Privacy Policy

How RestMap handles your data.

Last updated: October 16, 2026

The short version: RestMap does not require an account and does not sell your data. RestMap does not store continuous precise device-location history on its servers. Nearby search and navigation can use third-party services as described below. Optional Premium reports run only when you ask and after you review the trip data being sent; their separate server and AI-provider handling is described below. RestRoom IQ scoring runs on device, and ratings you choose to submit are stored without an account.

Our Privacy Principle

RestMap was built around a simple idea: you should not have to create an account or give up unnecessary personal data to compare restroom stops.

What We Do Not Collect

  • Personal account information - RestMap does not require accounts, email addresses, or sign-in.
  • Precise location history on our servers - We do not store continuous precise device-location history or movement tracks on RestMap servers. Optional Premium reports can retain the reviewed trip content described below.
  • Device profiles - We do not collect device IDs for cross-app profiles.
  • Cross-app tracking - We do not track you across other apps or websites.

On-Device Processing

  • Location - Your device location helps RestMap find nearby restrooms, guide trips and check whether a contribution was made at a place. Optional Always access enables low-power visit detection for rating reminders and location updates during navigation, including while the screen is locked. RestMap does not store live GPS readings as a server-side travel history. If Share App Analytics is on, RestMap can send derived region-level information as described under Analytics. Public-place coordinates submitted in ratings or optional reports identify the place, rather than a live device-location feed.
  • RestRoom IQ scoring - RestRoom IQ scores and recommendations are computed on your device using bundled data and on-device scoring logic.
  • Preferences, favorites, and trip history - These are stored on your device. RestMap can sync preferences, contribution statistics, badges, passport stamps and recent activity through your private Apple iCloud Key-Value Store so they can move between your devices and survive reinstalling the app. Passport stamps include region codes and the earliest known rating date in a region, or the date the stamp was added when no rating date was saved. This private iCloud sync is separate from RestMap's server storage and optional app analytics. Synced progress has no fixed automatic deletion period.

Optional Premium Trip Report and Place Research

Trip Report runs only after you tap the request button and review the disclosure. AI report content can include opaque report stop and public-place IDs, public stop names and approximate public-place coordinates rounded to three decimal places, timing, RestMap grades, route weather, reduced city-level endpoints, and optional traveler context left in the reviewed field. OpenAI is RestMap's AI provider.

When RestMap already holds a complete identity for a planned public stop, the app may send a separate same-place matching envelope to RestMap's server. The envelope repeats the report stop ID, place ID, public name, and type already included in the AI report data so RestMap can bind the two. It may additionally contain an Inspector locator, optional search and enclosing-place names, non-Unknown locality and region, address and exact public-place coordinates when held, and held provider anchors. RestMap uses the envelope only to decide whether an already-sourced Inspector record belongs to the same physical place. The additional exact matching fields are not included in AI prompts, web searches, or the Trip research cache and are not reused to improve future reports or Inspector records. Only compact Inspector facts authorized by the same-place match may be added to the report. The envelope expires with the temporary report job within seven days. Missing, legacy, synthetic, or ambiguous identity produces no Inspector evidence. Exact private start and end addresses remain excluded.

A signed StoreKit transaction proof is sent separately to RestMap to verify Premium access or one-free-report eligibility. It is not included in AI prompts or web searches. RestMap does not persist the raw proof or raw StoreKit transaction identifier; a one-way derived identifier is retained for quota, idempotency, and spend enforcement.

Trip Report request and result jobs are stored temporarily for up to seven days. Completed Trip Reports are saved on your device. Public-place research caches stop being used 30 days after their last research write. A daily deletion job removes expired cache documents, so physical deletion may occur the following day.

Unresolved public-place discoveries and destination-status observations may be held as candidates for up to 30 days after extraction. They cannot directly change public ratings or RestRoom IQ and do not retain the app's local trip identifier. A candidate transport envelope remains while processing is pending; after it succeeds or fails, it expires after seven days. The same daily deletion job removes expired candidates and terminal transport records.

Trip Report may ask our AI provider to search public information about places along the route. Inspector place research stores sourced facts about the public venue, with provenance and freshness information; it does not store your trip or traveler context in the venue record.

