Privacy policy

Maplists is operated by Studio Lite, LLC (doing business as "Maplists"), a limited liability company organized in the United States. For users in the United Kingdom and the EEA, Studio Lite, LLC is the "controller" of your personal data.

Questions, requests, or complaints about this policy or your data can be sent to privacy@maplists.app.

We collect only what the product needs to work:

• Account information you give us — your email address, username (handle), and an optional display name and avatar photo.
• Content you create — bases, lists, items, notes, reviews, saved items, likes, the people you follow, and any photos or cover videos you upload.
• Location data — your approximate device location, only if you grant permission, to show nearby places and build routes.
• Camera and barcode data — when you scan a product, the barcode (and any photo you choose to contribute) is used to look up and improve product information.
• Messages to Atlas — the questions and text you send to our in-app AI assistant.
• Purchase information — your Maplists Plus subscription status. Payments are handled by the app stores or our payment processor; we never receive or store your full card number.
• Usage and device data — basic analytics events (which screens and features you use), app version, device type, and crash diagnostics, used to fix bugs and improve the product.
• Optional demographic information — if you choose to provide it, your date of birth, gender, and country. Your date of birth is kept private (we never display it to other users); we use it to confirm you meet our minimum age, for optional birthday features, and to derive a general age range. You can add, change, or remove this at any time in Settings.
• Advertising measurement data — when a sponsored post is shown to you, we record an impression with a coarse, aggregate-only snapshot (your derived age range, gender, and country — never your exact date of birth or identity) so advertisers can see how their ads perform.

We do not ask for, and you should not send us, special-category data (such as health, religious, or precise government-identifier information).

We use your information to:

• Provide and sync the service across your devices.
• Build routes, surface nearby places, and power recommendations and search.
• Operate the Atlas AI assistant and product lookups.
• Process your Maplists Plus subscription and entitlements.
• Diagnose problems, prevent abuse, and improve performance and features.
• Show first-party sponsored posts in Discover and measure how they perform. Advertisers (and, where offered as a feature, creators measuring their own posts) only ever see anonymized, aggregated statistics — total views and the aggregate age range, gender, country, and time-of-day of the audience — never your identity, your exact date of birth, or your individual profile.
• Confirm you meet our minimum age and, if you opt in, provide birthday features.
• Send you essential service messages (password resets, security alerts, and notifications you have enabled).

We do not use your private content to serve third-party advertising, and we do not use your private content to train AI models.

If you are in the UK or EEA, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract — to provide the features you ask for, sync your data, and manage your account and subscription.
• Legitimate interests — to secure the service, prevent fraud and abuse, understand how the product is used, and improve it; we balance these interests against your rights and freedoms.
• Consent — for optional analytics cookies, access to your device location, and any marketing messages; you can withdraw consent at any time.
• Legal obligation — to comply with applicable law, respond to lawful requests, and keep records we are required to keep.

Where we rely on consent, withdrawing it does not affect processing we carried out before you withdrew it.

• We never sell your personal information.
• We never share lists or content you have marked private.
• We never run third-party advertising trackers on you.
• We never train AI models on your private content.

Maplists includes an in-app assistant called Atlas. When you send a message to Atlas, your message and the relevant conversation context are sent to our AI provider (Google's Gemini API) to generate a response. We send only what is needed to answer you and never include your account password. Your Atlas conversations are not used to train third-party models. As a precaution, do not enter anything in Atlas that you would not want processed by a third-party AI service.

Location features are off until you grant permission. When enabled, we use your approximate device location to show nearby saved places and to build and time routes. On supported devices you may also enable background or geofence-based reminders. You can turn location access off at any time in your device settings, which disables these features.

On our website we use a small number of cookies and similar technologies. Strictly necessary cookies keep the app working and cannot be turned off. Optional analytics cookies (Google Analytics) load only if you accept them in our cookie banner, and you can change your choice at any time using the "Cookies" control in the footer. Crash diagnostics (Sentry) run to keep the app stable and are configured not to collect identifying personal data.

We share the minimum data necessary with vetted service providers ("processors") who act on our instructions under data-protection agreements:

• Supabase — database, authentication, and file/video storage (United States; SOC 2 Type II).
• RevenueCat, with the Apple App Store, Google Play, and our payment processor (Stripe) — subscription billing and entitlements; we never receive your full card number.
• HERE — geocoding and place search.
• CARTO and OpenStreetMap — map tiles and base-map data.
• Google (Gemini API) — the Atlas AI assistant.
• Open Food Facts — third-party barcode and product lookups.
• Bunny CDN — hosting of list cover videos.
• Resend — transactional email (such as invites and account messages).
• Google Analytics — optional, consent-based usage measurement.
• Sentry — crash and error diagnostics.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users and the public. If our business is involved in a merger, acquisition, or sale of assets, we will continue to protect your information and notify you of any change in control.

Our infrastructure and most of our providers are based in the United States, so if you use Maplists from outside the US — including the UK and EEA — your personal data is transferred to and processed in the United States and other countries. Where required, we use appropriate safeguards for these transfers, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional measures as needed.

We keep your account data for as long as your account is active. When you delete your account, we remove your personal data from our live systems within 30 days; residual copies in encrypted backups roll off within 90 days. Public content you posted (such as public lists and reviews) may persist in other people's saved copies. We retain limited information where necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Aggregated or anonymized data that can no longer identify you may be kept indefinitely.

We protect your data with encryption in transit, row-level access controls, and least-privilege access. No system is perfectly secure, but if we ever discover a breach affecting your personal data, we will notify you and the relevant authorities without undue delay, as required by law.

You can access and export everything we hold about you, correct your profile, or permanently delete your account at any time from Settings → Account. For any request you cannot complete in the app, email privacy@maplists.app. We aim to respond within 30 days and will not discriminate against you for exercising your rights.

If you are in the UK or EEA, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected and, in certain cases, erased.
• Restrict or object to how we process your data.
• Receive your data in a portable format.
• Withdraw consent at any time where we rely on it.

To exercise any of these, email privacy@maplists.app. You also have the right to lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EEA, your national supervisory authority. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

If you are a California resident, you have the right to know what personal information we collect, to access, correct, or delete it, and to limit certain uses — all available from Settings → Account or by emailing privacy@maplists.app. We do not sell or share your personal information as those terms are defined under the CCPA / CPRA, and we will not discriminate against you for exercising your rights. Residents of other US states with comparable privacy laws (such as Virginia, Colorado, Connecticut, and Utah) may exercise similar rights by contacting us the same way.

Maplists is not directed to children. The service is intended for users 13 and older (16 in the EEA where required by local law). We ask for your date of birth to confirm you meet this minimum age, and the sign-up date picker does not allow an under-13 date. We do not knowingly collect personal data from children below these ages. If you believe a child has provided us personal data, contact privacy@maplists.app and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of Maplists after changes take effect means you accept the updated policy.

Studio Lite, LLC (dba Maplists)

Privacy questions and requests: privacy@maplists.app

General support: support@maplists.app

We will do our best to resolve any concern you raise directly with us.