Privacy Policy

Soul Map is operated as a location-based social discovery service for adults (18+). This Privacy Policy applies whenever you access the app, website, or related services (together, "the Service").

If you have a privacy question or want to exercise a legal right, email us at privacy@soul-map.xyz or use the in-app "Export My Data" / "Delete Account" tools. We respond to verified requests within the time required by law (typically 30 days in the EU/UK, 45 days in California).

We collect only what is needed to make the Service work. Under GDPR Art. 6, the bases are: performance of a contract, legitimate interest, consent, and legal obligation. Specifically:

• Account data — email address, display name, chosen identity, birth year (age gate). Used to create and secure your account, and to enforce the 18+ rule.
• Profile data — bio, city, avatar, preferences. Used to operate the Service and let others connect with you.
• Location data — precise GPS is used only to show bottles nearby and to anchor the messages you leave. We never publish your live location to other users, and we do not keep a permanent history of your movement. Location tied to a message is deleted when the message expires (24–72h).
• User-generated content — messages, voice recordings, intents. Stored to operate the Service. Voice recordings are held in a secure storage bucket.
• Technical data — approximate device/crash info for security and reliability. We do not use advertising trackers.

Soul Map is strictly for users aged 18 and older. The Service is not directed to children and we do not knowingly collect personal information from anyone under 18.

If you believe a child under 18 has provided us personal information, contact privacy@soul-map.xyz and we will promptly delete it and close the account. Under the U.S. Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation (GDPR-K), no parental-consent mechanism is applicable because the Service excludes children entirely.

Precise location is a special-category-adjacent practice under several laws (e.g., California CCPA/CPRA, EU ePrivacy, and location-specific rules in states like California and Illinois). Our safeguards:

• We ask for explicit in-app consent before any location access.
• You can use the Service without location ("Explore without location").
• Your live position is never shown to other users — only anonymised bottle markers.
• We do not build a movement history or sell location data.
• Location attached to a message is removed when the message expires.

We do not sell personal data, and we do not share it for advertising. We use limited sub-processors to operate the Service (e.g., secure cloud hosting and infrastructure). Where data leaves your country — including from the EEA/UK/Switzerland to regions like the U.S. — we rely on recognised transfer safeguards, such as Standard Contractual Clauses (SCCs) and applicable adequacy decisions, to keep your data protected to the GDPR standard.

Depending on where you live, you have the right to:

• Access a copy of your data.
• Rectify inaccurate data.
• Delete your data (right to be forgotten).
• Restrict / object to certain processing.
• Data portability — receive data in a machine-readable format (use in-app "Export My Data").
• Withdraw consent at any time.
• Opt out of sale/sharing (we do not sell, but we honour your request — see "Do Not Sell / Share My Personal Information").
• Lodge a complaint with your local supervisory authority (e.g., the Serbian Commissioner for Information of Public Importance and Personal Data Protection; the Irish DPC; the UK ICO; or your state AG).

California residents may exercise CCPA/CPRA rights and request information about our collection and disclosure practices. We will not discriminate against you for exercising your rights.

We keep data only as long as needed: account data while your account is active; message/location data until the message expires; and logs for a short security period. You can delete your account at any time in Settings — this permanently erases your profile, messages, bottles, and associated data from our systems, subject to legal retention obligations (e.g., where required by law to prevent fraud or comply with a court order).

We use encryption in transit and at rest, access controls, and least-privilege principles to protect your data. We respect your dignity and privacy as human rights, as reflected in the Universal Declaration of Human Rights (Article 12) and international privacy frameworks. We never sell data, we minimise collection, and we treat every person as an individual with rights.

European Economic Area & UK: the GDPR and the UK GDPR apply. You have the rights listed above and can contact your supervisory authority.

California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of sale/sharing. See the section below.

Brazil (LGPD), Canada (PIPEDA), and other regions: we afford rights substantially similar to the GDPR to users worldwide, regardless of legal obligation.

We do not sell personal information. California residents may submit a verified request through privacy@soul-map.xyz. We will honour Do Not Sell/Share preferences and provide our data practices on request.

For privacy matters: privacy@soul-map.xyz. For legal notices: legal@soul-map.xyz. We will respond to verified data-subject requests within applicable legal deadlines.

We may update this policy as the Service and the law evolve. Material changes will be highlighted in-app and posted here. Continued use after changes takes effect means you accept the updated policy. This version is dated 2026.