MAKVINCI TRAVEL · 2026-10-19
Privacy policy
Who is responsible
Denis Balabanov; Individual; Russia, Tula. This policy covers the MakVinci Travel mobile exploration game and makvinci.app. Privacy requests: [email protected]. Third-party identity and map services also have their own policies.
Data and purposes
Account: user ID, email (including an Apple private relay address), provider identity, nickname and password hash maintained by Supabase Auth, for access, security and recovery. Profile: names, optional avatar, city/country, biography, privacy and follow settings. Exploration: visited place IDs, timestamps, submitted check-in coordinates/accuracy and verification evidence, XP, coins, entitlements, achievements, collectible cards, album placements and transfers, for game delivery and synchronisation. Device: security/session identifiers, App Attest evidence, push token/preferences when enabled, and technical connection logs. Support receives the information you choose to send; never send passwords or recovery codes.
Location and permissions
The app uses location for nearby places and verified visits. Optional walking/reminder features can use background location subject to app settings and OS permission; you can disable them. Local nearby processing does not upload every movement. A submitted visit sends coordinates and verification evidence to the server. This website does not request geolocation, contacts, camera or microphone. App photo permissions relate only to your chosen avatar/save/share action.
Legal grounds
Where GDPR or equivalent law applies: necessary account/game delivery uses performance of the user agreement; optional processing requiring consent uses separate consent; proportionate anti-fraud/security may use legitimate interests; mandatory records use legal obligations. For Russian law, see Personal data processing. Accepting terms is not bundled consent to marketing, public dissemination or unrelated processing.
Recipients and international processing
Supabase provides account/database infrastructure; the current project is in Germany (Frankfurt). Apple provides Sign in with Apple, MapKit and APNs where used. Website hosting processes technical connections. Authorised personnel access data only for service, support and security purposes. This website adds no advertising SDK or behavioural analytics. International transfers require an applicable legal mechanism and safeguards; publishing this policy is not such a mechanism. A foreign database does not by itself satisfy Russian data-localisation requirements.
Reports and moderation
In-app reports include the sender and reported account IDs, reason, comment, a snapshot of their displayed names/nicknames and the reported biography/avatar URL, plus moderator decisions. Only authorised administrators can read them. Account deletion removes account links; submitted text and evidence snapshots may remain in the restricted moderation record. The operator must confirm a proportionate retention/deletion schedule before public launch; contact [email protected] for related data requests.
Public profiles
A public profile can show permitted profile information, achievements, activity and cards to other signed-in users. Email, passwords, push tokens and exact visit coordinates are not public profile fields. Profile privacy is controlled in app settings. Information you have already exported or shared can remain with recipients.
Retention
Account/progress data are retained while needed for the active service. You can initiate permanent account deletion in the app; account-linked live records and local account data are removed by its deletion flow. Limited legally required/security/dispute records can have separate restricted retention. Security logs: not yet confirmed days. Backup rotation: not yet confirmed days. The operator must confirm these periods before launch and reapply deletion records after any backup restoration. Uninstalling alone does not delete the account.
Rights and choices
Depending on applicable law, request access, correction, deletion, restriction, portability, objection or withdrawal at [email protected]. Identity is checked proportionately without your password. Withdrawal does not invalidate previous lawful processing and can disable the affected optional feature. You may contact the competent authority, including Roskomnadzor in Russia and the relevant EEA/UK authority. Statutory response periods apply. You can challenge suspected game enforcement errors with support.
Security, children and changes
The service uses access controls, live-session checks, encrypted transport and password hashing, without guaranteeing absolute security. It is not specifically directed to children. Where parental authorisation is legally necessary, obtain it before account creation; report suspected child-data issues to the operator. App Store age rating and the legal age of consent are separate. Material updates are published with a new version; processing needing new consent must wait for it.