MAPPO

Privacy Policy

Last updated: 30 October 2026

Mappo is an app to record, plan and share outdoor adventures. This policy explains what personal data Mappo collects, why, who else handles it, and the choices you have. It applies to the Mappo iOS app and to the web pages at mappoapp.com.

1. Who is responsible

The data controller is Andrea Rossi, an individual developer resident in Switzerland. For anything about your data, write to support@mappoapp.com.

2. What we collect

  • Account. Your email address (or the anonymous relay address if you use Sign in with Apple), the name and username you choose, and optionally a profile photo and a short bio. Your password is handled by our authentication provider and is never visible to us.
  • Activities and routes. The GPS tracks you record, import or plan (positions, times, altitude), the stats computed from them (distance, elevation, duration, speed) and anything you add: photos, videos, captions, titles, the places you pin on a track, the friends you tag. Imported activities can also carry heart rate and calories when the source provides them.
  • Location. While you record an activity, Mappo reads your location, including in the background so the track stays continuous when your phone locks. Outside a recording, your location is used on the device to centre the map and show the routes near you; it is not stored unless you record or save something.
  • Social activity. Who you follow, likes, comments, saved routes and lists, the trips you create or join, the events you create or join, and the direct messages you send.
  • Connected services. If you connect Strava, Polar or another service, we store the access tokens that service gives us, and the activities we import with them.
  • Apple Health. If you allow it, Mappo reads your workouts and their routes from Apple Health to import them, and can save activities you record to Apple Health.
  • Technical data. A push notification token for your device, your app settings (units, privacy options), and crash reports (device model, OS version, app version and the technical details of the error).

We do not use advertising, we do not track you across other companies' apps or websites, and we do not sell personal data.

3. Why we use it

  • To provide Mappo — your account, recording, the map, feeds, sharing, trips, messages and imports. Legal basis: performance of our contract with you (GDPR art. 6(1)(b)).
  • With your permission — location, photos, Apple Health and notifications are only used after you allow them in iOS, and you can withdraw that at any time in iOS Settings (art. 6(1)(a) and 9(2)(a) for health data).
  • To keep Mappo safe and working — crash reports, abuse reports and blocking, preventing misuse. Legal basis: our legitimate interest (art. 6(1)(f)).
  • To comply with the law when we must (art. 6(1)(c)).

4. Who can see what

  • Published posts are public: anyone can see them in Mappo, on the map, and on their web page at mappoapp.com, without an account. Private activities are visible only to you.
  • Your profile (name, username, photo, bio, published posts) is public unless you make your account private in Settings; then only your approved followers see your posts.
  • Hide start and end (Settings, and per post) removes the first and last 200 m of your tracks from what others see, to protect places like your home.
  • Activities imported automatically from Apple Health or a connected service follow the visibility you choose for imports.
  • Trips are visible to their participants, and to anyone holding a share link you create; you can turn the link off at any time.
  • Direct messages are visible to you and the person you write to.

5. Service providers we use

These companies process data on our behalf, only to run the parts of Mappo listed, under contracts that require them to protect it:

  • Supabase — database, file storage and sign-in (hosted in the European Union, Ireland).
  • Mapbox — maps, place search and matching tracks to roads and trails. The Mapbox map component also sends Mapbox anonymous usage telemetry.
  • Cloudflare — serves the mappoapp.com web pages, and stores and delivers the photos and videos of the posts you publish.
  • wsrv.nl — resizes public photos into thumbnails.
  • Expo — delivers push notifications and app updates.
  • Sentry — crash reports.
  • Apple — Sign in with Apple, Apple Health, push notifications.
  • OpenRouteService, OpenStreetMap / Overpass and OpenTopoData — route planning, trail data and elevation. When you plan a route, the points you place are sent to them.
  • Garmin, Strava, Polar and the other services you choose to connect — only if you connect them, to import your activities.

Some of these providers are outside the European Economic Area. Where that is the case, transfers rely on an adequacy decision or the European Commission's Standard Contractual Clauses.

6. Health and fitness data

Data from Apple Health and from connected devices or services (Garmin Connect, Strava, Polar and others) is used only to show your activities in Mappo. It is never used for advertising, never sold, and never shared with third parties other than the providers in section 5 that are needed to store and display it: Supabase stores it, Mapbox draws it on the map, Expo and Apple deliver the notification that a new activity has arrived (with its title), and Sentry may receive it inside a crash report.

When you connect Garmin, Garmin sends us each new activity (time, type, distance, duration, elevation, calories and GPS track) after your device syncs. Imported activities are private until you choose to post them. You can disconnect Garmin at any time in Settings or in your Garmin Connect account; disconnecting, or deleting your Mappo account, ends the connection at Garmin. To export your data, write to us (section 9).

7. Artificial intelligence

Mappo does not send your data — including data from Garmin, Apple Health or any connected device or service — to artificial-intelligence providers, and does not use it to train AI models.

8. How long we keep it

We keep your data while your account exists. You can delete any post at any time, and delete your whole account in the app (Settings → Delete account): your profile, activities, photos, videos, comments, likes, messages and connections are deleted. Copies in our providers' backups are removed within 30 days. Crash reports are kept for 90 days.

9. Your rights

Under the Swiss Federal Act on Data Protection and, if you live in the European Union, the GDPR, you can ask us to access, correct, delete or export your data, to restrict or object to its use, and you can withdraw a permission you gave at any time. Write to support@mappoapp.com; we answer within one month. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority of the country where you live.

10. Children

Mappo is not meant for children under 14, and we do not knowingly collect their data. If you think a child has created an account, write to us and we will delete it.

11. Changes

If we change this policy in a way that matters, we will tell you in the app before the change applies. The date at the top always shows the current version.

Privacy · Terms