Privacy policy
Effective September 24, 2026 · Last updated October 1, 2026
This policy explains what information MGRS Cardinal collects, why, where it’s stored, and how you can see, correct or delete it.
Who is responsible
MGRS Cardinal is operated by Vincent Cardinal (Alberta, Canada), who is responsible for the personal information described here and acts as its privacy officer. Contact: support@mgrscardinal.com.
The short version
- We collect only what the app needs to work, and we don’t sell your data or show ads.
- The free map works without an account. If you don’t sign in, your pins stay in your browser.
- Card details are handled by Stripe (website) or Google Play (Android app), and we never see your full card number.
- You can ask to see, correct or delete your data at any time.
What we collect, and why
| Information | Why | Where it’s kept |
|---|---|---|
| Email address or phone number, your name and profile picture if you sign in with Google, Microsoft or Facebook, and the nickname you choose | To create your account, sign you in and contact you about it | Firebase Authentication (Google) |
| Plan and billing status: plan, renewal date, Stripe customer ID or Google Play purchase reference | To turn paid features on or off, and to check purchases made in the Android app | Firebase, Stripe and Google Play |
| Payment details: card, billing address | To take payment | Stripe only, never on our servers |
| Your map content: pins, shapes, lines, text, spreadsheet imports and their columns | To save and sync your map (Premium cloud and team maps) | Firebase (Cloud Firestore) |
| Team information: team name, members, nickname, email, online and last-seen status, chat messages | To run shared team maps, the member list and chat | Firebase, visible to your team members |
| Photos and files you send in team chat | To share them with your team, who can view and download them | Firebase (Cloud Storage), visible to your team members. Photos are resized, and hidden location data (GPS/EXIF) is removed before upload |
| Maps saved on your device, and settings (units, map style, grid precision) | So the app remembers your work and preferences without an account | Only in your browser’s local storage |
| Your position and walked trail (Go to navigation) | Only while you navigate to a pin with Go to, to show your bearing, distance and the path you walked | Only in your browser on this device. Never sent to our database. You can hide or clear the trail at any time |
| Phone orientation (compass) | Only while the compass is open, to show which way you’re facing and to turn the map | Used in your browser only. Never sent to our database. Your phone may ask your permission first |
| Your location (Go to my location) | Only when you tap Go to my location, to centre the map | Used in your browser and not sent to our database. Your browser asks your permission first |
| Your live position (team location sharing) | Only if you turn on Share my location with the team (Premium). Your position and its accuracy are updated about every 15 seconds while the app is open | Firebase, visible only to Premium members of your team. Deleted when you stop sharing, leave the team, or the team is deleted |
| Call sign, icon and color | Set by your team owner to identify you on the team map and in chat | Firebase, visible to your team members |
| Technical data: IP address, browser type, requests | Needed to deliver the site, map tiles and fonts, and to keep the service secure | Our hosting and service providers (see below) |
We don’t use advertising or analytics trackers. The app uses your browser’s storage to keep you signed in and to save your settings. It does not use tracking cookies.
Information we receive from Google (Sign in with Google)
If you choose Continue with Google, Google asks for your permission and then shares only your basic profile with MGRS Cardinal: your name, your email address and your profile picture (the standard “openid”, “email” and “profile” permissions).
- How we use it: only to create your account and sign you in, to show your name in the app and on team maps (you can change it to a nickname), and to contact you about your account, payments and support.
- What we don’t access: we never ask for or access your Gmail, Contacts, Calendar, Drive, Photos or any other Google data.
- What we don’t do: we don’t sell this information, we don’t use it for advertising, and we don’t use it to train AI models.
- Sharing: it is only shared with the service providers that run the app for us (Google Firebase hosts your account), never with anyone else, unless the law requires it.
- Storage and security: it is stored in Google Firebase in the United States, encrypted in transit and at rest.
- Keeping and deleting it: we keep it while your account exists. When you delete your account (person icon → Personal information → Delete my account, or other ways), it is deleted within 30 days. You can also remove MGRS Cardinal’s access at any time in your Google Account, under Security → Third-party apps and services (myaccount.google.com/permissions).
MGRS Cardinal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your location
The app uses your device’s location only when you ask it to: to show where you are on the map, to navigate to a pin with Go to, and for the compass. This happens on your device and isn’t stored by us. Your position is sent to our servers only if you turn on Share my location in a team; then your team members can see it until you turn it off, and only your latest position is kept. Your walked trail stays on your device.
Information stored on your device
The app saves your settings (units, map style, preferences), maps you keep on “This device”, and PDF map overlays in your browser’s storage on your own device. We don’t use advertising or tracking cookies, and we don’t use third-party analytics. Our hosting provider (Cloudflare) may use strictly necessary security cookies to protect the site from attacks.
