Maastokartat Privacy Policy

Effective date 3.9.2026
Version 2.1

1. Introduction

This privacy policy describes how MapsiTech Oy ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Maastokartat application ("the app", "our service").

In this policy, personal data refers to any information relating to an identified or identifiable person, such as name, email address, location data, or device identifier.

We use your personal data solely for providing the service and ensuring its functionality. We do not sell, rent, or share your data with third parties for other purposes.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller

MapsiTech Oy
Email: privacy@mapsitech.fi

2. Data We Collect

2.1 Location Data

When you use location-based features, we collect:

GPS coordinates
Altitude
Speed and heading
Accuracy information
Timestamps

Location data is essential for many of the app's map and navigation features, but you can also use the app without location services, for example, just for viewing maps.

2.2 User-Generated Content

Content you create in the app:

Places: Locations you add including title, description, keywords, and coordinates
Tracks: Tracks you record and plan including title, description, duration, distance, and track points with timestamps
Groups: Groups you create to organise places and tracks
Users: Information about paired users for location sharing

2.3 Search Data

When you use the search functionality:

Search queries you enter
Your location or search area (for providing relevant results)

2.4 Account Data

If you create an account in the app, we collect:

Email address
Display name (if provided)
Profile image URL (if provided)
Authentication method
Unique user identifier

2.5 Purchase Data

When you make purchases, we collect the following information:

Purchased products
Purchase timestamp
Transaction identifier
Subscription status (active, expired, paused)
Subscription expiry date

Payment processing is handled entirely by Google Play. We do not have access to your payment card details.

2.6 Device Information

For technical purposes, we collect:

Device brand and model
Operating system version
App version
Session information (last active timestamp)
IP address (for server communication)

2.7 Health Data (Optional)

If you connect a Bluetooth heart rate monitor:

Heart rate measurements and timestamps
Your maximum heart rate setting
Calculated statistics (average heart rate, heart rate zones)

Heart rate data collection is entirely optional and only starts when you enable it.

Note: Heart rate data is sensitive health information. We only collect it when you connect a heart rate monitor and enable the feature, which serves as your consent.

2.8 Crash Reporting (Optional)

Crash reporting helps us keep the app reliable. If something goes wrong and the app stops unexpectedly, technical details about the error are sent to us so we can investigate and fix it.

If you enable crash reporting, we collect technical error information such as:

Error messages and stack traces
Device technical state at the time of the error
App version

Crash reporting is optional and can be enabled or disabled in the app settings. Depending on your device settings, the operating system may collect some crash data regardless of this setting.

2.9 Analytics Data (Optional)

Analytics helps us make sure the app runs well and decide where to focus improvements. We look at which features and screens are used and how the app performs, so we know what to improve next.

If you enable analytics, we collect app usage information such as:

Feature usage and interactions
Screen views and in-app navigation
Performance-related metrics
Pseudonymous analytics identifier

We only look at this data in aggregate and do not use it to identify individual users. Analytics is voluntary and based on your consent. You can enable or disable it in the app settings.

2.10 Local Storage and Synchronisation

Maastokartat is designed to work offline. All your data is stored locally on your device, allowing you to use the app without an internet connection with offline-downloaded maps.

Locally stored data includes:

Places and tracks
Saved map areas for offline use
Paired users
App settings and preferences, such as map display and app behaviour choices

If you sign in to your account, your data can be synchronised to the cloud, allowing you to access it on multiple devices. You can use the app entirely without an account, in which case your data remains only on your device and is not sent to our servers.

3. App Permissions

The app requests the following permissions when needed:

Location: Location on map, distances, navigation, track recording
Notifications: Track recording status, offline download progress, navigation to destination
Bluetooth: Connection to heart rate monitors

Additionally, the app uses internet connection for downloading maps, cloud synchronisation, and other server communication.

We do not request access to your camera, microphone, contacts, or phone.

4. How We Use Your Data

We use the collected data for the following purposes:

Provide map and navigation services: Location data
Search functionality: Search queries, location
Location sharing with other users: Location data
Barometric altitude calibration: Coarse location
Heart rate tracking: Health data
User account management: Account data
Sync data across your devices: User-generated content, settings
Process purchases and manage subscriptions: Purchase data
Technical support and troubleshooting: Device information
Crash reporting: Device information, crash logs
Analytics, service improvement: Aggregated usage data

5. Legal Bases for Processing

We process your personal data on the following legal bases under GDPR:

Contract performance: Map and navigation services, search functionality, altitude calibration, account management, data synchronisation, purchase processing
Consent: Location sharing, heart rate tracking, crash reporting, analytics
Legitimate interest: Technical support, service improvement

We rely on legitimate interest only where we have confirmed that our processing does not negatively affect your privacy rights.

6. Data Sharing

6.1 Location Sharing Feature

You can optionally share your real-time location with other Maastokartat users. This requires:

Enabling the feature in settings
Acceptance of pairing requests from users you want to share with
Active enabling of sharing for each paired user

You can disable location sharing at any time from the app settings.

6.2 We Do Not Sell Your Data

We do not sell, rent, or trade your personal data to third parties for any purpose.

6.3 No Advertisements

The Maastokartat app does not display advertisements. We do not share your data with advertising networks and do not use your data for targeted advertising.

