Privacy Policy

Last updated: 2 June 2026

This Privacy Policy explains how GetMostFY ("we", "us", "the application") collects, uses, stores, and shares information when you use the GetMostFY mobile application (the "Service"). By using the Service, you agree to the practices described here.

If you do not agree with this Policy, please stop using the Service. You can delete your account and all associated data at any time using the in-app Delete Account function.

1. Who We Are

GetMostFY is operated as a sole proprietorship (Norwegian ENK) based in Norway. For the purposes of the GDPR, the operator of GetMostFY is the Data Controller.

Contact: info@getmostfy.com

2. Information We Collect

We collect the following categories of information when you use the Service:

2.1 Account Information

An account is optional. You can subscribe to and use the core features of the Service — trip planning, point-of-interest discovery, and Memory Scripts — without creating an account. If you choose to create an account, to save your trips and access them across devices, we collect:

Email address — used for account creation and authentication via one-time passcodes (OTP).
Name — first name, last name, and/or nickname you provide at registration.

2.2 Location Data

Precise location (foreground) — used to calculate routes, discover points of interest along your trip, and provide the "My Location" feature.
Precise location (background) — when you actively use the in-app navigation feature, the Service continues to receive your location while the application is in the background or your device is locked. This is necessary to detect arrival at the points of interest you selected and to deliver the associated content. The Service displays a system indicator while this is active (the blue location bar on iOS, a persistent notification on Android). Background location monitoring stops when you end navigation.

2.3 Trip and Route Content

Your planned routes (departure and destination labels, sampled waypoints).
Your selected interest categories.
The points of interest you select for each trip.
Trip names you assign.
AI-generated Memory Scripts of completed trips.
Reports you submit about specific points of interest (e.g., "wrong location", "not a real place").

Trip data, saved routes, and your Memory Script library are stored on our servers only if you have created an account. If you use the Service without an account, this information is not saved to our servers.

2.4 Subscription and Purchase Information

Your current subscription status (active, trial, expired, cancelled).
The transaction history needed to validate access to paid features.

We do not receive, store, or have access to your payment card details. Payment is processed entirely by Apple (App Store) or Google (Google Play) under their own terms and privacy policies.

2.5 Usage and Diagnostics

Product interaction — anonymous interaction events (such as feature usage and screen transitions) collected via Firebase Analytics.
Crash data — when the Service crashes, diagnostic information including stack traces, device model, and operating system version is collected via Firebase Crashlytics. We do not associate crash reports with your account identifier.

2.6 Identifiers

A user identifier issued by our authentication provider (Supabase) that scopes all your data to your account.

2.7 What We Do Not Collect

Phone number.
Physical mailing address.
Photos or videos (the Service does not currently include any photo or video capture or upload feature).
Audio recordings.
Contacts, calendar, health, financial, or biometric data.
Advertising identifiers. We do not track you for advertising purposes and we do not display advertisements.

3. How We Use Your Information

Data type	Used for
Email, name	Account authentication, in-app personalisation
Precise location	Route calculation, POI discovery, arrival detection
Trip and route content	Display your trips, generate Memory Scripts, improve our POI database
Subscription status	Granting access to paid features
Product interaction	Understanding how features are used and planning improvements (analytics)
Crash data	Diagnosing and fixing application crashes
User identifier	Linking your data to your account

We do not use any of your information to:

Display advertisements.
Send marketing communications.
Build cross-app or cross-website tracking profiles.
Share with data brokers.

4. AI Processing (Google Gemini)

The Service uses Google Gemini, an artificial intelligence service operated by Google LLC, for two specific features:

Discovering new points of interest along your planned route, which improves the shared map of places for all users.
Generating your trip's Memory Script — a written recap of your completed trip — after arrival.

When AI processing is enabled, the following information is sent to Google Gemini:

Your route, including departure and destination labels and sampled coordinates along the path.
The interest categories you selected.
The names of the points of interest you visited during the trip.

The following is never sent to Google Gemini:

Your name.
Your email address.
Your account identifier.
Any other information that could identify you to Google.

Your control: The first time you use a feature that triggers AI processing, the Service asks for your explicit consent. You can decline this consent and continue to use the Service — only the AI-powered POI discovery enhancement and the Memory Script feature will be unavailable. You can change your AI consent at any time in the application's Settings.

