Privacy policy

The controller for data processing on maps.dog is zflys GmbH, Zappestraße 3, 4040 Linz, Austria. For any privacy question or to exercise your rights, use the contact form.

• Visiting the website: When you open a page your browser sends technically necessary data (IP address, time, page, browser). Our hosting provider processes it to deliver the site and protect it from abuse, and keeps server logs only briefly. Legal basis: legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
• Account: When you sign in (with an email link) we store your email address and a display name, to link your contributions, reviews and saved lists to your account. Legal basis: the contract for using maps.dog (Art. 6(1)(b) GDPR). The account stays until you ask us to delete it.
• Contributions: Places, photos, reviews and reports you submit. We review new places and photos before they go live. Your display name is shown publicly with your reviews. Photos are resized in your browser before upload, which removes metadata such as where they were taken. Notes on a place you submit are visible only to you and our moderators.
• Saved lists: Places you save to lists are private and visible only to you.
• Emails: We send sign-in links and short messages about your contributions (for example “Your place is live”). You only get promotional emails or the newsletter if you sign up for them yourself.
• Contact form: Name (optional), email address, topic and message, to answer your request (Art. 6(1)(b) and (f) GDPR). To prevent abuse we store a shortened, hashed value of your IP address (not the address itself) and limit messages per hour. We delete messages at the latest twelve months after the request is closed.
• Newsletter and updates: Only with your consent (Art. 6(1)(a) GDPR) and after you confirm by email (double opt-in): email address, language, chosen topics and the time of sign-up and confirmation as proof. Unsubscribe at any time with the link in every email; after that you get no more newsletters. We keep the proof of consent for up to three years.
• Bot protection: The contact form and newsletter sign-up use Cloudflare Turnstile. Turnstile checks technical signals from your browser and your IP address to tell whether a person is sending the form, and sets no advertising cookies. Legal basis: legitimate interest in preventing spam (Art. 6(1)(f) GDPR).
• Location: Only when you tap “Show my location” does your browser ask for your location. It is used only on your device to move the map, and is never sent to us or stored.
• Storage in your browser: We keep the map position and filters in your browser's storage (localStorage) so the map picks up where you left off. Signing in uses strictly necessary cookies. So that maps.dog opens offline, the app keeps public pages you visited on your device – never personal pages such as your lists. We use no tracking, analytics or advertising cookies and no profiling.

We use carefully selected providers. Where they process personal data on our behalf, we have data processing agreements in place.

• Vercel Inc. (USA): Hosting and delivery of the website.
• Supabase Inc. (USA): Database, sign-in and photo storage.
• Resend Inc. (USA): Sending all emails (sign-in links, notifications, contact requests, newsletters) and managing newsletter subscriptions.
• Cloudflare, Inc. (USA): Turnstile, the bot protection on the contact form and newsletter sign-up.
• Google Ireland Ltd. / Google LLC: Our server looks up place information (opening hours, ratings, photos) on Google Maps; no data about you is sent, and photos are loaded through our server.
• OpenFreeMap: Map tiles. Your browser loads them directly, which sends your IP address to the map server.
• Photon (komoot GmbH, Germany): Address search. Your search term and map area are sent to the service.

Some providers are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses (Art. 45 and 46 GDPR).

Write to us via the contact form, using your account's email address. We delete your account and lists; published places remain without any link to you, and we delete your reviews and photos too if you ask.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and can withdraw consent at any time. Just write to us using the contact form.

If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority: dsb.gv.at