Privacy policy.

1. Data Collection and Purposes

Fattermap is designed to minimize data collection. We process the following information based on your usage:

A. Location Data (GPS)

• Real-time visualization— To center the map on your position, Fattermap requests access to your device’s precise location (via explicit consent). This real-time position is neither stored nor transmitted to our servers.
• Track recording — Upon your voluntary action, the app can record your route (GPS track).
  • Without a user account or with the option disabled: These tracks are stored exclusively locally on your device.
  • With a user account (default behavior): Tracks are saved online so you can access them across different devices, along with other items in your synced library (such as saved routes and folders). You can disable this behavior in the settings to maintain strictly local storage.

B. User accounts

Account creation is optional. If you create an account, we process information for sign-in, your profile, and syncing your personal library across devices. See section 2 for full details on accounts and sign-in (including email/password, Google, and Apple).

C. Website Waitlist

When you join the mobile beta waitlist on our website, we collect your email address so we can notify you about the Fattermap mobile beta and related product updates. This data is stored with our email provider, Resend, and is used only for that purpose. You can request removal at any time (see the “Your Rights” section).

D. Analytics and Diagnostic Data

To understand how the app is used and improve its performance, we use the native web analytics solution of our hosting provider, Vercel (Vercel Web Analytics). This data is anonymized and does not personally identify you.

E. Technical Data Related to Map Tiles

Displaying 3D mapping requires downloading topographic data and map tiles from third-party servers. When loading these map elements, your IP address is technically exposed to these third-party providers, who operate under their own privacy policies.

2. Accounts and sign-in

Why we offer accounts

You can use parts of Fattermap without an account. If you create one, we use it to identify you, keep you signed in, and sync your personal library (for example saved routes and folders) across devices.

Ways to sign in

You may register and sign in using:

• Email and password — we store your email address and a hashed password. We may send you emails to verify your address, reset your password, or confirm a change of email.
• Sign in with Google — Google authenticates you and shares limited profile information with Fattermap so we can create or link your account.
• Sign in with Apple— Apple authenticates you and may share your name and email (including Apple’s private relay email, if you choose it) so we can create or link your account.

You only need one of these methods; you do not have to use every option.

Information we receive from Google and Apple

When you use Google or Apple sign-in, we receive only what is needed to operate your Fattermap account. We do not request access to your Gmail, Google Drive, contacts, Apple iCloud content, or other data held by those providers beyond basic sign-in.

From Google, we typically receive:

• Your email address
• Your display name
• Your profile picture (if available)

On the web and in our mobile apps, Google sign-in is limited to email and profile information used for authentication.

From Apple, we typically receive:

• Your email address (which may be Apple’s private relay address)
• Your name (only when Apple provides it, usually on first sign-in)

We use this information solely to create and maintain your Fattermap account, display your profile in the app where relevant, and communicate with you about your account when necessary.

We do not use Google or Apple account data for advertising, and we do not sell it. We do not allow Google user data to be used for purposes other than providing and improving Fattermap’s user-facing features, in line with Google’s API Services User Data Policy (including Limited Use requirements where they apply).

Information we store for your account

In addition to the profile fields above, we store:

• A unique account identifier
• Whether your email is verified
• Sign-in provider details (for example that your account is linked to Google or Apple)
• Session information so you stay signed in (for example session tokens, and technical data such as IP address and browser or app user agent, where our authentication system records them)
• OAuth tokens returned by Google or Apple as needed to maintain the link between your Fattermap account and that provider (stored securely on our servers; not exposed in the app interface)

If you use a synced library, routes, folders, and related metadata you save are stored on our servers and associated with your account.

Legal basis (EEA and UK)

If you are in the European Economic Area or the UK, we process this data to perform our contract with you (providing the account and sync features you request) and, where applicable, on the basis of our legitimate interests in keeping the service secure and preventing abuse. Where we send account-related emails (verification, password reset), that processing is necessary to provide the service you asked for.

Where and how long we keep it

Account and library data are stored on servers operated by our hosting and database providers (see section 5). We keep your account data for as long as your account exists. Session data is kept only as long as needed for sign-in and security, according to our session settings (sign-in sessions expire after a period of inactivity or time limit).

When you delete your account, we delete your user record and, through our systems, associated sessions, linked sign-in provider records, verification records tied to your account, and synced library data linked to that account. Some information may remain briefly in backups or logs for a limited period before being overwritten, as described elsewhere in this policy.

