Last updated: [OWNER: date of publication]
1. Who we are
Midnight Tour ("the app", "we") is operated by [OWNER: full legal name or company name], [OWNER: postal address], [OWNER: e-mail address for privacy requests]. We are the controller of the personal data described below. [OWNER: state whether a data protection officer is appointed; for a small operator this is usually not required.]
2. Summary
- You can browse the map and route catalog without an account.
- With an account we store your e-mail address, your preferences and the routes you save.
- Your location is used only while the app is open and only if you allow it. Before it leaves your phone it is rounded to about 100 m; we use it to find nearby routes and do not store it.
- We have no advertising, no analytics and no crash-reporting SDK of our own. The map is provided by Google, which receives technical data as described in section 4.
- You can delete your account in the app (Profile → Delete account) or as described at [OWNER: account deletion URL].
3. What we process, why, and on what legal basis
3.1 Account (only if you create one)
| Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| E-mail address, password (stored only as a hash by our authentication provider), account ID, sign-up / sign-in timestamps | Create and secure your account, confirm your e-mail, reset your password | (b) contract |
| Language, units, preferred navigation app | Apply your settings on every device | (b) contract |
| Saved routes (route IDs and when you saved them) | Show your saved list | (b) contract |
| Reports of a problem with a route and answers to a road's open files (the route, the reason or the fact and your answer, an optional note, the time, and what a moderator decided) | Keep the catalog accurate; count the answers and reports a moderator accepted on your driver card | (f) legitimate interests (accurate road information) [OWNER/LEGAL: confirm] |
| Roads you suggest with Add a road (the two points you tap on the map, until the road is checked; then only the outcome, the rules it failed and the measured length and score) [OWNER/LEGAL: draft, built locally only] | Find and check the road; enforce the limits (5 a day, 20 in 30 days) | (f) legitimate interests (a catalog drivers can add to) [OWNER/LEGAL: confirm] |
| Drive counts: when you finish a road in Drive mode (the same rule as a passport stamp), the road's ID. Your account ID and the time of that count are kept for at most an hour, so the same drive is not counted twice; then only the road's total stays, without any link to you. Every drive counts. No position, time of day, speed or direction is sent. Guests are not counted [OWNER/LEGAL: draft, built locally only] | Show how many times drivers drove each road | (f) legitimate interests (showing which roads drivers actually drive) [OWNER/LEGAL: confirm] |
| Authentication and security logs (IP address, user agent, time, outcome) kept by our backend provider | Protect accounts and the service against abuse | (f) legitimate interests (security) |
3.2 Location (optional)
If you tap Use my location and allow it in Android, the app reads one position while it is open (no background location). Before it is sent, the position is rounded to three decimal places (about 100 m). It is sent to our backend only to find and sort routes near you; it is not written to our database and is not linked to your account. It is also used on your phone to show your position on the map. Legal basis: (b) contract / (f) legitimate interests in providing the nearby search you asked for. [OWNER/LEGAL: confirm basis; the Android permission prompt is not by itself GDPR consent.]
Drive mode. If you start Drive mode on a route, the app reads your precise position about once a second while the Drive mode screen is open and the app is in the foreground. It stops when you leave the screen or switch to another app (no background location). The position is used only on your phone to show where you are on the route and how far is left. It is not sent to us, not stored, and no track, speed or driving time is recorded. Map tiles are loaded from Google as on the other map screens.
Drive mode offer on the map. Unless you turn off "Offer Drive mode near a route" in Settings, the app reads your precise position every few seconds while the Map tab is open and the app is in the foreground, to offer Drive mode when you approach the start of a route. Only the latest two positions are kept, in the phone's memory, and they are compared with the routes already shown on the map. Nothing is sent to us or stored, and it stops when you leave the Map tab or the app.
3.3 Browsing and search (no account needed)
When you move the map or search, the visible map area, filters and search text are sent to our backend to answer the request. They are not stored in our database. Our backend provider keeps short-lived request logs (including IP address) for operation and security ([OWNER: confirm the log retention of your Supabase plan]).
The scenic way. When you plan the scenic way to a destination, the app sends our backend an area around the way there, rounded outwards to about 1 km, to find good roads in it; your position and the destination themselves are not sent to us. When you open the trip, Google Maps or Waze receives the next road's entrance, or the destination, as the place to go to, without your position. If you tap See the whole trip in Google Maps, the link also gives Google your current position as the start of the trip, with the trip's roads as stops (when the app has no precise, recent position, the trip starts at its first road instead). That position goes to Google only in that link and only when you tap it; we do not receive or store it, and Google's privacy policy applies to what Google does with it. When you type where you are going, the text you type and your language are sent to our backend to find matching towns and villages (from our own list based on OpenStreetMap); your position is never sent with it, and nothing about the search is stored. [OWNER/LEGAL: draft for the scenic way, built locally only]
3.4 Data kept only on your phone
- Your session token, in Android's secure storage (Keystore-backed). It is excluded from Android backups.
