Privacy Policy

1. Data controller

FindTrack is an application for metal detectorists that lets you log finds, manage plots, and connect with the community. The controller responsible for your personal data is:

• Digital Elevation
• Chamber of Commerce (KVK) number: 98518410
• Address: Molenstraat 16, 4902 NN Oosterhout, Netherlands
• Email: support@findtrackapp.com

For questions about this privacy policy or to exercise your rights, contact us via the support form in the app or by email.

2. What data do we collect?

We collect the following categories of personal data:

• Account data: username, email address and password (stored hashed)
• Profile data: display name, bio, region, country, municipality, experience level, club and detector model — only what you choose to fill in
• Find data: description, category, date, GPS coordinates and photos of finds you register
• Plot data: plot boundaries, notes and session history
• Session data: GPS tracks from detecting sessions, stored as a coordinate sequence
• Home location: an optional home location (coordinates) you set yourself, used for proximity notifications (see §5)
• Device tokens: if you allow push notifications, we store a push token for your device so we can send you notifications
• Usage statistics: counts of clicks and impressions on advertisements, deals, products and events (see §8)
• Technical data: IP address (temporarily, for security and rate limiting), session cookies, app language and theme preference
• Payment data: for a Pro subscription, payments are processed via Stripe. FindTrack does not store payment card details itself; we do retain a Stripe customer and subscription ID to manage your subscription.

3. Legal bases

We process your data on the following legal bases under the GDPR:

• Account and service delivery (creating/managing your account, finds, plots, community): performance of the contract
• GPS and location data (find locations, session tracks, home location): your consent
• Push notifications (device tokens, alerts): your consent
• Security and rate limiting (preventing abuse, temporary IP processing): legitimate interest
• Payments (Pro subscription): performance of the contract and a legal obligation (tax retention duty)

Any consent you give (e.g. for location or notifications) can be withdrawn at any time via your device settings or the app settings.

4. How do we use your data?

• To create and manage your account
• To deliver the core functionality (saving finds, displaying the map, managing plots and sessions)
• To make your profile visible to other users — only the fields you have set to "public"
• To send you notifications (e.g. comments, nearby lost items and new events) if you have allowed this
• To notify you about your support tickets by email
• To detect abuse and secure the app
• To process your Pro subscription via Stripe

5. GPS and location data

FindTrack uses GPS and location data for the following purposes:

• Find locations: you can attach a GPS coordinate to a find. Public finds display a rounded location (approx. 1 km accuracy) to protect privacy-sensitive plot locations.
• Session tracking: GPS tracks are saved when you start a session. Tracks are private by default and are never shared automatically.
• Map functionality: your current location is used to centre the map. This is not stored on our servers unless you save it yourself as a find or session.
• Home location: you can optionally set a home location. We store those coordinates to send you notifications about lost items and events within the radius you set. You can remove this in your profile.
• Reverse geocoding: to convert coordinates into a place name we send individual coordinates to Nominatim/OpenStreetMap (see §7).

6. Photos and images

Photos you upload are processed on our servers: metadata (including GPS coordinates in EXIF data) is automatically removed before storage. Images are compressed and stored via Cloudflare R2.

Private find photos are accessible only to you. Public find photos are visible to all users of the app.

7. Processors and third parties

We never sell your personal data. We use the following processors, with their respective storage locations:

• Supabase — database and authentication (account data, finds, plots, profiles). Stored in the EU region.
• Cloudflare R2 — storage of uploaded photos and images, and network security.
• Stripe — payment processing for the Pro subscription.
• Expo push service (exp.host) — sending push notifications; receives your device token and the notification content. Located in the United States (see §8 international transfers).
• Nominatim / OpenStreetMap — reverse geocoding of GPS coordinates into place names. Receives individual coordinates, no account data.
• PDOK (Dutch public geodata service) — Dutch address and plot search; anonymous queries containing no personal data.
• Google Fonts — loading fonts when generating PDF exports; your IP address may be passed to Google in the process.
• Apple App Store / Google Play — distribution of the native app; they process installation and (where applicable) payment data under their own privacy policies.

With processors that process personal data on our behalf we conclude data processing agreements in accordance with the GDPR.

8. Clicks, impressions and international transfers

Measuring clicks and impressions. We count how often advertisements, deals, products and events are viewed (impressions) and clicked (clicks). To prevent double counting, a click or impression is temporarily linked to your logged-in account. These counts are used in aggregate for statistics and billing to advertisers — we do not build a personal profile from them, do not use them for ad targeting, and do not sell them. No third-party tracking services (such as Google Analytics or Facebook Pixel) are integrated.

International transfers. The Expo push service (exp.host) is located in the United States. When you enable push notifications, your device token and the notification content are transferred to the US. This transfer is based on the European Commission's Standard Contractual Clauses (SCCs). All other processing of account data takes place within the EU.

9. Cookies and local storage

FindTrack uses no tracking or advertising cookies. We use only functional cookies and local storage:

• Supabase auth cookies (access and refresh token): to keep you logged in
• lang cookie: remembers your language preference
• localStorage: onboarding status (onboardingDone), popup timers (to show popups at most once per day), theme preference and ad-impression deduplication

These are necessary for the app to function and are not shared with third parties.

10. Retention and deletion

• Account data is retained for as long as your account is active
• When you delete your account, your data is erased from our database immediately (accounts, finds, sessions, plots, messages, notifications, tokens and other linked data via cascade)
• Uploaded photos on Cloudflare R2 may remain present for a short time after deletion before being permanently removed
• Publicly shared finds and posts may be retained in anonymised form after account deletion for the benefit of the community
• Payment data is retained for as long as the statutory (tax) retention obligation requires
• Backups are retained for a maximum of 90 days

11. Security

We protect your data with the following measures:

• Passwords are stored as hashes (bcrypt)
• All connections use HTTPS
• Session cookies are httpOnly and secure
• EXIF metadata (including GPS) is automatically stripped from uploaded images
• Rate limiting on all API endpoints
• Data access at the database level is restricted via row-level security

12. Your rights

Under the GDPR you have the following rights:

• Access: you can request what data we hold about you
• Rectification: you can have inaccurate data corrected
• Erasure: you can delete your account and all associated data via Settings → Delete account
• Objection and restriction: you can object to or request restriction of certain processing
• Withdraw consent: you can withdraw consent (location, notifications) at any time
• Data portability: you can export finds as PDF (per find) and sessions as GPX (per session) via the app. For a full export of your personal data you can submit a request via support.

Right to complain. If you disagree with how we handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

To exercise your rights, contact us at support@findtrackapp.com or via the support form in the app.

13. Children

FindTrack is not intended for children under the age of 16. You may only create an account if you are at least 16 years old, or have consent from a parent or legal guardian. If we learn that we have collected data from a child under 16 without a valid basis, we will delete it.

14. Changes to this policy

For significant changes to this privacy policy you will receive a notification in the app. The date at the top of this document indicates when it was last updated.

15. Contact