Who is responsible
The operator of Bukway and controller of personal data is Kovalov Volodymyr, an individual in Ukraine. Mailing address: вул. Грецька, 9А, м. Могилів-Подільський, 24000, Україна. Support and personal-data requests: bukway.app@gmail.com. This policy covers the Bukway app and bukway.app and takes effect on 2026-11-08. The navigation service is intended for the Bukovel area in Ukraine.
Accounts and profiles
Firebase Authentication processes a UID, email and sign-in session. Guest access may use an anonymous Firebase account. Email OTP creates or signs into the account associated with that email. Firestore stores private birth date, self-declared age assurance, language and timestamps. A username and its reservation belong to a UID; public profiles are readable by other authenticated users under access rules. Skipping a nickname selects an available generic alias.
Email codes and sign-in protection
Cloud Functions handle requests and verification of six-digit codes. Codes last five minutes and resend has a 60-second cooldown. Verification records contain keyed HMAC hashes of email, IP and code, state, timestamps and attempt counts; the raw code is not stored in the challenge record. Resend receives the recipient address and email content including the code for delivery. Provider technical logs and delivery events have separate retention policies. Apple App Attest or DeviceCheck and Firebase App Check protect requests in supported builds. They do not verify a person’s identity.
Location and routing
With iOS permission, the foreground app uses coordinates, accuracy, time and heading for the map, route origin, navigation and measured distance. Routes are calculated locally from the graph. Trips does not persist a continuous actual GPS coordinate track. Planned endpoints and route geometry may reveal locations. Background distance measurement while the app is closed is not implemented. Permission can be changed in iOS settings.
Maps and Mapbox
Mapbox receives style and tile requests and associated technical information including IP addresses. The SDK may cache maps on the device. Mapbox telemetry defaults OFF and has a separate in-app control. GPS permission and telemetry are independent settings. The implemented Bukway code does not send routes to Mapbox Directions or Copilot. This does not mean the map provider receives no operational data.
Trips, saved items and device settings
Trips and Saved use on-device AsyncStorage scoped to the authenticated UID. They do not sync through Firestore. A trip includes elapsed time, measured distance, profile, planned distance/ETA, endpoints and bounded planned geometry. Language, preferences and drafts are also local. AsyncStorage is not a dedicated encrypted vault; backups and Keychain behaviour depend on iOS. Signing out hides account data but does not itself erase it.
Retention and deletion
Account and profile data are retained while the account exists; the current version does not automatically delete an account solely for inactivity. OTP records have a deleteAfter target of about 24 hours and hourly batch cleanup; this is a target, not a guarantee of immediate erasure. Support correspondence is kept while needed to resolve the request, protect rights or meet legal obligations. Technical logs and backups have their own service-specific lifecycle. In-app account deletion removes the owned profile and username reservation, Firebase Auth account and local data for that UID in sequence. An incomplete stage can be retried. This action does not automatically erase other devices, email or third-party logs. Registering again after complete deletion creates a new UID and does not restore deleted trips.
Support and this website
When you contact support, email services process your address, message and attachments. Do not send passwords, sign-in codes or unnecessary personal information. Website code does not load Firebase, Mapbox or Resend SDKs, request location, include analytics or advertising trackers, or set first-party cookies. The page URL determines language; fonts and images are served by the site. We use Cloudflare for hosting and protection: web requests transmit IP address, time, requested URL and browser technical information. Hosting protection may use necessary technical cookies. This is not advertising analytics.
Rights, legal bases and international transfers
We process data to provide requested features, perform arrangements with the user, keep the service secure, meet legal obligations and, where required, on the basis of consent. You may request access or a copy of your data, correction, deletion, object to processing or withdraw consent for operations based on it. There is no built-in export of all data; contact bukway.app@gmail.com. To prevent unauthorized access we may verify account ownership; passwords and OTPs are not needed for that purpose. Requests are handled within applicable legal time limits. You may also contact the Ukrainian Parliament Commissioner for Human Rights or a competent court. Google/Firebase, Mapbox, Resend and Cloudflare may process data outside Ukraine, including in the United States, under their service terms and applicable data-protection requirements. Provider policies and contractual terms are linked below. Location and telemetry can be controlled separately. Self-declared age validation from 18 to 120 is a product rule, not document verification.