Flexmap Privacy Policy
Effective date: 14 October 2026
Applies to: the Flexmap app for iPhone and iPad (bundle com.boliaev.Flexmap) and the website flexmap.app.
Who is responsible for your data: Igor Boliaev IE (Individual Entrepreneur), Republic of Armenia, support@flexmap.app.
This policy is written to be read, not skimmed past. The short version: Flexmap turns your workouts into cards on your phone. Your workouts, routes and photos stay on your phone. The app talks to the internet for exactly five things — map imagery, crash reports, anonymous usage statistics, remote configuration, and in-app purchases — and none of them carry your health data.
1. What Flexmap does with your data, in one table
| Data | Where it comes from | Where it goes |
|---|---|---|
| Workouts, GPS routes, heart rate, calories, distance | Apple Health, with your permission | Stays on your device. Never uploaded. |
| A photo you pick as a card background | The system photo picker | Stays on your device. Never uploaded. |
| Cards and videos you export | Rendered on your device | Saved to Photos or sent to the app you choose (Instagram, Messages, Mail, etc.) — only when you tap Share or Save. |
| Map imagery for the area of your workout | Flexmap's own map server | Your device requests map tiles for the area around the workout. See section 4. |
| Anonymous usage events (e.g. "video exported") | Firebase Analytics (Google) | Google's servers. No health data, no location, no name. |
| Crash reports | Firebase Crashlytics (Google) | Google's servers. |
| Purchase records for Flexmap Pro | Apple App Store and RevenueCat | Apple and RevenueCat servers. |
No account is needed to use Flexmap and the app never asks for your name, email, or login.
2. Apple Health data
Flexmap asks for read-only access to these Health categories: Workouts, Workout Routes, Heart Rate, Active Energy, Walking + Running Distance, and Cycling Distance. It uses them to show your recent runs, walks and rides and to put the numbers and the route line on your card. Flexmap never writes anything to Health.
We follow Apple's rules for Health data, and we want to be plain about what they mean in practice:
- Health data never leaves your device. Flexmap has no server that receives it. The only place your workout numbers can "go" is into an image or video that you yourself choose to save or share.
- Health data is never used for advertising or marketing, never sold, and never shared with data brokers, advertisers, or analytics providers. The anonymous usage events described in section 5 contain no Health values.
- You are in control. You can revoke access at any time in Settings → Privacy & Security → Health → Flexmap. The app keeps working in Demo mode with sample workouts.
Route privacy. Your GPS route is drawn as a line on the card. The "Hide start & finish" option removes the parts of the line within roughly 200 metres of where you started and stopped, so a shared card cannot be traced to your door. Your distance and time are still calculated from the full route.
3. Photos
If you add a photo as a card background, Flexmap uses Apple's photo picker, which hands over only the single photo you choose — the app does not get access to your library. On the Canvas, a copy of that photo is kept on your device so your card draft survives a restart; "Reset card" deletes it. A photo behind a template card is held only while the editor is open. The photo is never uploaded.
To save a finished card or video, Flexmap asks for add-only access to Photos. It cannot read or delete anything already there.
4. Map imagery (the one Flexmap server)
To draw real streets under your route, Flexmap downloads map tiles from tiles.flexmap.app, a service we run on Cloudflare using OpenStreetMap data (© OpenStreetMap contributors, via Protomaps).
What a tile request contains:
- The map area being drawn — the zoom level and tile coordinates covering the region around your workout. This reveals roughly where the workout took place (a neighbourhood-level area), but not the route itself, your start point, your pace, or anything else from Health.
- Your device language (so map labels are in your language), and standard connection details every web request includes: your IP address and the app's user agent.
- A build identifier that tells our rate limiter the request comes from the Flexmap app. It does not identify you.
Downloaded tiles are cached on your device by the map engine so the same area does not need to be fetched twice. The Flyover video temporarily stores the tiles for one route while rendering and deletes them afterwards.
Our map server does not keep request logs. Logging is switched off on purpose, because the path of a tile request reveals the approximate area of a workout; when we investigate a problem we watch a live stream of requests that is not stored anywhere. Cloudflare, which hosts the service, may process connection data under its own privacy policy.
If your device is offline, the card is exported without the map.
5. Usage analytics (Firebase Analytics, by Google)
Flexmap records anonymous events about how the app is used — for example that a card editor was opened, a video export started or failed, a share happened, or the Pro screen was shown. Each event carries technical details such as the chosen format (9:16 or 1:1), palette name, render time and file size. No event contains your workout data, your route, your photos, or your identity.
Firebase attaches standard device information to these events: device model, iOS version, app version, language, country (derived from IP), and a random app-instance identifier that is not tied to your Apple ID. We use this to understand which features are used and where things break.
