Privacy Policy

1. Who is responsible for your data

This policy applies to the IMRSY iOS app and imrsy.com. The data controller is Artem Pashkov, doing business as IMRSY, based in Larnaca, Cyprus ("IMRSY", "we", "us").

Privacy questions and requests can be sent to artem@imrsy.com.

2. Information we collect

Account information

IMRSY uses Sign in with Apple. We receive an Apple-provided account identifier and, when Apple makes it available, your name and email address or private relay email. We do not receive your Apple ID password.

Location information

With your permission, the app uses precise location to centre the map, estimate distance to a walk, start audio at route points, and support navigation during an active walk. Location may continue to be used in the background while an active walk is running so scenes can trigger correctly.

If you use Studio, we store the map point you choose and the resulting route with that story. During a Live walk, we store the starting location, route, session state, choices, and walk events. Events can include coordinates, location accuracy, heading, and speed so the server can progress and recover the story. Map and routing providers also process the coordinates needed to deliver their services.

Stories and product interactions

• Studio choices, the selected map point, generated story content, and production status.
• Live session state, routes, location events, choices, and generated scenes.
• Story completion and an optional 1–5 rating. The completion record does not include a GPS trace.
• Messages and details you choose to include when contacting support or reporting an issue.
• Bookmarks, interrupted-walk state, and downloaded audio stored locally on your device.

Technical information

Our infrastructure and SDK providers may receive normal request information such as IP address, device or browser type, operating-system version, timestamps, app interactions, and diagnostic data needed to deliver, secure, and troubleshoot the service.

Website information

The website loads public story data and audio from Supabase, fonts from Google Fonts, the MapLibre library from unpkg, and map tiles from OpenFreeMap. These providers receive web-request information such as your IP address and browser type. Browsing this website does not request your device location. We do not use advertising pixels or behavioural-advertising cookies here. If you choose to subscribe on Substack, Substack collects your subscription details under its own privacy policy.

3. How we use information

• Authenticate your account and manage account-owned stories.
• Provide maps, routes, GPS-triggered audio, offline playback, and walk recovery.
• Create and produce Studio stories and progress Live walks you request.
• Record completion and optional ratings to understand product quality.
• Protect the service, prevent abuse, diagnose failures, and maintain reliability.
• Respond to support, privacy, and legal requests.
• Comply with applicable law and enforce our rights.

Depending on the context and applicable law, we rely on performance of the service you request, your consent (including location and AI-generation permission), our legitimate interests in operating and improving IMRSY, and compliance with legal obligations.

4. AI-assisted story creation

AI-assisted features use place details, selected coordinates, story preferences, and generated material to create scripts and audio. Depending on the feature and configured provider, we send this material to Google (Gemini), OpenAI, Anthropic, or ElevenLabs. Live uses the route, nearby place facts, choices, and session context to continue its story.

Studio shows a disclosure before the first generation request. You can decline and continue using published walks. We do not intentionally include your Apple sign-in credential or account email in generation prompts. Avoid including private or sensitive information in story preferences or messages.

5. Service providers and sharing

We share information only as needed for the purposes above:

• Apple for Sign in with Apple, Apple maps, navigation, and platform services. See Apple's privacy policy.
• Supabase for authentication, database, storage, and server functions. See Supabase's privacy policy.
• Mapbox for routing and map services used by some app versions. Requests can include route coordinates; versions using the Mapbox SDK may also send SDK telemetry. See Mapbox’s privacy policy.
• Google, OpenAI, Anthropic, and ElevenLabs for AI-assisted story and audio creation. See their respective Google, OpenAI, Anthropic, and ElevenLabs privacy policies.
• Railway and Vercel for application and website hosting. See Railway and Vercel.
• Zoho Mail for correspondence when you email us. Your email address and the details you include are processed to respond to your request. See Zoho’s privacy policy.
• External navigation apps only when you choose to open a route in Apple Maps, Google Maps, or Yandex Maps. Your use of that app is governed by its provider's policy.

We may also disclose information when required by law, to protect users or the service, or as part of a merger, financing, acquisition, or sale where the recipient must honour applicable privacy obligations.

We do not sell personal information, share it with data brokers, use it for targeted advertising, or permit third parties to track you across unrelated apps or websites on our behalf.

6. Retention and deletion

• We keep account identifiers, account-owned stories, completion/rating records, and Live session records while your account is active or as needed to provide and troubleshoot the service. Live events and generated audio are subject to periodic cleanup after the walk; session records may remain for recovery and support. Contact us for details about your session or to request deletion. Backup and diagnostic copies can remain until their normal rotation.
• Local bookmarks, walk recovery state, and offline audio stay on the device until you remove them, sign out, delete the account, or remove the app.
• Support correspondence and limited security or diagnostic records are kept only as long as reasonably needed for support, safety, fraud prevention, dispute resolution, or legal obligations.

You can delete your account in IMRSY under Profile → Delete account. Account deletion removes your account and its associated personal application data. You can also email artem@imrsy.com to request deletion or ask about retained session data. Limited information may remain temporarily in provider backups or security logs until normal rotation, or longer where the law requires it.

Deleting IMRSY does not delete your Apple Account and may not itself revoke the Sign in with Apple authorization. You can manage that authorization in your Apple Account settings.

7. Your choices and rights

• Allow, limit, or withdraw location access in iOS Settings. Some walk features will not work without precise location.
• Decline Studio generation before a request is sent. Use published walks if you do not want to use AI-assisted creation or Live features.
• Where your app version uses the Mapbox SDK, use the telemetry control provided in the map attribution panel.
• Delete downloaded walks and other local data through the app or by removing the app.
• Delete your account in the app.

Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent. Email artem@imrsy.com to exercise a right or appeal a decision. We may need to verify your identity before acting on a request.

If you are in the EEA or UK, you may complain to your local data-protection authority. You can find EEA authorities through the European Data Protection Board and the UK authority at the Information Commissioner's Office.

8. Security and international processing

We use access controls, encrypted network transport, role-based database rules, authenticated server operations, and restricted storage to protect personal information. No online service can guarantee absolute security.

Providers may process information in countries other than yours. Where required, we and our providers rely on recognised safeguards for international transfers, such as adequacy decisions or standard contractual clauses.

9. Children

IMRSY is not directed to children under 13, and we do not knowingly collect personal information from them. Where local law requires parental permission at a higher age, a child should use IMRSY only with that permission. Contact us if you believe a child provided personal information without appropriate permission.

10. Changes and contact

We may update this policy when the product, providers, or legal requirements change. The date at the top identifies the current version. Material changes will be highlighted in the app or on the website when appropriate.