Pafta

Privacy Policy

Effective October 31, 2026

Applies to Pafta on iPhone and on Android.

1. About this policy

This policy explains how Pafta (“the app”, “we”, “us”) handles information when you use it on iPhone or Android. The app is developed by Nurcihan Fakioglu, who is responsible for the processing described here (the “data controller” under the EU and UK GDPR and Turkey's Personal Data Protection Law, KVKK).

Pafta is an offline map and GPS app. It shows topographic maps that you can download for use without a connection, shows your position in coordinate systems such as MGRS and UTM, and lets you save waypoints, record tracks, plan and follow routes, measure areas, import and export GPS files, print maps to scale and prepare an SOS message with your position.

2. Information the app uses

2.1 Your location

With your permission, the app uses your device's precise location to:

• show your position on the map and its coordinates;
• record a track of your trip;
• guide you to a waypoint or along a route, and warn you when you leave the route or arrive;
• add your coordinates to an SOS message that you send yourself (see 2.3).

While recording or navigating. While a track recording or a navigation is in progress, the app keeps receiving your location when it's in the background or the screen is off, so the track has no gaps and alerts keep working. On iPhone, iOS shows the location indicator during this time; you may also allow “Always” access, but recording works without it. On Android, a recording or navigation notification stays visible for as long as it runs. When you pause or finish the recording, or end the navigation, background location use stops. The Android app does not request the “Allow all the time” location permission.

What leaves your device. Your location is processed on your device, and recorded positions are stored only there. Only the following is sent elsewhere:

• when you open the weather screen, your position (or the map center, if there's no GPS fix) rounded to about 1 km (0.6 mi), to the weather provider (see 2.4);
• requests for map tiles and elevation data for the area you view or download, which may be the area around you (see 2.4);
• an SOS message or a shared location, only when you send it yourself (see 2.3).

We don't store your location on any server and we don't build a location history. Your recorded tracks stay on your device.

2.2 Waypoints, tracks, routes and attachments

Waypoints, folders, tracks, routes, areas, custom fields and notes are stored only on your device, together with the photos, videos and voice notes you attach to waypoints. They aren't sent to us.

• Camera and photo library: used only when you take or choose a photo or video to attach to a waypoint.
• Microphone: used only while you record a voice note or a video.
• Compass: your device's heading is read on your device for the compass.

2.3 Files you import, export, print or share, and SOS messages

• Import: files you open in the app (GPX, KML, KMZ, GeoJSON, Shapefile) and map files you add (MBTiles, PMTiles) are copied into the app's storage on your device.
• Export, print and share: exported files and printed PDF maps are created on your device. They leave it only when you send them somewhere through your device's share sheet, and you choose where they go. A KMZ export can include the photos attached to the exported waypoints.
• SOS: the SOS screen prepares a message with your coordinates, their accuracy, the time and map links. It's sent only if you send it yourself, by SMS or another messaging app, to the recipients you choose. The app doesn't contact emergency services or anyone else on its own; the call button opens your phone's dialer.

2.4 Map, elevation and weather data

The app connects to the internet to load map data. These requests carry no account, device or advertising identifier. Like any internet request, they include technical information such as your IP address and the app's name and version.

• Map tiles: tiles for the area you view or download are requested from the map source you select (such as OpenFreeMap, OpenTopoMap or Waymarked Trails). The provider can see which area's tiles were requested.
• Elevation: elevation values for the crosshair, route profiles and the area you're viewing come from the Copernicus DEM, read from Amazon Web Services' open data storage. The request names the part of the elevation grid that covers that area.
• Relief shading: when relief is turned on, shading tiles for the area you view are loaded from the Terrain Tiles dataset, also on Amazon Web Services.
• Weather: when you open the weather screen, the rounded position described in 2.1 is sent to MET Norway (the Norwegian Meteorological Institute). MET Norway keeps your IP address and the requested coordinates in its access logs in Oslo, Norway. Sunrise, sunset and moon times are calculated on your device.

Downloaded maps, elevation data and the last forecast are stored on your device, so the app works without a connection.

2.5 Purchases (PRO)

• PRO is a subscription or a lifetime purchase processed by the Apple App Store or Google Play. We never see your payment details.
• We use RevenueCat to check whether you've bought PRO and to restore your purchase. RevenueCat receives a random, anonymous identifier created on your device, your purchase history in this app, basic device information (such as platform, operating system and app version, and store country) and whether the purchase screen was shown or closed. This identifier isn't linked to your name or email address.
• The app remembers your last known PRO status on your device, so it opens with the right features even when you're offline.

2.6 Settings and other data on your device

The app stores the following in its private storage on your device. It isn't sent to us.

• your settings, such as coordinate format, units, theme, language and recording profile, and the answers you give in the welcome tour;
• the phone numbers you enter as SOS recipients;
• downloaded offline maps, cached map styles, elevation data (up to 250 MB, oldest removed first) and the last weather forecast;
• the state of a recording or navigation in progress, so it survives an app restart.

Depending on your device settings, this data, including your waypoints, tracks and attachments, may be included in your iCloud or Google device backup. That backup is managed by Apple or Google under your account, not by us.

2.7 Notifications

Arrival, off-route and sunset alerts, and the notification shown while recording or navigating, are created on your device. We don't use push notification servers or push tokens.