Flexmap does not use the advertising identifier (IDFA), does not request App Tracking Transparency permission, and does not track you across other apps or websites.
Event-level analytics data is retained by Google for 2 months. Google's own handling is described at https://firebase.google.com/support/privacy.
6. Crash reports (Firebase Crashlytics, by Google)
If Flexmap crashes, a crash report is sent to Crashlytics so we can fix it. It contains the technical state of the app at the time — stack traces, device model, iOS version, app version, free memory and storage — and a random installation identifier. It does not contain your Health data, routes, or photos. Crash reports are retained for 90 days.
7. Remote configuration (Firebase Remote Config, by Google)
At launch the app fetches a small configuration file that tells it which features are part of Flexmap Pro and how many videos and canvas cards are free. This request carries the same technical device details as analytics (app version, iOS version, language, country) and nothing about you.
8. In-app purchases (Apple and RevenueCat)
Flexmap Pro is sold through Apple's App Store. Apple handles payment; Flexmap never sees your card number or billing address.
We use RevenueCat to verify purchases and keep Pro unlocked across your devices. RevenueCat receives the App Store transaction (product, price, currency, purchase and expiry dates), your device type and app version, and an anonymous identifier generated on your device. Because Flexmap has no accounts, that identifier is not connected to your name or email. RevenueCat's privacy policy: https://www.revenuecat.com/privacy.
Your purchase history is also declared in our App Store privacy label.
9. Data stored on your device
- Which data source you chose (Apple Health or Demo), how many free videos you have used, and which workouts you have used a free canvas card on (stored as the workout's identifier, never sent anywhere).
- One card draft per workout (layout, colours, fonts, and the background photo if you added one), in the app's private storage.
- Cached map tiles.
- Temporary copies of exported PNG and MP4 files while sharing.
All of it is removed when you delete the app.
10. Sharing to other apps
When you tap Share, Save, Stories, Messages, Email or Copy, Flexmap hands the finished image or video to the app you chose. From that moment it is governed by that app's privacy policy (for example Instagram's). Flexmap does not post anything on your behalf and does not have access to your social accounts.
11. Your rights
Because Flexmap keeps your workouts and photos on your device and does not build a profile of you, most of what you might ask us to do you can do yourself:
- Access or delete your Health data: it lives in Apple Health; delete the app or revoke access in Settings.
- Delete drafts, photos and caches: delete the app.
- Stop analytics and crash reports: there is no switch for this inside the app today; deleting the app stops both. Neither contains your workouts, routes or photos.
- Purchase records: contact us at support@flexmap.app and we will ask RevenueCat to delete the record tied to your anonymous identifier. Apple's own purchase history is managed through your Apple Account.
If you live in the EU/EEA, UK, Switzerland, or a US state with a privacy law, you have the rights those laws give you — access, correction, deletion, portability, objection, and the right to complain to your supervisory authority. Write to support@flexmap.app and we will respond within the time the law requires. We do not sell personal data and do not process it for targeted advertising.
Legal basis (EU/UK): map imagery, crash reports, remote configuration and purchases are processed because they are necessary to provide the app you asked for (performance of a contract); anonymous usage analytics are processed on our legitimate interest in understanding and improving the app.
12. Children
Flexmap is not directed at children under 13 (or the higher age your country sets) and we do not knowingly collect personal data from them. If you believe a child has used the app in a way that sent us data, contact support@flexmap.app and we will delete it.
13. International transfers
Google (Firebase), RevenueCat and Cloudflare operate servers in the United States and elsewhere. Where data leaves the EU/UK, these providers rely on standard contractual clauses or an adequacy decision.
14. Third-party services, in one list
| Service | Provider | Used for | Their policy |
|---|---|---|---|
| Firebase Analytics | Google LLC | anonymous usage statistics | https://firebase.google.com/support/privacy |
| Firebase Crashlytics | Google LLC | crash reports | https://firebase.google.com/support/privacy |
| Firebase Remote Config | Google LLC | feature configuration | https://firebase.google.com/support/privacy |
| RevenueCat | RevenueCat, Inc. | purchase verification | https://www.revenuecat.com/privacy |
| Apple App Store / StoreKit | Apple Inc. | payments | https://www.apple.com/legal/privacy |
| tiles.flexmap.app (hosted on Cloudflare) | Igor Boliaev IE; Cloudflare, Inc. as host | map imagery | this policy; https://www.cloudflare.com/privacypolicy |
| MapLibre | open-source library | rendering maps on device | no data sent to MapLibre |
| OpenStreetMap / Protomaps | data source | map content | no data sent to them |
15. Changes to this policy
If we change what the app collects, we will update this page and the effective date, and for anything significant we will say so inside the app or on the App Store page. Previous versions are available on request.
16. Contact
Igor Boliaev IE (Individual Entrepreneur), Republic of Armenia support@flexmap.app