This policy explains what personal data MapMetrics collects when you use the MapMetrics app and website, why we collect it, who we share it with, how long we keep it and what your rights are. The short version is in section 2; the details follow.
1. Who we are
MapMetrics B.V. ("MapMetrics", "we", "us") is the controller of your personal data.
Address: Keurenplein 4, Unit A35, 1069 CD Amsterdam, the Netherlands
Chamber of Commerce (KvK): 86457101
Privacy contact: privacy@mapmetrics.xyz
2. Summary
- We use your location to show the map, navigate, record trips, give rewards, show nearby places and improve live traffic information. We use it in the background only during navigation and trip recording, never otherwise.
- Content you post (stories, photos, videos, reviews, road reports) is visible to others as described in section 5.
- Your live position is only shared with other people inside a group ride you joined, and only while that ride is active.
- We do not sell your personal data.
- Ads are optional rewarded ads. They are only personalised if you consent.
- App usage statistics (Firebase Analytics) are only collected if you agree; they are off until you say yes.
- You can delete your account at any time. It is hidden at once and all data linked to it is permanently deleted within 30 days (section 11).
3. What data we collect
3.1 Account data
When you create an account: e-mail address, username, display name, password (stored only as a secure hash) and, if you sign in with Google, Apple or Facebook, the identifier and the e-mail address that provider gives us. Optionally: a profile photo and a short bio.
3.2 Location data
- Precise location while you use the app: to show your position on the map, search nearby, calculate routes, navigate, check in at places and show nearby stories and places.
- Location in the background: only while navigation or trip recording is active, so guidance and trip recording keep working with the screen off. A persistent notification shows when this is happening. Background location is never used outside an active trip.
- Trips: when you drive or ride with trip recording on, we store the route of the trip (GPS points, time, distance and duration) in your account. We use it for your trip history, statistics, rewards and to detect fraud.
- Traffic information: during navigation the app sends speed samples for the road segments you drive on, so we can calculate live traffic and travel times for all users. These samples are not shown to other users. See section 9 for how long we keep them.
- Route requests: start, destination and waypoints are sent to our routing servers to calculate the route.
- Check-ins and posts: a check-in or a post records the place where you made it.
- Group rides: while you take part in a group ride, the other members of that ride see your live position. Nobody outside the ride sees it, and it isn't shown on the normal map.
3.3 Photos, videos and the microphone
Only when you choose to: photos and videos you take or pick from your gallery for stories, reviews, places, group posts or your profile picture. When you record a video, the microphone records its sound. We store the location and time of a post with it.
3.4 Social activity
Who you follow and who follows you, groups you join, group posts, events and polls, comments, reactions, reviews, road reports and votes on them, saved places and lists, and your own routes.
3.5 Rewards and points
Your XP, level, streaks, badges, quests and the in-app points (VAULT) you earn by driving, checking in and taking part. In-app points cannot be bought, withdrawn, exchanged for money or transferred to other users. We keep a record of rewards to show your balance and to prevent abuse.
3.6 Bluetooth device
If you connect a MapMetrics Bluetooth device, the app uses Bluetooth to find and connect to it and stores the device identifier in your account, so trips with the device can be rewarded.
3.7 Motion sensors
During a motorbike ride the app can use the phone's motion sensors to estimate your lean angle for ride statistics. These readings stay on your phone.
3.8 Device, usage and diagnostic data
- Device model, operating system, app version, language and time zone.
- A push notification token, so we can send the notifications you asked for.
- Your IP address. We use it for security, to block abuse (rate limiting) and to send you to the nearest server; we don't use it to build a profile.
- Only if you agree: app usage statistics, meaning which screens and features are used (Firebase Analytics). Collection is switched off when you install the app and stays off until you say yes. The app asks you once, and you can change your choice at any time in the app settings under "Usage statistics". We don't send your user ID, your location or an advertising ID to Firebase Analytics; it uses a random app instance ID, so these statistics are pseudonymised, not anonymous. If you switch them off, the app also resets that ID.
- Crash reports and technical logs (Firebase Crashlytics), so we can fix errors. A crash report contains the error, the app version and device details, without your user ID or an advertising ID.
- How you found the app (store install referrer or a shared link), to see which channels work. It is recorded once, when you sign up.
3.9 Advertising
The app offers optional rewarded ads, for example to recover a streak or earn an extra check-in reward. Ads are provided by Google AdMob. Before ads are shown, we ask for your consent where the law requires it. Without consent, ads are non-personalised. AdMob may use your device's advertising identifier and IP address as described in Google's policy. You can change your choice in the app settings.