2.8 Usage statistics

The app records which screens you open and which features you use, and sends these events to Mixpanel (stored in Mixpanel's EU data center) and to Google Analytics for Firebase. An event contains:

• the screen's name, or a feature with fixed values only, for example “track recording started”, “GPX exported” or “coordinate format MGRS selected”;
• counts and ranges instead of content, for example “10–100 waypoints” or a track's distance range and duration;
• the uses you choose in the welcome tour (for example hiking or search and rescue), your main settings (coordinate format, units, theme, language), your location permission level, whether you have PRO, and the number of days since you installed the app;
• purchase events (the product, and which feature opened the purchase screen); Google Analytics also records in-app purchases (product and price) automatically;
• device and app information, such as device model, operating system version, app version and language, and an approximate country or region that Google derives from your IP address (Mixpanel doesn't use your IP address to estimate location);
• random identifiers for this installation of the app, so we can count screens and features per device.

Usage statistics never include your location or coordinates, waypoint, track, route, area or folder names, notes, file names, photos, recordings or anything else you type. They aren't linked to your Apple or Google account and aren't used for advertising: collection of the advertising identifier and ad personalization signals is turned off. Sending usage statistics is part of how the app works and can't be turned off in the app.

2.9 Crash reports

If the app crashes or runs into a serious error, it sends a crash report to Firebase Crashlytics, a Google service. A report contains:

• technical details of the error, such as the stack trace and which part of the app was running;
• device and app information, such as device model, operating system version, app version, free memory and storage, and screen orientation;
• a random identifier for this installation of the app, so we can tell how many devices a problem affects.

Crash reports don't include your location, waypoints, tracks, routes, names, notes or purchase details, and they aren't linked to your Apple or Google account or used for advertising.

2.10 What we don't collect

• Your name, email address, phone number or contacts.
• Your precise location, location history, photos, videos or voice recordings.
• Advertising identifiers. The app contains no advertising SDKs and doesn't track you across apps or websites owned by other companies.

If you've chosen to share diagnostics in your device settings, Apple or Google may give us anonymous crash and performance reports. These don't identify you.

3. How we use information

We use the information described above only to:

• provide the app's features: maps, coordinates, track recording, navigation, elevation, weather, import and export;
• keep the app reliable by finding and fixing errors (crash reports in 2.9);
• understand which screens and features are used, so we can improve the app (usage statistics in 2.8);
• manage your PRO purchase and restore it;
• comply with legal obligations.

We don't use your information for advertising or profiling, and we don't sell it.

Legal bases (EEA, UK, Turkey). We process information because it's necessary to provide the app you asked for; with your consent, which you give through your device's location, camera, photo, microphone and notification permissions and can withdraw at any time in your device settings; and for our legitimate interest in keeping the app working and improving it (usage statistics and crash reports).

4. Service providers

We rely on the following providers. Each one handles data under its own privacy policy.

5. Sharing

We don't sell your personal information or share it for cross-context behavioral advertising. We share information only with the providers above, so the app can work; when required by law or to protect the rights and safety of users and others; or, if the app is ever transferred to a new owner, with that owner, who must continue to follow this policy.

6. How long data is kept

• On your device: until you delete it in the app or uninstall the app. Cached elevation data is limited to 250 MB and the oldest parts are removed first.
• On our side: we don't run servers and there's no user database. Map, elevation and weather providers may keep standard technical logs under their own policies.
• Crash reports: kept by Firebase Crashlytics for 90 days, then deleted automatically.
• Usage statistics: Google Analytics keeps device-level data for 2 months; Mixpanel keeps events for as long as we need them to understand how the app is used, and no longer than 2 years. Totals that can't identify a device may be kept longer.
• RevenueCat and the app stores: for as long as needed to manage your purchase and meet legal and tax obligations.

7. Your choices

• Location: change the permission at any time in your device settings. Without it, you can still use the map, plan routes and work with coordinates; your position, track recording and navigation need it.
• Camera, photos and microphone: allow or deny them in your device settings. They're only needed for attachments.
• Notifications: turn them off in your device settings. On Android, the recording or navigation notification may then be hidden, but recording continues.
• Saved data: delete waypoints, tracks, routes, areas, offline maps and attachments in the app. Uninstalling the app removes everything it stored on your device. On Android, you can also clear the app's storage in your device settings.
• Identifiers: uninstalling and reinstalling the app creates new random identifiers for usage statistics and crash reports.
• Purchases: restore PRO in Settings with the same App Store or Google Play account.

8. Your rights

Depending on where you live (for example the EEA, the UK, Turkey, California or other US states), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its processing, to withdraw consent, and to complain to your data protection authority (in Turkey, the Personal Data Protection Authority, KVKK).

Because the app has no accounts and we don't keep personal data on our own servers, most of your data exists only on your device, where you control it directly. Usage statistics and crash reports are tied only to random identifiers, so we usually can't find them from your name or email address alone. For any request, including purchase records held by RevenueCat, contact us at [email protected]. We'll respond within 30 days and won't treat you differently for exercising your rights.

9. International transfers

Our providers may process information in the United States and other countries outside your own. Mixpanel stores our usage statistics in its EU data center. Where the law requires it, including under the GDPR and KVKK, providers use recognized safeguards such as the European Commission's Standard Contractual Clauses.

10. Security

The app's connections to map, elevation, weather, analytics and purchase services use encryption (HTTPS). We keep the data we handle to a minimum, and data on your device stays in the app's private storage, protected by your operating system. No method of transmission or storage is completely secure, but we work to protect the information the app uses.

11. Children

Pafta is an outdoor navigation app and isn't directed to children under 13 (or the minimum age in your country). We don't knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we'll help delete it.

12. Changes to this policy

If we change this policy, we'll post the new version on this page and update the effective date at the top. Where the law requires it, we'll also notify you in the app.

13. Contact

Questions or requests about privacy:
Nurcihan Fakioglu
Odunpazarı, Eskişehir, Türkiye
[email protected]

See also the Terms of Use.