7. Third-Party Services

We use the following third-party services to provide our app. All providers are bound by contract to protect your data and use it only as we direct.

7.1 Cloud Services and Data Storage (Firebase/Google Cloud)

We use Google's Firebase platform for the app's core functionality:

Authentication: Sign-in, registration, and password management
Data storage: Store and sync your data across devices
Server functions: Account deletion, data export, and purchase status processing
Configuration: App settings management
Security: App authenticity verification
Crash reporting (optional): If you enable crash reporting, crash logs are sent to the service to improve stability
Analytics (optional): If you enable analytics, aggregated usage data is collected to improve the user experience

Firebase Privacy Policy: https://firebase.google.com/support/privacy

7.2 Map Services

Google Maps, Mapbox: Used for map display and navigation. These services may receive map tile requests and your location data for displaying the map.

Google Privacy Policy: https://policies.google.com/privacy

Mapbox Privacy Policy: https://www.mapbox.com/legal/privacy

7.3 Payment Services

Google Play Billing: Processing in-app purchases and subscriptions. Google Play handles all payments securely. We do not see or store your payment card details.

Google Privacy Policy: https://policies.google.com/privacy

7.4 Sign-In

Google Sign-In (optional): Authentication to the app using your Google account
Google Drive (optional): Drive backup requires signing in with your Google account

Google Privacy Policy: https://policies.google.com/privacy

7.5 Email Services

Mailgun: Used for sending transactional emails (e.g., account deletion confirmation). Receives your email address and email content.

Mailgun Privacy Policy: https://www.mailgun.com/legal/privacy-policy/

7.6 Server Infrastructure

UpCloud, Hetzner: We use these hosting providers located in the European Union for map tile distribution and backend API services. All servers used are located within the EU.

7.7 Weather Data Services

OpenWeather: Used for retrieving atmospheric pressure data for barometric altitude calibration. This service receives coarse location (latitude and longitude) to provide local atmospheric pressure readings.

OpenWeather Privacy Policy: https://openweather.co.uk/privacy-policy

7.8 Backup

Google Drive: Used for backing up your content, with the most limited Drive permission available. Maastokartat can only see and manage the backup files and the folder it creates itself; it cannot access any other file in your Google Drive. Backups are stored in your own Drive and are not sent to us or to third parties. You can delete them, or withdraw the app's access, at any time in your Google Account.

Maastokartat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. International Data Transfers

Your data is primarily processed in the European Union. However, some services may process data in other locations.

8.1 Transfers to the United States

Some services we use (Google, Mapbox) are based in the US. They are certified under the EU-US Data Privacy Framework, meaning the EU has confirmed they meet European data protection standards. You can verify this at https://www.dataprivacyframework.gov/list.

8.2 Transfers to the United Kingdom

OpenWeather Ltd is based in the United Kingdom. The EU has granted the UK an adequacy decision, meaning data transfers to the UK are permitted without additional safeguards.

8.3 Other International Transfers

For transfers to other countries outside the EU/EEA, we use EU-approved contract terms to ensure your data stays protected.

9. Data Retention

We retain your data according to the following periods:

Account data: While your account is active
Inactive accounts: Accounts inactive for 2 years with no active subscription may be deleted after advance email notification
User-generated content: Until you delete it or delete your account
Location sharing data: Only during active sharing (no permanent storage)
Google Drive backups: Until you delete them yourself
Crash reports: 90 days
Analytics data: 14 months

When you delete your account, your data is removed immediately from our active systems. Backups are cleared within 30 days. Service providers like Google may keep copies for up to 180 days per their data processing terms.

10. Security Measures

We implement appropriate technical and organisational measures to protect your data:

Encrypted data transmission (HTTPS/TLS)
Secure authentication mechanisms
App authenticity verification
Access controls and authentication for backend services
Data stored in secure cloud infrastructure with industry-standard protections

11. Your Rights

Under GDPR, you have the following rights:

Access: You can request a copy of all your personal data that we process
Rectification: You can correct inaccurate or incomplete personal data
Erasure: You can request deletion of your personal data ("right to be forgotten")
Restriction: You can request restriction of processing in certain situations
Portability: You can receive your data in a commonly used, machine-readable format
Object: You can object to processing based on your particular personal situation
Withdraw consent: When processing is based on your consent, you can withdraw it at any time

You can exercise some of these rights directly in the app: you can edit your data or change your consent settings in the settings. Through the My Account view menu, you can export your account data or delete your account and associated data. In other cases, you can contact us.

Please note that exercising your rights requires identity verification. Your registered email address is the sole means of verifying your identity. If you lose access to both your account and your registered email address, we will be unable to verify your identity and process your request.

You can also file a complaint with the data protection authority. In Finland, this is the Office of the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
Telephone: +358 29 566 6700
Email: tietosuoja@om.fi
Website: https://tietosuoja.fi/en

12. Children's Privacy

Maastokartat is not specifically directed at children under 13. If you are under 13, you must obtain parental or guardian consent before creating an account or using features that process personal data.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or by email. The effective date at the top of this policy indicates when it was last updated.

We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

MapsiTech Oy
Email: privacy@mapsitech.fi

We aim to respond to all inquiries within one month. If your request is complex or there are multiple requests, we may extend the response time by up to two months. We will inform you of any such extension within one month of your request.