long as tax law requires.

Direct messages to friends, your friend connections, and stories, a photo or video shown to friends for 24 hours, then kept privately in your own archive. You can block or report anyone; a report goes to the person running ymaplify, who can hide the content or block the account.

So you can plan and share trips with the people you travel with.

Neon Postgres in Singapore (ap-southeast-1); story media lives in Cloudflare R2 (Asia-Pacific).

Stories are friend-visible for 24 hours, then private to you; everything is removed when you delete your account.

When something breaks we log a technical error report (what failed and on which screen). We also keep an activity log of which screens are opened and for how long, which named buttons are tapped, which sign-in or setup errors you were shown, and which steps you reach while getting started and using the app (such as finishing the tour, opening a city and which city, starting a Magic search with its kind and how many places it found, saving your first pin and how long that took, or connecting Telegram). It never records what you type, where on the screen you tap, or your location. Each entry carries a random id for your browser tab, the page address and your browser's user agent (browser and device type), and your account id when you are signed in. It runs for everyone, also without an account and without the analytics switch. Any text in an entry is cut short, and your notes and passwords are never in it. The person running ymaplify can read your account's error reports and activity log as a timeline, to help when something breaks and to see where the app is hard to use. The person running ymaplify can also mark an account as a test account, with a short note, so it is left out of usage numbers.

To find and fix crashes, see where people get stuck, and keep the app reliable.

Neon Postgres in Singapore (ap-southeast-1); Sentry processes the limited technical crash diagnostics in its German region.

Deleted automatically once older than 90 days.

You can download a copy of your trips, maps, pins and profile as a file, together with your guides, the messages you sent, your chat with the assistant, your comments, friends, memberships, stories and bot links, or schedule your whole account for deletion.

It's your data, you can take it or remove it whenever you want.

Export is a file you download. Deletion runs on our own API on Cloudflare, as a daily job.

Deletion has a 30-day undo window. Sign back in before then to cancel. Card-subscription renewals stop as soon as you request deletion (your paid time runs to the period end); after the window a daily job cancels any remaining billing and permanently removes your account, content and files, ends your Claude connections, and we delete your analytics profile at PostHog as well (by hand within 30 days where it is not automatic).