This Privacy Policy describes how ClipMap ("we", "us", "our") collects, uses, and shares information when you use our service at clipmap.app. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Polish data protection law.
1. Who We Are (Data Controller)
The data controller for personal data processed through ClipMap is the ClipMap team, operating the service at clipmap.app. For data protection enquiries, contact us at: [email protected].
2. What Data We Collect
2.1 Data You Provide Directly
Account registration: email address, display name, and password (stored as a secure bcrypt hash).
Profile settings: avatar image URL (if you link one), display name changes.
Clips you submit: YouTube URL, geographic coordinates (latitude/longitude), start and end timestamps, city and country name, and optionally the artist/channel name fetched automatically from YouTube's oEmbed API.
Votes: which clips you have upvoted or downvoted (linked to your account).
Reports: clip ID, reason for report, and your account ID.
2.2 Data Collected Automatically
Server logs: IP address, browser type and version, operating system, referring URL, pages viewed, and timestamps. Retained for 30 days for security and diagnostic purposes.
Session data: a JWT (JSON Web Token) stored in your browser's local storage to maintain your login session. No session cookies are placed by ClipMap itself.
Approximate location: we use a third-party IP geolocation service (GeoJS) to detect your country and approximate coordinates on first visit, in order to centre the map near you. This is done via a single API call; we do not log or retain the returned coordinates.
2.3 Data from Third Parties
YouTube oEmbed API: when you add a clip, we call the YouTube oEmbed API to fetch the video title and channel name. No personal data from YouTube is stored beyond the video title and channel name.
Google AdSense: our advertising partner. See Section 5 for full details.
OpenStreetMap / CARTO: map tile providers. Your IP address is transmitted to their servers as part of loading map tiles. Their privacy policies apply.
Nominatim (OpenStreetMap): used for city and address search (geocoding). Your search query is transmitted to Nominatim's servers.
3. How We Use Your Data
Purpose
Legal Basis (GDPR)
Providing and improving the ClipMap service
Legitimate interest / Contract performance
Authentication and account security
Contract performance
Displaying your clips and vote history
Contract performance
Sending password reset and verification emails
Contract performance
Moderation and enforcement of Terms of Service
Legitimate interest
Server security, fraud prevention, and diagnostics
Legitimate interest
Serving personalised advertisements via Google AdSense
Consent (via cookie consent)
Aggregated analytics to understand usage patterns
Legitimate interest
4. Cookies
ClipMap itself sets only one item of persistent storage: a JWT authentication token in localStorage (not a cookie) and a language/theme preference also in localStorage. These are strictly necessary for the service to function and cannot be opted out of while using a logged-in account.
Third-party cookies may be set by:
Google AdSense / DoubleClick: for ad personalisation and frequency capping.
YouTube: when embedded video players load, YouTube may set cookies (including the VISITOR_INFO1_LIVE and YSC cookies).
You can control third-party cookies through your browser settings or through the Google Ad Settings page.
5. Google AdSense and Advertising
ClipMap uses Google AdSense to display advertisements. Google AdSense is operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google AdSense uses cookies including the DART cookie to serve personalised ads based on your previous visits to this and other websites.
Google's advertising partners and third-party vendors use cookies to serve ads based on a user's prior visits to our website or other websites on the Internet. The use of advertising cookies enables Google and its partners to serve ads to our users based on their visits to our site and/or other sites on the Internet.
You may opt out of personalised advertising by visiting www.aboutads.info/choices/ or Google Ad Settings. Even after opting out, you will still see advertisements, but they will not be personalised based on your interests.
We do not sell your personal data to third parties. We may share data in the following circumstances:
Service providers: cloud hosting, email delivery (for account verification and password reset), and database services. These providers process data on our behalf under data processing agreements.
Legal requirements: if required by law, court order, or governmental authority, we may disclose your data.
Business transfer: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is subject to a different privacy policy.
7. Data Retention
Account data: retained for as long as your account is active, plus a grace period of 30 days after account deletion request.
Clip metadata: retained indefinitely as part of the map's public dataset. Upon account deletion, clips are anonymised (author information removed) rather than deleted, to maintain map integrity.
Server logs: automatically deleted after 30 days.
Email address: deleted within 7 business days of confirmed account deletion request.
8. Your Rights Under GDPR
If you are located in the European Economic Area, you have the following rights regarding your personal data:
Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may request that we correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten"): you may request deletion of your personal data. See the account deletion process in our FAQ.
Right to restriction of processing: you may request that we limit how we use your data in certain circumstances.
Right to data portability: you may request your data in a structured, machine-readable format.
Right to object: you may object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority (UODO – Urząd Ochrony Danych Osobowych, uodo.gov.pl).
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
Passwords are stored as bcrypt hashes and are never stored in plain text.
Authentication tokens are signed JWTs with configurable expiry.
Our servers are hosted in the European Union with access controls and monitoring.
No method of transmission or storage is 100% secure. If you discover a security vulnerability, please disclose it responsibly at [email protected].
10. Children's Privacy
ClipMap is not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately at [email protected] and we will delete it promptly.
11. International Transfers
Your data may be processed in countries outside the European Economic Area, including the United States (for services such as Google AdSense). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes are effective when published on this page. The "Last updated" date at the top of this document indicates when the latest revision was made. For significant changes, we will notify registered users by email.
13. Contact Us
For any privacy-related questions, requests, or concerns:
