Privacy Policy

Cibus Maps

Who handles your information

Skript It Oy is the controller.
Kustaantie 9a 2, 01400 Vantaa, Finland
Contact: privacy@skriptit.fi

Information we use and why

• Browsing: scan coordinates, radius, language preferences, search text and restaurant identifiers, to return the places you request; connection addresses and a random installation identifier, to prevent misuse.
• Shared lists: when you share a list or a plan, the identifiers of its places, and for a plan how many fall on each day, so the people you send the link to can open it. The list's name and the plan's days and dates stay in the link and are not sent to us. Anyone with the link can open it.
• Account: your email address, the sign-in codes we send to it, your sign-in sessions, a coded sign-in key for each device you sign in on and the Terms version you accepted, to create your account, record your acceptance of the Terms and sign you in; if you sign in with Apple or Google, the identifier Apple or Google gives us for your account with them and the email address they confirm (with Apple, possibly an address Apple forwards to you), to create your account or sign you in, and with Apple a token Apple issues, which we keep encrypted to end your Apple sign-in for Cibus when you delete your account or remove that sign-in; your email address and connection address, to limit sign-in requests and refuse disposable email addresses; your email address, to send you notices about reports and moderation decisions; for a suspended account, a coded record of its email address and of any Apple or Google account linked to it, to stop it signing up again.
• Age signals: where Apple or Google Play provides them, the app uses the age range and parental-approval status on your device to apply the minimum age and required store approval. Age ranges and birth dates are not sent to us. To honour revoked approval, we receive the Play installation identifier or Apple's signed app transaction, which includes app-acquisition, version, date and device-verification information. We keep a coded store identifier linked to your account, and linkage and approval-change times. We receive revocation events from Apple or through Google Play's owner console and use them to restrict new contributions.
• Answers: your answer about a restaurant, the reasons you chose, its visit month and when you saved it, and your setting to hide places you marked Not for me, to show you your answers and apply that setting; your answers, to calculate Most loved badges, where Not for me answers can stop a place getting one; answers and the age of the accounts that gave them, to calculate badges, handle badge reports and remove answers the Terms do not allow. An answer you keep private stays on your device and is not sent to us.
• Photos: the image, its category, restaurant and capture month, to review the photo and publish it; the result of its check against known child sexual abuse material, to review it; a fingerprint of the photo, and of a rejected photo, to show us copies of rejected photos when we review; your daily upload count, to apply upload limits.
• Hidden contributors: a coded identifier made from your installation identifier, the hidden contributor's account identifier and the time you hid them, to hide their photos from you and let you undo that choice; a coded record of the network you connect from, to limit hides.
• Reports: the reported item, the reason, your explanation, your name and email address where you give them, a coded identifier made from your installation identifier and the reported item, never linked to an account, and the dates the report was received and decided, to handle the report, recognise repeat reports and send you notices about it; a coded record of the network you connect from, to limit reports.
• Moderation: reports about photos, contributors and badges, to decide on them; decisions about your photos, answers or account and the reasons for them, to apply them and tell you about them; when a photo is reported as child sexual abuse material or matched by PhotoDNA, the photo and a minimal record of its account, until we decide on it; when we report a photo to the police, the photo and a minimal record of its account, to support that report.
• Maps, updates and logs: map-region requests, app and platform information, update installation identifiers and connection addresses, to deliver maps and app updates; operational logs, to diagnose failures.
• Website: connection addresses and page requests, to deliver this website.
• Privacy requests: your request, contact details, necessary identity checks, our replies and the record of the outcome, to handle your request and defend legal claims about how it was handled.

You do not need an account or location permission to browse. Answers, photos and reports about a place's details need an account, which needs an email address.

The app keeps on your device your scan history, your lists with their notes and plans, your search history, your answers and photos, and Picks you keep offline. Your device's backup may include your lists and search history; the scan history, answers, photos and offline Picks are not backed up. We receive parts of this only to answer a request, such as a saved place's identifier or a scan's centre, and keep none of it.

Legal bases

• Contract (GDPR Article 6(1)(b)): your account, answers and photos, and the lists you share.
• Legitimate interests (GDPR Article 6(1)(f)), for these uses and interests:
  • scans and searches: providing the restaurant discovery you request;
  • request limits and other misuse prevention: keeping the service available and free of abuse;
  • reports and moderation: keeping illegal content and content the Terms do not allow off the service;
  • the suspension record: keeping suspended users from signing up again;
  • maps: showing you where restaurants are;
  • app updates: keeping the app working and secure;
  • logs: finding and fixing failures;
  • the website: publishing information about the app;
  • anonymous daily totals: understanding how the app is used;
  • privacy-request correspondence and records after closure: defending legal claims about how requests were handled.
• Legal obligation (GDPR Article 6(1)(c)): the notices the Digital Services Act requires, reports to the police of suspected crimes that threaten anyone's life or safety, including child sexual abuse material, and handling your data-protection rights requests.

Who receives it

Approved photos are public. A list you share can be opened by anyone with its link.

