Privacy Policy
Last updated: 6 November 2026
This policy explains what Thrift Map does with your data. It is published by Hugo Software.
The short version: Thrift Map has no accounts, collects no personal data, contains no advertising, and contains no analytics or tracking of any kind. Your GPS position itself is never sent anywhere. To find shops, the app sends the area of the map you are looking at; when the map is centred on you, that area shows roughly where you are. The places you save stay on your phone.
No accounts, no personal data
The app never asks for your name, email address, phone number or any other identifier. There is no sign-up and no login. We hold no user records, because there are none to hold.
Location
If you allow it, the app reads your device's approximate or precise location. It uses it for two things:
- Centring the map on where you are.
- Sorting nearby shops by distance from you.
Your GPS coordinates are not sent to our servers, not stored on any server, not written to any log, and not shared with anyone.
However, when the map is centred on you, the map area that the app sends to find shops (see below) is the area around you. That area therefore reveals your approximate location.
Location is optional. If you decline the permission, the app still works: you can search for any city or area by name.
What is sent over the network
To show shops, the app makes requests to our backend at thrift.bnj.app, a caching proxy in front of public OpenStreetMap services. It sends:
- The map viewport: the rectangle of the map currently on your screen, so we can return the shops inside it. When the map is centred on you, this is the area around you. It carries no identifier of you.
- Search text you enter when you search for a city or area. It is sent only when you press Search.
Our proxy asks the OpenStreetMap Overpass API for the shops in the fixed map square that contains your view, and passes your search text on to OpenStreetMap Nominatim.
Our proxy keeps a shared cache so the map can open quickly: shops by map square, refreshed after about a month, and search results by search term for about a week. It also fills in the squares of large cities ahead of time. This cache is shared across everyone and is not tied to any user. Our servers keep only ordinary, transient web request logs for operational purposes; they are not used to build a profile of anyone.
No advertising, no analytics, no tracking
The app contains no advertising SDK, no ad network, no advertising identifier, no analytics SDK, and no crash-reporting SDK. Nothing tracks you across other apps or websites.
Third parties
Using the app causes requests to these services, which is inherent to showing a map:
- OpenStreetMap Overpass API: receives the map square (via our proxy) to return the shops in it.
- OpenStreetMap Nominatim: receives your place-name search text (via our proxy).
- OpenStreetMap tile servers (
tile.openstreetmap.org): your device loads the map images directly, which reveals the area you are viewing.
Like any web request, these carry standard technical information including your IP address. We do not control those services; the OpenStreetMap Foundation's privacy policy applies.
Google Play processes all subscription payments. We never receive your card or payment details, only aggregate, anonymised sales reporting from Google.
Sharing
If you tap Share, the name, address and OpenStreetMap link of the place or trip you chose go to the app you pick on your phone's share screen. Your own location is not included. Nothing is shared unless you do this.
Stored on your device
The app stores these locally, on your device only. None of it reaches our servers:
- The places you save (want to go, been there, favorites) and your trip, with a copy of each place's address, opening hours and contact details.
- The last map position and the name of the place you last searched for.
- A flag recording that you have seen the introduction screen.
- The time Google Play last confirmed your subscription and which plan it was. Your subscription status always comes from Google Play; this time only keeps the map open for up to 7 days if Google Play cannot be reached (for example, without internet), so a paying subscriber is not locked out.
- For app reviewers only: a flag recording that the store-review access code was entered.
If Android backup is on for your device, Android may include this data in your device's backup in your Google account. You can turn that off in Android settings. Uninstalling the app removes all of it from the device.
Children
The app is not directed at children and collects no data from anyone, of any age.
Your rights
Because we collect and store no personal data, there is no personal data of yours for us to access, correct, export or delete. See the Data Removal page for details.
Changes
If this policy changes, the updated version will be published on this page with a new date.