Privacy Policy

Draw on a Map & Share (“the app”) is made by OZ, Çanakkale, Türkiye (“we”, “us”, “our”). We are responsible for the personal data described in this policy: its “data controller” (veri sorumlusu) under Türkiye's Personal Data Protection Law No. 6698 (“KVKK”), and its “controller” under laws such as the EU and UK GDPR where they apply to you. We collect personal data electronically, through the app and by email.

This policy covers the app on iPhone and iPad. Apple, Google and the apps you share with have their own privacy policies, and those apply to what they do.

Questions? Email thehelloworld.apps@gmail.com, or tap Settings › Help & Support › Contact Support in the app.

Most of it never leaves your device. Data goes to our cloud only when you tap to buy Premium, sign in with Apple, or turn on backup.

In short: the maps you make are stored in the app's private storage on your iPhone or iPad. We can't see them.

The app keeps these on your device:

• Your maps. The maps you save, and the one you're working on (kept as an automatic draft so you don't lose work, with the message you're writing to share it). That covers titles, notes, pins with their locations, names and addresses, drawings and text labels, the map style and visible area, and your folders.
• Thumbnails of your saved maps. They're made on the device and never uploaded.
• Recent places. The last 8 places you chose in search (name, address and coordinates). Swipe one away, or tap Clear to remove them all.
• Preferences, such as your language, appearance and sharing options.

Like other app data, this can be included in backups of your device that you make with iCloud Backup or a computer. You and Apple control those backups, not us. Deleting the app deletes its data from the device.

In short: the app starts using your location only when you tap Locate or My Location, and only while it's open. It's kept only if you put it on a map yourself.

• Permission. The first time you tap Locate or My Location, iOS asks whether to allow your location while you're using the app or just once, and you choose precise or approximate. Everything else works if you say no.
• Locate centers the map near you. My Location suggests your position as the destination, and it becomes part of your map only if you confirm it. After either one, the map shows your position as a blue dot until you close the app.
• We never receive your location. The app doesn't use location in the background, doesn't follow your movements, and keeps no history of where you've been.
• A location you put on a map is part of that map. It's shared only when you share the map, and uploaded only if you back that map up.

You can change the permission any time in iOS Settings › Privacy & Security › Location Services › Draw on Map.

In short: maps, search and addresses come from Apple Maps. Apple handles those requests, and we don't see them.

The app uses Apple's MapKit for the map itself, standard and satellite views, place search and suggestions, addresses for the pins you place, and the map images it creates when you share. To provide these, Apple receives what it needs, such as what you type into search, the part of the map you're viewing, and the coordinates of a pin you place. Apple handles this under the Apple Privacy Policy.

We don't receive or store your searches. The only searches the app keeps are the places you choose, saved as recent places on your device.

Pasting a link or coordinates

The Paste button in search reads your clipboard only when you tap it, so you can paste a place from Apple Maps, Google Maps or another app. The app never reads your clipboard by itself.

In short: sharing happens on your device and through the app you pick. We don't receive or keep anything you share.

• When you tap Share, the app creates an image on your device: a map image from Apple with your drawings and pins and, if you leave them on, the place name and your note.
• If your map has a destination pin, you choose whether to include an Apple Maps link. The link contains the destination's coordinates and name. If you turn on Settings › Sharing › Include Google Maps Link, a Google Maps link with the same details is added after it.
• The image, your message and any links go through the iOS share sheet to the app or person you choose, such as Messages, Mail or WhatsApp. That app handles them under its own policy. Once you've sent something, neither we nor the app can take it back.
• People who open a link go to Apple Maps or Google Maps, which handle that visit under their own policies.
• If you choose Save Image in the share sheet, iOS asks for “add only” access to your photo library, so the app can add the picture without seeing your other photos. Copy Location Link puts the link on your clipboard.
• The image file made for sharing is kept in a temporary folder that the app clears.

In short: Apple handles payment. We never see your card, your name or your Apple Account email.

• Premium is an auto-renewable subscription sold through the App Store. Apple processes the payment and keeps your purchase history under its own terms and privacy policy.
• The app checks your subscription with Apple's StoreKit, on your device. We don't upload your receipts or your purchase history. The only purchase-related data in our cloud is the random purchase token described next.
• To connect your purchase to cloud backup later, the app creates a private account for you when you tap to buy Premium. This happens before Apple's purchase sheet opens, so it happens even if you then cancel. This is an anonymous user ID in Google Firebase Authentication, with no name or email. Its record holds only whether the account is active, when it was created, whether it's a guest account, and a random purchase token. The app sends the token to Apple with your purchase, so the subscription can be matched to your account.
• Apple sends us sales and subscription reports, and those don't identify you.

