Privacy policy

1. Who is responsible

Madrid toilets (Android package es.ivanr.madridtoilets), including its optional Unhinged mode, is provided by Iván Ramírez. This policy also covers this website. For support, privacy questions or rights requests, contact ivan.ramirez.apps@gmail.com.

2. Location, camera and sensors

With your permission, the app uses your location to find nearby places, estimate distance and walking time, make recommendations, orient the map and augmented-reality view, and update home-screen widgets. The last real location and, if enabled, recent walking-trail points are stored locally. Widgets may use a saved location when a fresh fix is unavailable. The app does not request Android’s background-location permission.

The camera is used only for the live “View in AR” preview. The app does not record or upload that camera feed. Orientation sensors support the compass and direction indicators. Permissions can be withdrawn in Android settings; this does not erase previously stored records.

3. Local data and personal history

The app stores preferences, favourites, ratings, reports and visit history on your device. A visit can include the place, date and time, visit type (used, peed or pooped), and locally saved place coordinates and labels. These coordinates describe the place, not a continuous GPS track. Your personal history map is not uploaded as an image or a separate history database to our service.

Exporting settings or sharing a map is optional. A shared map image can reveal the places you visited. Android gives the receiving app temporary access to the image, and that app’s policies then apply. Exported images are kept in the app’s private cache; images older than seven days are cleaned up on the next map export.

Android backup or device transfer may include local app data and the installation identifier, depending on your system settings. Backups may restore old local data. Manage these copies through your Android backup provider. User-created exports remain wherever you saved or shared them.

4. Community visits, ratings and reports

When you choose to record a visit, the app sends a random installation identifier, a visit identifier, the place identifier, the visit time and the visit type to the Madrid toilets community service. In normal mode the type is “used”; in Unhinged mode it may be “pee” or “poop”. Ratings and reports also send the place identifier, a one-to-five-star rating and, when applicable, an unavailable report. Pending contributions can be uploaded after connectivity returns.

The server transforms the installation identifier with a salted SHA-256 hash before storing it. The result is pseudonymous, not fully anonymous. It allows us to enforce the daily usage limit, update your ratings and delete your contributions. We do not ask for a name, email address or advertising identifier for these features.

Public views contain per-place rating summaries, unavailable-report totals and usage counts, including separate pee/poop totals in Unhinged mode. They do not display your installation identifier or an individual timeline. The developer can administer the underlying contribution records. Although our community API does not receive your phone’s GPS coordinates, the place identifier and timestamp can reveal where and when a visit occurred.

5. Online services and recipients

• Google Maps and Google Play services: provide maps and location services. Map requests, map interactions, device information and location-related data may be processed by Google under its Privacy Policy. Opening walking directions sends the destination and, when available, the origin to the navigation app or Google Maps.
• Cloudflare Workers and D1: host the community API and its database. Cloudflare Pages hosts this website. See Cloudflare’s Privacy Policy.
• GitHub: hosts public dataset updates downloaded by the app. See GitHub’s Privacy Statement.
• Spain’s National Geographic Institute (IGN): serves elevation tiles. The requested tile identifies an approximate map area. See IGN’s website.
• Your chosen email, backup, navigation or sharing provider: receives the content you deliberately send through it.

Online providers necessarily receive technical connection data such as IP addresses, request details and device/browser information. They may process data internationally, including outside the European Economic Area; their policies explain locations and applicable transfer safeguards. We do not sell your data or include advertising or analytics SDKs.

6. Purposes and legal bases

We process the data needed to provide features you request, such as finding places and maintaining your contributions (GDPR Article 6(1)(b)). Optional sharing and access to device features are under your control and, where consent is required, rely on consent (Article 6(1)(a)). Service security, abuse prevention and technical delivery rely on legitimate interests (Article 6(1)(f)). The app does not make decisions with legal or similarly significant effects about you.

7. Retention and deletion

Local records remain until you remove them, clear app storage or uninstall. The optional recent trail is limited to the configured number of points. Community visits, ratings and reports have no fixed automatic expiry at present: they remain until you delete them or the service is retired. Limited recovery copies and technical logs may remain for the hosting provider’s applicable retention periods.

Settings → Data → Delete my data removes community records for the current installation, including visits, ratings, reports and cancellation markers, then clears its local visit records, favourites, ratings and preferences. This requires a successful internet connection. Undoing one visit removes that visit and updates usage counts, but does not erase a previously submitted rating. A pseudonymous cancellation marker is retained to stop a delayed upload restoring the visit; it is removed by “Delete my data”.

Uninstalling alone does not delete server contributions. Delete from the app before uninstalling or clearing storage. Once the installation identifier has been lost, we may be unable to associate old contributions with you. Contact us for help; do not post private history in a public issue. See data-deletion instructions.

8. Your choices and rights

You can use the app without submitting visits or ratings. You can revoke permissions in Android settings and stop sharing optional content. Where applicable, you may request access, correction, erasure, restriction, portability or object to processing; you may also withdraw consent without affecting prior lawful processing. Write to the contact address above. We may need information to locate the relevant installation’s records, but will not ask you to post your history publicly.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

9. This website and security

This is a static website with no account area, contact form, analytics, advertising or non-essential cookies. Fonts, icons and illustrations are served with the site. Cloudflare processes connection information to deliver and protect it. Clicking an external link, including Google Play or an email link, takes you to that service.

Our website and community API use HTTPS. Installation identifiers are stored as salted hashes. No online service can promise absolute security.

10. Policy changes

We will update this page if the app or its data practices change. The date above identifies the current version. Both English and Spanish versions are available using the language link.