Privacy Policy

Last updated: September 19, 2026

1. Who We Are

DearMaps is made by Juan David Gutierrez Olarte, an independent developer based in Portugal who publishes apps under the name Woyava. For the purposes of the EU General Data Protection Regulation (GDPR), he is the data controller for any personal data processed through DearMaps. In this policy, "we" and "us" refer to him.

Contact:
Email: support@dearmaps.com
Website: www.dearmaps.com

2. Our Privacy Principles

DearMaps is built on a privacy-first, encrypted architecture. This means:

• Your private memories are encrypted on your device before they are stored or synced anywhere. We cannot read, access, or decrypt your private data.
• No ads, no tracking, ever. We do not serve advertisements or sell your data to anyone.
• AI runs on your device by default. Magic Scan and the "Suggest" feature use on-device machine learning. Your photo library is never uploaded for analysis.
• Cloud AI is opt-in, one memory at a time. Some optional features ("Enhance with AI") use a cloud AI provider. Nothing is sent unless you turn it on for that specific memory (see section 3.7).
• We make money from subscriptions, not your data.

3. Data We Collect

The data we collect depends on how you use DearMaps:

3.1 Guest Users (No Account)

If you use DearMaps without creating an account, we collect no personal data. All your memories, photos, and media are stored exclusively on your device. Nothing is transmitted to our servers.

3.2 Signed-In Users (Free & Pro)

When you create an account, we collect:

• Authentication data: Email address and display name, provided through Sign in with Apple or Google Sign-In and processed by our authentication providers.
• Profile information: Username, bio, and profile photo you choose to set in your public profile.
• Private sync data: Your encrypted memories are synced using Apple's cloud infrastructure and your personal iCloud account. This data lives in your iCloud storage — we have no access to it and bear no cost for it.

3.3 Published Content (Social Feed)

When you explicitly choose to publish a memory to the public feed, DearMaps:

• Decrypts the content locally on your device
• Strips all metadata (GPS coordinates embedded in photos, camera info, etc.) from media files
• Uploads an optimized copy of the text, photos, videos, and/or audio to our hosting providers
• Stores the location data you assigned to the memory pin

Publishing is always a deliberate, explicit action. Nothing is published without your conscious decision.

3.4 Subscription & Purchase Data

DearMaps Pro subscriptions are processed entirely through Apple's App Store and tracked by our subscription management service. We receive:

• Subscription status (active, expired, cancelled)
• Purchase receipts (anonymized transaction identifiers)
• Entitlement information (whether you have Pro access)

We do not receive or store your payment method, credit card number, or Apple ID password. Payment processing is handled entirely by Apple.

3.5 Crash & Diagnostic Data

We use a crash reporting service to collect anonymous crash reports, including:

• Device model and operating system version
• Crash stack traces and error logs
• App version and build number

This data is not linked to your identity, is not used for advertising, and is solely used to fix bugs and improve app stability.

3.6 Product Analytics

We use analytics providers to understand how people use DearMaps. We track behavioral events such as:

• Onboarding flow completion and drop-off points
• Memory creation, editing, and deletion (counts and types — never content)
• Camera usage (photo/video capture counts)
• Magic Scan usage and free limit events
• Paywall views, purchase attempts, and conversions
• Feed publishing events
• Authentication events (sign-in method, success/failure)
• Screen views and app lifecycle events
• App Tracking Transparency (ATT) prompt results

What we never track: GPS coordinates, memory content (text, titles, descriptions), photo/video data, file paths, private record identifiers, or any content that could reveal what your memories contain.

This data is used solely for product improvement — understanding which features are valuable, where people encounter friction, and how to make DearMaps better. It is not used for advertising, not shared with third parties for marketing purposes, and not used for cross-app tracking.

3.7 Optional Cloud AI ("Enhance with AI")

Some features can use a cloud AI model to write a title and story for a memory, describe a photo, transcribe a voice note, or summarize several memories. These features are off by default and work like this:

• Consent per memory. Nothing leaves your device unless you turn on AI processing for that specific memory. You can turn it off again at any time, which also removes the AI markings and AI-derived tags from that memory.
• Only what the feature needs. Depending on the feature: short text about the memory (place name, date, tags detected on your device, and any note you wrote), a reduced copy of one photo with all metadata removed, or the audio of a voice note. We never send GPS coordinates, original files, or your account details to the AI provider.
• Not available to guests. Cloud AI requires an account, because usage limits are applied per account.
• How it travels. Requests go from the app to our own server, which checks your consent and your usage allowance and forwards the request to Mistral AI (Paris, France). The app never contacts the AI provider directly.
• What we keep. We do not store the text, photos, audio, or AI responses on our servers. We keep only usage records (which feature was used, the model, the amount of processing, an estimated cost, and the date) so we can apply fair-use limits.
• What the provider keeps. Mistral AI processes the data as our processor under its Data Processing Agreement. We have disabled the use of our data to train its models. Mistral AI may keep requests for up to 30 days to detect and prevent abuse, after which they are deleted.
• You always see what the AI wrote. AI-generated text is labelled in the app, and nothing is saved until you review and accept it.

