Privacy Policy

Who is responsible for your data

SouCampus builds (https://soucampus.online) is run by Yevhenii Stavytskyi, an individual based in Estonia. He decides why and how the personal data described below is used — in the language of the GDPR, he is the data controller.

For anything on this page — a question, a request, or a complaint — write to support@soucampus.online. A person reads that inbox, not a robot.

What we collect, and why

Only what the site needs to work. There is no profiling, no advertising network, and nothing is sold to anyone.

• Account. Your email address and a password, held by our authentication provider. We never see the password itself — only a hash kept by that provider. If you sign in with Google instead, see the section below.
• Profile. The username you choose, and anything you add yourself: avatar, short bio, name colour. All of it is public by design — a profile page exists to be looked at.
• Purchases. Which maps you bought, when, and for how much. We need this to give you the download and to keep proper accounts.
• Things you post. Comments and reactions on maps, and any application you send us. Comments are public and carry your username.
• Visits. A count of page views, described in its own section below because of how carefully it avoids identifying you.

If you sign in with Google

Signing in with Google is optional — an email and password work just as well. If you use it, Google tells us your email address and whether it is verified. That is all we ask for and all we receive: we get no access to your Google account, your contacts, your files, or anything else.

Google does not give us a username. So the first time you sign in this way, we ask you to choose one. Until you do, the site suggests a name derived from your email address — you are not stuck with it, and choosing your own name at that point costs you nothing.

If the email address from Google already belongs to an account here, the two are joined into one account rather than creating a second. Your purchases, profile and history stay where they are.

How we count visits

We count how many people visit, because it is useful to know whether anyone is reading. We do it in a way that cannot be turned back into a person, and that is worth spelling out because most sites cannot say the same.

• Your IP address is not stored. It is turned into an irreversible hash with a secret salt, used only to stop one person inflating the numbers. The address itself is never written down.
• One small cookie. A signed visitor number, set by us and read only by us. It lives 13 months and tells us that two page views came from the same browser — nothing else about you.
• No cross-site tracking. Nothing follows you off this site. No advertising pixels, no third-party trackers, no data broker.
• No cookie banner, and why. Because there is nothing here to consent to: one first-party cookie used solely to measure our own audience, with no data passed onward. That is the narrow case regulators accept without a banner. If that ever changes, a banner appears with it.

Payments

Payments are handled by Stripe. Your card number never reaches this site — you type it on Stripe's own checkout page, and Stripe tells us only whether the payment succeeded and which items it covered.

That means we cannot lose your card details, because we do not hold them. What Stripe does with them is governed by Stripe's own privacy policy.

Who else touches your data

The services below run parts of this site on our behalf. They process data under contract and are not free to use it for their own purposes.

• Supabase. Database, file storage and sign-in.
• Vercel. Hosting, and privacy-friendly analytics that set no cookies.
• Stripe. Payments.
• Hostinger. Outgoing email, such as confirmation and password-reset messages.
• Google. Only if you choose to sign in with it.

Where your data lives

Data is stored and processed in the European Union. Some of the providers above are based in the United States and may process data there; where that happens it is covered by the standard contractual clauses approved by the European Commission.

How long we keep things

Not longer than there is a reason to.

• Your account. For as long as it exists. Delete it and the profile goes with it.
• Orders. Kept after an account is deleted, because accounting law requires records of sales to be retained. They are kept for that purpose alone.
• Deleted maps. Files of a removed map are kept for 30 days, then deleted for good.
• Visit counts. The visitor cookie expires after 13 months. The hashed records behind the counter contain nothing that identifies you.

What you can ask us to do

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, receive a copy in a portable form, or object to a particular use. Write to the address below and we will answer within one month.

If you think we have handled your data badly, you can complain to the data protection authority in your country. You may do that whether or not you talk to us first — though we would rather fix it than have you go there.

Children

This site is not aimed at children, and accounts are not intended for anyone under 16. If you believe a child has created an account here, tell us and we will remove it.

Changes to this policy

When the site starts doing something new with data, this page changes first, and the date at the top changes with it. We will not quietly widen what we collect and update the wording later.