Please don’t store sensitive information
MGRS Cardinal is not built or approved for classified, protected or operationally sensitive information, or for sensitive personal information about other people. Please keep that kind of information out of your maps, imports and chat.
Reports and moderation
If someone reports a chat message, photo or file, a copy of the reported content and the names and account IDs of the people involved are sent to us for review, including by email to our support address. We may view the reported content and hide or delete it. We may also suspend the account. If content appears to involve the sexual exploitation of a child, we keep it and report it to Cybertip.ca and law enforcement, as Canadian law requires. Reports are kept for up to 2 years, or longer if the law requires.
Who we share it with
We share information only with the services that run the app, and only as much as they need:
- Google Firebase for sign-in and the database.
- Esri for recent satellite imagery and elevation (Premium): your device asks Esri for map images of the area you look at, and for the height of the points you choose. No account details are sent.
- Stripe for payments and subscriptions on the website.
- Google Play for payments and subscriptions in the Android app.
- Cloudflare for website hosting and the billing service.
- Map and content providers (MapTiler, EOX and the USGS), Google Fonts, jsDelivr and cdnjs. When the map loads, your browser requests map images and code from them, which shows them your IP address and the areas of the map you view.
- Your team: if you join a team, its members see your display name, email, online status, and what you add to the team map and chat.
We may also disclose information if the law requires it, or to protect the safety of people or the service. We do not sell or rent personal information.
Where your information is stored
Our providers may store and process information outside Canada, including in the United States. Information held there is subject to that country’s laws, and authorities there may be able to access it. We choose providers that protect information to a standard comparable to Canadian law.
How long we keep it
- Account and map data: until you delete it or ask us to delete your account.
- Live position: only while you’re sharing. It’s deleted when you tap stop, leave the team, or the team is deleted. If the app closes without stopping, your last position stays stored and is shown to your team as old for up to 30 minutes. It’s deleted the next time you open the app.
- Team maps, chat, and photos and files sent in chat: until the team owner deletes the team. When you leave a team, what you added to the team map stays there for the team. You can ask us to remove your chat messages.
- Billing records: as long as tax and accounting laws require, usually up to 7 years.
- Maps saved on your device: until you clear them in the app (Layer → Clear the map) or clear your browser data.
Support access to team maps and chat
To answer questions or investigate abuse, our administrators can open a team’s shared map and chat. When they do, a visible message (“MGRS Cardinal Support joined”) appears in that team’s chat, and anything they write is labelled as MGRS Cardinal Support. Administrators cannot see team members’ live positions. Each time an administrator opens a team, it is recorded in our internal log.
Online status
While you’re signed in and using the app, it tells our server every 90 seconds that you’re online, with your nickname, plan, app version and whether you use the website or the Android app. Our hosting provider (Cloudflare) adds your approximate country, taken from your internet connection, not from your device’s location. This lets us see how many people use the app and where, and helps us support you. Only our administrators can see it, and each person’s record is simply overwritten with the latest check-in. It’s deleted with your account.
Deleting your account
Step-by-step: how to delete your account.
You can delete your account yourself at any time: open the app, tap the person icon at the top right, then Delete my account. You can also email support@mgrscardinal.com from your account’s email address and we will do it for you within 30 days.
Deleting your account cancels any subscription straight away. It deletes your sign-in, your cloud map, your chat messages, and the photos and files you sent. It removes you from your team, and if you own a team, the team and its map and chat are deleted for everyone. Pins and shapes you added to someone else’s team map stay there for that team. We keep billing records that tax law requires, safety reports and bans, and a record of your account ID and the deletion date, so we don’t recreate your plan by mistake. Maps saved only on your device are cleared from the device you delete from.
Your rights
You can ask to see the personal information we hold about you, correct it, get a copy of it, or have it deleted. You can also withdraw your consent, although some features may then stop working. Email support@mgrscardinal.com from your account’s email address, and we will reply within 30 days. You can export your map yourself at any time with Save as KML.
If you’re not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or the privacy regulator in your own province.
Security
We use encrypted connections (HTTPS). Database rules let people read and change only what they are allowed to. Card handling is left to Stripe, and access to our admin tools is limited. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
Children
The app isn’t aimed at children, and accounts are for people 18 and over, or younger users with a parent’s or guardian’s permission. If you believe a child gave us personal information without permission, contact us and we will delete it.
Changes
We may update this policy. The date at the top shows the latest version. For important changes, we will let you know in the app or by email.
Contact
Privacy questions and requests: support@mgrscardinal.com.