Privacy Policy

Kartaterra ("we," "us," or "our") provides a travel-tracking web application that turns the countries, states, regions, and flight routes you've visited into a map you can view and share. This policy explains what information we collect when you use Kartaterra, how we use it, who we share it with, and the choices and rights you have.

Account information. When you sign up, we collect your email address and password. Authentication is handled entirely by Supabase Auth - your password is managed and stored by Supabase using industry-standard hashing; we never see or store it in plain text ourselves.

Travel data you enter. This is the core of the app, and it's entirely data you choose to add:

• Countries, U.S. states, and other countries' regions/provinces you mark as visited
• Flight trips you log - airport codes, dates, and the order of stops in multi-stop routes

Username. Every account has a username, which is how you appear to other people on group leaderboards. We generate a starting one from the part of your email address before the @ (plus a short random suffix if that name is already taken), and you can change it to anything you like in Settings. Your email address itself is never shown to other users.

Groups you join. If you create or join a group, we store which groups you belong to and which of them you own. Joining is always something you do yourself with an invite code - nobody can add you to a group.

Achievements and totals. We keep a running summary of your travel data - how many countries and continents you've visited, how many trips you've logged, total distance flown, your Travel Score, and which badges you've earned. This is calculated from the travel data above rather than collected separately.

Home location (optional). If you set a home location in Settings, we store the city/country label and its geocoded latitude/longitude (looked up via Mapbox's geocoding service) to center your World Map and power the map's Home button. This is entirely optional and can be cleared at any time from Settings.

Preferences. We save your unit system (metric/imperial) and chosen map style to your account so they persist between visits. Map projection and other in-map display choices are session-only - they are not saved to our servers and reset to the default each time you load the app.

Payment information. Subscription payments are processed by Stripe (our current payment processor for this MVP; we intend to move to Paddle as our long-term merchant of record). We never see or store your raw card details - those are handled entirely within Stripe's hosted checkout. We store only a Stripe customer ID and subscription ID (so we can look up your subscription status) and whether a cancellation is pending.

Contact form submissions. If you use the contact form, the name, email, and message you provide are sent to us via Resend as a transactional email. They are not stored in our own database.

Technical data. Our hosting provider (Vercel) may log IP addresses and basic request data as a standard part of serving the application, for purposes like security and abuse prevention - this happens at the infrastructure level, not through any custom tracking code we've built. As of this policy's effective date, we do not use any analytics or tracking tool on Kartaterra - we checked the codebase to confirm this before writing this policy, rather than assume.

• To create and secure your account, and let you sign in
• To store and display your travel data - marked places, flight routes, and the maps/stats generated from them
• To apply your saved preferences (units, map style) and optional home location
• To process subscription payments and determine your account tier (Free or Pro)
• To respond to messages sent through the contact form
• To award achievement badges, calculate your Travel Score, and show you how your totals compare with other users
• To show the leaderboard for any group you have joined
• To maintain the security and reliability of the service

We do not use your travel data, email, or any other information to serve you advertising, and we do not build advertising profiles.

Most of Kartaterra is private to you. The exceptions are listed here in full, and both of them are limited to totals - no other user can ever see which specific countries, regions, trips, or routes you have logged.

Group leaderboards. If you join a group, the other members of that group can see your username alongside three numbers: countries visited, continents visited, and total distance flown. Only members of that same group can see it. You can leave a group at any time, which removes you from its leaderboard immediately.

The All Kartaterra Users leaderboard. This site-wide leaderboard is visible to signed-in users and ranks the top accounts by the same three numbers. Entries are shown under an anonymous handle derived from your account ID - something like "Traveler-4f2a1c" - never your username, email, or anything else that identifies you. Accounts are included by default; you can opt out entirely with the toggle in Settings, which removes you from all three of its lists.

Percentile comparisons. The Stats page tells you what percentage of Kartaterra users you are ahead of. This is calculated from an anonymous count of how many accounts sit at each total; it exposes only the percentage itself, and does not reveal anything about any individual account - to you or to anyone else.

We do not sell your personal information to advertisers or any other third party. We share information only with the service providers that operate Kartaterra on our behalf, each acting under their own privacy policy and terms:

• Supabase - database hosting and authentication. Your account and travel data are stored in Supabase's infrastructure.
• Stripe - payment processing for Pro subscriptions. Stripe handles and stores your payment card details directly; we never receive them.
• Resend - delivers transactional email (account confirmation, password reset, contact form messages).
• Mapbox - renders the interactive maps and powers location search/geocoding. Interacting with the map (panning, searching a location) involves requests to Mapbox's services, which are subject to Mapbox's own privacy policy and terms.
• Vercel - hosts the application and its infrastructure.

We may also disclose information if required to do so by law, or to protect the rights, property, or safety of Kartaterra, our users, or others.

We retain your account and travel data for as long as your account remains active, so your map stays intact between visits. If you request that your account be deleted (see "Your Rights" below), we will delete your account data from our systems, except where retaining certain records (for example, payment records held by Stripe) is required for legal, tax, or fraud-prevention purposes.

Contact form messages are not stored in our database - they exist only as an email in our inbox, retained per our normal email practices.

You can access and update most of your information directly in the app - your travel data in the World Map, Country Maps, and Flight Mapper tabs, and your preferences in Settings.

For anything you can't change yourself - including requesting a copy of your data or full deletion of your account - contact us using the form on our homepage. We don't yet have a fully self-serve data export or account deletion button; requests like these are currently handled manually, and we'll respond as promptly as we can.

Depending on where you live, you may have additional rights under laws like the GDPR (EU/UK) or state privacy laws (e.g. the CCPA in California), including the right to object to or restrict certain processing. Contact us and we'll do our best to accommodate applicable requests.

Kartaterra uses your browser's local storage to keep you signed in between visits (this is how Supabase Auth persists your session) - it isn't used for tracking or advertising. We don't currently use any advertising, tracking, or third-party analytics cookies.

Kartaterra is not directed at, and is not intended for use by, children under 13 (or under 16 in jurisdictions where that is the applicable threshold). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

This notice is not about personal data; it lives here as its permanent home because Kartaterra has no separate legal or About page.

All airline logos, brand names, and aircraft liveries displayed on this platform are the property of their respective owners. Their use here is for informational, identification, and tracking purposes only under nominative fair use guidelines, and does not imply endorsement, affiliation, or sponsorship by any airline, aircraft manufacturer, or other rights holder.

Kartaterra is an independent travel-tracking tool. It is not operated by, affiliated with, or endorsed by any airline or aircraft manufacturer. If you are a rights holder and have a concern about how a name or mark appears here, please reach out via the contact form.

We may update this policy as Kartaterra changes - for example, as we move from Stripe to Paddle, or add new features. We'll update the effective date above when we do. Material changes will be reflected here; continued use of Kartaterra after an update means you accept the revised policy.

Questions about this policy or your data? Reach out via the contact form on our homepage - it goes directly to the team.