Privacy Policy

Last updated: March 2026

1) Who we are

MunchMap ("MunchMap", "we", "us") is a mobile application (available on iOS, Android, and Web) operated by Stuart Cleary (United Kingdom) as an individual developer.

Contact email (support & privacy): support@munchmap.app

2) What this policy covers

This Privacy Policy explains how we collect, use, share, and protect personal data when you use the MunchMap mobile application and related services (the "Service").

3) Information we collect

3.1 Account information

When you create an account or sign in, we process:

Email address (for email/password sign-in and/or where provided by sign-in providers);
Authentication information required to sign you in (for email/password, we store a password hash rather than your raw password);
If you use "Sign in with Apple" or Google sign-in, we process the identifiers those services provide to authenticate you (and any email address you choose to share via those services).

3.2 Saved content (your "Munches")

When you save a TikTok video link or Instagram Reel link, we store:

The URL you submit;
The video title and description obtained via metadata;
The thumbnail URL (and/or a cached copy if technically required for display);
Derived place/location details used to display your saved spots on a map (for example, venue name, address, coordinates, and a Google Place ID where available).

3.3 Precise location (used, not stored)

If you grant permission, MunchMap accesses your device's precise location to show your current position relative to your saved spots ("near me" functionality). We do not store your precise location on our servers. Location is used only at the time you are using the map view.

3.4 Technical and operational data (logs)

Our hosting and infrastructure may process limited technical data such as IP address, timestamps, and request metadata to operate the Service, maintain security, and troubleshoot issues.

4) How we use your information

We use the information above to:

Create and manage your account;
Store and display your saved spots;
Infer and display a likely place/location for a saved link (see "Third parties" below);
Maintain and secure the Service, prevent abuse, and debug issues;
Respond to support requests.

5) Legal bases (UK GDPR / GDPR)

Where UK GDPR / GDPR applies, we rely on the following lawful bases (as appropriate to the specific processing):

Contract: processing necessary to provide the Service you request (e.g., account and saved items);
Legitimate interests: operating, securing, and improving the Service (balanced against your rights);
Consent: for optional device permissions such as precise location (you can withdraw consent by disabling location permissions in your device settings).

6) How we share information

We do not sell your personal data. We share data only as necessary to provide the Service:

6.1 Hosting (Replit)

Our backend is hosted with Replit. Replit's documentation indicates published apps are hosted in the United States.

6.2 AI processing (OpenAI)

We use OpenAI to help infer likely place/location details from link metadata (for example, text from the link's title/description). We send only the metadata necessary for this purpose. OpenAI's platform documentation states that data sent via the OpenAI API is not used to train or improve OpenAI models unless you explicitly opt in.

6.3 Place lookup (Google Places API)

We use the Google Places API to look up accurate location details (coordinates, address, ratings, opening hours) for venues you save. When you save a link or search for a place, we send the venue name and relevant context (such as city or country) to Google. Google's processing of this data is governed by their privacy policy.

6.4 Video metadata retrieval (TikTok & Instagram)

To obtain metadata such as title/description/thumbnail for a submitted TikTok link, we may use oEmbed or equivalent metadata endpoints (where available).

For Instagram Reels, we use Supadata.ai to retrieve video metadata (such as title, description, and thumbnail). When you save an Instagram Reel link, that URL is sent to Supadata.ai's API for processing. Supadata.ai's processing of data is governed by their own privacy policy. We send only the information necessary to retrieve the metadata for the Reel you have submitted.

6.5 Email delivery (Resend)

We use Resend as our email service provider to send transactional emails (such as password reset emails). When you request a password reset, your email address is shared with Resend for the purpose of delivering that email. Resend's processing is governed by their own privacy policy.

6.6 Sign-in providers (Apple / Google)

If you choose to use Apple or Google sign-in, those providers process data as part of authenticating you. Their processing is governed by their own policies and settings.

7) International data transfers

Because our hosting is on Replit (hosted in the United States), your data may be processed outside the UK/EEA. Where required, we rely on appropriate safeguards (e.g., contractual protections) to enable international transfers.

8) Data retention

Account data and saved spots are retained until you delete them or delete your account.
Account deletion: you can delete your account in-app. Deletion is immediate (subject to reasonable technical processing time) and will remove your account and associated saved content from our active systems unless we are legally required to retain limited information (e.g., for security, fraud prevention, or legal compliance).
Operational logs are retained for a limited period for security and troubleshooting.

9) Your rights

Depending on your location, you may have rights to:

Request access to personal data we hold about you;
Request correction or deletion;
Object to or restrict processing;
Request a copy (portability), where applicable.

To exercise rights, contact: support@munchmap.app

If you are in the UK, you can also complain to the Information Commissioner's Office (ICO).

10) Security

We use reasonable technical and organisational measures designed to protect your information, including access controls and encryption in transit where supported by our infrastructure.

11) Children

MunchMap is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us personal data, contact us and we will delete it.

12) Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice in-app or by other reasonable means. The "Last updated" date will reflect the latest version.