Privacy

What we store

• Your order email and the order number, which the creator’s shop sends us when you buy a map, and which maps they unlock.
• One session per device you sign in on (at most three): a random key, stored only as a hash, and the time of your last visit. It lasts a year after your last visit, or until you sign out.
• Sign-in codes, stored only as a keyed hash, used once, deleted within a day.
• Counters against abuse: how often codes were asked for, under a keyed hash of the email and of the IP address, deleted within a day.
• Your Want to try, Tried and Loved marks for each map, with when you last changed each place, so they follow you to another phone or a reinstall. They’re kept with your account until you ask us to delete them.

We don’t store payment details (the creator’s shop handles payment), your location, or anything else you do in the app.

Who else is involved

• Cloudflare hosts the apps and this site, and sees technical data (IP address, browser) to serve them and protect them from abuse.
• Resend sends the sign-in code to your email address. The emails have no tracking.
• OpenFreeMap serves the map tiles your phone loads.
• YouTube plays a creator’s video only when you tap play, through its privacy-enhanced player (youtube-nocookie.com).
• Google Maps or Apple Maps opens when you tap Go, under their own privacy terms.

No advertising and no analytics. The apps set one cookie, the one that keeps you signed in; this site sets none of its own. Cloudflare may set a technical security cookie (such as cf_clearance) when it checks for bots before the legal notice; it’s strictly necessary and not used to track you.

Why, and your rights

We use your order email and order number to give you what you bought (the contract), and the session and counters to keep your account safe (our legitimate interest). You can ask to see, correct or delete your data at any time: write to hello@backlane.app from the address you ordered with, and it’s done within 30 days. You can also complain to the French data protection authority, the CNIL (cnil.fr).