Privacy Policy

This Privacy Policy explains what personal data Old Ways collects, why, who receives it and what choices you have. It applies to the Old Ways mobile application and to this website.

Old Ways is a tool for exploring historical maps, viewing terrain and georeferencing your own maps and photographs. Many features work on your device and do not require an account. Other features, such as the historical map archive, terrain data, Energy and subscriptions, require an internet connection and, in some cases, a signed-in account.

Old Ways is developed and operated by BEZSMERTNYI VADYM OLEKSANDROVYCH, FOP, a Ukrainian sole proprietor (“we”, “us”). D-U-N-S number (a Dun & Bradstreet business identifier): 96-406-6896. We decide how and why the personal data described in this policy is processed, which makes us the controller of that data.

You can contact us at vadym.bezsmertnyi@gmail.com.

Depending on how you use Old Ways, we may process:

• Account data. If you sign in with Google or Apple, we receive your email address and, where you or your Apple account provide them, your first and last name. Firebase Authentication also assigns a unique sign-in identifier, and Old Ways assigns its own user ID to your account. When the Firebase software runs in the app, Firebase also creates a Firebase Installations ID on your device.
• Device and app data. If you sign in, we record a randomly generated installation ID, your platform (iOS or Android), the app version and build, your language, whether notifications are allowed and, if they are, your Firebase Cloud Messaging push token. The installation ID is generated by Old Ways and is specific to this app. It is not your IMEI, a hardware serial number, an advertising identifier or an identifier used to track you across other apps. It does not necessarily identify a physical device, and a new one may be created if you reinstall the app. If you sign in to more than one account in the same app installation, the same installation ID may be associated with each of those accounts. Separately, some of our providers receive their own identifiers: RevenueCat receives the iOS identifier for vendors (IDFV) and Mixpanel receives a random device ID, as described below.
• Location-related data. See “Location Data” below.
• Requests you submit. For example, a region, country or area you ask us to track for historical maps or terrain, including a polygon you draw on the map.
• Purchase, Energy and access records. For example, your Energy balance and transaction history, store transaction identifiers for Energy packs, your subscription state and the historical maps you have unlocked.
• Satellite order records. If you rent satellite imagery, we store the squares and periods you order, the status and dates of the order and the Energy charged or refunded. After an account is purged, these records stay linked to its internal user ID, like the other financial and audit records described under “Account and Data Deletion”.
• Reward records. For example, a welcome bonus and promo code or voucher redemptions, a short-lived record of recent promo code attempts and, to give the welcome bonus only once per verified email address, a record that contains a keyed hash of that address (see “Welcome Bonus Eligibility Record”).
• Usage and analytics data. See “Analytics” below.
• Crash and diagnostic data. See “Crash and Diagnostic Data” below.
• Technical data. When your device contacts our servers or our providers, they receive technical request information such as your IP address. Our own reverse proxy does not keep access logs, and server logs rotate automatically and are kept only for a short time.
• Messages you send us. If you use the support form on this website, we receive your email address, the topic and optional device you choose, and your message. If you use “Contact developers” in the app, we receive your message, the category you choose, your platform, app version and language, and we store them together with your user ID. Both are also sent by email from our server to our support mailbox, which is a Google Gmail account; emails sent from the app include your user ID and email address. We keep them for as long as we need to respond and to keep a record of support requests, and we have not set a fixed retention period for support emails.
• Legal acceptance records. When you accept the Terms of Use or this Privacy Policy, we record which document and version you accepted, where you accepted it and when.

• To provide Old Ways, including sign-in, the historical map archive, terrain data, access to maps you are entitled to, Energy, subscriptions and rewards.
• To keep Old Ways secure, prevent abuse and fraud, and enforce limits such as promo code attempt limits. For these purposes, including account security, preventing misuse of testing programs, investigating suspected abuse and protecting the integrity of our services, we may compare which accounts are associated with the same installation ID. Authorized administrators review any matches manually. A match is only a signal: it does not by itself prove misconduct (for example, family members may share a phone) and does not automatically restrict an account. These records are removed under the processes described under “Data Retention” and “Account and Data Deletion”.
• To send notifications about your account, Energy, rewards and the maps you requested, and other service messages, if you allow notifications.
• To understand how Old Ways is used, fix problems and improve the product.
• To keep financial and accounting records and to meet legal obligations.
• To respond to your requests and questions.

We do not sell your personal data and we do not use it for third-party advertising.

If you allow it, Old Ways reads your device location while the app is in use to show your position on the map and to support field tools. Your device location is used on your device and is not stored in your Old Ways account. The Google Maps SDK that draws the base map runs inside the app and may itself collect device and usage data under Google's own policies.