Optional Place Reports

A Place Report is a guide to a whole visit, created only after you review the details and tap Create Place Report. RestMap sends the reviewed place and visit details to its server and OpenAI. Those details include the selected destination's identifier, name, type, exact public-place coordinates and any available address, plus your language and distance units. For a town or area, they also include its locality and country. These coordinates describe the destination, not a live reading of your device's location.

The visit details include start and end dates if selected, an optional approximate visit length, adult count, any children's ages you choose to add, transport choice and the needs you keep selected. Those needs can include food (vegetarian, kosher or halal), stroller, step-free access and EV charging, and restroom needs such as a single-person, all-gender or companion restroom, wheelchair access, space beside the toilet, grab bars, a hoist, a baby or adult changing table, and pet access. Restroom needs start from the ones you chose in RestMap's Settings, and you can change or remove any of them before you create the report. The request also records which needs are preferences or must-haves and whether kosher or halal certification is required. Children's names, exact birth dates, religious identities and medical diagnoses are not requested. You can create a general guide without adding ages or personal needs.

As with Trip Report, a signed StoreKit proof is sent separately to verify Premium access; it is not stored with the job or included in AI prompts, and RestMap keeps only the one-way quota identifier described above.

The temporary job associates the reviewed visit input and report result with the one-way quota identifier used for access and quota checks. This association includes public-place coordinates and any optional personal needs you keep in the reviewed request. It expires with the temporary job under the retention and cleanup described below.

Public web research uses the destination, selected visit dates or approximate visit length, and language; children's ages and personal needs are not included in those search prompts. OpenAI then uses the reviewed visit details to tailor the report to the researched facts. Visit details are not added to public place records, shared research caches or analytics. OpenAI's separate data handling is described under Third-Party Services below.

Remember for next time is an optional local save. Visit dates and duration are not saved as remembered preferences. Remembered Place Report choices are excluded from RestMap's iCloud preference sync and can be edited or forgotten on the device. Changing one visit does not save those changes as remembered preferences unless you choose to do so. Saved reports keep the visit details used to create them and remain readable after Premium expires. A report you share includes its visit details and sources.

RestMap keeps private request and result copies in Google Firebase as temporary jobs. Access to a job expires seven days after it is created, and scheduled cleanup removes expired jobs. This temporary retention also applies to completed, failed or cancelled requests. Cancelling asks the service to stop further work; it does not erase research already processed by the AI provider.

Forgetting remembered choices or deleting a saved report removes that data from your device, not from a temporary server job or copies you have already shared. Temporary server copies follow the seven-day expiry and cleanup described above; the AI provider's separate retention still applies. Completed reports are saved locally, and reading or exporting them does not require an active Premium subscription.

Ratings and Contributions

When you choose to submit a rating, we store the following in our shared ratings database, Google Firebase, without an account:

  • The location of the place being rated, not your device location.
  • Your rating, such as Good, Okay, Poor, or No Restroom.
  • Optional amenity answers you provide, such as changing table or accessibility details, stored as described below.
  • Optional review text you choose to write.
  • A random submission ID, UUID, so other travelers can thank your contribution.

RestMap has no accounts. Public ratings use submission identifiers; yes or no amenity answers also use a one-way App Store-derived key and a change history so you can correct or withdraw them. RestMap does not store the raw App Store identifier for those answers. Credit bookkeeping and optional report jobs use persistent derived identifiers separately from the public rating record. You can request removal of a specific submission by emailing us with the location and approximate submission time.

If you send feedback on a World Tour puzzle, RestMap stores your rating, any short comment you write, the puzzle and city, your score, the app version and a random installation ID.

If you share your contribution map, RestMap uploads an image of that map so the link can show a preview; anyone with the link can see the image.

Inspector Credits and Invites

RestMap verifies a signed App Store transaction proof to derive a one-way identifier for Inspector Credits, invite rewards and quota enforcement. No RestMap account is required, and the raw proof or App Store identifier is not saved by this bookkeeping path. The server associates that derived identifier with progress claims, such as contribution levels, earned thanks, rating streaks and game progress, and with granted and used credits and referral relationships. Your invite code identifies the referrer's reward relationship and is visible to anyone you share it with.

