Privacy policy
Last updated: 12 November 2026
BadgeAtlas ("we", "us") is responsible for the personal data processed in connection with the app.
Contact: badgeatlas.app@gmail.com
Support: Support page
BadgeAtlas is a travel tracker for iPhone and iPad. In version 1.0 you must sign in with Apple or Google (there's no mode that works only on the device). You can log countries and visit dates, earn badges, sync your map across devices, and optionally buy BadgeAtlas Pro (Lifetime or Yearly). The app has no ads. The backend is hosted on Supabase in the EU, Frankfurt region (eu-central-1).
1. What we collect
Account data (Sign in with Apple or Google), required. To use the app you sign in with Apple or Google. We receive the identifiers the provider shares with us so we can create and recognise your account. This typically includes a stable provider user ID and, depending on what you (and the provider) allow, an email address (including a private email relay from Apple, if you choose it) and a name. We don't receive your Apple or Google password. We request only the minimum scopes needed to sign you in.
Your content. Countries you add, visit dates you add, badges you earn, and similar choices you make in the app (for example theme or share-card preferences). We don't collect GPS or continuous location. Countries and dates are entered by you. They're travel records you create, not a location trace.
Purchases. If you buy BadgeAtlas Pro (BadgeAtlas Pro – Lifetime or BadgeAtlas Pro – Yearly), payment is handled by Apple In-App Purchase. We do not receive your card number, bank details, or Apple ID password. We receive the entitlement we need to provide Pro (for example a transaction identifier and product / subscription status) so we can restore purchases and provide the features you paid for.
Technical and support data. Standard server or device logs may include an IP address, device type, app version, and timestamps, used to operate the service, debug failures, and keep the account secure.
Analytics and crash data. We do not use any third-party analytics or crash SDK in the app. We don't run our own in-app analytics or crash reporter. If you choose, in your device settings, to share App Analytics and/or crash reports with developers, Apple may provide us with aggregated App Analytics and opt-in crash information in App Store Connect, under Apple's own terms and privacy policy. That sharing is optional and controlled by you on the device, not by a prompt or SDK in BadgeAtlas. The app has no ads and doesn't use a tracking identifier for advertising.
We don't collect precise location, photos, contacts, microphone, or your payment card data.
2. Why we process it (GDPR legal bases)
- To provide the app you asked for (contract): creating your account, storing your countries, dates and badges, syncing across devices, providing Pro, customer support, and account deletion.
- Legitimate interests: keeping the service secure, preventing abuse, and operating necessary server logs, in a way that doesn't override your rights.
- Legal obligation: tax, accounting, and responding to lawful requests, where applicable.
- Consent: only where we actually ask for it. Version 1.0 isn't planned to send marketing email. Apple's App Analytics and crash-report sharing, if any, is an opt-in you control in the Apple device settings.
3. Who processes data on our behalf
- Supabase hosts the app backend and database as a processor under our instructions. Hosting region: EU, Frankfurt (
eu-central-1). - Apple provides Sign in with Apple, App Store distribution, In-App Purchase, and (if you opt in on your device) App Analytics and crash reports. Apple also processes data as described in its own policies when you use those services.
- Google provides Sign in with Google, if you choose it, under Google's own policies for that service.
We won't sell your personal data. We won't use your map as an advertising profile. We don't use third-party advertising, analytics, or crash SDKs.
If a provider stores or views data outside the EU/EEA (Apple and Google often do, even when our own database is in Frankfurt), a valid transfer mechanism (for example, an adequacy decision or standard contractual clauses) must be in place before launch. This is an open legal task, not something this draft settles.
4. How long we keep data
- Account and user content: for as long as the account exists, then deleted or irreversibly anonymised after you delete the account, within a short administrative period (to be set; example to confirm: 30 days), except where a limited record must be retained (for example, a Pro purchase) for tax, accounting, or dispute purposes.
- Logs: for a short, fixed period (to be set) unless needed longer to investigate a security issue.
- Backups: may lag deletion by the backup cycle (to be documented once the Supabase backup practice is known).
5. Your rights
If the GDPR applies to you, you may have the right to access, correct, delete, or restrict the use of your personal data, to object to processing based on legitimate interests, to receive a portable copy of data you provided, and to withdraw consent where we rely on it. You can also complain to a supervisory authority. In Denmark, that is Datatilsynet. Elsewhere, it's your local authority.
To use these rights, contact badgeatlas.app@gmail.com. You can also correct much of your content in the app itself.
Account deletion (required by Apple): you can delete your account in the app. That will delete or anonymise the personal data held for that account, subject to the limited legal retention above. Deletion is available in the app, not only by email.
6. Children
BadgeAtlas is not directed at children. The App Store age rating is 4+, which is a content rating, not an invitation for young children to create accounts. We don't knowingly collect personal data from children under 13. If you believe a child has created an account, contact badgeatlas.app@gmail.com and we'll delete it. (Final minimum age wording should be confirmed with counsel; don't treat this paragraph as a completed COPPA / GDPR-Article-8 analysis.)
7. Security
We use a hosted EU backend (Supabase, Frankfurt), sign-in through Apple or Google rather than storing our own passwords, and HTTPS for transport. No method of transmission or storage is perfectly secure. Access controls and keys should be documented before launch.
8. Changes
If the policy changes in a material way, we'll update the "Last updated" date and, where required, notify you in the app or by email.
9. Contact
badgeatlas.app@gmail.com
Support page
This website
These pages are static HTML with no scripts, no third-party fonts, no analytics, and no cookies set by BadgeAtlas. The hosting provider may process technical data such as IP addresses in order to deliver the pages.