- Your settings (language, units, navigation app, high contrast).
- A small offline copy of public route information you viewed, so the app works with poor signal. It contains no account data and is deleted when you sign out, delete your account or tap Clear offline data in Profile.
- After you open Google Maps or Waze with Navigate to start, which route you were sent to and when (route, entrance and time; not your position), for up to 3 hours. When you come back to the app near that entrance, the app offers Drive mode; answering either way deletes the record.
- After you open a scenic-way trip in Google Maps, the trip (its roads, their entrances and exits, the destination you chose and when) for up to a day, so the app can lead you from one road to the next. It is not sent to us.
- After you tap Open in another app, a GPX file of the route in the app's cache. It holds public route information only (the line, its start, end and chapter points, notes and the data licence), nothing about you. Android may clear the cache at any time.
- After you tap Share image, a picture of a road card, a passport page or your driver card in the app's cache. It shows only what the preview showed (no dates, times or positions; your name only if you added it) and leaves the phone only where you share it.
- Your road passport, if you use Drive mode: for each road you drove from end to end in Drive mode, the road, the direction and the calendar day; for each road chapter you passed, the chapter number and the day; and the public road facts needed to draw the stamp (name, region, the road's line). No time of day, duration, speed, track or position is kept. It shows that you drove a road on a day, so treat it as location-derived data: it stays on your phone, is not sent to us and is not linked to your account. Delete one stamp, or everything with Clear passport; deleting your account or uninstalling the app also deletes it. (If you are signed in, the road's drive count goes up by one, see section 3.1; the count does not include your passport.)
3.5 Team members (only for people we invite)
If you help curate routes, we additionally store your role, the review actions you take
(status changes, notes, timestamps) and, for team invitations, the invited e-mail address and
an audit trail of role changes. Purpose: accountable editorial control of the catalog; basis:
(f) legitimate interests. Published routes show how they were checked (review method) but not
who reviewed them, and the app never shows the team's account identifiers to other users. An
invitation that is not accepted within 30 days expires and is deleted. [OWNER: re-check this
section against the team-management and triage features merged from dev.]
3.6 Photos you add to photo spots
[OWNER/LEGAL: built 2026-10-19 (photo spots v2, photo-spots-v2-plan.md), local database only. Legal review before it is published.]
If you add a photo to a photo spot, we store the photo file, the spot it belongs to, the credit name you typed (by default the nickname of your driver card; you can leave it empty), the photo's size in pixels, when you sent it, and the decision on it (approved or declined, when, and which moderator decided). Purpose: show the photo with its credit under the licence you gave us (see the terms of use); basis: (b) contract. Moderation records: (f) legitimate interests (keeping the service lawful and safe).
- Metadata. Before the photo leaves your phone, the app makes it smaller (about 1600 pixels on the longest side), saves it as a new JPEG and removes every metadata block from the file (Exif and similar: location, capture time, camera and phone model). The app checks the result and does not send a file that still carries them. We do not store where or when the photo was taken; the spot gives the place. The app opens only the photo you choose in the system photo picker; it has no access to your other photos and no camera permission.
- Credit. The credit is the name you typed, never your e-mail address (the app and our server refuse an e-mail address as a credit).
- Faces and number plates. Please leave them out. A moderator declines photos that show a recognisable face or a readable plate.
- Who sees what. The photo is stored in a private storage area. Before approval, only you, the owner and the moderators can open it. After approval everyone can see it with its credit; nobody sees your account ID or e-mail.
- Deletion. A declined photo's file is deleted at once. Deleting your account deletes all your photo files first, then the records about them. To delete a single approved photo, write to us at [OWNER: e-mail]; deleting it ends our licence. [OWNER: an in-app "My photos" list is not built yet; retention of backups after deletion.]