Some features send coordinates to our servers when you use them, so that the server can answer your request:

• When you view the map, the center and the bounds of the visible map area, together with the zoom level, are sent to our API to check which historical maps and terrain are available there. When the map is centered on you, the center of the map is the same as your position. We do not store these coordinates.
• If you sort historical maps by distance, the reference point (your location or the map center, as you choose) is sent to our API to calculate the order. If you use your GPS position as the reference, it is rounded to five decimal places before it is sent. We do not store it.
• If you use the elevation tool, the points you draw are sent to calculate the elevation profile.
• If you submit a historical map request for an area, the polygon you chose is stored with your user ID. If you submit a custom terrain coverage request, the polygon is stored without your account details.
• If you use place search, the text you type and the center of the current map view are sent directly from the app to Google's Places API. This request does not go through our servers and does not include your Old Ways user ID, and Google handles it under its own privacy policy.

Our servers answer the map view, distance sort and elevation requests without saving the coordinates: access logging is switched off on our reverse proxy and our API does not log individual requests. Analytics events may include the geographic extent of a map, as described under “Analytics”. Diagnostic reports may include coordinates, as described under “Crash and Diagnostic Data”.

You can turn location access off at any time in your device settings. Old Ways will still work, but features that rely on your position will not.

Maps, photographs, georeferencing projects, exports, saved points and point groups that you import or create in Old Ways are processed and stored on your device. Old Ways does not upload them to our servers. You decide whether to share an export, for example through your device share sheet.

Some analytics events describe a personal map in summary form, such as its size and geographic extent, but not the file itself. Local content stays on your device until you delete it or remove the app, and signing out or deleting an account does not remove it.

The exception is a custom terrain coverage request. If you submit one, the outline of the area you drew is uploaded to our storage and kept with the request. We do not attach your account or contact details to that request.

Old Ways uses Mixpanel to measure how the app is used. Analytics is currently switched on by default and the app does not yet offer a setting to turn it off.

Events describe actions such as opening the app, signing in, viewing or adding a historical map, importing or using a personal map, using map tools, georeferencing, and viewing or completing a purchase. Events carry properties such as app version, platform, whether you are a guest or signed in, historical map names and identifiers, file sizes, counts, prices, and the geographic extent (a bounding box) of historical maps and of personal maps you import, use or export. We do not send your GPS position, file names, or the names or notes of your markers.

We use analytics to understand how features are used, to support the stability of the app and to improve Old Ways. Analytics events and profile data are not deleted from Mixpanel automatically when you delete your account. You can ask us to request deletion of your Mixpanel profile by contacting us.

If you are signed in, analytics events are linked to your Old Ways user ID, and your email address and name are stored on your Mixpanel profile. All events, for guests and for signed-in users, also carry a random device ID generated by the analytics software. The analytics software also adds standard device and system details, such as the operating system, its version and the device manufacturer and model. Mixpanel derives an approximate location (country, region and city) from your IP address; this is currently switched on. Analytics data is processed in Mixpanel’s EU data centre.

Old Ways uses Sentry to receive crash and error reports and performance data; performance data is collected for about 10% of sessions. Reports include the error, the device model, operating system and app version, and breadcrumbs, which are a short trail of recent app events and network requests. Breadcrumbs and request URLs can contain request parameters such as map coordinates. Sentry assigns an installation-based device ID to the events it receives. We do not attach your name or email address to reports. Like any service your device contacts, Sentry receives your IP address with each report. Sentry processes this data in its EU region (Frankfurt, Germany).

Old Ways also keeps a diagnostic log on your device. It is not uploaded automatically. You can copy or share it yourself from the Diagnostics screen, for example to send it to us. The log can contain technical events, identifiers of maps and projects, and your coordinates when you use a location function. Review a report before you send it.

Energy packs are bought through the Apple App Store or Google Play. The store processes your payment and we never receive your payment card details. We use RevenueCat to confirm the purchase with the store. RevenueCat receives your Old Ways user ID (as the app user ID), on iOS the identifier for vendors (IDFV), your language, your store country, your app and operating system versions, your IP address and your purchase transactions. RevenueCat sends purchase events to our servers, and we store the full event data, including these identifiers and the transaction details. We receive the store transaction identifier, the product and the purchase status.

Subscriptions and the permanent unlocking of historical maps are paid for with Energy inside Old Ways. We keep a ledger of your Energy balance, credits and spending, and records of your subscription and unlocked maps, so that you receive what you are entitled to.

To keep the welcome bonus fair, we check whether a verified email address has already received it. We do this with a one-way keyed hash (HMAC-SHA-256) of the address, calculated on our server with a secret key. We do not keep the address itself in this record.

The eligibility record contains only:

• the hash of the verified email address; and
• the date the record was created.

