Snaptrip Privacy Policy

Last updated: 6 May 2026

This Privacy Policy describes how Snaptrip (“Snaptrip”, “we”, “us”, or “our”) handles personal data when you use the Snaptrip mobile app (iOS and Android), the Snaptrip website, or any related services (together, the “Service”).

If anything here is unclear, email mateusz@dwgroup.pl.

1. Who is the data controller

The data controller for the Service is:

Mateusz Twardy Poland Contact: mateusz@dwgroup.pl

If you live in the EU/EEA or UK, you may also contact us at the email above to exercise your rights under the GDPR/UK GDPR.

2. What data we collect

2.1 Information you give us

Account information — your email address and password when you create an account. Passwords are never stored in plaintext; they are hashed by our authentication provider.
Display nickname — an optional nickname that appears on the leaderboard. You choose what this is.
Photo submissions — if you submit a photo to be added to the game, we store the photo file along with metadata you provide (place name, event name, license, credit, optional tags). Before submitting, you must affirm that you own the rights to the image or have explicit permission from the copyright holder; this affirmation is recorded with the submission. If your photo file contains GPS coordinates in its EXIF data, those coordinates are extracted to pre-fill the pin location; you can adjust or remove the pin before submitting.
Copyright reports — if you file a copyright report via the Report Copyright Infringement form, we store the name, email, optional source URL, and description you provide, along with the IP address and User-Agent of the request. We use this information to investigate the claim, contact you for follow-up, and meet our obligations as a service provider.
Email submissions — if you contact us via the in-app feedback form or by email, we receive whatever you write to us.

2.2 Information we collect automatically

Game activity — when you play the daily challenge, practice rounds, or friend matches, we record your guess coordinates, scores, completion times, and submission timestamps so we can compute leaderboards and match results.
Device token — a random identifier generated and stored on your device. This token allows anonymous gameplay (so you can play the daily challenge without an account) and prevents duplicate submissions. It is not linked to your real identity unless you sign in.
Technical data — when our servers receive your requests, we automatically log basic technical information including IP address, approximate timestamp, the URL of the request, and a User-Agent string. This is standard server logging used to operate the Service and detect abuse.
Crash and error reports — if the app crashes or hits an error, we collect a diagnostic report containing the stack trace, app version, operating system, device model, and a randomly generated installation identifier. We have configured our crash reporting tool to not capture personal information such as IP address by default.

2.3 Information we do not collect

We do not track you across other apps or websites.
We do not sell your personal data to anyone.
We do not use third-party advertising trackers or marketing pixels.
We do not request access to your contacts, microphone, calendar, or background location.
We do not collect precise device location in the background. The map in the app is for placing guesses and viewing answers — it does not request your real location.

3. How we use your data

We use the data described above to:

Provide the Service (display the daily challenge, accept submissions, compute scores, render leaderboards, run friend matches).
Authenticate you when you sign in.
Moderate user-submitted photos before they appear in the game.
Diagnose crashes and bugs.
Communicate with you when you contact us.
Detect abuse (e.g. duplicate submissions, fraud).

Legal bases (EU/EEA / UK users)

Activity	Legal basis (Art. 6 GDPR)
Providing the core game features when signed in	Performance of a contract
Anonymous gameplay (no account)	Legitimate interest in operating the Service
Server access logs	Legitimate interest in security and abuse prevention
Crash and error reports	Legitimate interest in maintaining a working app
Responding to your emails	Performance of a contract / legitimate interest
Photo moderation	Performance of a contract (the submitter), legitimate interest (other users)

You can object to processing based on legitimate interests by contacting us; see Section 7.

We use a small number of third-party service providers (“processors”) to operate the Service. They process data on our behalf under contractual safeguards:

Supabase, Inc. — database, authentication, and file storage. Your account email, password hash, nickname, game submissions, and uploaded photos are stored here.
Sentry GmbH (EU region) — crash and error reporting. Stack traces and diagnostic metadata are sent here.
MapLibre and our map tile provider — the app and website render maps using the open-source MapLibre GL library. When you view the map, your device fetches map tiles directly from our tile provider. The provider will see the IP address of your device making the request.
The hosting provider for our web app and API — handles server traffic and stores access logs.
Google Maps (Android only) and Apple Maps (iOS only) — render the map tiles in the app. When you view the map, your device fetches map tiles directly from Google or Apple. They will see the IP address of your device making the request.

We do not share personal data with any third party for marketing or advertising purposes.

If we are legally required to disclose data (court order, lawful subpoena), we will do so to the extent required and notify the affected user where legally permitted.

International transfers

Some of our processors are based outside the EU/EEA (notably Google and Apple in the United States). Where data is transferred outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards.

5. How long we keep your data

Account data (email, nickname, password hash) — kept while your account is active. Deleted within 30 days of account deletion (see Section 7).
Daily submissions, match submissions, scores, guesses — kept while your account is active. Deleted alongside your account.
Pending photo submissions — kept until reviewed; rejected submissions are deleted within 30 days of rejection. Approved photos are added to the public game catalog and are not tied to your account; they remain in the catalog after account deletion.
Copyright reports — kept for at least 12 months after resolution to maintain an audit trail of takedown decisions, then deleted unless required for an ongoing dispute.
Server access logs — typically kept for up to 30 days.
Crash and error reports — kept for up to 90 days.
Email correspondence — kept for as long as needed to resolve your inquiry, plus a reasonable period for record-keeping.

6. How we protect your data

All traffic between your device and our servers uses HTTPS.
Passwords are stored as salted hashes; we never see your plaintext password.
Access to production systems is restricted to a small number of authorised people.
Database access is governed by row-level security policies; users can only read and modify their own records (with the exception of public game content like leaderboards).

No system is perfectly secure. If we ever detect a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.

7. Your rights

Depending on your jurisdiction, you may have some or all of the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Deletion — ask us to delete your account and associated data. You can do this yourself in the app: open the Account screen and tap Delete account in the Danger Zone. This permanently deletes your account, daily submissions, friend-match data, and any pending photo submissions.
Restriction — ask us to stop processing your data in certain circumstances.
Portability — receive your data in a machine-readable format.
Objection — object to processing based on legitimate interests.
Withdraw consent — where processing is based on consent, withdraw it at any time.
Lodge a complaint — with your local data protection supervisory authority. For Polish users, this is the Urząd Ochrony Danych Osobowych (UODO).

To exercise any of these rights, email mateusz@dwgroup.pl. We will respond within one month.

8. Children

The Service is not directed at children under 13 (or under 16 in some EU jurisdictions). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

9. Cookies and similar technologies

The mobile app does not use cookies. The website uses only essential cookies required to keep you signed in. We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

10. Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the “Last updated” date at the top, and where appropriate notify users in-app or by email. Continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

11. Contact

Questions, concerns, or requests under this policy:

mateusz@dwgroup.pl

This policy is provided in English. If a translated version conflicts with the English version, the English version controls.