Privacy Policy

The short version

We collect your email address so you can sign in, and we store the journey maps you create. We use privacy-friendly analytics to see which pages get visited. We don't sell your data, we don't run ad trackers, and you can delete everything at any time.

What we collect

Your email address.This is the only personal detail we ask for. It's how magic-link sign-in works and how we reach you if something goes wrong with your account. We don't ask for your name, company, or phone number.

The content you create. Your journey maps — titles, phases, steps, emotions, pain points, and possible actions — are stored so you can come back to them. Whatever you type into a map, we store.

Basic usage analytics. Vercel Analytics records page views and general traffic patterns. It is privacy-focused by design: it does not build a profile of you, does not follow you across other websites, and does not collect personally identifying information.

Technical logs. Our hosting and database providers keep standard server logs — IP address, browser type, timestamps — for security and debugging. These are held briefly and automatically discarded.

Feedback you choose to send. If you use the feedback button, whatever you write in that form goes to Tally. Sending feedback is entirely optional.

How we use it

• To sign you in and keep you signed in.
• To store, display, and export the journey maps you create.
• To serve read-only share links to people you send them to.
• To send you transactional email — sign-in links, and account or security notices.
• To understand which parts of the product get used, so we know what to improve.
• To keep the service secure and to investigate abuse.

We do not sell your personal data, rent it out, or share it with advertisers. We do not send marketing email unless you explicitly ask us to.

Where your data lives

Your account and journey data are stored in a Postgres database managed by Supabase, which runs its infrastructure on Amazon Web Services (AWS). Data is encrypted in transit, and encrypted at rest by the provider.

The application itself is hosted on Vercel. Depending on where you are in the world, your data may be processed on servers outside your own country, including in the United States.

Third parties we rely on

Running Journey Maps means trusting a few other companies with narrow slices of data. Each one has its own privacy policy:

• Supabase — authentication and database. Holds your email address and your journey maps.
• Vercel — application hosting. Processes requests and keeps short-lived server logs.
• Resend — transactional email delivery. Receives your email address in order to deliver sign-in links.
• Vercel Analytics — privacy-focused, aggregated page-view statistics.
• Tally — the optional feedback form. Only receives what you type into it.

These providers act as our processors — they are not permitted to sell your data.

Cookies

We use a small number of cookies and similar browser storage, and none of them are for advertising:

• Essential:Supabase stores your session so you stay signed in between visits. Without this, the app can't work.
• Analytics:Vercel Analytics uses minimal, non-identifying cookies to count page views. It doesn't track you across other sites.

How long we keep it

We keep your account and journey maps for as long as your account exists. Delete a journey map and it is removed from our database along with its phases and steps. Delete your account and we remove your account record and your maps.

Backups and provider logs may hold residual copies for a short period after deletion before they age out on their normal cycle.

Your rights

You are in control of your data. At any time you can:

• Access it — view your maps in the app, or export any map as a PDF.
• Correct it— edit or rename anything you've created.
• Delete it — delete individual maps, or ask us to delete your entire account and everything in it.
• Object or complain— if you're in the UK, EU, or another region with data protection laws, you have the right to lodge a complaint with your local data protection authority.

To request account deletion or a copy of your data, email support@journeymaps.io. We'll action it within 30 days.

A note on share links

Read-only share links are accessible to anyone who has the URL — they don't require an account to open. Only share a map if you're comfortable with its contents being seen by whoever receives that link.

Children

Journey Maps isn't designed for children and isn't directed at anyone under 16. We don't knowingly collect data from children. If you believe a child has given us personal data, email us and we'll delete it.

Changes to this policy

If we change how we handle data, we'll update this page and the “last updated” date above. For significant changes, we'll let you know by email before they take effect.

Contact

Any question about privacy or your data — email support@journeymaps.io.