Mistmap1. Travel recording
Walking, cycling and vehicle travel can all be recorded. Physical activity permission is optional and is used only for steps (see Pins, photos and steps); it never decides what is recorded. Only confirmed GPS movement adds distance and explored area. Dotted connections show unrecorded gaps and do not add distance or area.
2. Who we are
JC Studio operates Mistmap (com.jcstudio.mistmap), a personal exploration map. This policy covers the current app and these public pages. Contact: whdcjf8172@gmail.com.
3. Travel and location
When you start a trip and grant permission, the app records precise location, timestamps, distance and explored areas on your device. Recording may continue with the screen off or the app in the background during that trip; pause or finish it to stop recording. Map recentering may also request your current location. Routes, place collections and preferences are stored locally. Android automatic app backup is disabled; operating-system backups on other platforms remain subject to your device settings. Location is collected only during a trip you start yourself, in the app or with the home-screen widget, and Android shows an ongoing notification while it runs. Mistmap does not detect or record movement on its own when no trip is running and does not request “Allow all the time” location access on Android.
4. Map and city services
OpenFreeMap receives map-tile requests, including the viewed map area and ordinary connection information such as IP address. The operating system’s geocoding service receives a representative coordinate to obtain a city name, each pin’s coordinate to name its area for pin search, and the text you type when you search for an address or place. These requests can reveal a viewed or visited area. We do not send your entire travel route to these services.
5. Usage statistics
Release versions send a randomly generated installation ID, event ID, launch activity, platform, app/build version, selected app language and number of completed trips to Supabase. We use these to count installations and activity and understand app use. They contain no route, coordinates, city names, account details, advertising ID or hardware identifier. Pending events may be stored locally and retried later. A random ID is pseudonymous, not a guarantee of complete anonymity.
6. Files, accounts and purchases
You choose when to export or share a file. Backup files (a ZIP when pins have photos) contain precise routes, pins and photos; shared route pictures hide areas near route endpoints but may still reveal a familiar place. The destination app or storage service handles the file under its own policy. Cloud backup works only after you sign in with Google (see Optional cloud backup). On Android, free users may see a Google AdMob interstitial when opening Journal or Discovered Cities from the map, or after saving a new pin. Interstitials are limited to once per four hours, four per rolling 24 hours and two per app session, and are skipped when not preloaded. Banners appear only on the Journal, Cities and Settings tabs, not on the exploration map. Google Mobile Ads can collect and share IP address, app and ad interactions, diagnostics, and advertising or device identifiers for ad delivery, analytics and fraud prevention. Mistmap does not pass routes, coordinates or travel records into ad requests. Mistmap Plus is an optional auto-renewing subscription (monthly, or yearly with a possible free trial) sold through Google Play; while active it removes ads, keeps up to three photos per pin and adds pin photos to the optional cloud backup. A separate one-time purchase removes ads permanently. RevenueCat processes an anonymous app user ID and purchase/subscription status to grant the entitlement; Google Play processes payment and billing data. Mistmap does not receive full card details.
7. Pins, photos and steps
When you drop a pin, its place, time, memo and the photos you choose are saved on your device. Photos come only from the system photo picker and are kept as resized copies in the app folder without the original’s location data (EXIF); the camera is never used. If you allow physical activity, the phone’s step sensor is read while you explore to save steps per trip and split the distance into on foot and riding; an optional weight you enter estimates calories and stays on the device. Steps never decide what is recorded and are never used for ads.
8. Optional cloud backup
Off unless you sign in with Google in Settings. The app sends the Google ID token it receives from Android Credential Manager to JC Studio’s backup server (Cloudflare Workers), which checks it with Google and keeps backups under your Google account’s unique number. Your email address and name are not stored on the server; the email is only shown in the app on this device. About once a day (when you open the app, or in Android’s background task) the days that changed — precise routes, times, distances, city names and steps — pins (place and memo) and, with Plus, pin photos are uploaded to Cloudflare R2, and a new device you sign in on downloads and merges them. Signing out stops uploads; “Delete the cloud copy” immediately deletes all of this account’s data on the server. Without signing in, nothing is sent.
9. Service providers and transfers
Supabase processes usage events and hosts the statistics database. OpenFreeMap and the device’s location/geocoding providers supply maps and place names. Google AdMob is the advertising provider for eligible free users on Android. RevenueCat manages subscription entitlement status, Google Play handles billing, and Cloudflare hosts these public pages and, if you use it, stores and processes the optional cloud backup (R2, Workers); Google verifies the sign-in. Providers may process ordinary request logs, IP addresses and technical information for delivery and security, in countries outside yours. We do not sell personal information or independently share travel records for cross-app advertising. Disclosure may also be required by law or necessary to protect the service and its users.
