Privacy policy
Last updated
BoboMaps helps parents find baby-friendly places and share new ones. This policy explains what information the BoboMaps app and this website use, why, how long we keep it and what you can do about it. We collect as little as we can: you can browse the map without an account, and the website uses no cookies and no analytics.
If anything here is unclear, write to us at hello@bobomaps.com.
Who is responsible
BoboMaps is the controller of the personal data described here. You can reach us about privacy, or anything else, at hello@bobomaps.com.
Using the app without an account
- Your location. If you allow it, the app reads your location only while it is open, to show where you are and to sort places nearest first. It sends the coordinates of the area you are looking at to our server to find places there. We use them to answer that request and do not store them or link them to you. You can refuse location access; the app then uses the centre of the map instead.
- Saved places and settings stay on your phone. We do not receive them, and they are removed when you uninstall the app.
- The map is drawn from OpenStreetMap data served by OpenFreeMap. Your phone downloads map tiles directly from them, so they see your IP address, as any website you visit would.
Your account
You need an account to add places, photos and reviews, or to report content. Accounts are provided by Firebase Authentication (Google).
- What Firebase keeps: your email address, your password (stored securely by Firebase; we never see it) and whether your email is confirmed.
- What we keep: the identifier Firebase gives your account, whether your email is confirmed, the state of your account (active or suspended), and your username and avatar. We do not store your email address on our servers.
- Why: to let you sign in, to keep contributions tied to the person who sent them while they are reviewed, to show who wrote a review, and to protect the community from abuse.
Your username and avatar
We never ask for your name and we do not copy the name from your sign-in. Instead, every new account gets a generated username, such as boboparent4821, and an avatar picked at random from a fixed set of illustrations. You can change both in your profile in the app. Avatars come only from that set: you cannot upload a picture.
Usernames are unique, so two people never look the same. Please do not use your full name or anything else that identifies you: a nickname is enough. The terms of use explain what a username may not contain.
What you share
- New places and changes: the name, position, kind of place, amenities and notes you enter.
- Photos: the app resizes each photo on your phone and removes its hidden metadata, such as the location where it was taken, before uploading it. Photos are stored privately until a moderator approves them. They must not show people, documents or number plates.
- Reviews: your ratings, the highlights you choose and your comment, shown with your username and avatar. With a review you can also suggest amenities and a practical tip; if a moderator adds them to the place, they show no author.
- Reports about a place or a photo, with the reason you give and the account that sent it.
While a contribution waits for review, only you and our moderators can see it. Once approved, reviews are public and show your username and avatar, so other parents can see who wrote them. Places and photos are public and show no author. Your email address is never shown, and there is no public profile or list of what you have shared. Contributions that are not approved, and earlier versions of a review you edited, stay private: only you and our moderators can see them. We keep them until you delete your account.
You can write one review of each place. To change it, you edit it. A moderator checks the edit and sees it next to your published review, which stays visible until then. If the edit is approved, it replaces your published review, and the practical tip from the earlier version is removed: only a tip the moderator accepts from the edit is shown. If the edit is rejected, your published review stays as it was. Editing a review that is still waiting for moderation replaces it, and the version it replaces is deleted.
Moderation and safety
Moderators see the account behind each contribution and report so they can deal with misuse. If a username breaks the terms of use, a moderator can replace it with a new generated one; the change is recorded in the moderation history. If an account breaks the terms, a moderator can suspend it, with a reason we keep alongside the account. If a suspended account is deleted, we keep only a one-way fingerprint (a SHA-256 hash) of its Firebase identifier, so the same sign-in starts suspended instead of fresh. The fingerprint cannot be turned back into the identifier and is removed if the account is reinstated.
To enforce the daily submission limit, we separately record your account identifier, a submission reference and its time, including when a pending review is replaced or a contribution is withdrawn. These records contain no contribution text or photos and are not public. Only submissions from the last 24 hours count towards the limit.
Technical data
Our servers and our network provider, Cloudflare, process technical data such as IP addresses to deliver the app and website and to block abuse, for example by limiting how many requests one address can make. We do not log your precise location searches or sign-in tokens. Logs are kept only as long as needed for security and troubleshooting.
Why we may use your data
Under the GDPR we rely on:
- performing our agreement with you (the terms of use) for your account, your username and avatar, and your contributions;
- legitimate interests in keeping the service secure and the community trustworthy, for moderation, reports, suspensions, submission limits and technical logs;
- your consent for location, camera and photo access, which you give and withdraw in your phone's settings.
Who helps us
We use a small number of providers who process data on our behalf and only for this purpose:
| Provider | What for |
|---|---|
| Google Firebase | Accounts and sign-in |
| Cloudflare | Network protection, hosting this website and storing photos |
| OpenFreeMap | Map tiles downloaded by your phone |
Some providers may process data outside the European Economic Area. When they do, the transfer is covered by safeguards such as the European Commission's standard contractual clauses. We do not sell your data and we do not use it for advertising.
How long we keep it
- Your account until you delete it.
- When you delete your account in the app, your Firebase account (email address and password) is deleted, and we delete the link to it, your username, your avatar, every review you wrote (published ones included) and the practical tips published from your reviews, your pending and rejected contributions and every photo that was not published. Ratings are then worked out again from the remaining reviews. Places you added stay on the map. Your published photos, and the amenities a moderator confirmed for a place from your reviews, stay public without any link to you. A record without personal details remains so moderation history stays consistent.
- Submission-limit records that are more than 24 hours old are deleted when your next new contribution is stored. All of these records are deleted when you delete your account.
- Location searches are not stored.
- Technical logs for a short period, for security and troubleshooting.
Your rights
You can ask us to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. You can delete your account at any time in the app's profile. To exercise any right, email hello@bobomaps.com; we will answer within one month.
You also have the right to complain to a data protection authority, in Poland the President of the Personal Data Protection Office (UODO), or the authority where you live.
Children
BoboMaps is made for parents and carers. It is not meant for children, and you must be at least 16 to create an account.
Changes
If we change this policy, we will update the date at the top. If a change matters for how we use your data, we will let you know before it applies.