Privacy Policy for Hvor Kart

Hvor Kart is built to work without you giving anything away. The map, GPS, track logging and “Where am I?” work without an account, and with incognito on nothing leaves your phone. This policy explains what is sent where when you use features that need the internet.

Who is responsible

The Adept AS is the data controller for personal data in Hvor Kart. For questions about privacy, or to see or delete your data, write to holding@adept.as.

On your phone

Hvor Kart uses GPS to show where you are and record trips, and the barometer to measure altitude more accurately. The app uses your location in the background only while you record a trip. The camera is only used when you take a photo for a place or a check-in. Trips, places, notes, photos, check-ins and downloaded maps are stored on your phone.

Maps and lookups online

Outside incognito, the app fetches maps and data directly from these services:

• Kartverket and Geonorge (the Norwegian Mapping Authority): maps, place names, addresses, altitude, trails and property boundaries
• NVE (the Norwegian Water Resources and Energy Directorate): slope steepness and avalanche danger
• Miljødirektoratet (the Norwegian Environment Agency): protected areas
• Amazon Web Services: open elevation data for the terrain
• Overpass servers for OpenStreetMap: trails when you plan a route

These services see your IP address and the area or point being asked about, for example the coordinate when the app looks up the nearest place name or the altitude where you stand. No information about you is included.

Account with “Sign in with Apple”

When you sign in, we receive a user ID from Apple, and your name and email address if you choose to share them. Apple lets you hide your email address behind a forwarding address. We store your name, email, app version, and when you created your account, signed in and last used the app.

Backup and sync (Pro)

With Pro and an account, your places (name, position, notes and photos), trips (the track with time, position and altitude) and summit check-ins are stored in the cloud so they follow you to new devices. Only you can access them.

Profile, feed and following

When you're signed in, you have a profile with your name and, if you add them, a profile photo, cover photo, short bio and home town. The profile shows statistics and the summits you have checked in on (the summit, number of visits, first and last visit). It also shows the trips and check-ins you share, with title, time, distance, ascent, duration, the summits, a simplified route and photos.

You decide who sees your profile:

• Friends (default): only friends, meaning people you follow each other with.
• Everyone: everyone signed in to Hvor Kart. Others can then find you by searching for your name. For search, we store your name, profile photo, home town, friend code and the number of summits you have visited. Your name, profile photo and visits are also shown in the list of who has been on a summit.
• Nobody: only you. Then no check-ins or trips are shared, whatever each of them is set to.

Each check-in and trip has its own visibility: Only me, Friends or Public. New check-ins follow your profile, and you can change each one or keep it out of the feed. What you share with friends, your friends see in their feed and on your profile. What you make public, everyone signed in can see – on your profile, on the summit and in “Nearby” when they're in the area – with your name, profile photo and friend code, even if your profile is friends only. For “Nearby”, we store a public copy of the check-in or trip with what is shown, and one point: the summit you checked in on, or roughly the middle of the trip. The full GPS track and your exact position are never shared.

You can follow others with their friend code, or from search, the feed and their profile. The person you follow sees your name and friend code in their list of followers, and may get a notification. When you follow each other, you're friends. Only you can see who you follow and who follows you. When you cheer on a check-in or trip, its owner sees your name.

People you have blocked never see your profile or what you share, can't find you in search, don't follow you and can't send you anything. Your blocked list is private.

When you share places with a friend, they get a copy of the places (name, position, notes and photos) along with your name and friend code.

Reports and blocking

If you report content, we store who reported it, who it concerns, why, and a copy of the text and which photos it concerns, so we can handle the case even if the content is deleted. The person you report isn't told who reported them. Reports are deleted automatically after one year. If you block someone, their name is stored in your list of blocked people, which only you can see.

Notifications

If you're signed in and allow notifications, we store a notification token for your phone and the language the app shows, so we can let you know when friends share places with you, when someone cheers you on and when someone starts following you. Notifications are sent through Firebase Cloud Messaging and Apple's push notification service, and contain the other person's name and the place or trip. The token is deleted when you sign out, turn off notifications or delete your account.

Strava (optional)

If you connect Strava, the access tokens from Strava are stored on our server, where only the server can read them. Trips you share to Strava are sent there as GPX with a name and description. What is stored at Strava is covered by Strava's privacy policy. If you disconnect, the tokens are deleted.

Apple Health (optional)

If you give access, the app saves your trips as hiking workouts in Health, with distance and route. Hvor Kart doesn't read any health data. What is in Health is controlled by Apple and your settings.

Buying Pro

Purchases and payment go through Apple, and we never receive your payment details. We use RevenueCat to keep track of your subscription. RevenueCat receives an anonymous ID, or your user ID when you're signed in, your App Store purchase history and technical information about your phone, such as model, iOS version, IP address and the device's vendor ID. If you have allowed tracking, RevenueCat also receives the advertising ID.

Ad measurement (Meta)

To see which ads lead people to try Hvor Kart, the app may use Meta's ad measurement tools. They only start after you have accepted the terms and answered Apple's tracking question, and never in incognito. Meta learns when the app is opened and when you start a trial or buy Pro, and RevenueCat reports renewals. If you allow tracking, the advertising ID is included. If not, measurement happens without the advertising ID, in aggregate through Apple's SKAdNetwork and Meta's Aggregated Event Measurement. You can change your answer in iOS under Settings → Privacy & Security → Tracking.

Technical logs

The server logs technical events, such as a notification being sent or an upload failing, together with your user ID. The logs are used for troubleshooting and deleted automatically after 30 days. What the app logs on your phone is not sent to us.

Who processes data for us

• Google (Firebase): account, database, photos, notifications and server functions. The database is in Sweden and the server functions run in Finland.
• RevenueCat: subscriptions (USA)
• Meta Platforms: ad measurement (Ireland and USA)
• Strava: only if you connect it (USA)
• Apple: sign-in, notifications, purchases and Health

When data is processed outside the EEA, this is based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Legal basis

• Contract (GDPR Article 6(1)(b)): account, sync, profile, feed, search, following, sharing, notifications, Strava and purchases, to provide the features you ask for.
• Consent (Article 6(1)(a)): ad measurement with the advertising ID, and the access you give in iOS to location, notifications, camera and Health. You can withdraw consent in iOS Settings at any time.
• Legitimate interest (Article 6(1)(f)): security, troubleshooting, handling reports and aggregate ad measurement without the advertising ID.

How long we keep data

We keep your data for as long as you have an account. If you delete your account under Settings → Delete account, we delete the account, everything synced, your profile with photos and summit visits, what you have shared in the feed, your search entry, who you follow and who follows you, your inbox, cheers you have given, notification tokens and the Strava connection. Places you have shared with friends stay with them as a copy, and reports are deleted after one year as usual. What is on your phone stays until you delete the app. Purchase history at Apple and RevenueCat is kept for as long as accounting rules require.

Your rights

You can ask to see, correct or delete the data about you, and to receive a copy of it. You can also object to or ask us to restrict processing. You can export trips and places as GPX from the app yourself. Write to holding@adept.as and we'll reply within 30 days. If you believe we process data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Children

Hvor Kart is not aimed at children under 13, and we don't knowingly collect data about them.

Changes

If we change this policy significantly, the app will ask you to accept the new version before you continue.