This policy explains what personal data Mapira, Phanteus’s collaborative map app, processes, what we use it for, who we share it with and what control you have over it. It applies to the Android app (com.phanteus.mapira) and to this website. The Spanish version is the reference text; if the two differ, the Spanish version prevails.
In short: your phone’s location is only used when you tap “My location” and it never leaves the device, unless you turn on “Show me on the map” in a group: then only that group’s members see it. What you post is seen by whoever views that map (the public or your group). We do not sell your data or use third-party analytics. You can delete your account from the app at any time.
1. Who is responsible
The data controller is Faber Gómez Gómez, operating as Phanteus, based in Colombia.
- Contact email: phanteus.group@gmail.com
- App: Mapira (
com.phanteus.mapira)
We process data in accordance with Colombian Law 1581 of 2012 and its regulations and, where they apply, the European Union General Data Protection Regulation (GDPR), the UK GDPR and California privacy laws (CCPA/CPRA).
2. What data we process and why
| Data | When | Why |
|---|---|---|
| Account: email address, password, display name, username (optional) and language | When you create your account or edit your profile | To create and protect your account, show who posted something and write notifications in your language. The password is stored encrypted by our authentication provider: we never see it. |
| Document acceptance: version of the terms, this policy and the guidelines, and the date | Before your first post | To show that you accepted them. |
| Posts: category, the place you mark on the map (point, zone, area or route), optional title and description, duration, target map or group and date. Also the places you save in My map (for example “Home”): name, type and point | When you post | To show them to whoever views that map, notify group members and moderate. |
| Interactions: confirmations (“Still there”, “Gone”), reports, blocks, groups, roles and invitations | When you make them | To keep information up to date, moderate and protect the community. |
| Map area you are viewing: the bounds of the visible area and the zoom level | While you use the map | To load only what is on screen. It is not stored in your profile. |
| Place search: the text you type and the approximate center of the map | When you search for a place | To suggest places, nearby ones first. |
| Notifications: the device’s notification identifier (Firebase Cloud Messaging token) and the groups you want alerts for | Only if you turn on an alert | To send you the alerts you asked for. |
| Technical data: IP address, device model and operating system and technical request logs | When you use the app or this website | Security, abuse prevention and keeping the service running. |
| Advertising: the device’s advertising identifier and technical data (through Google AdMob) | Only when ads are enabled | To show ads. See section 5. |
Your location
- Mapira only uses your phone’s location when you tap “My location”, with the precise location permission (or approximate, if you choose so on your phone) and while the app is open. Never in the background.
- It is used on the phone itself to center the map and draw your position. It is not sent to our servers or stored.
- The place of each post is the one you mark on the map, which may differ from where you are.
- “Show me on the map” (optional, in private groups): if you turn it on in a group, your phone sends your precise location to our servers so that only that group’s members see you on their map, along with the direction your phone is pointing (while the screen is on) or the direction you’re moving. It keeps sending it with the app closed while it’s on, and you’ll always see it in an ongoing notification with a “Stop showing me” button. We keep only your last position, with no history. If your phone turns off or loses signal, the group sees your last position with the time. It’s deleted as soon as you remove yourself from the map, leave the group, sign out or delete your account. People you blocked, or who blocked you, don’t see it.
What we do not collect
We do not access your contacts, photos, camera, microphone, messages or calls, we do not keep your location history, we do not use your location in the background unless you turn on “Show me on the map”, and we do not use third-party analytics or tracking tools.
Legal bases
We process your data because it is necessary to provide the service you request (your account, your posts and your groups), with your consent (notifications, location permission and, where required, ads), based on our legitimate interest in keeping the service safe and moderated, and to comply with legal obligations. You can withdraw your consent at any time, without affecting anything done before.
3. Who sees what you post
- Public map: anyone using Mapira sees the post. Only people with an account see your display name; without an account, who posted is not shown. If you choose to post anonymously, nobody sees your name, but the post remains linked to your account so it can be moderated.
- Private group: only its members.
- My map: only you. If you turn it into a group to invite someone, its places become visible to that group’s members.
