Privacy Policy
Effective 5 September 2026
The data controller is Aleksandr Manukyan (France) — [email protected]. Short version: we collect the minimum needed to run the service, we don't run ads, we don't sell data, and we don't track you across the web.
What we collect and why
- Account data — email, name, password (stored hashed by our auth provider). Needed to sign you in and sync your trips. Legal basis: performance of a contract.
- Your trips — the cities, routes and settings you create, stored so they sync across your browsers. Legal basis: performance of a contract.
- Purchase records — which trip you unlocked, a transaction reference, amount and currency. Payment details (card numbers) go to Paddle, our payment provider; we never receive them. Legal basis: contract and legal (accounting) obligations.
- Technical data — standard server and security logs held briefly by our hosting providers. Legal basis: legitimate interest in keeping the service secure.
Videos you export are rendered on your device and never uploaded to us.
Processors we use
- Supabase — database and authentication (hosted in the EU, Ireland region)
- Paddle — payments, as merchant of record (see Paddle's own privacy policy)
- Cloudflare — hosting and CDN
- Resend — transactional email (confirmation and password-reset emails)
- Mapbox — city search and route calculation: your search text and route coordinates are sent to Mapbox to return results; we don't attach your identity to these requests
- Map tile providers / OpenStreetMap — your browser fetches map imagery directly from tile servers
Some providers process data in the United States under appropriate safeguards (EU standard contractual clauses and/or the EU–US Data Privacy Framework).
Cookies and local storage
We use no advertising or cross-site tracking cookies. Your browser's local storage holds app state (your session, drafts, cached routes) strictly to make the app work.
Retention
Account and trip data are kept until you delete your account (email us and we'll remove them). Purchase records are kept as long as French accounting law requires.
Your rights
Under the GDPR you can request access, correction, deletion, portability, or restriction of your data, and object to processing based on legitimate interest. Email [email protected] — we respond within 30 days. You may also lodge a complaint with the CNIL (cnil.fr).