Privacy Policy

This Privacy Policy explains how Zafiro Labs SAS ("Zafiro Labs", "we", "us" or "our") handles personal information in connection with the mobile application Scratch Map (the "App"). Zafiro Labs is a company incorporated under the laws of the Oriental Republic of Uruguay.

The short version: Scratch Map has no accounts and no backend. The map you build — the countries you mark as visited — is stored only on your device. We never see it, and we could not show it to anyone if we wanted to. The only data that leaves your device is anonymous usage analytics, crash reports and the network requests needed to load the map itself.

If anything is unclear, write to us at support@getscratchmap.com.

1. Who We Are

The data controller responsible for any personal information processed in connection with the App is Zafiro Labs SAS, a company incorporated and registered in the Oriental Republic of Uruguay. You can reach our privacy team at support@getscratchmap.com.

2. Data That Stays on Your Device

The App does not offer accounts and does not operate a backend for user content. The following data is stored exclusively in the App's local storage on your device and is never transmitted to us:

• Your visited countries — the list of countries you have marked on the map.
• Map settings — style and display preferences.
• Your last known map position, used to restore the map where you left it.

Deleting the App deletes this data. It is included in your device backups (iCloud / Google backup) according to your device settings, under Apple's or Google's privacy terms, not ours.

3. Data We Collect

We collect a minimal set of data, all of it generated automatically:

• Usage analytics (Google Firebase Analytics): screens viewed, features used (for example, marking a country or sharing your map), app version, device model, operating system version, language and coarse country derived from IP address. We do not collect advertising identifiers (IDFA / Android Advertising ID).
• Crash reports (Google Firebase Crashlytics): stack traces, device model, OS version and app state at the moment of a crash, so we can fix bugs.
• Map tile requests (Mapbox): when the App renders the map, your device requests map tiles from Mapbox. Like any web request, this exposes your IP address to Mapbox. See Mapbox's privacy policy.
• Purchase information. The App is a one-time paid purchase processed entirely by the Apple App Store or Google Play. We do not receive your name, email or payment details from your purchase.
• Communications with us. If you email support, we receive your email address and whatever you choose to tell us.

4. Location

If you grant the location permission, the App uses your device location once, locally, to center the map on where you are. Your location is not sent to us and is not used for advertising or profiling. You can deny or revoke the permission at any time in your device settings; the App works fully without it.

5. Why and How We Use Data

• Provide the App — render the map through Mapbox.
• Improve the App — understand which features are used and fix crashes and bugs using aggregated analytics and crash reports.
• Respond to you — answer support requests you send us.
• Comply with legal obligations and enforce our rights.

Where required by law (for example, in the European Economic Area), the legal bases we rely on are described in Section 13.

6. How We Share Data

We share data only with the following categories of recipients:

• Analytics and crash-reporting providers (Google Firebase).
• Map providers (Mapbox) that receive tile requests from your device.
• App stores (Apple, Google) that distribute the App and process your purchase.
• Professional advisers (lawyers, accountants, auditors) under duties of confidentiality.
• Public authorities when required by law, valid legal process or to protect rights, property, or safety.
• An acquirer, in the event that Zafiro Labs is involved in a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy.

For the current list of third-party processors, see our Sub-Processors page. We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

7. Cross-Border Data Transfers

Zafiro Labs operates from Uruguay. Our service providers are primarily located in the United States. Whenever personal data is transferred across borders, we rely on appropriate legal safeguards:

• Adequacy decisions. Uruguay has been recognized by the European Commission as providing an adequate level of data protection (Commission Implementing Decision 2012/484/EU).
• Standard Contractual Clauses or equivalent contractual safeguards for transfers to jurisdictions without an adequacy decision.

8. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority. In Uruguay, the competent authority is the Personal Data Regulatory and Control Unit (URCDP).

Because we hold no account data about you, most of these rights are satisfied by design: your map data is on your device and under your control, and deleting the App deletes it. Analytics and crash data are not tied to your identity, so we generally cannot link them back to you. For any request, write to support@getscratchmap.com and we will respond within 30 days.

9. How Long We Keep Data

• Your map data — stored on your device only, for as long as you keep the App installed. We never hold a copy.
• Analytics data — retained by Firebase Analytics for up to 14 months, then aggregated.
• Crash reports — retained by Firebase Crashlytics for 90 days.
• Support emails — kept as long as needed to resolve your request and for a reasonable period afterwards.
• Legal holds. Where we are required to retain data to comply with a legal obligation, we retain it for as long as that requirement persists.

10. Security

The data that matters most — your map — never leaves your device, which is the strongest protection available. Data in transit to our analytics and map providers is protected with TLS encryption. No system is perfectly secure; if a personal-data breach affects you, we will notify you and the competent authorities as required by applicable law.

11. Children's Privacy

The App is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Advertising and Tracking

The App contains no advertising. We do not use the iOS Advertising Identifier (IDFA) or the Android Advertising ID, and we do not track you across apps or websites owned by other companies. Because the App never accesses the IDFA, it does not present Apple's App Tracking Transparency prompt.

13. Regional Privacy Disclosures

13.1 European Economic Area, United Kingdom and Switzerland

If you are in the EEA, the UK or Switzerland, the GDPR and the UK GDPR apply. The legal bases on which we rely under Article 6 of the GDPR are:

• Performance of a contract — to provide the App you purchased.
• Our legitimate interests — to secure, debug, analyze and improve the App, balanced against your privacy interests.
• Your consent — for the optional location permission. You can withdraw it at any time in your device settings.
• Compliance with a legal obligation — when we are required by law to retain or disclose information.

You may also lodge a complaint with your local supervisory authority.

13.2 California, United States

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct and opt out of sale or sharing of personal information. We do not sell or share personal information as defined under the CPRA. To exercise these rights, contact support@getscratchmap.com.

13.3 Uruguay and Latin America

If you are in Uruguay, our processing is governed by Law No. 18.331 on Personal Data Protection (LPDP). You may exercise your rights of access, rectification, update, inclusion and erasure by contacting support@getscratchmap.com. The competent supervisory authority is the URCDP. Similar rights are recognized in other Latin American jurisdictions under their respective data-protection laws (e.g., LGPD in Brazil, Ley 25.326 in Argentina).

14. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the App after the changes take effect constitutes acceptance of the updated Policy.

15. How to Contact Us

Zafiro Labs SAS
Montevideo, Uruguay
Privacy inquiries: support@getscratchmap.com
Postal address available upon request.