Privacy
Privacy Policy
Draft — drafting notes only, not a policy. This needs to be written properly and legally reviewed before maple leaves beta.
What we collect
Account email and password (Supabase Auth), your display name, your 8-character invite code, and — if you set one — your home city. For each pin: the place name, the city-level coordinate it snapped to, an optional rating, colour, note, and travel year. A pin created from photo metadata also stores the visit’s start and end dates, since that is what the photos actually establish; a pin you add by hand stores a year and nothing finer. Explicitly not collected: photographs themselves, contact records, continuous or background location, and there is no analytics SDK in the app.
Photos and contacts
Both are opt-in, both are read on the device, and neither is uploaded. Photos: with permission maple reads each photo’s creation date and location — the metadata only. It never opens, transmits or displays a photograph, there is no way to attach one to a pin, and shared albums are excluded. It proposes cities you then approve, and only the city names you keep are written to the database. Contacts: read on the device to suggest people you might invite by text; the contact list itself never leaves the phone and is never sent to us or to Supabase. Spell out that revoking either permission in iOS Settings stops the feature and removes nothing already saved.
How we use it
Authenticate you, render your map and passport, and compute your counts and your standing among the friends you have added. Nothing is used for advertising or profiling.
Data sharing
Nothing is public. Every friend you add sees your entire map, symmetrically, with no per-place or per-trip controls — adding someone is the whole decision. Friends of your friends cannot see you; this is enforced in the database with row-level security, not just in the app. Name the processors: Supabase (authentication and Postgres hosting), Apple MapKit (basemap, place search and reverse geocoding — a long-press, a search, or a photo-import scan sends coordinates or a query to Apple, and the import case is worth naming because it sends one coordinate per cluster of photos rather than one per photo), and Vercel (this website only). No ad networks, no data brokers.
Location
When-in-use only, never background. Location is requested to centre the map on you, to power the “near you” city suggestions, and to prefill your home city if you let it. Your live position is never written to the database. The only coordinates stored are the ones you deliberately confirmed as a pin — and those are snapped to the nearest city, so a pin records “Lisbon”, not a street address.
Home base
Optional, and one city rather than an address. If you set it, maple stores that city and its coordinate on your account and uses it to centre the map before you have any pins, to measure the furthest you have been, and to decide which places photo import leaves out. It is not a pin, so it appears on no map and counts toward no total. Clearing it is one tap.
Your choices
Remove a friend and they stop seeing your map immediately. Delete any pin, or any single visit to a place, at any time. Revoke the photo or contacts permission in iOS Settings at any time. Delete your whole account from inside the app — see below.
Data retention & deletion
State how long data is kept. Account deletion is self-service and in-app: You › Account › Delete account, behind a confirmation. It runs server-side and cascades — account, pins, visits, friend links in both directions, and invites all go — then signs you out. Nothing needs to be emailed. (This satisfies App Store guideline 5.1.1(v), which requires an in-app deletion path for any app offering account creation.)
Contact
Privacy questions? Email hello@maple.app.