Privacy Policy

Last updated: October 4, 2026 · Translation provided for convenience; if there is any discrepancy, the Portuguese version prevails.

This policy explains what data Mappum (www.mappum.com) collects, what it uses it for and what your rights are, in line with the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).

1. Who is responsible

The controller of the data is the developer of Mappum. Contact for any privacy matter: eduardo.schmidte@gmail.com.

2. What data we collect

Google account data (only if you sign in with Google): email, name and profile picture. We do not receive your Google password or any access to your Gmail, Drive or any other service.
Email and password account (if you create one): your email and an encrypted version of the password (hash, with salt). We never store the password itself. The email is confirmed through a link before the account exists.
Content you create: notes, links, lists, spreadsheets, boards, connections and images. Images are converted to WebP in your browser before upload.
Minimal technical data: IP address, used only to limit abuse (request limits) and for the security of the service.

If you continue as a guest, your content is saved only in your browser, on this computer, and nothing is sent to our server.

3. What we use it for

Identifying you and keeping your session active;
Syncing and storing your content across your devices;
Generating share links only when you ask;
Applying your plan’s limits and keeping the service secure.

We do not sell your data, we do not run advertising and we do not use your content to train artificial intelligence models.

4. Cookies and storage

We use a single cookie, a session cookie (nx), needed to keep you signed in. It is HttpOnly and is not used for tracking. In your browser we store your map (IndexedDB) and simple preferences (localStorage), including your chosen language. Account holders keep that local copy so the app opens quickly and works offline. We do not use advertising or analytics cookies.

5. Who we share it with

Google: for sign-in (Google Identity Services) and to show the site icon (favicon) on link cards, which sends the site’s address to Google.
Hosting: data is kept on a VPS server contracted from Hostinger.
People you share a link with: anyone with the link sees the shared board (and its sub-boards) in read-only mode until you stop sharing.
Websites whose links you add: when you use the title, description or preview of a link, our server fetches that public page to read its information.

6. How long we keep it

As long as your account exists. When you delete your account (avatar menu → “Delete my account and data”), your cloud data is erased immediately. Automatic backups are kept for up to 7 days and then discarded.

7. Your rights (LGPD)

At any time you may: confirm that we process your data, access it, correct it, export it (“Export” button in the app, available on the Pro plan), request deletion, withdraw consent and ask for information about sharing. Just use the options in the app or write to the email above.

8. Security

Encrypted connection (HTTPS), protected session cookie, request limits, validation of uploaded files and separation of each user’s files. No system is completely immune to failures; in the event of a relevant incident, we will notify those affected as required by law.

9. Children

Mappum is not directed at children under 13.

10. Changes to this policy

We may update this text. The date at the top shows the latest revision; relevant changes will be announced in the app.