Privacy Policy

In short: no ads, no tracking cookies, no selling of data.

Controller

The controller responsible for data processing is the operator of Planted Maps named in the imprint. Contact: hello@getmind.io.

The short version

• Planted Maps is free and is not paid for with your data: no ads, no tracking cookies, no selling of data, no profiling.
• You only need an account to write reviews, add photos, keep lists and suggest places. The map and navigation work without one.
• Your location is determined on your device and is not stored in your account.

Using the website and app (server logs)

Every request to our server involves technically necessary data: IP address, time, requested address and browser/app identifier (user agent). We use it to deliver content and to fight abuse (e.g. per-IP rate limits, detecting automated access). Legal basis: Art. 6(1)(f) GDPR (secure, stable operation). Server logs are kept only briefly.

Your account

If you create an account we store: your email address, your password only as a secure hash (bcrypt), display name, an optional profile picture, the creation date and whether your email is confirmed. We use your email only for the confirmation mail, password resets and – if ever needed – important notices about your account, never for newsletters. Legal basis: Art. 6(1)(b) GDPR (contract).

Content you create

• Reviews and photos are public, together with your display name and profile picture. Uploaded photos are re-encoded on our server, which removes all metadata including EXIF and GPS data.
• Lists are private unless you make them public yourself. Public lists show the list name, its places and your display name.
• "Been here" visits are private; only the total number of visits of a place is shown, without names.
• Suggestions and reports (new places, edits, reported reviews/photos) are only seen by our moderators.

Location

With your permission, your location is determined on your device and used there for the map view and navigation. Our server only receives map coordinates when a feature needs them: the "nearby" list, route calculation (start and destination) and determining your country/language. These coordinates are not linked to your account and are not stored as a movement history.

Third-party services

• Stadia Maps, Inc. (USA) – routing and place/address search. Our server makes the request; Stadia receives the start/destination coordinates or search text, but not your IP address.
• Google (Google Ireland Ltd. / Google LLC) – (1) Google Places: for a restaurant's detail view our server requests ratings and photos from Google using the restaurant's name and coordinates – no data about you. Photos are delivered through our server. (2) Google Cloud Text-to-Speech: navigation prompts (e.g. "Turn left onto Main Street") are converted to speech by our server; no personal data is sent.
• Mailgun Technologies, Inc. (USA) – sending our emails (confirmation, password reset), which requires your email address and the content of the mail.
• Map tiles – your device loads the background map directly from OpenFreeMap (openfreemap.org), which sees your IP address. Map style, fonts and app files come from our own server.
• Places data – restaurant data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL), supplemented by the Overture Maps Foundation (© Overture Maps Foundation, CDLA-Permissive-2.0). Our server fetches/imports it; no data about you is involved.
• Analytics – we use self-hosted, cookieless Tacilytics (analytics.heynyx.dev). On the website it counts page views and clicks on external links; in the apps it counts screens viewed and features used (e.g. "directions started"). No cookies, no stored IP addresses, no device or advertising IDs and no user profiles; the apps only use a random ID created at launch and never stored. Do-Not-Track / Global Privacy Control is honored, and the apps have an off switch in Settings. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly product improvement).

Where providers are based in the USA, transfers rely on the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) or (f) GDPR.

Storage on your device

The app or browser stores your sign-in token and settings (e.g. language) locally. This is technically necessary and not used for tracking.

Retention and deletion

We keep your account data and content until you delete them or your account. You can delete your account at any time right in the app (in your profile) or at plantedmaps.com/account/delete. This immediately removes your account, reviews, photos (including the image files), lists and visits; place suggestions that were already accepted stay as map data, no longer linked to you. Password-reset links expire after one hour. Backups are overwritten in the normal rotation.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20 – we provide your data as a JSON file) and to object to processing based on legitimate interests (Art. 21). Just write to hello@getmind.io. You can also lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR).

Children

Planted Maps is not directed at children under 16. Please don't create an account if you are younger.

Changes

When features change we update this policy. The current version is always available here.

Last updated: October 2026