Google's processing of data sent via the Gemini API is governed by the Google Privacy Policy and the Gemini API Terms.

5. Service Providers and Third Parties

The Service relies on the following third-party service providers. Each operates under its own privacy policy.

Provider	Purpose	Privacy policy
Supabase	Backend hosting — stores your account, trip data, route data, POI reports, and Memory Scripts	supabase.com/privacy
Mapbox	Maps, route calculation (Directions API), and route optimisation. Receives departure and destination coordinates and waypoints.	mapbox.com/legal/privacy
Google LLC — Gemini	AI processing for POI discovery and Memory Scripts (see section 4). Used only when you have granted AI consent.	policies.google.com/privacy
Google LLC — Firebase Analytics	Anonymous usage analytics	policies.google.com/privacy
Google LLC — Firebase Crashlytics	Crash reporting and diagnostics	policies.google.com/privacy
RevenueCat	Subscription management — receives and validates your subscription state from Apple or Google	revenuecat.com/privacy
Apple Inc.	App Store distribution and in-app payment processing	apple.com/legal/privacy
Google LLC — Google Play	Google Play distribution and in-app payment processing	policies.google.com/privacy

We do not sell your personal data to third parties for monetary consideration. We do not share your data with advertising networks.

6. Data Retention

We retain your information for as long as necessary to provide the Service to you:

Account data (email, name, profile): for the duration of your account.
Trip data, routes, Memory Scripts, POI reports: for the duration of your account.
Subscription records: for the duration of your account, plus the period required by tax and accounting law in Norway.
Crash diagnostics: retained by Firebase Crashlytics according to its standard retention (typically 90 days for crash reports, longer for aggregate metrics).
Analytics events: retained by Firebase Analytics according to your project's configured retention period.

When you delete your account, all your data stored on our servers and in Supabase Storage is removed. Crash reports and analytics events that were already collected by Google before deletion remain subject to Google's own retention policies. Aggregate, anonymised statistics that cannot be linked back to you may be retained for product improvement.

7. International Data Transfers

The operator of GetMostFY is based in Norway (European Economic Area). Several of our service providers process data in countries outside the EEA, including the United States. Where personal data is transferred outside the EEA, we rely on appropriate legal safeguards such as the European Commission's Standard Contractual Clauses with the relevant provider.

8. Your Rights

8.1 Rights under the GDPR (European Economic Area, United Kingdom)

If you are located in the EEA or the UK, you have the following rights with respect to your personal data:

Right of access — to receive a copy of the personal data we hold about you.
Right to rectification — to correct any inaccurate or incomplete data.
Right to erasure — to request deletion of your personal data ("right to be forgotten").
Right to restrict processing — to ask us to limit how we use your data in certain circumstances.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on our legitimate interests.
Right to withdraw consent — where processing is based on your consent (for example, AI processing), you may withdraw consent at any time in the application's Settings.
Right to lodge a complaint — with your national data protection authority.

You can exercise the access, correction, erasure, and portability rights directly from within the application's account settings, or by contacting us.

8.2 Rights under California law (CCPA / CPRA)

If you are a California resident, you have the following rights:

The right to know what personal information we collect, use, and disclose.
The right to delete personal information.
The right to correct inaccurate personal information.
The right to opt out of the sale or sharing of personal information.
The right to limit the use and disclosure of sensitive personal information (including precise geolocation).
The right to non-discrimination for exercising these rights.

We do not sell your personal information for monetary consideration. Our use of Firebase Analytics may be considered "sharing" under California law because aggregate analytics events are sent to Google. You may opt out of this processing by disabling analytics in your device settings or by deleting your account.

9. Account Deletion

You can delete your account and all associated data at any time using the Delete Account function in the application's profile settings. Deletion is immediate and irreversible. It removes:

Your account record in Supabase Auth.
Your profile, trips, route data, Memory Scripts, and POI reports.
Any files you have uploaded to Supabase Storage.
Your subscription record in RevenueCat.

To cancel your active subscription separately from deleting your account, use the platform's subscription management screen, accessible from within the application or directly via App Store Settings (iOS) or Google Play Subscriptions (Android).

10. Children's Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from anyone under 16. At registration, users confirm they are of legal age. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Security

We use commercially reasonable measures to protect your information, including encryption in transit (HTTPS for all backend communication) and access controls on stored data. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you within the application. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise any of your rights, contact us:

Email: info@getmostfy.com