MunchMap Privacy Policy

Last updated: January 2025

1) Who we are

MunchMap ("MunchMap", "we", "us") is an iOS application operated by Stuart Cleary (United Kingdom) as an individual developer.

Contact email (support & privacy): support@munchmap.app

2) What this policy covers

This Privacy Policy explains how we collect, use, share, and protect personal data when you use the MunchMap mobile application and related services (the "Service").

3) Information we collect

3.1 Account information

When you create an account or sign in, we process:

Email address (for email/password sign-in and/or where provided by sign-in providers);
Authentication information required to sign you in (for email/password, we store a password hash rather than your raw password);
If you use "Sign in with Apple" or Google sign-in, we process the identifiers those services provide to authenticate you (and any email address you choose to share via those services).

3.2 Saved content (your "Munches")

When you save a TikTok video or Instagram Reel link, we store:

The URL you submit;
The video title and description obtained via metadata (e.g., oEmbed or equivalent endpoints);
The thumbnail URL (and/or a cached copy if technically required for display);
Derived place/location details used to display your saved spots on a map (for example, venue name, address and/or coordinates).

3.3 Precise location (used, not stored)

If you grant permission, MunchMap accesses your device's precise location to show your current position relative to your saved spots ("near me" functionality). We do not store your precise location on our servers. Location is used only at the time you are using the map view.

3.4 Technical and operational data (logs)

Our hosting and infrastructure may process limited technical data such as IP address, timestamps, and request metadata to operate the Service, maintain security, and troubleshoot issues.

4) How we use your information

We use the information above to:

Create and manage your account;
Store and display your saved spots;
Infer and display a likely place/location for a saved link (see "Third parties" below);
Maintain and secure the Service, prevent abuse, and debug issues;
Respond to support requests.

5) Legal bases (UK GDPR / GDPR)

Where UK GDPR / GDPR applies, we rely on the following lawful bases (as appropriate to the specific processing):

Contract: processing necessary to provide the Service you request (e.g., account and saved items);
Legitimate interests: operating, securing, and improving the Service (balanced against your rights);
Consent: for optional device permissions such as precise location (you can withdraw consent by disabling location permissions in iOS settings).

6) How we share information

We do not sell your personal data. We share data only as necessary to provide the Service:

6.1 Hosting (Replit)

Our backend is hosted with Replit. Replit's documentation indicates published apps are hosted in the United States.

6.2 AI processing (OpenAI)

We use OpenAI to help infer likely place/location details from link metadata (for example, text from the link's title/description). We send only the metadata necessary for this purpose. OpenAI's platform documentation states that data sent via the OpenAI API is not used to train or improve OpenAI models unless you explicitly opt in.

6.3 TikTok / Instagram metadata retrieval

To obtain metadata such as title/description/thumbnail for a submitted link, we may use oEmbed or equivalent metadata endpoints (where available).

6.4 Sign-in providers (Apple / Google)

If you choose to use Apple or Google sign-in, those providers process data as part of authenticating you. Their processing is governed by their own policies and settings.

7) International data transfers

Because our hosting is on Replit (hosted in the United States), your data may be processed outside the UK/EEA. Where required, we rely on appropriate safeguards (e.g., contractual protections) to enable international transfers.

8) Data retention

Account data and saved spots are retained until you delete them or delete your account.
Account deletion: you can delete your account in-app. Deletion is immediate (subject to reasonable technical processing time) and will remove your account and associated saved content from our active systems unless we are legally required to retain limited information (e.g., for security, fraud prevention, or legal compliance).
Operational logs are retained for a limited period for security and troubleshooting.

9) Your rights

Depending on your location, you may have rights to:

Request access to personal data we hold about you;
Request correction or deletion;
Object to or restrict processing;
Request a copy (portability), where applicable.

To exercise rights, contact: support@munchmap.app

If you are in the UK, you can also complain to the Information Commissioner's Office (ICO).

10) Security

We use reasonable technical and organisational measures designed to protect your information, including access controls and encryption in transit where supported by our infrastructure.

11) Children

MunchMap is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us personal data, contact us and we will delete it.

12) Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice in-app or by other reasonable means. The "Last updated" date will reflect the latest version.