How to delete your account

You can delete your account from within the Fattermap app (account settings). Deletion is permanent and removes your synced library from our servers as described above. If you cannot use the app, contact us at contact@fattermap.com and we will help you request deletion.

After deletion, signing in again with the same email or social provider will create a new account; previously deleted data cannot be restored.

Your choices

• You can use email/password instead of Google or Apple, or the reverse, subject to how accounts are linked in the app.
• You can revoke Fattermap’s access in your Google Account permissions or Apple ID settings; you may need to sign in again or use another method until you reconnect or delete your Fattermap account.
• You may have rights to access, correct, or delete personal data under applicable law; contact contact@fattermap.com for requests (see also section 7).

Children

Fattermap is not directed at children under the age required in your jurisdiction without parental consent. We do not knowingly collect account information from children in violation of applicable law.

3. Public Sharing of GPS Tracks

Fattermap offers a feature allowing you to share a GPS track with other users by generating a public link. Sharing requires an explicit action on your part. Anyone with the link can view the shared route. Retention depends on whether you are signed in when you share:

• Without an account (non-authenticated sharing): We upload a copy of the route as it exists at the moment you share it (stored on our servers, including Vercel Blob Storage). The share link remains available for 90 days, after which the copy is removed and the link no longer works. Later changes to the original route on your device are not reflected in the shared copy.
• With an account (authenticated sharing): The share link stays available indefinitely and reflects later modifications to the original route. The link becomes inaccessible if you revoke the share or delete the original route.

4. Sharing Data with Third Parties

We do not sell, rent, or trade your personal data. The app does not contain any third-party advertising.

Personal data is shared with service providers that process it on our behalf to operate Fattermap (see section 5), and in limited cases with other parties as follows:

• Google and Apple — When you choose sign-in with Google or Apple, those providers authenticate you under their own policies; we receive only the account information described in section 2.
• Mapping providers — Only for the technical request of displaying maps (IP address).

5. Subprocessors

We use the following service providers (“subprocessors”) to host Fattermap and process personal data on our behalf. They may only use that data to provide services to us and must protect it under contractual terms consistent with applicable data protection law.

We may update this list from time to time. The “Last updated” date at the top of this policy applies to subprocessors as well.

Vercel Inc.

Role: Hosting and operation of the Fattermap web app and API (serverless functions, CDN, request handling).

Location (typical): United States (and other regions where Vercel operates edge infrastructure).

Personal data involved: Technical data such as IP address, request timestamps, and HTTP metadata in server and platform logs; application data processed when you use the service.

Vercel Inc. — Vercel Blob

Role: Storage of shared route payloads, in particular copies created when you share a route without being signed in.

Location (typical): Same as Vercel Inc. above.

Personal data involved: Content you choose to share (for example route geometry, name, and map settings). Non-authenticated share copies are kept for 90 days. Authenticated shares remain available until you revoke them or delete the original route (see section 3). The content may be personal if you include identifying information.

Vercel Inc. — Vercel Web Analytics

Role: Privacy-oriented usage analytics on the web app.

Location (typical): Same as Vercel Inc. above.

Personal data involved: Aggregated or pseudonymous usage data (for example pages or views). We do not use this product to sell your data.

Neon, Inc. (Neon Postgres)

Role: Database for accounts, authentication records, sessions, and synced library data.

Location (typical): United States — AWS US East 1 (N. Virginia).

Personal data involved: Account identifier, name, email, profile image URL, email verification status, sign-in provider linkage, session metadata (which may include IP address and user agent where recorded), and library items you sync while signed in.

Resend, Inc.

Role: Transactional and product email delivery.

Location (typical): United States.

Personal data involved: Email address and message content for account emails (verification, password reset, email change); waitlist emails and related product communications if you join the mobile beta waitlist; and, if you use feedback, the email address you optionally provide with your message.

6. Security

Your personal data (profiles, online stored tracks, and related account records) is hosted on the secure cloud infrastructure of our subprocessors (see section 5), including Vercel and Neon. We implement industry-standard security measures to protect your information against unauthorized access, alteration, or destruction.

7. Your Rights (GDPR)

In accordance with the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access and portability — Obtain a copy of your data (tracks, profile, and waitlist email).
• Right to rectification — Modify your account information.
• Right to erasure (“right to be forgotten”) — Request the deletion of your account, synchronized tracks, or your waitlist email. For authenticated share links, you can also revoke access or delete the original route in the app (see section 3). Non-authenticated share copies expire automatically after 90 days.

To exercise these rights, or for any questions regarding this privacy policy, you can contact us at contact@fattermap.com.