flanoryFlanory privacy policy
In short
- You need an account. Signed out, nothing is recorded.
- Your raw GPS points stay on the phone. What you explore, your walks and your discoveries are backed up to your account.
- Others see your profile and what you choose to share, nothing else.
- No ads, no tracking, nothing sold.
What we keep
| Data | Why |
|---|---|
| E-mail, username, password (only as a hash) | Your account. Others with an account see the username |
| Discoveries and their photos (location data is removed from photos on the phone) | Backup, and sharing if you choose |
| Explored blocks (first and last visit, number of visits), passed-through blocks, km per day, stamps | Backup |
| Walks: a simplified route of GPS points, start and end time, length, name | Backup; only you see them |
| Profile: blocks, km, stamps and countries, and the title, stamps and discoveries you pick | Others with an account see it |
| Friends and friend requests | You and the other person see them |
| Reports you make | So we can review content |
| The app's language when you signed up | E-mails in your language |
| Sign-in attempts (username and IP address) | Against password guessing |
Only on the phone: your raw GPS points, your home area (where the map starts), drafts and settings. Signing out empties the phone except settings and downloaded map data.
Sharing
A shared discovery is seen by others with an account, with your username and when you shared it. Others can add their own discoveries at the same place; each is theirs. A place stays seen for 30 days after the last discovery shared there. You can make yours private again at any time. We can hide reported content.
Location
Flanory follows your location from when you open the map until you tap Stop in the notification or leave the app. With the app closed only if you choose it; you can change that in the app. To name places and find areas and routes, a position goes to the services below without your account. A photo at someone's discovery checks your position without keeping it.
Services we use
| Service | What it gets | Where |
|---|---|---|
| Supabase | Everything in "What we keep" | EU (Stockholm) |
| Brevo | Your e-mail, when we send e-mail | EU (France, Germany, Belgium) |
| Have I Been Pwned | The first five characters of a hash of a new password | Cloudflare (worldwide) |
| OpenFreeMap, Mapterhorn | Which part of the map is shown, and your IP address | Cloudflare (worldwide) |
| Valhalla (FOSSGIS) | Start and destination when you ask for directions | Germany |
| Overpass (FOSSGIS, Private.coffee) | Which area is fetched, and your IP address | Germany, Finland, Austria |
| Google Play services | Your position and whether you walk or ride, from Google's services on the phone; a place's coordinates, to name it | Google (also USA) |
| Google Play | Crash reports, if you allow them in the phone's settings | Google (also USA) |
Cloudflare and Google may handle data in the USA. Both are certified under the EU–US Data Privacy Framework, which the European Commission has found gives adequate protection. Nothing else leaves the EU.
Legal basis and how long
The account and backup: our agreement with you. Location: your consent, which you can withdraw in the app or the phone's settings. Sign-in attempts and reports: legitimate interest (against abuse).
Everything is kept until you delete your account, except sign-in attempts (a day), reports (6 months) and raw GPS points (7 days, on the phone). Supabase also keeps its own sign-in records, with IP address.
Your rights
- Download a copy of all your data, with your photos: Profile → Settings → Account → Download my data.
- Delete your account: Profile → Settings → Account → Delete account, or by e-mail. Everything is deleted after 30 days; see deleting your account.
- Correct, object or ask: e-mail us.
- If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.
Security, children, changes
Everything is sent encrypted (HTTPS), sign-in attempts are limited, and an account only reaches its own data and what others share. Flanory is not made for children under 13. If something important changes here, we e-mail you before it applies.
Contact
Questions about your data, or anything else? E-mail us at contact@flanory.com and we will get back to you.