Privacy policy · StickyMaps

StickyMaps is an app that lets groups keep track of their stickers on a shared map. Here you can read what data we process for that, why we do it and what rights you have.

In short: we only process what’s needed to make the app work. Your group is private. We don’t show ads, we don’t track you and we don’t sell anything.

Who we are

StickyMaps is responsible for processing your personal data. Got a question or request? Email [email protected].

What data we process

Account: your name, email address (and whether you’ve confirmed it) and password. We only store your password as a hash (Argon2id), so we can’t read it ourselves.
Groups: which groups you’re a member of, your role (admin or member) and any title the admin gives you.
Stickers: the location (coordinates, accuracy and address), the photos, the times, who put up and checked the sticker, and whether it’s still there.
Likes and comments you post on stickers.
Notifications: your notifications in the app and your settings for them. If you turn on push notifications, we also store the address your browser creates for them.
Language: your language choice, so notifications arrive in your language.
Security: the number of failed login attempts and your session. For your session, we only store a hash.

Location

The app only asks for your location when you add a sticker. We only use that location to put the sticker on the map. We don’t track your location in the background. If you show your own position on the map, it stays on your device.

Photos

When saving, we remove all metadata (EXIF) from your photos, such as the device type and GPS data. If you add a photo from your gallery, the app reads the location and time on your own device. We only use these for the sticker.

Who can see your data

Stickers, photos, likes and comments are only visible to members of the group they were posted in. Members of your group see your name. Group admins also see the members’ email addresses, so they can manage the group. The map isn’t public and doesn’t appear in search engines.

Why we use your data

We use your data to make the app work. This is necessary to perform our agreement with you (Article 6(1)(b) GDPR). We also use data to protect the app against abuse, such as slowing down login attempts. That is our legitimate interest (Article 6(1)(f) GDPR). We only send push notifications if you turn them on yourself.

We don’t use ads, trackers or analytics services. We don’t sell your data and don’t use it for other purposes.

Third-party services

OVHcloud hosts our server and database in a data centre in France.
Cloudflare secures and speeds up the connection to the app and this website. All traffic goes through their network.
Esri (ArcGIS) provides the map. Your browser fetches the map images directly from Esri. Esri sees your IP address and which part of the map you’re viewing.
OpenStreetMap (Nominatim) looks up addresses. If you search for an address or place a sticker, your browser sends the search term or the coordinates to Nominatim, along with your IP address.
Have I Been Pwned checks whether a new password appears in known data breaches. We only send the first 5 characters of a hash of your password. Your password and email address never leave our server.
Resend sends our emails, such as the confirmation email and the link to set a new password. For this, Resend receives your name and email address, and sends from the EU (Ireland).
Push services from Apple, Google, Mozilla or Microsoft (depending on your browser) deliver push notifications. The content is encrypted, so only your device can read it.

Some of these parties are based outside the European Union. Data that ends up there is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Cookies and storage in your browser

The app uses one cookie: a login cookie, so you stay logged in. It’s valid for 90 days and is renewed as long as you use the app. The app also stores your language choice and some data in your browser so it starts faster. Because all of this is needed for the app to work, we don’t ask for your consent.

This website uses no cookies and no analytics services. The fonts are hosted on our own server.

How long we keep data

We keep your account, stickers, photos, likes and comments as long as your account exists.
If you leave a group, the stickers you put up there stay visible to the group.
A session expires after 90 days without use. A link to reset your password expires after one hour (by email) or 24 hours (from your admin). A confirmation link expires after 7 days.
We keep server logs with IP addresses for a short time, only for security and fixing errors.
We back up the database every day and keep those backups for 14 days.

You can delete your account yourself under Profile → Delete account. Your name, email address, password, likes, comments and notifications are deleted straight away. Stickers you put up stay visible to your group, without your name. If you want those gone too, you can choose that when you delete your account. Groups where you’re the only member are deleted entirely. Data then remains in backups for up to 14 days. Doesn’t it work? Email [email protected].

Security

The connection to the app is always encrypted (HTTPS). Passwords are only stored as a hash, login attempts are slowed down and photos can only be accessed by members of the group.

Your rights

You have the right to access your data, have it corrected or deleted, have its processing restricted, object to its processing, and take your data to another service. You can change your name yourself in your profile, and delete your account there too. For everything else, email [email protected]. We’ll respond within one month.

Not happy with how we handle your data? Let us know. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country.

Changes

If the app changes, we update this policy. At the top you can see when that last happened.