3.8 "What happened here?" (Place Discovery)

When you use the discovery layer on the map, the app asks Wikipedia (Wikimedia Foundation) for notable places near the area you are looking at. The request contains only the approximate centre of that map area (rounded to a grid of about 900 metres) and a search radius. It contains no account information and nothing about your memories. Results are cached on your device.

4. Data We Do NOT Collect

• Browsing history or web activity
• Contacts, calendars, or health data
• Advertising identifiers or cross-app tracking data
• Location data from your device (we only store the location you assign to a memory pin)
• Your photo library for analysis (Magic Scan runs 100% on your device)
• Any data from people who do not create an account

5. Legal Basis for Processing (GDPR Art. 6)

Under the GDPR, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Processing your authentication data and syncing your memories to provide the DearMaps service you signed up for.
• Consent (Art. 6(1)(a)): Publishing content to the public feed — you actively choose to publish each memory — and optional cloud AI processing, which you enable for each memory individually.
• Legitimate interest (Art. 6(1)(f)): Collecting anonymous crash data and product analytics to maintain, improve, and develop the app. Our interest in providing a reliable and well-designed app does not override your rights. Analytics data is used solely for product improvement, not advertising or profiling.
• Legal obligation (Art. 6(1)(c)): Retaining transaction records as required by Portuguese and EU tax law.

6. Third-Party Services

DearMaps relies on a small number of trusted service providers to operate. These providers only process the data described above and are bound by their own privacy policies:

• Our authentication and social backend providers — handle sign-in, the public feed, usage limits for cloud AI, and hosting of published media. Servers located in the EU.
• Mistral AI (Paris, France) — processes optional cloud AI requests (section 3.7) as our processor. Mistral AI Privacy Policy.
• Wikipedia / Wikimedia Foundation — answers place-discovery lookups (section 3.8). No account data is sent. Wikimedia Privacy Policy.
• Apple's cloud infrastructure (private encrypted sync) — Apple Privacy Policy. Data stored in your personal iCloud account.
• Our analytics providers — process behavioral events and screen views. Data may be processed in the United States under Standard Contractual Clauses.
• Our crash reporting service — processes anonymous crash data, which may be handled in the United States under Standard Contractual Clauses.
• Our subscription management service — processes anonymized purchase data.
• Apple App Store (payments) — Apple Privacy Policy. All payments are processed directly by Apple.

7. International Data Transfers

Your data may be transferred outside the European Economic Area (EEA) in the following cases:

• Analytics and crash reporting: May be processed in the United States, protected by EU Standard Contractual Clauses (SCCs).
• Subscription management: Anonymized subscription data may be processed in the United States, protected by SCCs.
• Apple's cloud infrastructure: Your encrypted data is stored in Apple's data centers, which may include locations outside the EU, subject to Apple's data processing agreements.
• Cloud AI: Mistral AI is based in the EU. If it uses sub-processors outside the EEA, transfers are made only to countries with an adequacy decision or under Standard Contractual Clauses, as set out in its Data Processing Agreement.
• Place discovery: Wikipedia lookups are answered by the Wikimedia Foundation in the United States. They contain only a rounded map location and no personal identifiers.

Our primary backend providers operate EU-based servers for DearMaps.

8. Data Retention

• Account data: Retained for as long as your account is active. Deleted upon account deletion request.
• Published content: Retained while published. You can unpublish at any time, which removes the content from public view. Content is permanently deleted when you delete the memory or your account.
• Crash reports: Retained for 90 days, then automatically purged.
• Cloud AI usage records: Retained for as long as your account is active; deleted with your account. The content of AI requests is not stored on our servers; the AI provider may keep it for up to 30 days for abuse prevention.
• Purchase records: Retained as required by Portuguese and EU tax law (typically 10 years for financial records).
• Encrypted local data: Remains on your device and in your iCloud until you delete it. We have no access to this data.

9. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data we hold.
• Right to rectification (Art. 16): Correct inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"). When you delete your account, all your data — including social database records, published content, and hosted files — is permanently and irreversibly deleted. No data ghosts remain.
• Right to restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Withdraw your consent for published content at any time by unpublishing your memories, and for cloud AI by turning it off for a memory.

To exercise any of these rights, contact us at support@dearmaps.com. We will respond within 30 days as required by the GDPR.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

10. Account Deletion

You can delete your account at any time from within the app (Settings → Delete Account). When you do:

• Your authentication record is permanently deleted
• Your public profile, published memories, and all associated media are permanently deleted from our servers
• Your social interactions (reactions, etc.) are permanently removed
• Your cloud AI usage records are permanently deleted
• Local data on your device remains under your control — you can delete the app to remove it
• Your iCloud data is managed by Apple and can be removed through your iCloud settings

This process is irreversible. No data can be recovered after deletion.

11. Children's Privacy

DearMaps is not directed at children under 13 years of age (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of private memories on your device (AES-GCM), with keys that never leave it
• Metadata stripping before any photo leaves your device, whether you publish it or send it to cloud AI
• Strict access-control policies on all backend databases
• HTTPS encryption for all network communications
• No plaintext storage of sensitive data on our servers

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by updating the "Last updated" date at the top of this page. Your continued use of DearMaps after changes become effective constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or your data, contact us:

Juan David Gutierrez Olarte (Woyava)
Email: support@dearmaps.com
Website: www.dearmaps.com/support
Location: Portugal, European Union