In short: signing in is optional and is used for cloud backup. The app doesn't ask Apple for your name or your email.

• You can sign in at Settings › Account to back up and sync your saved maps.
• Apple gives the app a sign-in token that is unique to this app. Firebase Authentication uses that token to create or open your account and gives the account a user ID. Because the app requests neither your name nor your email, we don't receive them.
• If you used Premium before you signed in, your guest account is linked to your Apple sign-in, or merged into it, so your subscription comes with you.
• Signing out keeps your cloud copies. When you sign out you can choose to remove that account's maps from the device or keep them.
• You can stop the app using Sign in with Apple at any time in iOS Settings › your name › Sign-In & Security › Sign in with Apple. Deleting your account (section 14) also does this for you.

In short: backup is off unless you turn it on. When it's on, your saved maps are stored in your private account in Google Firebase, in the United States.

What's uploaded

Cloud backup is part of Premium and needs Sign in with Apple. Nothing is uploaded until you turn on Settings › Cloud Backup › Back Up & Sync Saved Maps. After that, the app uploads:

• your saved maps: titles, notes, pins with their locations, names and addresses, drawings and text labels, the map style and the visible area;
• your folders: their names and order.

Not uploaded: unsaved edits and your current draft, thumbnails, recent places, preferences, and your device's location (unless you placed it on a saved map).

Where it's stored, and who can see it

• In Google Cloud Firestore, in Google's United States multi-region.
• Security rules let only your signed-in account read or change your data. Your maps have no public links, and no other user can see them.
• Google encrypts the data in transit and at rest. It isn't end-to-end encrypted, though: because we run the Firebase project, we have technical access to the database. We don't browse your maps. We access account data only to keep the service running and secure, to help you when you ask us to, or when the law requires it.

Small records that keep sync reliable

• Sync records. Each change that syncs leaves a small record so that a retried upload isn't applied twice. The record holds a fingerprint of the request, the kind of change, the map or folder ID, the result and the time, but none of your map's content. The app deletes them once they're 30 days old, the next time it connects.
• Deleted-map markers. When you delete a backed-up map, its content is deleted. A small marker with no content (its ID, version number and dates) stays so your other devices know the map is gone.

Turning sync off keeps both your device copies and your cloud copies. Settings › Cloud Backup › Delete Cloud Copies removes your maps from the cloud.

In short: free use never connects to our servers. Only buying Premium, signing in and cloud backup do.

• The app connects to Google Firebase only after you tap to buy Premium, sign in with Apple or use cloud backup. Firebase provides the account system (Firebase Authentication), the database (Cloud Firestore) and security checks (App Check). The app includes no Firebase Analytics, no Crashlytics and no advertising SDKs.
• App Check uses Apple's App Attest to confirm that requests come from the genuine app on a real Apple device. Apple and Google exchange an attestation for this, and it carries none of your content.
• As with any internet service, Google receives technical information when the app connects, such as your IP address, the type of device and system, and the versions of the Firebase libraries in the app. Google uses it to deliver and protect the service. We don't use it to identify you.

• Emailing us. If you contact us, we receive your email address, your message and anything you attach. The subject line the app suggests includes the app version. Our mailbox is hosted by Google (Gmail). We use your message only to help you. We delete it once we no longer need it, and at the latest 24 months after our last exchange.
• Ratings. Rate Us opens the App Store, and ratings and reviews go to Apple. After you share, iOS may show Apple's rating prompt; Apple decides when it appears. We never learn who rated the app. We see only the reviews the App Store shows publicly.

• Your name, email address or phone number (unless you email us)
• Your contacts, photos, camera or microphone
• Your location in the background, or a history of where you've been
• The advertising identifier, or tracking across other companies' apps and websites
• Analytics, usage statistics or crash reports
• Your searches or browsing history (searches go straight to Apple)
• Payment details (Apple handles payment)
• Anything to train AI models: your maps are used only to provide the features you use

You don't need to contact us for any of these. You can do them in the app or in iOS Settings.

• Delete a map Delete it in Saved Maps. While backup is on, its cloud copy is deleted too.
• Clear recent places In search, swipe a recent place away, or tap Clear.
• Stop backing up Turn off Settings › Cloud Backup › Back Up & Sync Saved Maps. Both your device copies and your cloud copies stay.
• Delete your cloud copies Settings › Cloud Backup › Delete Cloud Copies removes your maps from the cloud and turns sync off. The maps on this device stay, and your other devices remove their cloud copies the next time they connect.
• Sign out Settings › Account › Sign Out, then choose whether to keep this account's maps on the device or remove them.
• Delete your account Settings › Account › Delete Account… deletes your cloud maps, folders, sync records and account, withdraws the app's Sign in with Apple access, and removes this account's maps from this device. Your other devices remove their copies the next time they connect. If something can't be finished straight away, the deletion completes automatically and the app tells you. Deleting your account doesn't cancel your subscription. To cancel, go to iOS Settings › your name › Subscriptions.
• Location and photos Change or withdraw access any time in iOS Settings › Privacy & Security.
• Delete the app This removes everything stored on the device. It doesn't delete cloud copies or your account, so delete those first if you want them gone.

