Privacy Policy

Information we collect

• Account information: the email address you sign up with. If you sign in with Google instead, Google provides us your email address, your Google account identifier, and the basic profile information (such as your name) made available through the sign-in process. We use this only to authenticate and manage your account.
• Home base: a location you manually choose on the map, used to center your view and estimate flight distances — the same idea as typing in a home address. This is a one-time, user-set point, not something sensed from your device. The app does not track your live or continuous location.
• Travel data you enter: countries, cities, and regions marked visited; flights; budget entries; journal entries; landmarks and lists you create; and any photos you choose to attach.
• GPX route files you import: these may contain precise geographic coordinates from your travels (a hike, drive, or other route). We store and, if you choose to share or export a route, transmit these coordinates as part of that feature. We don't use them to track your current location, and the app never performs live, background, or continuous GPS tracking.
• Technical and security information: our service providers automatically process limited technical information — such as IP address, device/browser information, authentication events, and timestamps — to operate sign-in, keep the service secure, and prevent abuse.
• Device region: your device's language/region setting, used only to suggest a default currency, never your GPS location.

How we use it

Everything you enter is used solely to power the app's own features for your account: your map, your stats, your stories. We don't use your data for advertising, and we don't sell or rent it to third parties.

Third-party services

A few external services help run the app. Each only receives what it needs to do its job:

• Supabase is our backend: it handles account sign-in, stores your travel data in a database, and stores any photos you upload. As part of running authentication, Supabase automatically processes technical information such as IP address, device/browser information, and timestamps for security and abuse-prevention purposes. See Supabase's privacy policy.
• Google Maps SDK renders the interactive map inside the app. Beyond what we ask it to display, the SDK automatically processes limited technical information on Google's behalf, including device and SDK metadata, IP address, a Maps SDK-specific identifier, and crash/stability metrics for the SDK itself. See Google's privacy policy.
• Google Sign-In is used only if you choose to sign in with your Google account, in which case Google provides your account email, account identifier, and basic profile information to create and manage your login. This is separate from the Maps SDK above.

We don't use a separate advertising or analytics SDK, and we don't integrate a third-party crash-reporting service ourselves — the technical data noted above is limited to what Supabase and Google Maps automatically process as part of their own operation. The app does not include any in-app purchases or payment processing.

Security

Connections between the app and our backend are encrypted in transit (HTTPS/TLS). Passwords are never stored in plain text; our authentication provider hashes them. Your travel data is protected by database-level access rules that only allow your own signed-in account to read or write it, not other users or the app's own general-purpose access key.

Data retention and deletion

We retain your account and travel data for as long as your account remains active. If you delete your account, we delete the personal data and content associated with it, including your profile, every country/city/region/flight/budget/journal/route/list entry, and any uploaded photos, from our active systems. This happens automatically and immediately when you use the in-app deletion flow. Some limited data may be retained briefly afterward only where required for security, fraud prevention, legal obligations, or backup recovery, and is not used for any other purpose.

Account and data deletion

You can permanently delete your account and all associated data at any time from within the app: go to Settings > Account > Delete Account, and confirm by typing DELETE. This is immediate and cannot be undone.

If you no longer have the app installed, you can also request deletion from the web. Visit our account deletion page for instructions.

Your choices

You can edit or remove almost everything you've entered directly in the app at any time. For anything you can't change yourself, or for a full data export, email us at passport@bordersandstories.com.

Age requirement

Borders & Stories is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. If a change materially affects how we collect, use, or share personal information, we'll provide additional notice where appropriate or required by law.

Contact

Questions about this policy or your data: passport@bordersandstories.com.