Privacy Policy

Last updated: August 22, 2026

This Privacy Policy describes how Terrastamp ("we", "us", or "our") collects, uses, and protects your information when you use the Terrastamp mobile application and website (the "Service").

1. Information We Collect

We collect only the information needed to provide the Service:

• Account information: your email address and a password (stored only as a bcrypt hash — we never store your password in plain text). If you sign in with Google or Apple, we store no password at all.
• Profile information: your name, username, and city of residence, if you choose to provide them.
• Content you create: the cities and countries you mark as visited, your ratings, travel tips, must-see suggestions, and votes.
• Technical data: basic request information (such as IP address) processed transiently for security and rate limiting.

2. How We Use Your Information

• To create and manage your account and authenticate you.
• To display your travel map, statistics, and badges.
• To show community content, such as aggregated city ratings, tips, and must-see lists.
• To send transactional emails (account verification codes and password reset codes).
• To keep the Service secure and prevent abuse.

3. What We Don't Do

4. Public Content

Some content is visible to other users of the Service as part of its social features: your public profile (name, username, city of residence), your travel map and statistics, your badges, the tips and must-see suggestions you post, and any trips where another user tagged you as a travel companion. Your email address is never shown publicly.

5. Service Providers

We share data only with the providers required to operate the Service:

• Amazon Web Services — hosts the PostgreSQL database where your account and content are stored.
• Vercel and Cloudflare — deliver the web version of the app. Our API runs on container hosting we operate ourselves.
• Resend — delivers transactional emails (welcome, verification and password reset codes).
• Google and Apple — only if you choose to sign in with them; they handle that authentication and share your email and basic profile with us.

These providers process data on our behalf and are not permitted to use it for their own purposes.

6. Data Retention and Deletion

We keep your information for as long as your account is active. You can delete your account at any time from Settings > Delete Account: your account is deactivated immediately, your sessions are revoked, your content stops being visible to other users, and the underlying records are erased from our production database within 30 days (and from encrypted backups within 90 days). You can also request deletion by emailing support@terrastamp.app — we will process your request within 30 days.

7. Security

All communication with our servers is encrypted in transit (HTTPS/TLS). Passwords are hashed, authentication uses short-lived tokens, and access to production data is restricted.

8. Children

Terrastamp is not directed at children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

9. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, email support@terrastamp.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above.

11. Contact

For any questions about this Privacy Policy or your data, contact us at support@terrastamp.app.