Privacy Policy

Last updated: July 17, 2026

1. Controller

This privacy policy explains how we process personal data when you use the MapDreamy mobile app and the website mapdreamy.com (together, the "Service"). The controller within the meaning of the GDPR is:

2. The website (mapdreamy.com)

Our website is hosted by Vercel Inc., 650 California St, San Francisco, CA 94108, USA. When you visit it, technically necessary data (IP address, browser type, time of request, referrer) is processed in server logs to deliver the site securely (Art. 6(1)(f) GDPR — legitimate interest in a secure, functional website). We have concluded a data processing agreement with Vercel including EU Standard Contractual Clauses for transfers to the USA.

The website does not set cookies and does not use tracking that stores personal data. We may use privacy-preserving, cookieless aggregate analytics (Vercel Web Analytics) to understand site usage.

3. The app: account and profile data

When you use the MapDreamy app, we process:

• Account data: email address, display name (optional), authentication identifiers. Sign-in is provided through Firebase Authentication (Google Ireland Ltd. / Google LLC, USA). If you use "Sign in with Apple" or "Sign in with Google", the respective provider transmits your name and email (Apple lets you hide your email). Before you create an account, the app may operate with an anonymous account that is merged into your real account when you sign up.
• Profile data: optional information you add, such as your name shown to friends.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract — providing your account).

4. The app: content you save and share

• Shared links and imports: when you share a social media link (e.g. TikTok, Instagram, YouTube) to MapDreamy, we process the link and publicly available information about the post (caption, thumbnail, author name/handle) to identify the places it mentions. This processing uses AI services (Google Gemini, Google LLC/Google Ireland Ltd.); we send the link/post content, not your identity, to the AI service.
• Places, trips, lists, posts: the places you save, notes, trips, lists, and content you share with friends are stored on our backend so we can provide the Service.
• Photos, videos, and other media (as such features become available): media you upload is stored on our backend and processed to provide the relevant features. How your content may be used is described in our Terms of Use; where the app offers privacy/visibility settings for your content, we honor them.

Our backend and database are provided by Convex Inc. (USA) as a processor under a data processing agreement with EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR.

5. The app: location and travel data

The places you save inherently include location information (the location of the saved place, not your own position). If we introduce features that use your device location or record travel history (e.g. travel tracking or statistics), the app will ask for your permission first; such processing is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app or in your device settings.

6. The app: social features

If you connect with friends or join shared maps and trips, your display name and the content you choose to share become visible to those users. Legal basis: Art. 6(1)(b) GDPR.

7. Subscriptions and purchases

Purchases are processed by Apple or Google under their own privacy policies; we never receive your payment details. To manage subscriptions we use RevenueCat Inc. (USA) as a processor, which processes pseudonymous purchase information (app user ID, transaction and subscription status). Legal basis: Art. 6(1)(b) GDPR; transfers are safeguarded by EU Standard Contractual Clauses.

8. Push notifications

If you enable push notifications, a push token for your device is processed via Expo (650 Industries, Inc., USA) and delivered through Apple Push Notification service or Firebase Cloud Messaging (Google). Legal basis: Art. 6(1)(a) GDPR (your consent via the system permission); you can disable notifications at any time in your device settings.

9. Embedded third-party content

When you open a saved post inside the app, the post may be displayed via the embedding players of the respective platform (TikTok, Instagram, YouTube). In that moment, your device connects to that platform's servers, which process your IP address and may use their own cookies/identifiers under their own privacy policies. Legal basis: Art. 6(1)(b) GDPR (displaying the content you requested).

10. Recipients and international transfers

We share personal data only with the processors named in this policy (hosting, backend, authentication, AI processing, subscription management, push delivery), with the app stores where required for purchases, and where we are legally obliged to. Some providers are located in the USA; transfers are safeguarded by EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. We do not sell personal data.

11. Retention and deletion

We store personal data as long as your account exists or as needed to provide the Service. You can delete your account at any time in the app's settings; your account data and content are then deleted, except where we must retain data to comply with legal obligations (e.g. commercial and tax law) or where content you shared with other users remains as described in the Terms of Use. Backup copies are purged on a rolling basis.

12. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, contact us at support@mapdreamy.com. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.

13. California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising these rights. We do not sell or share personal information within the meaning of the CCPA. Requests can be sent to support@mapdreamy.com.

14. Children

The Service is not directed at children under 13 (or the higher minimum age applicable in your country). We do not knowingly collect personal data from children below that age; if we become aware of such data, we will delete it.

15. Changes to this policy

We update this privacy policy when the Service or the legal situation changes. The current version is always available at mapdreamy.com/privacy; material changes will be announced in the app.