Privacy Policy

Cartaveo is a platform for community-built map collections: members create collections, others contribute locations — places with coordinates, photos and descriptions. For any privacy request (access, correction, deletion), contact the site operator.

Account data: your email address, display name and password (stored as a salted hash), or your Google account identity if you sign in with Google.

Profile data you choose to add: bio, avatar, websites, favorite categories, an optional home location. All of these are optional and shown on your public profile.

Contributions: locations you submit (including their coordinates, title, description, tags, custom fields and photos), comments, likes and follows. Locations in public collections are public — including their coordinates.

Technical data: a session cookie to keep you signed in. We set no tracking or advertising cookies. Anonymous submissions are protected by Cloudflare Turnstile, which processes technical browser data to tell humans from bots.

Your device's location is used only after you explicitly allow it, and only to position a location you are creating. You can withdraw this consent at any time in Settings. Without consent you can always place the pin by hand.

Nearby suggestions: when your browser grants location access, Cartaveo may use your device's approximate position — rounded to about a kilometre before it ever leaves your browser — to suggest collections near you. The rounded position is used only to answer that request and is not stored.

Photo location metadata (EXIF): photos you pick from your gallery may contain embedded GPS coordinates. With your consent, Cartaveo reads them locally in your browser to suggest the location's position — they are not sent anywhere by that step. Our server strips all EXIF metadata, including GPS, from every stored photo, so published photos never expose embedded location data.

Published coordinates: a location's coordinates are part of its content. In a public collection they are visible to everyone, including through the API and embeds. Please don't publish precise locations of private homes or of other people without their permission.

We process your data on these GDPR bases: consent for device and photo location collection; contract for operating your account and the features you use; legitimate interest for abuse prevention (rate limiting, spam protection).

Your data is kept while your account exists. Deleted comments leave a tombstone without the original text while replies remain. To delete your account and associated personal data, contact the site operator.

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to processing, request portability, and withdraw consent at any time (for location, directly in Settings). You may also lodge a complaint with your data protection supervisory authority.

We will update this page when our data practices change and adjust the date shown beside the title.