Privacy

Who processes your data

The controller is me, Samuel Tuka, a private individual. I build the app as a non-commercial project for my master's thesis.

If you have questions about your data, write to samueltuka1@gmail.com.

What data I process

• Account: email, username, display name and password. I store the password only as a hash, never in readable form.
• When you register, you confirm that you are at least 16. If you set an avatar or a default map location, I store those too.
• Google sign-in: your Google account identifier, email, name and profile photo as Google sends them.
• Graffiti: photos, location, address and the other details you fill in. Before storing a photo I remove its metadata, including GPS coordinates. You can also upload graffiti without an account. It then carries no name.
• Community review: your answers to tasks and the points you earn for them.
• Marketplace: your artist profile with the contacts you enter, orders with their location and photos, offers, ratings, and chat messages and photos.
• Reports you send.
• Technical data: IP address and the type of device and browser. You can see the device name in the list of signed-in devices.
• I use your device location only when you allow it. The map uses it to show your surroundings, and when you take a photo it tells me where the graffiti is. The only location I keep is the location of the graffiti itself.

Why I process it

• To run your account, uploads, review, the marketplace and the chat. The legal basis is the performance of a contract under Art. 6(1)(b) GDPR.
• I send emails only when the service needs them: to verify your address, to reset your password, and to tell you that Google was linked to your account.
• For security. Server logs and request limits protect the app from abuse. Here I rely on legitimate interest under Art. 6(1)(f) GDPR.
• To keep the community review reliable. I compare your answers with what the others agree on. If they keep disagreeing over time, your answers stop affecting the result. It has no other consequences. Here I rely on legitimate interest under Art. 6(1)(f) GDPR.
• In my thesis I work only with aggregated data that does not reveal who uploaded what.

I do not sell your data and I do not use it for advertising.

What you have to provide

To create an account I need an email, username, display name and password, or a Google sign-in. Without them an account cannot be created. You can browse and upload graffiti without an account. Everything else is optional.

What is public

Anyone can see a published graffiti: its photos, location, address and description. Your display name appears next to it unless you hide it in the settings. Artist profiles, their portfolios and order ratings are public too. Nobody else sees your email or password. Reports, including who sent them, are visible only to the administrator.

Who receives your data

• The hosting provider of the server in the European Union that holds the database and the photos.
• Resend, which sends the app's emails. It receives only your email address and the text of the message.
• Google, if you sign in with Google.
• Mapy.com by Seznam.cz, when you search for an address or when the app looks up an address from coordinates. It receives the search text or the coordinates. The request is sent by the server, so Mapy.com does not see your IP address.
• OpenFreeMap, which provides the map tiles. Like any server the app loads content from, it sees your IP address.

Resend and Google may process data outside the EU. For such transfers they rely on mechanisms allowed by the GDPR, such as standard contractual clauses.

How long I keep it

• I keep your account until you delete it. Right after deletion I remove your email, password, name, avatar, artist profile, contacts and device data. Graffiti and ratings you contributed stay in the repository without your name.
• Photos of rejected, removed and hidden graffiti are deleted after 30 days.
• A sign-in on a device expires after 30 days at the latest.
• Server logs are overwritten continuously.
• I back up the database every day. Daily backups are kept for 7 days, weekly ones for 4 weeks and monthly ones for 6 months, so deleted data can stay in backups for up to 6 months.

Cookies and storage on your device

I only use what the app needs to work. On the web these are the sign-in cookies and a cookie with your chosen theme. On your device the app remembers your settings, unfinished uploads and your sign-in. On mobile it keeps them in secure storage.

I do not use any analytics, advertising or tracking tools.

Security

The connection to the app is encrypted. Passwords are stored only as hashes. Chat photos and photos nobody has approved yet are kept in private storage and open only through a temporary signed link.

Your rights

You can ask for access to your data, its correction, erasure, restriction of processing and portability. You can object to processing based on legitimate interest. You can delete your account yourself in the account settings. Send any other request to samueltuka1@gmail.com. The Account deletion page describes the steps too.

You allow access to the camera, location and photos in your phone's system settings, and you can withdraw it there at any time.

If you think I handle your data wrongly, you can file a complaint with the Office for Personal Data Protection of the Slovak Republic.

Changes

When I change this text, I update the date at the top. I will tell you about significant changes in the app.