3.10 Messages to us
If you contact support or report content, we keep that message and our reply.
3.11 Searches, vehicles and business trips
- Searches: what you type in the search bar is sent to our search servers to find places and addresses. Your recent searches are also kept on your phone so you can pick them again.
- Vehicles: if you add a vehicle, we store its type and the details you enter (such as make, model and fuel type) in your account, to route and reward trips correctly.
- Business trips: if you mark trips as business trips, the purpose, project and notes you add stay on your phone. Reports you export are created on your phone and only shared where you choose to send them.
4. Why we use your data (and our legal basis)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the app: account, map, search, routes, navigation, trips, social features | Account, location, content, social activity | Performance of the contract (art. 6(1)(b)) |
| Rewards, points, streaks, leaderboards | Trips, check-ins, rewards, Bluetooth device ID | Contract |
| Live traffic and better travel times for everyone | Speed samples during navigation | Legitimate interest (art. 6(1)(f)); not shown to other users |
| Security, fraud and abuse prevention, content moderation | IP address, trips, rewards, uploaded content, reports | Legitimate interest; legal obligation where applicable |
| Push notifications | Push token, preferences | Consent (you can turn them off in your phone settings or the app) |
| Usage statistics (Firebase Analytics) | Usage data, app instance ID, device data | Consent (art. 6(1)(a) GDPR; art. 11.7a of the Dutch Telecommunications Act, which implements the ePrivacy Directive). Off until you agree; you can withdraw at any time in the app settings |
| Crash reports (Firebase Crashlytics) | Crash and device data | Legitimate interest (finding and fixing errors). No consent is needed because it only measures the quality of the app, with little effect on your privacy (art. 11.7a(3)(b) Telecommunications Act) |
| Personalised ads | Advertising ID, IP address | Consent (art. 6(1)(a)); non-personalised ads otherwise |
| Answering your questions and reports | Messages, account | Contract / legitimate interest |
5. What other users can see
- Your public profile: username, display name, profile photo, level and badges, and the stories and reviews you posted.
- Stories, reviews, photos, road reports: visible to other users together with the place where they were posted. Stories you mark as followers-only are only shown to your followers.
- Leaderboards: your name, photo and rank can appear on leaderboards. In the app settings you can turn off "Show me on public leaderboards"; you then no longer appear on the country, world and all-time leaderboards, only on the weekly leaderboard of your city.
- Groups: posts, events and comments in a group are visible to the members of that group, or to everyone if the group is public.
- Group rides: your live position, only to members of the same ride while it is active.
- Your e-mail address, trips and exact location history are never shown to other users.
6. Who we share data with
We do not sell your personal data. We share it only with service providers who process it on our behalf under a data processing agreement, or where you ask us to:
| Provider | What for |
|---|---|
| Cloudflare, Inc. | Hosting of our servers, databases and media storage (primary database in the EU), website statistics, and protection against attacks |
| Contabo GmbH | Servers for routing, maps and traffic calculation (Germany, plus servers in the United States and Asia for users in those regions) |
| Google (Firebase) | Sign-in, usage statistics, crash reports, push notifications, remote configuration |
| Google (AdMob) | Rewarded ads (see 3.9) |
| Google, Apple, Meta (Facebook) | Only if you choose to sign in with them. We use Facebook only for login; no Facebook app events or advertising ID are sent. |
| Apple App Store / Google Play | App distribution and the install referrer |
| IPinfo | Website only: an approximate location from your IP address to choose where the map starts (see section 14) |
We may also disclose data if the law requires it, to protect the rights and safety of our users, or as part of a merger or acquisition (in which case this policy continues to apply).
7. Content moderation
To keep the app safe, photos and videos you upload are first checked by an automated system, running on our own hardware, before other users can see them. Content that breaks our rules is not published. Users can report content and accounts; we review those reports and may remove content or block accounts. Illegal content may be reported to the authorities where the law requires it.
8. International transfers
Some of our providers process data outside the European Economic Area, for example in the United States. In those cases we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards.