Credit and referral bookkeeping has no fixed automatic deletion period. Referral credit expiry limits when those credits can be used; it does not automatically delete the ledger or progress claims. Other earned grants can have different eligibility and expiry rules. Contact flush.restmap@gmail.com with enough details to identify the relevant request or invite if you want to request deletion.

Community Thanks

When another traveler thanks one of your ratings, reviews, or hours updates, we record an anonymous count next to that submission. To prevent duplicate thanks on the same item, we attach a one-way hashed key derived from a random per-install identifier. It is not your Apple ID, email, or device serial.

Thanks counts are stored alongside the contribution in Firebase. The hashed deduplication keys are visible only as opaque strings on individual contribution records. We do not aggregate them, build profiles from them, or share them with third parties.

Contributors

Unless you turn on Hide from Contributors in RestMap Settings > Privacy, RestMap adds an entry for this installation to Contributors. An entry contains a random installation ID, a display name and emoji that RestMap generates, your XP, level and rating counts, the app version, and the avatar look and backdrop you choose. It does not contain your name, email, location or the places you rated. Anyone using RestMap can see Contributors entries. This setting stops new Contributors updates from this device. Existing shared entries may remain in rankings. To remove an entry already published, email us.

Alerts You Ask For

Report-ready alerts are off until you turn them on. You can turn them on in RestMap's alert settings, or by tapping Notify me when it's ready while a Place Report is being created, which also keeps alerts on for later reports. When alerts are on, the app sends your device's Apple push token to RestMap's server, and only to register for these alerts; the token is not attached to any other request. The server keeps the token with a random registration code for up to 60 days after your device last registered, and removes it sooner if Apple reports that it is no longer valid. RestMap keeps only a one-way fingerprint of the secret your device uses to manage that registration.

While alerts are on, each Place Report, Trip Report or Inspector check you request carries the registration code and that secret, so the server can link the result to your device's registration. That link is kept with the request's temporary job and expires with it, within seven days. Each alert record names the kind of result and an opaque reference to it, never the report's contents, your needs or your location. An alert record is kept for seven days, and an alert that cannot be delivered expires within 24 hours. A daily deletion job removes expired registrations, links and alert records, so physical deletion may occur the following day. Alerts are delivered through Apple Push Notification service, which receives the push token and the alert's short, generic text. RestMap does not use the push token to identify you or for advertising. You can turn alerts off at any time in RestMap's settings or in iPhone Settings, and RestMap then removes the registration from its server the next time the app is open and online.

Live ETA Sharing

When you explicitly start live ETA sharing, RestMap sends your destination label, estimated arrival time and trip status to Google Firebase so people with your private link can see updates. It does not send your route, GPS coordinates or location history. Anyone you give the link to can forward it, so share it only with people you trust.

Only the latest update is kept in the active sharing record. Links expire after at most 24 hours and stop serving updates if your device has not renewed sharing for five minutes. Stopping sharing online revokes the link immediately. If you are offline, RestMap retries closure when connected, and the five-minute expiry bounds access to the last update. Arrival also ends sharing.

Expired sharing records are scheduled for automatic deletion, which normally completes within 24 hours after expiry. Online revocation removes the destination and arrival update from the active record immediately. The existing database can retain recovery versions for up to seven days and weekly backups for 30 days; those copies are not available through your link.

The recipient page uses no advertising trackers or third-party analytics scripts. We count links created, recipient-page visits and visits that click through to our website. Random per-visit values are held only in page memory; their one-way hashed deduplication records expire after 48 hours. Rate-limit records expire within about 25 hours. Daily aggregate counts expire after 90 days. Automatic deletion can take an additional 24 hours, and the recovery and backup periods above apply. These counters contain no destination label, arrival time or GPS coordinates and do not identify unique people.

The optional website link carries only the campaign name and link placement, never your private trip link. The website then uses its ordinary analytics as described below. Our hosting provider processes ordinary connection information, such as IP addresses, to deliver and protect the service.