4. Who receives data
We use service providers that process data on our behalf under data processing agreements:
| Provider | Role | Data | Location / transfer safeguard |
|---|---|---|---|
| Supabase (database, authentication, realtime, file storage) | Processor | Account data, saved routes, preferences, photos you add to photo spots, request and auth logs | Project hosted in the EU (AWS eu-west-1, Ireland). Supabase may access data from outside the EEA under the EU Standard Contractual Clauses in its DPA. [OWNER: accept the Supabase DPA] |
| Expo / 650 Industries (app updates via EAS Update) | Processor [OWNER: confirm DPA] | When the app checks for updates: device OS, a random installation token, IP address | United States. [OWNER: confirm safeguard, e.g. SCCs or EU-US Data Privacy Framework] |
| [OWNER: e-mail provider, e.g. the SMTP service configured in Supabase] | Processor | E-mail address, message content (confirmation and reset links) | [OWNER] |
Google Maps. The map inside the app is provided by Google's Maps SDK for Android. Google receives technical data such as your IP address, device model and OS, an SDK identifier, crash data and map interactions (for example the area you view), which Google uses to provide and improve its services under its own responsibility. Use of Google Maps features in the app is subject to the Google Maps Additional Terms of Service and the Google Privacy Policy.
Wikimedia Commons photos. A photo spot without a driver's photo can show a free photo from Wikimedia Commons, credited to its author. Our own tools choose the photo in advance, so the app never searches Wikimedia. To show it, your phone loads the image from Wikimedia's image servers (upload.wikimedia.org, thumb.wikimedia.org), which receive your IP address and your device's standard browser information, as with any image on the web; we send them nothing else. See the Wikimedia Foundation privacy policy. [OWNER: alternatively we copy the chosen images to our own storage so phones never contact Wikimedia; this uses part of the free storage quota.]
Navigation apps. When you tap Navigate to start, we open Google Maps or Waze (or their website) with the route entrance as destination. From then on, that app's own privacy policy applies.
GPX files. When you tap Open in another app, Android's share sheet opens with a GPX file of the route. The file goes only to the app or person you choose; from then on, that app's own privacy policy applies. The file contains no data about you.
We do not sell personal data and do not share it for advertising. Our optional AI drafting tool for our team (Anthropic API) only receives map data from OpenStreetMap about candidate roads, never user data.
Drive log. If the drive log is on (Settings), each complete drive in Drive mode keeps the road, the direction, when the drive ended, its distance and how long it took, on your phone only. We never receive it. Turn the log off or clear it in Settings; uninstalling the app also deletes it.
Roads you suggest. To check a road you suggest with Add a road, our server asks the public OpenStreetMap Overpass API for the map data in an area of a few kilometres around your two points. Overpass receives only that area from our server: never your account, your name or your IP address.
5. How long we keep data
- Account data, preferences and saved routes: until you delete your account.
- Drive counts: the record linking your account to a road and the time it was last counted is deleted after an hour; the road's total has no link to you. Deleting your account deletes any record not yet deleted.
- Roads you suggest: the two points are deleted as soon as the road is checked, or after 30 days if it could not be checked by then. The outcome is kept with your account until you delete it. A road that passed stays in the catalog without any link to you.
- After deletion your account, profile, roles and saved routes are removed at once. Editorial history on routes you curated is kept without your identity. Pending team invitations for your e-mail address are deleted, and your e-mail address is erased from the team audit trail (its entries stay, without naming you).
- Team invitations: until accepted or cancelled, and no longer than 30 days; an expired invitation can no longer be used and is deleted. [OWNER: expired invitations are purged at the next sign-up or team change, not by a timer; add a scheduled purge if a hard limit is needed.]
- Team audit trail (role changes, invitations): kept for accountability while the team exists. It names invited people by e-mail address until they delete their account. [OWNER: decide whether to set a fixed retention period, in particular for people who never accepted.]
- Photos you add to photo spots: until you delete your account or ask us to delete the photo. A declined photo's file is deleted at once; the record that it was declined (without the file) stays until you delete your account.
- Backend logs and backups: [OWNER: retention per your Supabase plan and settings].
- E-mails: [OWNER: retention of the e-mail provider].
6. Your rights
You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of the data you gave us in a portable format, by writing to [OWNER: e-mail]. We answer within one month. You can delete your account yourself in Profile. You can also complain to the Luxembourg data protection authority, the Commission nationale pour la protection des données (CNPD, cnpd.public.lu), or the authority in your country.
7. Children
Midnight Tour is meant for adult drivers and is not directed at children. Do not create an account if you are under [OWNER: 16 or 18].
8. Security
All traffic is encrypted (HTTPS/TLS). Access to stored data is limited by row-level security so users can only read their own account data. Session tokens are kept in Android secure storage.
9. Changes
We will update this page when the app's data use changes and show the date at the top. Material changes will also be announced in the app.