Privacy Policy

Controller and contact

tracespotting (tracespotting.com) and śladmap (sladmap.pl) share accounts and content. The controller is DEFE Przemysław Drązewski. Privacy contact: tracespotting@pm.me.

Accounts and sign-in

We use your name, email, sign-in details and account activity to provide your account. For security, we also process connection data, including your IP address and browser information. Passwords are stored in a protected form.

If you choose Google sign-in, we receive your account identifier, name, email, verification status and profile picture when available. We also keep information needed to support this sign-in method. We do not access Gmail or Google Drive. Google also processes information under its own privacy policy.

Your account and content are shared by tracespotting and śladmap, but you sign in separately on each site. You can use email and password instead of Google.

Profiles, stories, locations and files

We process information you add to your profile and stories, including text, images, places, routes, collections and favourites. Live updates and uploaded routes may contain precise locations and travel times. You can turn off access to your device location in browser settings.

Public content can be read without an account, appear in search engines and be copied by others. Uploaded images have public addresses even when the story has restricted visibility. Do not upload confidential material. Removing content does not automatically remove copies made by others.

Purposes and legal bases

Accounts, saving content and providing requested features are necessary to perform the agreement for using the service (GDPR Article 6(1)(b)). Preventing abuse, security and defending legal claims rely on the operator’s legitimate interests (Article 6(1)(f)). Data protection duties, including responding to individuals’ requests, are based on legal obligations (Article 6(1)(c)). Optional analytics requires your consent (Article 6(1)(a)).

Required registration fields are necessary to create an account. Other details and Google sign-in are optional. You can read public stories without an account. We do not make decisions producing legal effects about you based solely on automated processing. Permission for Google sign-in, location or notifications is not consent to analytics.

Who receives your data

We use providers of hosting, file storage and correspondence services. They may process data as needed to provide those services. Google receives data when you choose Google sign-in or consent to Google Analytics.

Using maps and place search may share your IP address, search terms and the area viewed with those providers. Finding sources for a story may share place names and locations with search and archive services. Private content requires a separate confirmation.

Viewing external images or starting media players connects you to their providers. They receive connection data and may use their own cookies. Players load only after you click. Hiding a player does not erase information already sent.

Notifications require browser permission and use its notification service. We store the information needed to deliver them. You can withdraw permission in browser settings.

Cookies and device storage

Cookies and browser storage keep you signed in, protect your account and remember your language, settings and unsaved content. They also support some offline features. Clearing site data may sign you out and remove local drafts.

Google Analytics measures site use only after you choose “Allow”. Choosing “Necessary only” does not limit site features. You can change or withdraw consent through “Cookie settings” in the footer or on the sign-in and registration pages. Withdrawal stops analytics and removes Google Analytics cookies accessible to the site.

We remember your choice for up to 180 days, separately on each domain. Analytics cookies also expire within 180 days. If your browser blocks storage, you may need to choose again. Analytics covers visited pages and device information. We do not use it to personalise advertising.

International transfers and retention

Service providers, including Google, may process data outside the European Economic Area, including in the United States. Depending on the recipient, safeguards include adequacy decisions or standard contractual clauses. You can request information about these safeguards and how to obtain copies at tracespotting@pm.me.

We retain account information while you use the account, and content and files until deletion or account closure, subject to legal duties and specific claims. Sign-in and notification information remains while needed for those features or until it expires.

We keep correspondence about reports and complaints for 12 months after the matter is closed. A legal duty or ongoing dispute may require longer retention. Error and security information is kept as needed to investigate an incident or protect related claims.

Deleted data may temporarily remain in backups, which are gradually replaced. Backups are used to restore the service. After restoration, we reapply completed deletion requests. Our response explains the scope and timing of your request.

Withdrawing analytics consent does not automatically erase data already sent to Google. Its retention depends on Google Analytics settings. You can contact us for information or deletion of data covered by your request. Local drafts and settings can be removed by clearing your browser’s site data.

Your rights and account deletion

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent without affecting the lawfulness of earlier processing. You may complain to Poland’s President of the Personal Data Protection Office (UODO) or another competent supervisory authority.

For privacy requests or account deletion, email tracespotting@pm.me. Identify the account and what you need; never send passwords or access codes. We may ask you to confirm your identity. Deletion covers the account, associated information, content and files, subject to legal exceptions. We generally respond within one month. Any permitted extension and its reason are explained within that period. If some data must be retained, we explain the basis and retention period.