Privacy policy
Effective September 24, 2026
This policy explains what information MGRS Cardinal collects, why, where it’s stored, and how you can see, correct or delete it.
Who is responsible
MGRS Cardinal is operated by Vincent Cardinal (Alberta, Canada), who is responsible for the personal information described here and acts as its privacy officer. Contact: support@mgrscardinal.com.
The short version
- We collect only what the app needs to work, and we don’t sell your data or show ads.
- The free map works without an account. If you don’t sign in, your pins stay in your browser.
- Card details are handled by Stripe, and we never see your full card number.
- You can ask to see, correct or delete your data at any time.
What we collect, and why
| Information | Why | Where it’s kept |
|---|---|---|
| Email address, and your name and profile picture if you sign in with Google | To create your account, sign you in and contact you about it | Firebase Authentication (Google) |
| Plan and billing status: plan, renewal date, Stripe customer ID | To turn paid features on or off | Firebase and Stripe |
| Payment details: card, billing address | To take payment | Stripe only, never on our servers |
| Your map content: pins, shapes, lines, text, spreadsheet imports and their columns | To save and sync your map (Pro Plus cloud and team maps) | Firebase (Cloud Firestore) |
| Team information: team name, members, display name, email, online and last-seen status, chat messages | To run shared team maps, the member list and chat | Firebase, visible to your team members |
| Maps saved on your device, and settings (units, map style, grid precision) | So the app remembers your work and preferences without an account | Only in your browser’s local storage |
| Your location | Only when you tap Go to my location, to centre the map | Used in your browser and not sent to our database. Your browser asks your permission first |
| Technical data: IP address, browser type, requests | Needed to deliver the site, map tiles and fonts, and to keep the service secure | Our hosting and service providers (see below) |
We don’t use advertising or analytics trackers. The app uses your browser’s storage to keep you signed in and to save your settings. It does not use tracking cookies.
Please don’t store sensitive information
MGRS Cardinal is not built or approved for classified, protected or operationally sensitive information, or for sensitive personal information about other people. Please keep that kind of information out of your maps, imports and chat.
Who we share it with
We share information only with the services that run the app, and only as much as they need:
- Google Firebase for sign-in and the database.
- Stripe for payments and subscriptions.
- Cloudflare for website hosting and the billing service.
- Map and content providers (such as Esri, OpenStreetMap, OpenTopoMap, EOX and the USGS), Google Fonts, jsDelivr and cdnjs. When the map loads, your browser requests map images and code from them, which shows them your IP address and the areas of the map you view.
- Your team: if you join a team, its members see your display name, email, online status, and what you add to the team map and chat.
We may also disclose information if the law requires it, or to protect the safety of people or the service. We do not sell or rent personal information.
Where your information is stored
Our providers may store and process information outside Canada, including in the United States. Information held there is subject to that country’s laws, and authorities there may be able to access it. We choose providers that protect information to a standard comparable to Canadian law.
How long we keep it
- Account and map data: until you delete it or ask us to delete your account.
- Team maps and chat: until the team owner deletes the team. When you leave a team, what you added to the team map stays there for the team. You can ask us to remove your chat messages.
- Billing records: as long as tax and accounting laws require, usually up to 7 years.
- Maps saved on your device: until you clear them in the app (Layer → Clear the map) or clear your browser data.
Your rights
You can ask to see the personal information we hold about you, correct it, get a copy of it, or have it deleted. You can also withdraw your consent, although some features may then stop working. Email support@mgrscardinal.com from your account’s email address, and we will reply within 30 days. You can export your map yourself at any time with Save as KML.
If you’re not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or the privacy regulator in your own province.
Security
We use encrypted connections (HTTPS). Database rules let people read and change only what they are allowed to. Card handling is left to Stripe, and access to our admin tools is limited. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
Children
The app isn’t aimed at children, and accounts are for people 18 and over, or younger users with a parent’s or guardian’s permission. If you believe a child gave us personal information without permission, contact us and we will delete it.
Changes
We may update this policy. The date at the top shows the latest version. For important changes, we will let you know in the app or by email.
Contact
Privacy questions and requests: support@mgrscardinal.com.