It does not contain your email address in readable form, your name, your sign-in identifier, your Old Ways user ID, your purchases or your subscriptions.

A hash of this kind is pseudonymous, not anonymous. It is still personal data, because the same address always produces the same hash, so the hash can be used to recognize that address again.

We create the record when a welcome bonus is granted. If your account received a welcome bonus, we also make sure the record exists when you delete your account and before a retained account is purged. We keep each record for 24 months from the date it was created and then delete it automatically. If you delete your account, the record may therefore remain until that period ends, so that a new account created with the same verified email address does not receive the welcome bonus again. Deleting your account does not delete the record immediately. The account deletion process described under “Account and Data Deletion” otherwise continues to apply.

If your sign-in does not provide a verified email address, we cannot make this check and we do not create the record. We use the record only to give the welcome bonus once, not for advertising or tracking.

To exercise your rights regarding this record, contact us as described under “Your Rights”. Because the record holds only a hash, we need the email address concerned to find it. Where we have a compelling legitimate reason, such as preventing the welcome bonus from being obtained repeatedly, we may keep the record until the period above ends.

We share personal data only with providers that help us operate Old Ways, and with the platforms you choose to use:

• Google (Firebase Authentication, Firebase Cloud Messaging and Firebase Installations) for sign-in and push notifications. We do not use Firebase Analytics or Crashlytics. Google Sign-In and Apple Sign-In are operated by Google and Apple under their own privacy policies.
• Apple and Google, as the stores that process Energy pack payments and deliver the app.
• RevenueCat for confirming Energy pack purchases and delivering purchase events to us.
• Google (Gmail), which receives the support messages sent through the support form on this website and through “Contact developers” in the app.
• Netlify, which hosts this website.
• Mixpanel (EU data centre) for analytics.
• Sentry (EU data centre) for crash and error reporting.
• Google Maps Platform (Maps SDK for iOS and Android and the Places API), which provides the base map and place search. The Maps SDK runs in the app and may collect device and usage data under Google's own privacy policy.
• OVH, which hosts our API server, reverse proxy and PostgreSQL database on a virtual private server that we operate, and Cloudflare R2, which stores map and terrain files and our encrypted database backups.

These providers process data on our behalf or, in the case of the stores and sign-in providers, under their own terms. Our API server, database and reverse proxy run on a server that we operate ourselves. We may also disclose information when the law requires it or to protect our rights, users or services.

The Red Diamond feature in Old Ways is created using Copernicus Sentinel-2 satellite data. The notice that applies to it is the following, where [Year] is the year of the satellite data used, not the date this document was last updated:

• Contains modified Copernicus Sentinel data [Year]

If European or UK data protection law applies to you, we rely on the following bases:

• Performing our agreement with you, to provide accounts, maps, Energy, subscriptions and rewards.
• Our legitimate interests in running, securing and improving Old Ways, including analytics, crash reporting and abuse prevention.
• Responding to your support requests, based on our legitimate interest in answering you and on our agreement with you.
• Your consent, where required, for example for location access and push notifications, which you can withdraw in your device settings.
• Our legitimate interest in keeping our promotional offers fair and preventing their abuse, including making sure the welcome bonus is not obtained repeatedly for the same verified email address.
• Legal obligations, such as accounting and tax record keeping.

• Local content stays on your device until you delete it or remove the app.
• Account, device, notification, request and in-app support message records are kept while your account record exists. What happens after you delete your account is described under “Account and Data Deletion”.
• Energy, purchase, subscription and map access records, including the purchase event data we receive from RevenueCat, are kept as long as they are needed to honor your entitlements and to meet accounting, fraud-prevention and legal needs.
• Records of recent promo code attempts are deleted after 30 days.
• Welcome bonus eligibility records (a keyed hash of a verified email address and the date it was created) are deleted automatically 24 months after they were created.
• Custom terrain coverage requests and uploaded areas are kept until we delete them.
• Analytics and crash data are kept by Mixpanel and Sentry for as long as we need them for the purposes above, subject to their settings.
• Encrypted database backups are kept in Cloudflare R2: daily backups for 14 days and weekly backups for 56 days.
• Server logs rotate automatically and are kept only for a short time.

We have not set fixed retention periods for every category. When data is no longer needed, we delete it or remove its link to you.

If we discontinue some or all online services, as described in our Terms of Use, the data involved would be affected as follows. We have not set a schedule for any of this and we do not promise a particular timing.

