Last updated: 7 September 2026
Chinook Maps is a map and navigation app built from Canadian government open data. This policy explains what it collects, what it does not, and what you can do about it. It is written to be read, not to be survived.
This policy applies to everyone, everywhere. The maps cover Canada, but the app is distributed worldwide and the same rules apply wherever you are. Where your local law gives you a right this policy does not name, you have that right too.
Who is responsible. Chinook Maps is published by an independent developer, contactable at privacy@chinookmaps.com. For the purposes of the UK and EU GDPR that developer is the data controller for anything described here.
policy URL, and the app links to this address from About.
contact a server.
route, and that is all.
Nothing else.
Play's Data safety form uses fixed categories. This is the same information as the rest of this page, expressed in those categories so the two cannot drift apart:
| Play category | Collected? | Shared? | Purpose |
|---|---|---|---|
| Location (approximate and precise) | No — used on device only, never transmitted | No | Draw your position, plan a route |
| Personal info — Email address | Only if you create an account | No | Sign-in and account recovery |
| Personal info — Name, address, phone | No | No | — |
| App activity — Saved places, recent searches | Only if you create an account | No | Sync your own list between your devices |
| App info and performance — Crash logs, diagnostics | No | No | — |
| Device or other IDs | No | No | — |
| Financial, health, messages, photos, contacts, calendar | No | No | — |
Nothing in this app is sold, and nothing is shared with a third party for advertising or analytics. There are no advertising, analytics or social SDKs in the build.
The app has no account requirement. Used signed out, Chinook Maps sends no personal information anywhere. Region packs are downloaded from a file host, which necessarily sees the request and your IP address as any web request does; that is a server log, not a profile, and it is not linked to you.
| What | Why | Where it is stored |
|---|---|---|
| Email address | To identify your account and let you sign in | Supabase, Canadian region |
| Password | Stored only as a salted hash; we never see it | Supabase, Canadian region |
| Saved places (name, coordinates) | So they appear on your other devices | Supabase, Canadian region |
| Recent searches | So they appear on your other devices | Supabase, Canadian region |
That is the complete list.
Chinook Maps asks for location permission so it can show where you are on the map and plan a route from where you are standing.
That location is used on the device and is never transmitted. Routing happens against a graph stored on your phone; there is no server to send a position to. If you decline the permission the app still works — you can pan the map and plan routes from any point you choose.
The app requests only foreground location. It does not request background location and does not track you when it is closed.
Account data is stored with Supabase in a Canadian region (ca-central-1), so it does not leave the country in normal operation.
Access is enforced by PostgreSQL Row Level Security: every row is readable only by the account that owns it. This is enforced by the database, not by application code, so a bug in the app cannot expose another person's data.
If you never create an account there is nothing to justify, because nothing is collected. If you do, the legal bases under the UK and EU GDPR are:
| What | Basis |
|---|---|
| Email address and password hash | Contract — an account cannot exist without them |
| Saved places and recent searches | Contract — they are the feature you asked for |
| Keeping the service secure and working | Legitimate interests, balanced against your privacy |
There is no processing based on consent for advertising or profiling, because there is no advertising or profiling. Nothing here involves automated decision-making.
These apply to everyone using the app, wherever you live. Different laws give them different names — the UK and EU GDPR, Canada's PIPEDA, Quebec's Law 25, California's CCPA/CPRA — but the substance below is what you get from us regardless of which one covers you.
there is nothing to withhold
Exercising any of these costs nothing and we will not ask you to justify it. We answer within 30 days.
California. We do not sell or share personal information as CCPA/CPRA define those terms, and we have never done so.
In the app: About → Account and saved places → Delete account. This removes your account, your email address, and every saved place and recent search, permanently and immediately.
Without the app, if you have uninstalled it or lost the device: https://chinookmaps.com/delete-account, or email the address below. We will action the request within 30 days.
Deletion is real deletion. Nothing is retained in a "deleted" state, and there are no backups kept for the purpose of restoring erased accounts.
Chinook Maps is not directed at children and does not knowingly collect information from anyone under 13. If you believe a child has created an account, contact us and we will delete it.
tampered or corrupted map file is rejected rather than used.
unavailable, the app tells you so rather than staying quiet about it.
on a device.
No system is perfect. If a breach occurs that creates a real risk to you, we will tell you directly and notify whichever regulator is responsible for you — within 72 hours where the GDPR sets that deadline, and without undue delay everywhere else.
Chinook Maps contains no advertising SDKs, no analytics SDKs, and no social SDKs. It does not use Google Play Services.
Two services are involved in running it:
file download does. It is a content network, not an analytics provider.
Account data is stored in Canada and nowhere else. If you are in the UK or the EEA, that is a transfer out — Canada holds a partial adequacy decision from the European Commission covering commercial organisations, which is the basis we rely on. Map files are served from a global network, but a map tile is public data and says nothing about you beyond the request itself.
| What | Kept for |
|---|---|
| Account, email, saved places | Until you delete the account — then gone immediately |
| Deletion requests sent from the web form | 12 months, so we can prove the request was actioned |
| Server request logs at the file host | Cloudflare's own retention, days rather than months |
There is no archive, no backup kept for restoring deleted accounts, and no shadow copy.
Map data comes from the Government of Canada and the City of Calgary under open government licences. Those are data sources; nothing about you is sent to them.
If this policy changes materially, the app will say so before the change takes effect. The date at the top always reflects the current version.
Email: privacy@chinookmaps.com — for anything on this page, including any of the rights above.
If you are not satisfied with how we handle it, you can complain to the privacy regulator where you live. In the UK that is the ICO, in the EEA your national data protection authority, and in Canada the Office of the Privacy Commissioner. You do not need our permission and you do not have to come to us first, though it is usually faster if you do.