9. How long we keep data
| Data | Retention |
|---|---|
| Account record (e-mail, username, profile, password hash) | As long as your account exists. When you delete your account, your sign-in details and public profile are removed at once; the rest of the record is deleted within 30 days. |
| Content, trips, rewards, social activity, check-ins | As long as your account exists. After you delete your account (section 11): hidden from others at once and permanently deleted within 30 days, except the anonymised records listed in section 11. |
| Traffic samples | In the live traffic system: at most 15 minutes, with a trip code (a random code per trip; in older app versions your user ID). After that we keep a historical archive to calculate expected travel times. It is pseudonymised: the trip code is replaced by a code that changes every day, and it contains no GPS coordinates (only road segment, speed and time rounded to 10 seconds). It is kept for up to 24 months and then deleted. |
| Rate-limit counters and security records | Rate-limit counters at most 2 days; records of abuse at most 30 days |
| Usage statistics and crash reports | According to Firebase's settings: usage statistics at the user level at most 14 months, crash reports 90 days |
| Support messages and reports | As long as needed to handle them, at most 2 years |
| Data we must keep by law (e.g. administration) | As long as the law requires |
10. Your rights
Under the GDPR you have the right to access, correct, delete and receive a copy (portability) of your personal data, to object to processing based on legitimate interest, to restrict processing, and to withdraw consent at any time (this does not affect processing that happened before). To use these rights, e-mail privacy@mapmetrics.xyz. We answer within one month.
You can also change many things yourself in the app: edit your profile, delete posts, leave the public leaderboards, turn off notifications, change your ad choice, switch usage statistics on or off, and turn off location access in your phone settings (navigation and trips then won't work).
You have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the authority in your own country.
11. Deleting your account
- In the app: Profile → Info → Delete Account (at the bottom, below Logout), then confirm.
- Without the app: request deletion on our account deletion page or by e-mail to privacy@mapmetrics.xyz from the e-mail address of your account.
Immediately when you delete your account in the app, it is deactivated and hidden: you are signed out on all devices, and your profile, stories, reviews, check-ins, follows, group posts and ride presence disappear for other users. You can no longer sign in to the account. Signing up again creates a new, empty account; a deletion cannot be undone.
Within 30 days all remaining data linked to your account is permanently deleted automatically: trips and their routes, rewards and points history, badges, quests, saved places and routes, uploaded photos and videos, push notification tokens, and your sign-in records, including your sign-in record at our login provider (Firebase). A deletion request by e-mail is handled the same way.
What we keep:
- Anonymised records that can no longer be linked to you: entries in the rewards and payout ledger and hotel booking records, which we need for accounting and tax law (kept for the legal retention period, without your account); past weekly leaderboard results; reports you filed about content (still counted, without your identity); and comments you wrote in other people's threads, which are shown as "[deleted]".
- Data we must keep by law, for as long as the law requires.
- Short-lived operational records expire on their own schedule (section 9): rate-limit counters within 2 days, records of abuse within 30 days. Usage statistics and crash reports at Firebase follow Firebase's retention settings (section 9).
- Traffic statistics: the historical traffic archive is pseudonymised. Instead of the trip code or your user ID it holds a code that changes every day, and it contains no GPS coordinates. We don't link it to your account, so it is not deleted with your account; it is deleted after at most 24 months (section 9). Aggregated statistics that no longer relate to anyone (such as traffic averages) are kept.
Points have no monetary value and are not paid out when an account is deleted.
12. Children
MapMetrics is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it.
13. Security
We protect your data with encryption in transit (HTTPS), passwords stored only as secure hashes, access controls, rate limiting and monitoring. No system is 100% secure. If a data breach is likely to put you at risk, we will inform you and the authorities as the law requires.
14. Website and cookies
On our website, mapmetrics.org:
- We set one cookie, NEXT_LOCALE, which remembers the language you chose, for one year. It is needed for the site to work as you asked, so it does not require consent.
- We use no advertising or tracking cookies, which is why the site shows no cookie banner. Visits are counted with Cloudflare Web Analytics, which uses no cookies and does not follow you across websites.
- Map preferences (recent searches, the last map position, the map style and notices you closed) are kept in your browser's local storage. They are not sent to us, and you can remove them by clearing your browser's site data.
- To choose where the map starts and which units to use, your browser asks IPinfo for an approximate location (country and city) based on your IP address.
- If you press the location button, your browser asks for permission to use your precise location. We use it only to show your position and nearby results.
- Searches, routes and the places you open are sent to our servers to answer them.
More about cookies: cookie page.
15. Changes to this policy
We may update this policy when our app or the law changes. We show the date of the latest version at the top, and we tell you in the app about important changes.
16. Contact
MapMetrics B.V., Keurenplein 4, Unit A35, 1069 CD Amsterdam, the Netherlands · KvK 86457101 · privacy@mapmetrics.xyz