• Local data on your device, such as your own maps, saved points and downloaded files, stays on your device until you delete it or remove the app. We cannot access or delete it remotely.
• Remote data in our infrastructure, such as account, device, notification and request records and files in cloud storage, may become unavailable or be deleted when the related service stops.
• We may keep minimal Firebase sign-in and account records if that is feasible, but we do not guarantee that they, or Firebase itself, will remain available.
• Purchase, Energy and entitlement ledger records may be kept for as long as needed to honor remaining entitlements, handle refunds and disputes, and meet accounting and other legal obligations.
• Data held by Apple, Google, RevenueCat, Mixpanel, Sentry and Cloudflare remains subject to their own processes, and we cannot promise to delete it from every provider automatically.
• Encrypted database backups kept in Cloudflare R2 expire after up to 56 days.

Your rights described in this policy, including the right to ask us to delete your account, continue to apply to the extent that applicable law provides, and the account deletion information below stays valid for as long as we can carry it out.

You can delete your account in the app, under Profile, Delete account. You must confirm the deletion and, for your security, you may be asked to sign in again. If you use Sign in with Apple, you are asked to confirm with Apple so that Old Ways can be removed from your Apple sign-in. We then delete your sign-in identity from Firebase Authentication, sign you out, turn off automatic renewal of any Old Ways subscription, and remove your email address, name, push notification tokens and the areas you requested from your account. Historical maps downloaded to your device are removed from the device. Maps and projects you imported or created yourself stay on your device until you delete them or remove the app.

We do not erase the account record immediately. If your account has permanently unlocked maps, an Energy balance above zero, or an active subscription (paid or promotional), we keep it for as long as that remains the case, so that you do not lose what you paid for. Otherwise we keep it for six months after deletion and then purge it. While an account is retained, we keep its internal user ID, its former sign-in identifier from Firebase, your language setting, your notifications, your Energy, purchase, subscription, reward and map access records, your legal acceptance records and, if your email address was verified, a keyed hash of it (not the email address itself) that lets us recognize you if you return.

When an account is purged, we remove its notifications, devices, request records and in-app support messages and replace its sign-in identifier and email hash. Financial and audit records, such as the Energy ledger, store transaction identifiers, reward records and legal acceptance records, remain linked to the internal user ID. They no longer contain your contact details, but because the internal ID still exists in our systems and in some provider records, they should be treated as pseudonymous rather than anonymous.

If your account received a welcome bonus, a separate welcome bonus eligibility record may remain for up to 24 months after it was created, even after your account has been purged. A new account created with the same verified email address can be used normally, but it does not receive the welcome bonus again while that record exists. See “Welcome Bonus Eligibility Record”.

If you sign in again with the same verified email address while your account is still retained, we restore it with its Energy, unlocked maps, subscription and reward history, and you do not receive a second welcome bonus. After the account has been purged it cannot be restored, and you start with a new account.

Encrypted database backups kept in Cloudflare R2 may continue to contain deleted data for up to 56 days. Data held by Google, Apple, RevenueCat, Mixpanel or Sentry is handled under their own processes. We do not currently delete your Mixpanel profile or your RevenueCat customer record automatically when you delete your account, and you can ask us to request their removal by contacting us. We also store the raw purchase events we receive from RevenueCat, and we do not delete them automatically. Support emails you sent us remain in our support mailbox until we delete them.

If you cannot use the in-app function, see our account deletion page or contact us using the details below.

We are based in Ukraine, which is outside the European Economic Area and the United Kingdom. Our server runs at OVH. Mixpanel and Sentry store data in the EU. Other providers, such as Google, Apple, RevenueCat, Netlify and Cloudflare, may process data in the United States and in other countries. Where the law requires safeguards for those transfers, we rely on the safeguards offered by the relevant provider.

We use reasonable technical and organizational measures to protect personal data, including encrypted connections, access controls and encrypted database backups. However, no method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent you have given. You also have the right to complain to your local data protection authority.

To exercise these rights, contact us using the details below. We may need to verify your identity before acting on a request. There is currently no self-service data export in the app: to receive a copy of your data, contact us and we will provide it manually. To have data removed from Mixpanel or RevenueCat, contact us and we will request its deletion from them. Part of your information, such as your Energy history and unlocked maps, is also visible in the app.

This website uses a single functional cookie to remember your selected language. It does not use advertising cookies.

With your consent, this website also uses Google Analytics to understand how it is used. Analytics cookies are set and analytics requests are sent only after you accept. They collect page views and technical information such as your browser, device type and approximate location derived from your IP address. We do not send your name, email address or account data to Google Analytics, and Google signals and ad personalization are switched off. You can change or withdraw your choice at any time with “Cookie settings” in the page footer.

Old Ways is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time as Old Ways evolves. When we do, we will update the “Last updated” date above, and where the changes are significant we will tell you in the app or on this website.

If you have questions about this Privacy Policy or want to exercise your rights, you can contact us at vadym.bezsmertnyi@gmail.com.