Analytics

RestMap uses Google Firebase Analytics to understand app and feature usage. Firebase assigns a pseudonymous app-instance identifier to each installation and uses the IP address at collection time to derive coarse location; Google states that it discards the IP address before logging the event. Events and user properties are associated with that installation identifier, even though RestMap has no accounts. RestMap does not collect Apple's IDFA or IDFV, is configured not to send ad-personalization signals, and does not use this data for cross-app or cross-website tracking.

If Share App Analytics is on, Atlas and Passport events can include the region you open, whether it is your current region, whether a contribution was location-verified, region codes where a contribution earned a stamp, and counts of stamps and achievements. These events are associated with the Firebase installation identifier. They do not contain raw GPS coordinates, a place identifier or review text. Your Journey and monthly stories are assembled on your device from saved activity; their existing contribution data can also be synced privately through iCloud.

During RestMap navigation, the app can send coordinate-free events showing whether a road-trip plan was saved, in-app navigation was started or completed, approximate driving distance accumulated on-device, and, in broad bands, how far from the destination navigation ended. Driving distance is sent in five-mile checkpoints and a terminal remainder rounded down to one-tenth of a mile. These events do not include GPS coordinates, route geometry, origins or destinations, place names or IDs, or RestMap trip IDs. Debug, simulator, TestFlight, sandbox, and unverified builds are excluded.

You can stop future app analytics collection on this device in RestMap Settings > Privacy > Share App Analytics. Turning it off does not delete events already received. This setting does not control analytics on the restmap.io website, which can use a browser client identifier and cookies for aggregate website measurement.

Raw analytics events are retained according to RestMap's configured Google Analytics retention period while needed to measure product trends, then deleted or aggregated. Aggregate reports that no longer contain event-level records may be retained longer.

Third-Party Services

  • Apple Maps and Apple WeatherKit - Used for map display, search, directions, and the weather forecast shown for a planned route. When you query the map, request directions, or plan a route, that query is handled by Apple according to Apple's privacy policy.
  • OpenStreetMap - Used for public restroom and amenity data. RestMap sends a bounding box for the public place or map area being viewed directly from your device to a public OpenStreetMap Overpass service. The request includes ordinary network information, but RestMap does not attach an account, analytics identifier, or device identifier.
  • Refuge Restrooms - Used for community-contributed restroom locations, accessibility information, all-gender or unisex context, changing-table information, votes, comments, and directions. RestMap sends a search-area or public-place latitude and longitude directly from your device to Refuge's live API to find nearby records. The request includes ordinary network information, such as your IP address, but RestMap does not attach an account, analytics identifier, or device identifier.
  • Open Charge Map - Used for EV charging-station locations along a public route or near a requested location. RestMap sends route-sample or search-center coordinates directly from your device to Open Charge Map. The request includes ordinary network information, but RestMap does not attach an account, analytics identifier, or device identifier.
  • Google Maps Platform (Places API) - Used in three cases. It looks up a place's opening hours when you expand the hours section for a place RestMap has no other hours source for. It shows Premium live open or closed status, on a place's page and for the upcoming stops Scout Ahead compares, and a Premium place photo. When Inspector researches a place, it finds that place's public listing (its status, hours, restroom details and reviews) as one of Inspector's sources. These lookups go from RestMap's server and carry only public details of the place, such as its name, address or town, coordinates and Google place ID. They never carry an account, device identifier, analytics identifier or your own location. A Premium place photo is then downloaded by your device from the short-lived Google address the server returns, so Google receives your device's network address for that image, as with any download. Hours looked up for the hours section are not stored; each viewing is a fresh lookup. If you paste a shortened Google Maps or Apple Maps link to add a stop, your device opens that link directly with Google or Apple to find the place it points to, so they receive the link and your device's network address; RestMap sends no identifier with it.
  • Google Firebase - Used for anonymous community ratings, pseudonymous app-instance and website analytics, Premium access and quota enforcement, temporary report jobs and separate same-place public-place identity matching, public-place research caches, unresolved public-place candidates, terminal candidate transport, sourced public-venue facts, and report-ready alert registrations and alert records. Analytics are not linked to a RestMap account. Optional traveler context and Place Report visit details are stored only in the reviewed report request's temporary job.
  • OpenAI - RestMap's sole AI provider for user-requested Trip Reports, Place Reports and public-place research, including Inspector checks. RestMap sends store: false, does not use Conversations or background mode, and disables prompt-cache writes at launch. OpenAI states that API data is not used to train its models unless the API customer explicitly opts in; default abuse-monitoring logs may retain content for up to 30 days, with limited legal and safety exceptions. No other AI provider receives this data.