- Place links: if you share a place, its name and coordinates travel inside the link and whoever receives it can see them. The link does not go through our servers: the page that shows it reads it in the browser itself.
- Nobody else sees your blocks, reports or settings. The person you block is not notified.
4. Who we share data with
We do not sell or rent your personal data. We only share it with the providers we need for Mapira to work, who process it on our behalf and under their own safeguards:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Cloud infrastructure: database, authentication, realtime and functions | Account data, posts and interactions |
| Google Firebase Cloud Messaging | Sending notifications | Device token and the content of the alert |
| Google AdMob and User Messaging Platform | Ads and the consent form | Advertising identifier, IP and device data |
| OpenFreeMap (data © OpenStreetMap) | Downloading the base map | IP and the map area being downloaded |
| Photon (komoot) or Stadia Maps | Place search | Search text, approximate map center and IP |
| Resend | Sending account emails (email confirmation, password recovery) | Email address and message content |
| Vercel | Hosting this website | IP and technical logs when you visit it |
| Google Play | Distributing the app | As described in Google’s privacy policy |
We may also disclose data when required by law or by a competent authority, or to protect people’s safety.
5. Advertising
Mapira may show Google AdMob ads so it can remain free. Ads are disabled during closed testing. When they are shown:
- AdMob may use the device’s advertising identifier, IP address and technical data to show and measure ads and to prevent fraud.
- In the European Economic Area, the United Kingdom and Switzerland we ask for your consent with Google’s form before the first ad. You can change it in Settings → Ad privacy.
- By default we request non-personalized ads.
- Your posts, your groups and your location are not shared with advertisers.
- You can reset or delete the advertising identifier in Android settings.
More about how Google uses data: policies.google.com/technologies/partner-sites.
6. How long we keep data
- Account and profile: as long as the account exists.
- Posts with a duration: when they end they stop showing live and are archived 30 days later. They remain linked to your account while it exists.
- Retracted posts and posts from deleted accounts: permanently deleted after 90 days, unless they are part of an open moderation case.
- Notification tokens: until you turn off alerts, sign out or delete your account.
- Your location in a group (“Show me on the map”): only the last one, until you remove yourself from the map, leave the group, sign out or delete your account.
- Moderation and security records: as long as needed to prevent abuse and comply with legal obligations.
7. Your rights
You can know, access, update, correct and delete your data, withdraw your authorization, object to processing and, where applicable, request the portability of your data. We will never discriminate against you for exercising them.
You can do many things yourself in the app:
- Edit your display name and username: Account → Edit profile.
- Turn alerts on or off: Alerts, or in each group’s details.
- Change your ad consent: Settings → Ad privacy.
- Retract one of your posts: in its details, Retract.
- Delete your account: Account → Delete account.
For anything else, email phanteus.group@gmail.com from your account’s email address. We answer inquiries within 10 business days and complaints within 15 business days, as required by Colombian law. If you are not satisfied, you can contact Colombia’s Superintendencia de Industria y Comercio (sic.gov.co) or the data protection authority in your country.
8. Deleting your account
You can delete it from the app in Account → Delete account or ask us by email. We explain what is deleted and what is kept in Delete your account. Uninstalling the app does not delete the account.
9. Security
All communications are encrypted (HTTPS). The database enforces access rules so that each account and each group only sees its own data, your session is stored encrypted in your phone’s secure storage and internal access to data is kept to a minimum. No system is infallible: if we detect an incident affecting your data, we will notify you as required by law.
10. International transfers
Our providers may process data outside Colombia (for example, in the United States or the European Union). We only work with providers that offer adequate protection safeguards, such as standard contractual clauses.
11. Children
Mapira is not directed at children under 13 (or the minimum age required in your country) and we do not knowingly collect their data. If you are a minor, you need the authorization of your parents or guardians. If we learn that an account belongs to a child under 13, we will delete it.
12. Changes to this policy
We will publish any change at this same address, with its date. If the change is significant, we will let you know in the app and ask you to accept the new version before you post again.
13. Contact
For any privacy question: phanteus.group@gmail.com.