Privacy policy

1. Data controller

thanhphm, sole trader, SIREN 844 829 085, 25 allée des Commerces, 77200 Torcy, France — contact@thanhphm.fr. See the legal notice.

2. Data collected

• Account: email address, password hash (never the password itself), creation date, date the terms were accepted, date of the age confirmation, date the address was activated.
• Map: the countries and cities you mark as visited, and the date you marked them.
• Memories: the photos, documents and notes you upload; their caption; the date the photo was taken and the GPS coordinates read from its EXIF metadata where they exist, otherwise the point where you dropped it.
• Subscription: current plan, Stripe customer and subscription identifiers, renewal date, date of the request for immediate performance. No banking data passes through or is stored on our servers.
• Public sharing (only if you enable it): the handle you choose for your map address, and the list of memories you mark as public.
• Reports (if you report content to us): your name if you give it, your email address, the address of the content concerned, the reason, your explanation and your IP address.
• Contribution log: each time a memory is uploaded, the date, your identifier and email address, the memory identifier, your IP address and your browser. The law requires us to keep it (see § 5).
• Technical server logs: IP address, date, page requested, browser — produced automatically by the web server.

3. What we do not do

• No advertising, no profiling, no resale of data.
• No audience measurement tool, no third-party tracker, no cookie other than your session cookie.
• No automated analysis of the content of your photos: they are sent to no artificial intelligence service.
• No request leaves for a third party when the map renders: the base map and the fonts are hosted by us.
• No automatic publication: nothing you upload becomes public unless you have asked for it, memory by memory.

4. Purposes and legal bases

• Providing the service (account, map, memories, subscription) — performance of the contract (art. 6.1.b).
• Billing and accounting — legal obligation (art. 6.1.c).
• Security of the service: rate limiting of sign-in attempts, technical logs — legitimate interest (art. 6.1.f) in protecting accounts.
• Sending account activation and password reset emails — performance of the contract (art. 6.1.b).
• Replying to your messages sent through the contact form — legitimate interest in providing support.
• Publishing your map and the memories you mark as public — your consent (art. 6.1.a), given by enabling sharing and then memory by memory, and withdrawable at any time without consequence for the rest of your account.
• Handling reports about public content — legal obligation (art. 6.1.c; Articles 16 and 17 of the European Digital Services Act).
• Retaining identification data of people who upload content — legal obligation (art. 6.1.c; Article 6-II of the French law for confidence in the digital economy and decree no. 2021-1362).

5. Retention periods

• Account, visits and memories: kept for as long as the account exists. They are erased immediately, files included, when you delete your account.
• Sign-in session: 30 days, then automatic expiry. Expired records are erased every day by a maintenance task.
• Activation and reset links: 24 hours for activation, 1 hour for reset. They work only once, and expired tokens are deleted every day by a maintenance task.
• Technical web server logs: 14 days (daily rotation).
• Contribution log: one year from the upload, then automatic deletion. That is the period set by law, no more and no less. This log survives the deletion of your account — Article 17.3.b of the GDPR reserves erasure where a legal obligation requires retention. It appears in your export: we keep it, we do not hide it from you.
• Content reports: 12 months from receipt, then automatic deletion by the daily maintenance task. They are kept even after the content concerned has been removed: they are the record of the decision taken.
• Moderation decisions (removal of public content or refusal to remove it, with their reasons): kept without a fixed period. They distinguish an isolated mistake from a repeat offence, which the repeat-infringer policy requires.
• Accounting records (subscription invoices, kept by Stripe): 10 years, as required by Article L123-22 of the French Commercial Code.
• Messages sent through the contact form: kept in our support tool for as long as following up your request justifies it. You may ask for their erasure at any time.

One deliberate exception: the administrative boundaries of cities, fetched from OpenStreetMap the first time a city is marked by anyone, are kept even after an account is deleted. They are public data from OpenStreetMap, they contain no information about you, and keeping them avoids querying a volunteer service again.

6. Processors and transfers outside the European Union

Your photos are therefore stored with Cloudflare, in the United States, and not on the server that hosts the site. They are encrypted at rest there and are never served directly from Cloudflare: they pass through our server, which checks on every request that the requester is entitled to them — you, or anyone if you have marked the photo as public (see § 10).

The support tool that receives messages from the contact form is self-hosted on the same server: it is not a third party.

7. Cookies

TrotterMap sets a single cookie, gm_session, which keeps you signed in. It is strictly necessary for the service to work and serves no other purpose: no consent banner is therefore required. It expires after 30 days, and deleting it amounts to signing out.

8. Your rights

You have a right of access, rectification, erasure, restriction, objection and portability. Two of them are exercised directly from the application, without writing to us or waiting, in ⚙ Settings → Your data:

• Export my data: downloads a ZIP archive containing a machine-readable JSON file and your original photos and documents, at full resolution, whatever your plan.
• Delete my account: immediately erases the account, the visits, the memories and the matching files. The operation cannot be undone.

For the other rights, write to contact@thanhphm.fr. You may also lodge a complaint with the CNIL, the French supervisory authority (3 place de Fontenoy, 75007 Paris — www.cnil.fr), or with the supervisory authority of your own country of residence.

9. Security

Passwords are stored as scrypt hashes. Sessions are stored as hashes: a copy of the database would not allow anyone to sign in as you. All exchanges go exclusively over HTTPS. Your photos are served only after checking that the requesting account is yours — except those you have marked as public yourself, which are then accessible to anyone with the link. In the event of a data breach likely to result in a risk to your rights, you will be informed in accordance with Article 34 of the GDPR.

10. Public sharing

Sharing is disabled by default. As long as you do not enable it in ⚙ Settings → Public sharing, your map exists at no public address and any attempt to reach one returns a not-found page.

Once sharing is enabled, the following are visible to anyone with the link:

• the handle you chose for the map address;
• the countries and cities you have lit up, and your statistics;
• only the photos you have marked as public one by one, with their caption, the date they were taken and their exact position on the map.

Never published: your email address, your name, your documents, your notes, and every memory you have not explicitly marked as public.

A preview address (share image) is produced so that the link displays correctly in messaging apps and social networks. It contains only the outline of the countries visited and your statistics, never your photos. Public pages are not indexed by search engines.

Withdrawal. Disabling sharing, or unticking a memory, makes it inaccessible immediately. We cannot, however, erase what a third party may already have saved or copied during the period of publication — that is true of any online publication, and it is why nothing here is public by default.