KOVA / Legal
Privacy Policy
What KOVA processes, why it is needed, and the choices you have.
Last updated:
1. Who to contact
KOVA is maintained by @MAICOWAVE. For questions about personal data, access or deletion, contact hello@kova.spot. This notice covers the KOVA website and app.
2. Data used by KOVA
- Location: with device or browser permission, KOVA uses your coordinates to centre the map and find nearby spots. The last known coordinates and a timestamp are saved on your device for the next visit. Map requests and nearby searches reveal the area being viewed to the relevant service providers. Browsing remains possible without location permission.
- Submitted spots: the spot name, description, category, coordinates, photo, contributor name and submission time are sent to Firebase for moderation. Approved details may be shown publicly. Use a contributor name you are comfortable publishing. Uploaded images are stored separately and may be accessible to anyone with their download link.
- Saved spots, routes and ratings: saved spots, planned routes, transport preference and your previous ratings are stored on your device. A rating also updates the public spot's aggregate score and rating count.
- Accounts, if used: the account page processes your email, password, display name and optional profile photo through Firebase Authentication and associated storage. You do not need an account to browse the map.
- Technical data: hosting, map, content-delivery and security services receive connection information such as IP address, browser or device details and requested resources. Firebase App Check and Google's reCAPTCHA Enterprise process security signals and tokens to help prevent abuse.
- Messages: if you contact us, we receive the contact details and information you include.
3. Purposes and legal bases
We process information needed to provide features you request, such as reviewing a spot submission or managing an account, to perform the relevant service. Optional device location is used with your permission; you can withdraw that permission in your device or browser settings.
Our legitimate interests are operating and securing KOVA, moderating contributions and answering enquiries, balanced against your rights. Legal obligations may require us to retain or disclose certain information. Where consent is required for optional processing or device storage, that processing requires a separate choice; reading this notice does not constitute consent.
4. Providers and disclosure
KOVA uses Google Firebase for spot data, uploaded images, account features and app security, and MapTiler for maps and weather layers. Page resources also come from content-delivery providers, including Google and jsDelivr. These providers process the information needed to deliver their services.
Opening directions in Google Maps or Apple Maps sends the destination or route you selected to that service. External social and donation links take you to services with their own privacy practices. We may also disclose information when legally required or necessary to address abuse or protect legal rights.
Providers may process data outside your country, including outside the European Economic Area. Their applicable data-processing terms describe transfer safeguards, such as standard contractual clauses or an applicable adequacy framework. See Firebase privacy information, Google Cloud's Data Processing Addendum and MapTiler's Privacy Policy. Contact us for information about the safeguards relevant to your data.
5. How long data is kept
Local KOVA preferences and the last known location have no automatic expiry: they remain until overwritten, removed through a feature, or cleared in your browser or app settings. Clearing them does not delete submissions or accounts held on the server.
Published spot contributions are kept while they are part of the map, subject to correction and removal requests. Pending submissions and uploaded photos are retained for moderation and require separate removal; there is no automatic deletion period in the current app. Account information remains until the account is deleted. Contact us to request review or deletion of information associated with you.
Messages are retained as needed to handle the enquiry and any related dispute or legal obligation. Provider logs, security tokens and backup copies follow the applicable provider's retention arrangements. Deletion from backups may take longer than removal from the live service.
6. Your choices and rights
Depending on the applicable law, you can request access, correction, deletion, restriction and portability of your personal data. You can object to processing based on legitimate interests and withdraw consent without affecting processing that was lawful before withdrawal. We may need proportionate information to verify a request.
Email hello@kova.spot and identify the account or contribution concerned. Do not send passwords. We normally respond to GDPR requests within one month and explain any permitted extension. You can complain to your local data-protection authority; in Belgium this is the Data Protection Authority.
Disable location in your device settings at any time. Remove saved spots or routes within KOVA, or clear site/app data to remove local records. KOVA does not use automated decisions that produce legal or similarly significant effects about you.
7. Updates
We will update this notice when data practices change. See the date above and our Cookie Policy for information about storage on your device.