Privacy Policy

Effective date: July 1, 2026
Who we are: FYI (fyimap.com) ("FYI", "we", "us"). Contact: support@fyimap.com.

FYI is a map that shows golf courses and restaurants reviewed by YouTube creators.
This policy explains what we collect and why.

What we collect

You give us:
- Account (optional — only if you sign up to save places): your name, email, and optionally your phone number and ZIP code. Used to create your account, save your spots across devices, and (with the email) contact you about your saved places and new creators. Phone and ZIP are optional; ZIP helps us understand which areas to map next.
- Saved places: the pins you bookmark. Stored on your device if you're signed out, and tied to your account if you sign in.
- "What to map next" survey (optional): the categories and creator names you suggest. Tied to your account if signed in, otherwise anonymous.
- Creator / contact form ("Get on the map"): your name (optional), email, YouTube channel link (optional), and message. Stored so we can contact you.

Automatically, as you use the map:
- Usage & analytics data — we collect comprehensive activity across the app: pages and screens viewed, which place cards you open, videos you play, links you click, "directions" taps, searches, votes, taps, scrolls, session length, referrer, and similar interactions. We use third-party analytics (e.g. Google Analytics / Google Tag, PostHog) that set their own cookies/identifiers and may associate this activity with a device, session, and — if you're signed in — your account, to measure and improve the service. Device/browser details (type, OS, screen size, approximate region from IP) are collected too.
- "Wrong location" reports — the place you flagged.
- Technical data — IP address and basic request info, used for rate-limiting/abuse prevention and kept in standard server logs (via our host, Vercel). We do not store your IP alongside usage events.
- Approximate location — only if you use "search near an address" / distance features, which use your browser's geolocation with your permission. Used in your browser to sort by distance and build directions links; we don't store it.

Cookies / local storage:
- A random session ID (`sessionStorage`) for analytics.
- Analytics cookies/identifiers set by Google Analytics/Google Tag and PostHog to recognize your device and sessions.
- Your saved places in `localStorage` so they survive a refresh even when signed out.
- If you create an account, a single login cookie (httpOnly) that keeps you signed in. It holds a random token, not your personal details.
- Embedded YouTube players and Google Maps may set their own cookies when you interact with them — governed by Google's privacy policy.

How we use it
- Create and run your account and sync your saved places across devices.
- Contact you (via email) about your saved places, new creators, or if you submitted the creator form. We only email about the service — no spam, no selling your address.
- Decide what to map next using survey answers and ZIP-level area interest.
- Run and improve the map (what's useful, which areas/creators perform).
- Measure the traffic we send creators (we tag outbound links with `utm_source=fyi`).
- Prevent abuse and keep the service secure.

We do not sell your personal information.

Third parties (processors)
- Google Maps / Places / Geocoding — map tiles, place data, and directions.
- YouTube (Google) — embedded videos and channel/video data.
- Google Gemini — analyzes *public* video metadata (titles, descriptions, transcripts, thumbnails) to map locations. We do not send your personal info to it.
- Vercel — hosting. Neon — database.
- Resend — sends account/login emails and creator-form notifications.
- Google Analytics / Google Tag and PostHog — product and traffic analytics (see "Usage & analytics data" above).
- Payments (e.g. Stripe): if/when you buy a featured placement or other paid service, our payment processor handles the card transaction directly; we receive only limited billing metadata (such as name, email, and the last digits/brand of the card) — never your full card number. We'll name the specific processor here when payments go live.

Retention
- Account data (name, email, phone, ZIP, saved places, survey answers): kept while your account exists. Delete it anytime — see below — and it's removed immediately.
- Contact submissions: kept until handled, then as needed for follow-up.
- Usage/analytics data: kept for up to 24 months, then aggregated/deleted (analytics providers may retain per their own policies).

Your rights
Delete your account and all its data: email support@fyimap.com from the
address on your account and we'll erase your profile, saved places, and survey
answers, and delete your account. You can also email us to access or correct your
data. Depending on where you live (e.g. EEA/UK/California),
you may have rights to access, correct, delete, or object to processing; we honor
these. Legal basis where required: legitimate interest (analytics, security),
consent (account, geolocation), and to respond to you.

Other
- Not for children under 13. We don't knowingly collect their data.
- Security: input validation, rate limiting, encrypted connections, no hardcoded secrets. No method is 100% secure.
- Changes: we'll update this page and the effective date; material changes get clearer notice.

_Questions: support@fyimap.com._