Privacy Policy

Last updated: April 26, 2026

Overview

OutsiderMap is an independent project. We collect only what is necessary to operate the service and do not sell your personal data to anyone. This policy explains what we collect, why, and how you can control it.

What we collect

Account data

Email address — used for authentication and transactional emails only.
Encrypted password — stored by Supabase Auth, never accessible in plain text.
Subscription status — whether your annual access is active, used to gate the map.

Review data (optional)

City reviewed, friction rating (1–5), and demographic tags you self-select.
Reviews are stored without your name or email — they are anonymous by design.
Your user ID is linked to reviews only so you can edit or delete them later.

Usage data

Standard server logs (IP address, browser, pages visited) retained for up to 30 days.
No third-party analytics scripts (no Google Analytics, no Meta Pixel).

Payment data

Payments are handled by Paddle. We never see or store your card number. Paddle provides us only with your subscription status and a customer ID.

How we use your data

To authenticate you and maintain your session.
To display your subscription status and grant map access.
To link your reviews to your account so you can manage them.
To send transactional emails (account confirmation, password reset). No marketing emails without explicit opt-in.
To detect and prevent abuse.

Data sharing

We do not sell, rent, or share your personal data with third parties for advertising or marketing. The only third-party services that receive data are:

Supabase — database and authentication infrastructure. Data is stored in the EU.
Paddle — payment processing. Governed by Paddle's own privacy policy.
Mapbox — renders map tiles. Receives your IP to serve map tiles. No account data is shared.
Google Gemini — used to generate AI city summaries. Only city names and tag labels are sent, never account data.

Your rights

Depending on your location you may have the right to access, correct, or delete your data. To exercise any of these rights:

Delete your reviews: click the delete option on any review you submitted.
Delete your account: email us and we will remove all personal data within 30 days.
Export your data: email us and we will provide a copy of everything we hold.

For GDPR or CCPA requests, contact us at privacy@outsidermap.com.

Cookies

We use a single session cookie set by Supabase Auth to keep you logged in. We do not use advertising cookies or tracking pixels. You can clear this cookie at any time by signing out or clearing your browser storage.

Data retention

Account data is kept for as long as your account exists.
Reviews are kept indefinitely to maintain the integrity of city scores. Deleted reviews are purged within 7 days.
Server logs are deleted after 30 days.

Changes to this policy

If we make material changes we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of OutsiderMap after changes constitutes acceptance.