Privacy Policy
In short: our server knows your email address and a scrambled form of your password. Your rides and where you ride stay on your phone, unless you turn on backup, and even then nothing near your home and no GPS track ever leaves it. The website sets no cookies, and the waitlist holds only your email address until you unsubscribe.
CartoRealm ("the app") is provided by Kevin Beqo, Rotterdam, the Netherlands ("we"). We are the controller of the personal data described here. Contact: privacy@cartorealm.com.
Your account
You need an account to use the app. For it, our server stores:
| Data | Why | Kept until |
|---|---|---|
| Email address (also your login name) | To identify your account, sign you in and send password-reset and verification codes | You delete your account |
| Password, as a bcrypt hash | To check your password. We never store or see the password itself | You delete your account or change the password |
| Whether you confirmed your email address, and when | To know that codes reach you | You delete your account or change your email |
| Terms version and the time you accepted it | To show which terms you agreed to | You delete your account |
| Account creation and last-update times | To run the account | You delete your account |
| A session counter | To sign you out on every device when you change your password or ask us to | You delete your account |
| A password-reset code, as a hash | To let you set a new password | Used, replaced, or 15 minutes pass |
| An email-verification code, as a hash | To confirm your email address | Used, replaced, or 24 hours pass |
We do not ask for your name, phone number, photo or birthday.
When the app talks to our server, the server briefly uses your IP address to limit repeated sign-in and sign-up attempts. Our host, Railway, keeps request logs (IP address, time and the address requested) for up to 30 days.
What stays on your phone
The app records your location only after you tap Start ride, and stops when you tap Stop. It uses location in the background during a recording so a ride keeps recording with the screen off. It never starts recording by itself.
On your phone the app keeps your recorded rides (GPS points), the map squares you have ridden through, the places you stopped, the stops you collected, your cards, level and stats, and a sign-in token in the phone's secure storage. Each account on the phone has its own store. This stays on the phone until you uninstall the app, including after you sign out or delete your account.
Navigation routes are planned on your phone, from routing maps you download. We never see where you start, where you are going or the route you take.
Test metrics. The app also counts events on your phone, such as how many rides you recorded and how often you opened the app. These counts contain no locations, places or account details. They leave the phone only if you tap "Share test metrics" and choose where to send them.
Backup (optional)
Backup is off until you turn it on. It keeps a copy of your progress on our server so a new phone can restore it. During testing it is open only to testers we have added to a list of allowed email addresses.
Before anything is backed up, you set a privacy zone around places you want to keep private, such as your home. The app moves each zone's centre at random by up to half its radius, so the zone doesn't point at your door. Nothing inside a zone is backed up. The first and last 500 m of every ride, the places you stopped and your GPS tracks never leave the phone either.
What a backup holds:
| Data | What it says |
|---|---|
| Your privacy zones | Each zone's moved centre and its radius (at least 1 km) |
| Map squares you collected outside your zones | Which squares (about 100 m across), which ride first crossed each and when |
| Your rides | Start and end time, distance and number of GPS points. No GPS points |
| Which squares each ride crossed | Outside your zones, without the first and last 500 m |
| Stops you collected outside your zones | Which stop and when |
| Cards and your level | Which cards you earned, your highest level, tiers and unlocks |
| Rides you deleted or hid | Their id and when |
The backup is kept until you tap "Stop backing up", which deletes it from our server, or until you delete your account. The squares you collected are a picture of where you ride: that is why the privacy zone and the trimmed ride ends exist.
The website and the waitlist
Our website, cartorealm.com, uses no cookies, analytics or trackers, and loads nothing from other sites. Cloudflare serves it (see below).
If you join the waitlist, we keep:
| Data | Why | Kept until |
|---|---|---|
| Your email address | To email you when CartoRealm opens to more riders, and about the waitlist itself | You unsubscribe, or 12 months after the app's public launch, whichever comes first |
| The phone you chose (Android or iPhone) | To know whom to tell first | The same |
| The page you signed up on, and its language | To know which page works | The same |
| When you confirmed your email address | To show that you asked to join | The same |
Nothing goes on the list until you tap the link in the confirmation email. The waitlist is separate from app accounts: joining it doesn't create an account, and we don't link it to one.
When you send the form, the website uses your IP address for a moment to limit repeated attempts. It isn't stored or passed to Brevo.
Other services we use
| Service | What it receives | Why |
|---|---|---|
| Cloudflare (Cloudflare, Inc., USA) | Your IP address, browser details and the pages you open on cartorealm.com | To serve the website and protect it from attacks |
| Railway (Railway Corporation, USA), servers in its EU West region | Everything our server stores (above) and its request logs | To run our server |
| Brevo (Sendinblue SAS, France) | Your email address and the code in the email; for the waitlist, the details in The website and the waitlist | To send verification and password-reset emails, and to keep the waitlist and send its emails. Brevo keeps its log of sent emails for 1 month |
| OpenFreeMap | Your IP address and which map areas you view | To draw the map |
| Our server, for downloads | Your IP address and which file you download (for a routing map, its region) | To download featured stops, the stops list, game settings and the routing maps you choose. These downloads carry no account details |
If you email us, your message passes through Cloudflare's email forwarding (Cloudflare, Inc., USA) to our mailbox.
We don't sell your data, show ads or use analytics or advertising trackers.
Legal bases
We process your account data to provide the app you signed up for (contract, GDPR Art. 6(1)(b)). We back up your progress because you turned backup on (consent, Art. 6(1)(a)); you withdraw it by tapping "Stop backing up", which deletes the backup. We keep you on the waitlist because you asked to join it (consent, Art. 6(1)(a)); you withdraw it with the unsubscribe link in every waitlist email, or by writing to privacy@cartorealm.com. We use IP addresses for rate limiting in the app and on the website's form, and request logs, to keep accounts and the server secure (legitimate interests, Art. 6(1)(f)).
Railway and Cloudflare are US companies. Railway's transfers are covered by the EU standard contractual clauses in our data processing agreement with it; Cloudflare is certified under the EU-US Data Privacy Framework.
Your rights
You can do these in the app, under Stats → Account:
- See and download your account data and your backup ("Download my account data")
- Correct your email address
- Stop backing up, which deletes the backup from our server
- Delete your account. This removes it and its backup from our server immediately and signs you out everywhere
Without the app, you can ask for deletion as described on Delete your account. You can also ask us at privacy@cartorealm.com to access, correct, delete, restrict or port your data, or object to processing. You may complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
Our server keeps no database backups at the moment, so deleted data is gone at once. If we add them, deleted data drops out of them within 30 days.
Security
Connections to our server are encrypted (HTTPS). Passwords are stored only as bcrypt hashes, and sign-in tokens expire after 90 days.
Children
The app is not meant for anyone under 16, and we don't knowingly create accounts for them.
Changes
If we change this policy, we'll update the version and date above, and the app will ask you to accept the new version where the law requires it.