Viapoint Privacy Policy

Effective date: [EFFECTIVE DATE]

Viapoint is a mobile app for travellers built around photos with a precise geotag. This policy explains what data we collect, why, who we share it with, how long we keep it and what rights you have.

Viapoint is operated by [OPERATOR NAME], [COUNTRY] (“we”, “us”). For any questions about your data, write to viapointsupport@gmail.com.

1. The short version

• With a public profile, photos you publish are public together with the exact place where they were taken, the shooting direction, date and time, your description and tags, your nickname and avatar. With a private profile, only you see your photos; others see only your nickname and avatar.
• We do not show ads, do not sell your data and do not use third-party analytics or advertising trackers.
• You can delete a photo, a trip or your whole account in the app at any time. Deleting the account removes your photos, files and profile from our servers.

2. What data we collect

Account

• Phone number — to sign you in and to recognise your account.
• One-time sign-in code — we store only its hash, never the code itself, and, if you sign in via Telegram, the identifier of your chat with our bot; the verification record is deleted about a day after it expires.
• Session data: a device identifier issued by our server, session keys and their expiry dates. We do not collect your device model, advertising ID or contacts.

Profile

• Nickname, avatar, “about me” text, home city (its name, country and the coordinates of the city centre), interface language, profile visibility setting.
• Before saving an avatar we remove all metadata from the image, including any location.

Photos and trips

• The photo file you choose to upload and the metadata read from it: GPS coordinates, shooting direction (GPSImgDirection), date and time of shooting and time zone offset.
• City and country of the shooting place, determined from the coordinates.
• Your description, tags, trip title and trip dates.
• A fingerprint (SHA-256 hash) of the original file in your gallery — only to warn you that the same photo has already been uploaded.
• The uploaded original is kept in temporary storage only while it is being processed and is deleted within a day. We publish resized copies without any metadata, but the coordinates, direction and time are shown next to the photo as part of the service.

Location of your device

• Only when you allow it and only for a specific action: to suggest your home city, to show where you are on the map. The coordinates are sent to our server to find the nearest city and are not stored.
• When you search for a place, we send the search text and the centre of the visible map area to find places nearby.

Plans

• If you save photos to plans, we store your plans (name, time of changes) and the saved places: a link to the photo, its shooting point, direction, city and country, and when it was added.

Reports

• If you report a photo or a user, we store who sent the report, what was reported (the photo or user and its author), the reason, your comment and the time. The reported user is not told who reported them. Reports are used only for moderation.

Blocks

• If you block a user, we store who blocked whom and when. The blocked user is not notified.

Technical data

• Our servers may record technical logs (for example, request time, errors and IP address) to keep the service secure and working. Logs are kept for up to [LOG RETENTION, e.g. 30 days].

Data stored only on your device

• Session keys, the upload queue, marks of already uploaded photos, recently used map tags, the tag list cache and the interface language. Signing out or deleting the account clears the data linked to your account; the device identifier, the language setting and the tag list cache stay on the device.

3. Why we use your data

We do not use your data for advertising, profiling or automated decisions with legal effects.

4. What is public

Your profile has one of two visibility settings, which you can change at any time in the app.

Public profile. Other users and anyone with access to the app can see:

• your published photos, their exact shooting location, direction, date and time, city and country, description and tags — on the map and in your profile;
• your nickname, avatar, “about me” text and home city;
• your trips (title, dates, photos) and statistics: the number of trips, photos, countries and cities.

Private profile. Other users see only your nickname and avatar. Your photos, trips, “about me”, home city and statistics are visible only to you: the photos are not shown on the map, in search or on the photo page.

Plans are visible only to you. Authors are not told who saved their photos; only the number of saves affects how high a photo is shown on the map. If you save someone’s photo and the author later hides or deletes it, the photo disappears from your plan, but the point and shooting direction stay there, without any link to the author or the photo. In the same way, if other people saved your photo and you delete it, the point stays in their plans without the photo and without any link to you.

Blocking. If you block a user or a user blocks you, neither of you sees the other’s photos, trips and places — on the map, on the photo page, in the profile or in plans. The person who blocked sees only the other’s nickname and avatar; for the blocked person the profile looks unavailable. You can unblock a user at any time in profile settings. Blocking does not stop someone who uses another account, so it does not replace care about which places you publish.

Before your first upload the app warns you that the geotag will be public, and before switching a private profile to public it reminds you that all your photos will appear on the map. Do not publish photos taken at home or in other places whose location you do not want to reveal.

5. Who we share data with

We share data only with providers who help us run the service:

• Hosting provider — [HOSTING PROVIDER, COUNTRY]: servers, database and file storage.
• Mapbox, Inc. (USA) — map display, place search and determining the city by coordinates. Our server and the app send Mapbox only the coordinates, map areas and search queries needed for these functions; the Mapbox map component may collect technical usage data under the Mapbox Privacy Policy.
• Telegram — delivery of the sign-in code via the Viapoint bot. To confirm that the number belongs to you, the bot asks you to share your phone number from Telegram and compares it with the number you entered; we receive that number and your Telegram chat identifier. Telegram receives the code message; your Telegram account is subject to the Telegram Privacy Policy. We keep the chat identifier only in the sign-in code record and delete it together with that record.

We may disclose data if required by law or to protect the rights and safety of users. We do not sell personal data.

6. International transfers

Some providers (for example, Mapbox) process data outside your country, including in the USA. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep data

• Account, profile, photos and trips — until you delete them or your account.
• Deleted photos and trips — removed from the database and file storage immediately.
• Deleted account — sign-in is blocked at once and all sessions end; photos, files, profile and the account itself are removed by a background process, usually within minutes.
• Sign-in code records — about a day after they expire; ended sessions — about a day after they end.
• Temporary upload files — up to a day.
• Reports — until they are reviewed and for up to 6 months after that. Reports you sent and reports about you or your photos are deleted together with your account.
• Blocks — until the user who blocked removes them or one of the two accounts is deleted.
• Plans — until you delete them or your account.
• Backups — up to [BACKUP RETENTION, e.g. 30 days], after which deleted data disappears from them too.

8. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy of it;
• correct it — most of it is editable in the app;
• delete it — in the app (Profile → Edit profile → Delete account) or by writing to us;
• restrict or object to processing based on legitimate interest;
• data portability;
• withdraw consent (for example, revoke location access in the device settings);
• complain to your data protection authority.

Write to viapointsupport@gmail.com from any address and mention the phone number of your account; we may ask you to confirm that the account is yours. We answer within 30 days.

9. Children

Viapoint is not intended for people under 16. We do not knowingly collect data from them. If you believe a child has created an account, let us know and we will delete it.

10. Security

Connections to our servers are encrypted, sign-in codes are stored only as hashes, sessions can be revoked, and access to servers is restricted. No system is perfectly secure, so please keep your phone and Telegram account protected.

11. Changes to this policy

We will publish the new version with a new effective date and, for significant changes, notify you in the app before they take effect.

12. Contact

[OPERATOR NAME], [ADDRESS] Email: viapointsupport@gmail.com