Privacy Policy

Last updated: 17 September 2026

MachiSpot turns places you see in short videos into pins on your own map, and lets you plan routes between them. This policy explains what the app stores, why, and what you can do about it.

MachiSpot is run by Michael, based in Ontario, Canada. You can reach us at hello@machispot.com.

What we collect

Your account

• Your email address and a scrambled version of your password. We never store the password itself and cannot read it.
• Your username, and a display name if you set one.
• Your date of birth, used to check you are old enough to use MachiSpot.
• A record of each device signed in, so you can sign out of one without the others.

What you save

• The places you save: Google's ID for the place, its map coordinates, your own title, your note, the category, which collections it is in, whether you have been, and who you allow to see it.
• The link or screenshot you shared, if you saved a place from a video.
• Your routes: their stops, travel mode, how long you plan to stay, and the time you plan to leave.
• Your collections.
• Your home location, if you set one. Your home is never shown to anyone else, ever.

Social

• Who you follow, who follows you, and follow requests.
• People you have blocked or muted. A block is never revealed to the person blocked.
• Reports you send us, including what you wrote in them.
• Shared routes: the stops, the name you join with, and when you last looked.

Location

• The app asks for your location when you open it and when you tap the locate button, so the map starts where you are. It is not tracked in the background and not stored on our server.
• When you search for places nearby, your approximate position is sent with that one search so the results are near you. It is used for that search and not kept.

What we do not collect

• No background location tracking.
• No advertising identifiers, no ad networks, no selling of anything to anyone.
• No screenshots kept on our server. A screenshot you share is read once to find the place in it and is not stored by us.
• No Google place names, addresses, ratings, review counts or photos kept in our database. Those are fetched fresh from Google when a place is shown, as Google's terms require.

Who else sees your data

• Google Maps Platform — we send a place search, a place ID, or your approximate location to find places, photos and travel times. Google's privacy policy applies to what they receive.
• Anthropic — when you share a video link or screenshot, its caption or the image is sent to Anthropic's Claude to work out which place it names. See Anthropic's privacy policy.
• Resend — sends account emails such as password resets. See Resend's privacy policy.
• Cloudflare — hosts this website and forwards email sent to our contact address. See Cloudflare's privacy policy.

Nobody else. We do not sell your data, and we do not share it for advertising.

What other people can see

Everything you save starts hidden. A place, route or collection becomes visible to others only when you choose Followers or Public for that one item.

• A public route shows its places but never your times, and never your notes.
• Your home location can never be published.
• A public profile shows only the name you typed for a place, never Google's.
• Place save counts never name anyone, and are hidden entirely when the number is small enough to point at one person.

How long we keep it

• Your saved places, routes and collections stay until you delete them or delete your account.
• Map coordinates from Google are refreshed or erased within 30 days, as Google requires.
• Shared route links expire on their own.
• Sign-in sessions end when you sign out, when you reset your password, or when the server rejects them.

Deleting your account

Settings → Delete my account deletes the account and everything attached to it: your saved places, notes, collections, routes, follows, blocks and shared routes. It cannot be undone and we cannot restore it. Reports you have sent may be kept without your name so they can still be acted on.

Children

MachiSpot is for people aged 13 and over. We ask for your date of birth when you sign up and refuse accounts for anyone younger. If you believe a child under 13 has an account, email hello@machispot.com and we will delete it.

Security

Passwords are stored only as scrambled hashes. Sign-in tokens are stored only as hashes on our server and in your phone's secure storage. Google's API key stays on our server and is never sent to your phone.

No system is perfect, and we will tell affected users if something goes wrong.

Your rights

Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. In-app deletion is the fastest route; for anything else, email hello@machispot.com and we will respond within 30 days.

Changes

If this policy changes in a way that matters, we will say so in the app before the change takes effect.

Contact

Michael · hello@machispot.com · Ontario, Canada