Cloudflare provides hosting, databases, storage, photo processing, sign-in emails and moderation notices; Microsoft checks a fingerprint of each uploaded photo against known child sexual abuse material (PhotoDNA), without receiving the photo; OpenFreeMap provides maps; Expo provides app updates. Google Workspace stores necessary private records for handling privacy requests, incidents and operational actions.

Cloudflare, Google Workspace and, for app updates, Expo process information for us under data processing terms that require them to protect it as this policy describes. If you sign in with Apple or Google, Apple or Google handles that sign-in under its own privacy policy; when you delete your account or remove Sign in with Apple, we ask Apple to end it. When a scan does not name its area, the app asks your device's location service (Apple or Google) for the area's name at the scan's centre. Expo, Microsoft and OpenFreeMap also handle what they receive under their own privacy policies.

Account information and photos are stored in the EU. Cloudflare processes information on its worldwide network, including in the United States, under the standard contractual clauses and the EU–US Data Privacy Framework in its data processing terms. Expo processes update requests in the United States under the standard contractual clauses in its terms and the Data Privacy Framework. Microsoft's photo fingerprints may be processed in the United States under the Data Privacy Framework, and Google Workspace may process our private records outside the EU under its transfer terms. Contact us for a copy of the safeguards.

We report suspected child sexual abuse material and other threats to life or safety to the Finnish police.

How we protect it

The app connects to our servers and providers only over encrypted connections (HTTPS). Session tokens are stored only as hashes. Access to stored personal data that is not public is limited to Skript It Oy and its service providers.

How long we keep it

• Scan and search requests: not kept after the answer, except in server logs.
• A shared list: seven days from when you share it.
• Request-limit counters: the one-minute limit window.
• Your account, its email address and the Terms version you accepted: until you delete the account, or until Apple tells us you deleted the Apple Account that was the only way to sign in to it.
• Sign-in codes: deleted within 24 hours after they expire.
• Sign-in sessions: one year, or until you sign out or delete the account.
• A device's sign-in key: one year from sign-in, or until you delete the account or sign out your other devices; signing out keeps it.
• Apple or Google sign-in: until you remove it in Account or delete your account. Apple's token: until then, and at most 7 more days while we ask Apple to end the sign-in.
• Store-consent account links: until account deletion. Revocation event records: 90 days. A separate coded record of the latest revocation and later reapproval: 2 years after the latest revocation, including after account deletion.
• Coded records of sign-in code requests, used to limit them: 24 hours.
• Coded records of the network a report or a hide came from, used to limit them: 24 hours.
• A suspended account's coded email record: 2 years after the account is deleted.
• Answers: until you withdraw them or delete your account.
• Approved photos: until you withdraw them, we remove them or you delete your account. Photos awaiting review expire after 30 days. The details of a closed photo are cleared 30 days after it closes; a minimal record remains until account deletion. Photo files are normally deleted from storage within 24 hours after the photo closes. A photo we report to the police, and the minimal record of its account, are kept for 90 days after the report, longer only if the police ask in writing.
• A photo reported as child sexual abuse material or matched by PhotoDNA, and its account's identifier, email address and creation time: until we decide on it, at most 30 days, including after the photo is withdrawn or the account is deleted. If we report it to the police, the 90-day period applies.
• Check results and photo fingerprints: until 30 days after the photo closes, or until account deletion.
• Fingerprints of rejected photos, without photo or account identifiers: 1 year after the latest matching rejection, including after account deletion.
• Daily photo upload counts: 7 days.
• Hidden contributors: until you undo the hide or the hidden contributor's account is deleted. These choices belong to your installation, so deleting your account does not remove them.
• Reports: 6 months after the report is decided, or when the reported photo is removed. Reports of illegal content or child sexual abuse material: 6 months after the decision, including when the reported photo or its account has been deleted. Notices of illegal content, including the sender's name and email address and the receipt needed to answer them: 6 months after we send our decision, including when the reported photo has been removed; if you supplied no contact details, 6 months after the decision.
• Moderation decisions and their reasons: until the account they concern is deleted; for a suspension, 2 years after the account is deleted.
• Server logs: up to seven days. Database recovery copies: up to 30 days.
• Website requests and photo processing at Cloudflare: kept by Cloudflare under its data processing terms until they are no longer needed to provide the service. Map requests: kept by OpenFreeMap under its privacy policy. App update requests: kept by Expo under its privacy policy.
• Email delivery records: kept by Cloudflare under its data processing terms until they are no longer needed to provide the service, or until our agreement with Cloudflare ends, whichever is earlier. Cloudflare shows them to us for up to 30 days.
• Email addresses our email provider blocks after a failed delivery or a spam complaint: from 24 hours to no end date, depending on the cause.
• Requests about your personal data, including account deletion by email, and our replies: 3 years after the request is closed.

Your choices and rights

You can withdraw answers and photos and delete your account in the app, or by contacting us.

You can request access to your personal data and its correction, erasure, restriction or, where applicable, portability at privacy@skriptit.fi.

You can complain to the Finnish Data Protection Ombudsman or another supervisory authority, including where you live or work.

Your right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Email privacy@skriptit.fi.