Data Sources

RestMap's restroom database combines public and app-specific data sources credited in the app:

  • OpenStreetMap - Public restroom and place data contributed by the OSM community.
  • Refuge Restrooms - Gender-neutral restroom and accessibility records contributed by the Refuge Restrooms community.
  • Open Charge Map - EV charging station locations.
  • MapKit/Apple Places - Business and place data from Apple Maps.
  • RestMap brand profiles and user-submitted ratings - RestMap-specific context used by the app.

RestMap's own brand profiles are bundled with the app. OpenStreetMap, Refuge Restrooms, and Open Charge Map records are fetched live as described under Third-Party Services above. RestMap does not attach an account, analytics identifier, or device identifier to these source lookups, but the providers receive the query coordinates and ordinary network information needed to return results. Apple Places results come from queries your device sends to Apple. Google Maps Platform listings are looked up through RestMap's server for opening hours, Premium live status and photos, and Inspector research, as described under Third-Party Services above.

Data Storage

Your preferences, favorites, trip history, and Trip Reports are stored on your device, with limited preferences and activity data optionally synced through your iCloud account. Public ratings and contributions are stored in Google Firebase as described under Ratings and Contributions. Inspector credit and referral records use a one-way App Store-derived identifier. Optional report jobs associate their reviewed input and result with the quota identifier for the job's temporary lifetime. Pseudonymous analytics events are stored in Google Analytics under the retention criteria above. Premium systems also retain one-way quota identifiers, temporary report jobs and any separate same-place public-place identity matching data, public-place research caches, unresolved public-place candidates, terminal candidate transport, and sourced public-venue facts as described above. If you turn on report-ready alerts, RestMap's server also keeps your device's push registration and short-lived alert records as described under Alerts You Ask For. RestMap's servers and hosting provider process ordinary connection information, such as IP addresses, to deliver and protect the service, and may keep it briefly in security and error logs. We do not sell or share your data with third parties for marketing purposes.

Your Rights

  • Deny location access in Settings. The app will function with limited features.
  • Object to future app analytics by turning off Share App Analytics in RestMap Settings > Privacy.
  • Turn off report-ready alerts in RestMap's alert settings or in iPhone Settings, which removes your device's push registration from RestMap's server.
  • Request removal of a submission you made by emailing us with enough detail to identify it.
  • Request deletion of Premium report data by emailing us with the completed trip and report details needed to identify it.
  • Report inappropriate content from within the app.

International Users

For users in the EEA and UK, RestMap processes device location when you grant system permission to provide requested nearby and navigation features. For pseudonymous analytics, RestMap currently relies on its legitimate interest in understanding and improving the app, balanced by data minimization and the in-app right to object. Any jurisdiction that requires opt-in consent must be addressed before this instrumentation is released there.

Anonymous review data, pseudonymous analytics, and optional Premium processing may be handled on servers in the United States by Google Firebase and OpenAI as applicable. You may request access, correction, deletion, restriction, or objection by contacting us; you can object to future app analytics immediately with the in-app toggle.

The optional Premium Trip Report and place research described above rest on a different basis: your consent, given the first time you use Trip Report and reviewed before every request. You can withdraw it at any time in RestMap Settings > Privacy > Trip Report & privacy. Withdrawing consent stops future requests; it does not undo a report already generated and saved on your device.

Children's Privacy

RestMap is rated 4+ on the App Store and does not require a child's name, email address, or account. A parent or guardian should review any optional traveler context before a Premium report is requested and remove personal details they do not want sent.

Changes to This Policy

We may update this privacy policy from time to time. We will post any changes here with an updated date. Significant changes will be highlighted in the app.

Contact Us

If you have questions about this privacy policy or wish to request data removal, contact us at flush.restmap@gmail.com.