Privacy Policy

Last updated: July 16, 2026

1. Who We Are

DearMaps is made by Woyava, a small independent studio based in Portugal. For the purposes of the EU General Data Protection Regulation (GDPR), Woyava acts as the data controller for any personal data processed through DearMaps.

Contact:
Email: support@dearmaps.com
Website: www.dearmaps.com

2. Our Privacy Principles

DearMaps is built on a privacy-first, encrypted architecture. This means:

• Your private memories are encrypted on your device before they are stored or synced anywhere. We cannot read, access, or decrypt your private data.
• No ads, no tracking, ever. We do not serve advertisements or sell your data to anyone.
• AI processing happens 100% on your device. Magic Scan uses on-device machine learning to analyze your photo library. No photos or media are ever sent to a server for analysis.
• We make money from subscriptions, not your data.

3. Data We Collect

The data we collect depends on how you use DearMaps:

3.1 Guest Users (No Account)

If you use DearMaps without creating an account, we collect no personal data. All your memories, photos, and media are stored exclusively on your device. Nothing is transmitted to our servers.

3.2 Signed-In Users (Free & Pro)

When you create an account, we collect:

• Authentication data: Email address and display name, provided through Sign in with Apple or Google Sign-In and processed by our authentication providers.
• Profile information: Username, bio, and profile photo you choose to set in your public profile.
• Private sync data: Your encrypted memories are synced using Apple's cloud infrastructure and your personal iCloud account. This data lives in your iCloud storage — we have no access to it and bear no cost for it.

3.3 Published Content (Social Feed)

When you explicitly choose to publish a memory to the public feed, DearMaps:

• Decrypts the content locally on your device
• Strips all metadata (GPS coordinates embedded in photos, camera info, etc.) from media files
• Uploads an optimized copy of the text, photos, videos, and/or audio to our hosting providers
• Stores the location data you assigned to the memory pin

Publishing is always a deliberate, explicit action. Nothing is published without your conscious decision.

3.4 Subscription & Purchase Data

DearMaps Pro subscriptions are processed entirely through Apple's App Store and tracked by our subscription management service. We receive:

• Subscription status (active, expired, cancelled)
• Purchase receipts (anonymized transaction identifiers)
• Entitlement information (whether you have Pro access)

We do not receive or store your payment method, credit card number, or Apple ID password. Payment processing is handled entirely by Apple.

3.5 Crash & Diagnostic Data

We use a crash reporting service to collect anonymous crash reports, including:

• Device model and operating system version
• Crash stack traces and error logs
• App version and build number

This data is not linked to your identity, is not used for advertising, and is solely used to fix bugs and improve app stability.

3.6 Product Analytics

We use analytics providers to understand how people use DearMaps. We track behavioral events such as:

• Onboarding flow completion and drop-off points
• Memory creation, editing, and deletion (counts and types — never content)
• Camera usage (photo/video capture counts)
• Magic Scan usage and free limit events
• Paywall views, purchase attempts, and conversions
• Feed publishing events
• Authentication events (sign-in method, success/failure)
• Screen views and app lifecycle events
• App Tracking Transparency (ATT) prompt results

What we never track: GPS coordinates, memory content (text, titles, descriptions), photo/video data, file paths, private record identifiers, or any content that could reveal what your memories contain.

This data is used solely for product improvement — understanding which features are valuable, where people encounter friction, and how to make DearMaps better. It is not used for advertising, not shared with third parties for marketing purposes, and not used for cross-app tracking.

4. Data We Do NOT Collect

• Browsing history or web activity
• Contacts, calendars, or health data
• Advertising identifiers or cross-app tracking data
• Location data from your device (we only store the location you assign to a memory pin)
• Photos or media for AI analysis (Magic Scan is 100% on-device)
• Any data from people who do not create an account

5. Legal Basis for Processing (GDPR Art. 6)

Under the GDPR, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Processing your authentication data and syncing your memories to provide the DearMaps service you signed up for.
• Consent (Art. 6(1)(a)): Publishing content to the public feed — you actively choose to publish each memory.
• Legitimate interest (Art. 6(1)(f)): Collecting anonymous crash data and product analytics to maintain, improve, and develop the app. Our interest in providing a reliable and well-designed app does not override your rights. Analytics data is used solely for product improvement, not advertising or profiling.
• Legal obligation (Art. 6(1)(c)): Retaining transaction records as required by Portuguese and EU tax law.

6. Third-Party Services

DearMaps relies on a small number of trusted service providers to operate. These providers only process the data described above and are bound by their own privacy policies:

• Our authentication and social backend providers — handle sign-in, the public feed, and file hosting. Servers located in the EU.
• Apple's cloud infrastructure (private encrypted sync) — Apple Privacy Policy. Data stored in your personal iCloud account.
• Our analytics providers — process behavioral events and screen views. Data may be processed in the United States under Standard Contractual Clauses.
• Our crash reporting service — processes anonymous crash data, which may be handled in the United States under Standard Contractual Clauses.
• Our subscription management service — processes anonymized purchase data.
• Apple App Store (payments) — Apple Privacy Policy. All payments are processed directly by Apple.

7. International Data Transfers

Your data may be transferred outside the European Economic Area (EEA) in the following cases:

• Analytics and crash reporting: May be processed in the United States, protected by EU Standard Contractual Clauses (SCCs).
• Subscription management: Anonymized subscription data may be processed in the United States, protected by SCCs.
• Apple's cloud infrastructure: Your encrypted data is stored in Apple's data centers, which may include locations outside the EU, subject to Apple's data processing agreements.

Our primary backend providers operate EU-based servers for DearMaps.

8. Data Retention

• Account data: Retained for as long as your account is active. Deleted upon account deletion request.
• Published content: Retained while published. You can unpublish at any time, which removes the content from public view. Content is permanently deleted when you delete the memory or your account.
• Crash reports: Retained for 90 days, then automatically purged.
• Purchase records: Retained as required by Portuguese and EU tax law (typically 10 years for financial records).
• Encrypted local data: Remains on your device and in your iCloud until you delete it. We have no access to this data.

9. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data we hold.
• Right to rectification (Art. 16): Correct inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"). When you delete your account, all your data — including social database records, published content, and hosted files — is permanently and irreversibly deleted. No data ghosts remain.
• Right to restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Withdraw your consent for published content at any time by unpublishing your memories.

To exercise any of these rights, contact us at support@dearmaps.com. We will respond within 30 days as required by the GDPR.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

10. Account Deletion

You can delete your account at any time from within the app (Settings → Delete Account). When you do:

• Your authentication record is permanently deleted
• Your public profile, published memories, and all associated media are permanently deleted from our servers
• Your social interactions (reactions, etc.) are permanently removed
• Local data on your device remains under your control — you can delete the app to remove it
• Your iCloud data is managed by Apple and can be removed through your iCloud settings

This process is irreversible. No data can be recovered after deletion.

11. Children's Privacy

DearMaps is not directed at children under 13 years of age (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Security

We implement appropriate technical and organizational measures to protect your data:

• End-to-end encryption for private memories (end-to-end encryption)
• Metadata stripping before any content leaves your device
• Strict access-control policies on all backend databases
• HTTPS encryption for all network communications
• No plaintext storage of sensitive data on our servers

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by updating the "Last updated" date at the top of this page. Your continued use of DearMaps after changes become effective constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or your data, contact us:

Woyava
Email: support@dearmaps.com
Website: www.dearmaps.com/support
Location: Portugal, European Union