The app relies on two companies. Google processes data for us as our service provider. Apple provides maps, purchases and sign-in under its own privacy policy.

We don't sell or rent personal data, and we don't share it with advertisers or data brokers. We disclose information only:

• when the law requires it, for example in response to a valid legal request;
• when it's needed to protect the safety, rights or security of our users, the public or us;
• if the app changes hands (for example a sale or merger). This policy would still apply to your data, or we'd tell you before anything changed.

International transfers

Google stores and processes data in the United States and other countries. For data from the European Economic Area, the UK and Switzerland, Google relies on the EU–U.S. Data Privacy Framework (with its UK and Swiss extensions) and on Standard Contractual Clauses in its data processing terms.

From Türkiye, this is a transfer abroad under Article 9 of KVKK: your account record, the maps and folders you back up, connection data and support emails go to Google's servers in the United States, for the purposes in sections 7 to 11.

• To provide what you ask for (performance of a contract): your account, linking your purchase, cloud backup and sync, and account deletion.
• Legitimate interests: keeping the service secure and reliable (App Check, sync records, deleted-account markers and connection data) and answering your support emails. We keep this data to the minimum those purposes need, and you can object (section 17).
• Legal obligations: where the law requires us to keep or disclose information.

Under KVKK, the same processing relies on Article 5(2)(c) (necessary to set up or perform a contract with you), Article 5(2)(ç) (to meet a legal obligation) and Article 5(2)(f) (our legitimate interests, without harming your fundamental rights and freedoms). The GDPR bases above apply where the GDPR applies to you (the EEA, the UK and Switzerland).

You give or refuse location and photo access in iOS, and the processing they allow happens on your device.

Depending on where you live, you may have the right to:

• access your personal data and get a copy
• have it corrected
• have it deleted
• receive it in a portable format
• restrict or object to how it's used
• complain to your data protection authority

You can delete your data in the app at any time (section 14). For anything else, email thehelloworld.apps@gmail.com. We don't know your name or email address, so we may need your help to find your data. For example, we may ask you to follow a few steps in the app. We reply within 30 days, and we'll never treat you differently for using your rights.

Türkiye (KVKK)

Under Article 11 of KVKK, you can ask us whether we process your personal data and for information about it; learn why we process it and whether it's used for that purpose; know the third parties in Türkiye or abroad it's transferred to; have it corrected if it's incomplete or wrong, or deleted or destroyed; ask that the third parties it was transferred to be told of a correction or deletion; object to a result against you that comes only from automated analysis of your data; and claim compensation if unlawful processing causes you damage.

Send your request to thehelloworld.apps@gmail.com or by post to the address in section 21. We answer free of charge within 30 days at the latest. If we turn your request down, or you aren't satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within the time limits in Article 14 of KVKK.

California and other US states

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We use sensitive information, such as the precise locations in maps you back up, only to provide the service. We collect these categories of personal information: identifiers (your account's user ID), geolocation (locations on maps you back up), your content (maps and folders you back up), and internet activity (connection data). The purposes are the ones in this policy.

The app is suitable for all ages, and its free features collect no personal data. It isn't directed at children. Its optional account and cloud backup are meant for people old enough to agree to them under their local law, or who have a parent's permission. That age is 13 in the United States and between 13 and 16 in the EU, depending on the country. If you think a child has created an account without permission, contact us and we'll delete it.

• Connections to Apple and Google use encrypted HTTPS (TLS), and Firebase encrypts stored data.
• Security rules give each account access only to its own data. App Check helps block requests that don't come from the app.
• On your device, iOS keeps the app's data in its own private storage and, when your device has a passcode, encrypts it.

No system is perfectly secure. If a breach affects your data, we'll notify the authorities and the affected users as the law requires. Because we don't have your contact details, we would tell you through the app or its release notes.

When this policy changes, we'll update this page and the “Last updated” date. If a change significantly affects how your data is handled, we'll say so in the app's release notes before it takes effect, and we'll ask for your consent where the law requires it.

If you aren't happy with our answer, you can complain to the Personal Data Protection Board in Türkiye or, in the EEA, the UK or Switzerland, to your local data protection authority.