10. International transfers
The recipients below are headquartered or process data outside Korea, so the following information may be transferred abroad. Each transfer happens over encrypted HTTPS whenever you use the related feature.
· Supabase, Inc. (US company; database in the Seoul, South Korea region; privacy@supabase.io) — random installation ID, event ID, launch activity, platform, app/build version, selected language and number of completed trips / when a release build launches or a trip is completed / usage statistics / see Retention and deletion (no fixed automatic expiry yet)
· Cloudflare, Inc. (USA; privacyquestions@cloudflare.com) — with cloud backup on: your Google account’s unique number, trips (precise routes, times, distances, city names, steps), pins (place and memo) and, with Plus, pin photos; IP address and connection data when you open these pages / about once a day for backup, and when you open these pages / cloud backup storage and restore, serving these pages / backups until you delete them or ask us to; connection data per Cloudflare’s policy
· Google LLC (USA; https://support.google.com/policies/contact/general_privacy_form) — Google sign-in (ID token check); Google Mobile Ads for free Android users (IP address, app and ad interactions, diagnostics, advertising or device identifiers); Google Play billing data; the device geocoder on Android (a representative coordinate, pin coordinates and search text; on iOS this goes to Apple Inc., USA) / when you sign in, ads are requested, you buy, or city names and places are looked up / sign-in, ad delivery and measurement, payment, place names / per Google’s policies
· RevenueCat, Inc. (USA; privacy@revenuecat.com) — anonymous app user ID and purchase/subscription status / at launch, purchase and restore / granting the entitlement / per RevenueCat’s policy
· Hyperknot Software Kft. (Hungary; OpenFreeMap; privacy@openfreemap.org) — the viewed map area (tile requests) and connection data such as IP address / while you view the map / map display / per its policy (server logs 7 days, up to 30 days during a security investigation)
If you do not want these transfers, you can avoid the related feature or uninstall the app. Refusing the transfers needed to show ads may limit free use; no ad data is sent with Plus or the ad-removal purchase.
11. Retention and deletion
Local trips remain until you delete them or clear app data. Exported files and operating-system backups must be deleted separately. Installation and daily statistics currently have no fixed automatic expiry; we retain them while needed for operating and understanding the app, unless deletion is requested or they are no longer needed. Duplicate-prevention event IDs older than 30 days are removed on a subsequent collection request. Provider logs follow the provider’s retention practices. Support correspondence is retained as needed to resolve the request and meet applicable duties. The optional cloud backup is kept until you delete it in the app or ask us to; each account can keep up to 300 pin photos.
12. Your choices and rights
You can deny or revoke location permission, stop a trip, delete local trips and export a backup. Clearing app data resets the installation ID but does not itself delete statistics already received by our server. To request access, correction, deletion or restriction of statistics, contact us and, if available, include the “Usage statistics ID” shown in the app’s Privacy screen before clearing data. We do not identify an installation by name or email, so without that ID we may be unable to locate its records. You may also have rights to object, portability, withdrawal of consent where processing relies on consent, and a complaint to your local data-protection authority. Requests are handled under applicable law. Finish any trip in progress, then stop using the app to stop future collection.
13. Children, security and changes
Mistmap is intended for a general audience and is not directed to children under 13 or a higher minimum age required locally. Contact us if you believe a child’s data was collected. We use HTTPS, restricted server access and database access controls; no storage or transmission is completely secure. We will publish changes here with an updated effective date and provide additional notice or consent where required.
14. Privacy officer and remedies
Privacy officer: Jongcheol Lee (owner), whdcjf8172@gmail.com. We reply to access, correction, deletion and suspension requests within 10 days.
You can also contact these Korean authorities about a privacy infringement:
· 개인정보분쟁조정위원회 (Personal Information Dispute Mediation Committee): 1833-6972 (www.kopico.go.kr)
· 개인정보침해신고센터 (KISA Personal Information Infringement Report Center): 118, no area code (privacy.kisa.or.kr)
· 대검찰청 사이버수사과 (Supreme Prosecutors’ Office Cyber Investigation Division): 1301, no area code (www.spo.go.kr)
· 경찰청 사이버수사국 (Korean National Police Agency Cyber Investigation Bureau): 182, no area code (ecrm.police.go.kr)
15. Policy history
November 7, 2026: removed automatic exploration and background location; updated where interstitials appear
October 16, 2026: added privacy officer, international transfers and remedies
October 8, 2026: previous version