Privacy policy
This policy covers Explored, the travel map at exploredworld.com, and applies to the website and to any Explored mobile app. It is written to be read. If anything here is unclear, email team@exploredworld.com.
Who is responsible
Explored is operated by Veer Gadodia, an individual developer based in the United States, who is the data controller for the personal data described here. Contact: team@exploredworld.com.
What we collect, why, and on what basis
- Your map: the countries, states and regions you pick, and the theme you chose. Purpose: this is the service. Basis: performance of our contract with you (the terms of service). Without it there is nothing to show.
- An anonymous account. When you first open Explored we create an account with a random identifier and no personal details, so your map is saved as you build it. Purpose: saving your work without asking you to register. Basis: our legitimate interest in providing the service, and yours in not losing your map.
- Google account data, only if you choose to sign in with Google: your email address, your name and your profile picture, as provided by Google. Purpose: to attach your map to an account you can reach from any device, to suggest a display name, and to show your avatar in the corner. We request only the basic profile and email scopes and nothing else. Basis: your consent, given on Google's consent screen, which you can withdraw at any time by signing out and deleting the account, or by removing Explored under your Google account's connected apps.
- A display name, if you set one. Purpose: it labels your shared map and its preview card. Basis: contract.
- Technical data handled by our hosting providers to serve and secure the site: IP address, browser type, the pages requested and timestamps, kept in short-lived logs. We may use the country your request comes from to open the globe on it; that value is not stored. Basis: legitimate interest in running a secure service.
Providing the map data is necessary to use the service. Signing in with Google is optional. We do not carry out automated decision-making or profiling.
How we use Google user data
Explored's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google data is used only to provide the features described above. It is never used for advertising, never sold, never shared with data brokers, never used to train artificial intelligence or machine learning models, and never read by a human except with your permission, for security, or where the law requires.
What we do not do
- No advertising and no ad networks on the site.
- We do not sell personal information and we do not share it for cross-context behavioural advertising.
- No analytics or tracking scripts today. If we add product analytics later, this page will say so first.
- On the website, no access to your photo library, contacts or precise location. The iOS app reads photo locations only as described below, on your phone.
Photos in the iOS app
The Explored app for iPhone can light up your map from your photo library. If you allow it, the app reads two things from each photo, on your phone: where it was taken and when. It never uploads, copies or looks at the picture itself. From the location it works out the country and region, and it keeps a rough count of photos per area, in cells about 20 kilometres across. What reaches our servers is the same map data as the website holds, the countries and regions on your map, plus those cells with their counts. Photo coordinates never leave the device.
You review the places the first import finds before any of them go on your map. With full library access, the app keeps checking for new photos so the map stays current; you can turn that off in the account sheet or in iOS Settings, and removing a country from your map removes its cells too. Basis: your consent, given in the iOS permission prompt, which you can withdraw at any time in Settings.
Sharing your map
A map is private until you share it. Sharing creates a link. Anyone with the link can see the map, the name on it and the places on it, and services like chat apps may fetch its preview card. Links are unguessable but not secret, so treat one like any link you send. You can change the name or the places at any time; the link stays the same. Deleting your account makes the link stop working.
Who else handles the data
These providers process data on our behalf, only on our instructions, and under their own security and privacy commitments that are at least as protective as this policy:
- Supabase (Supabase Inc.): the database that holds accounts, maps and display names, and the sign-in service.
- Vercel (Vercel Inc.): hosts and serves the website and generates share cards.
- Google (Google LLC): handles sign-in with Google when you choose it.
We do not share personal data with anyone else, except if required by law, to protect the rights and safety of users, or as part of a sale or transfer of the service, in which case this policy would continue to apply to your data.
Where the data is kept
Data is stored and processed in the United States. If you use Explored from the United Kingdom, the European Economic Area or Switzerland, this involves transferring your data outside your region. Our providers rely on standard contractual clauses and, where applicable, the EU-US Data Privacy Framework for these transfers.
How long we keep it
- Your account, map and display name: until you delete the account.
- Anonymous accounts that never saved a map: deleted automatically after thirty days.
- Server logs: kept by our providers for a short period, typically no more than thirty days, for security and debugging.
Security
Data is encrypted in transit (HTTPS) and at rest by our providers. Access to the database from the browser is restricted per account by database-level rules, so one account cannot read another's map except through a share link. No method of storage is perfectly secure, and we cannot guarantee absolute security.
Your rights and choices
- Delete your account and everything in it from inside Explored: open the avatar menu and choose Delete account. This removes the account, the map, the display name and every share link, immediately and permanently.
- Change your data at any time: edit the map, or change the display name from the avatar menu.
- Access or export a copy of your data, correct it, restrict or object to processing, or ask about anything here: email team@exploredworld.com from the address on your account. We answer within thirty days.
- Withdraw consent for Google sign-in at any time by deleting the account or by removing Explored at myaccount.google.com under third-party connections.
- If you are in the UK, the EEA or Switzerland you also have the right to complain to your data protection authority.
- If you are a California resident: we do not sell or share personal information as those terms are defined in the CCPA, and we will not treat you differently for exercising any privacy right. Requests can be made at the email above.
Children
Explored is not directed at children under 13 (or under 16 where that is the local age of digital consent), and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change affects how Google user data is used, we will ask for your consent again before using it in the new way.