Version of 30 October 2026.
This policy explains how eMapa processes personal data. It applies to the portal emapa.me and to the eMapa iOS app (com.teleteh.emapa).
We collect only what the service needs to work, to protect it from abuse and to improve it. We do not sell data.
The data controller is TELETEH DOO, Montenegro. eMapa is an independent project. It is not an official service of a government body.
Send privacy questions and requests through the contact form on the portal or to [email protected]. No data protection officer is appointed; send every question to [email protected].
You can use most of the service without an account. We collect the data below only when you use the related feature.
| Feature | Data |
|---|---|
| Account | E-mail address, name (if you enter it or get it from Google or Apple), password as a one-way hash (never in plain form), dates of registration and last sign-in, plan and number of purchased lookups. |
| Sign-in with Google or Apple | From Google: the verified e-mail address and the name. From Apple: the Apple account identifier, the e-mail address (it can be Apple's private relay address) and the name if Apple sends it. We do not keep an access token for your Google or Apple account. |
| Session | The cookie "emapa_auth" on the web. In the app: an access token (valid 15 minutes) and a refresh token (valid 60 days; our database holds only a hash of it, and the app keeps it in the secure storage of iOS). |
| Daily limits and abuse protection | An anonymous identifier from the cookie "emapa_anon", the counter of daily cadastre lookups, the network address (IP) with sign-ins, registrations and the first lookups of a day, and daily data budgets per account or anonymous identifier. |
| Human check (web) | Cloudflare Turnstile checks your browser. The result is kept in the cookie "ek_human" (1 hour). |
| Device proof (app) | Apple App Attest: the public key of the device, a random device identifier, a counter, the time of first and last use, the network address at registration of the device, the number of failed checks per day and the account last signed in on the device. We do not read the serial number, the device name or the advertising ID. |
| Usage statistics (app) | An anonymous random install identifier (replaced every 90 days), app version, iOS version, device class, language, screen names, modes and a few key actions, session length, JavaScript errors. No account, no location, no advertising ID and no network address. You can switch it off in the profile. |
| Visit statistics (web) | Visit counts in our Umami service (anal.teleteh.com): page, referrer, device and browser type, country. Umami does not use cookies. |
| Location | The app asks for your location only while it is open and only with your permission. The display of your position on the map stays on the device. The app sends the location to our server only for actions that you start: weather and fire danger around you, a report of crowd or price at a beach, adding a water source. |
| Beach reports | Crowd level or price, the beach, the time, the coordinates from which you sent the report (at most 500 m from the beach) and a mark of your account or device. The mark and the coordinates are not shown to other users. |
| Water sources | A source that you add (type, place, and the name and comment that you type), your edits and the marks "suitable / unsuitable". A source is public on the map. The author is recorded in the database but is not shown to others. |
| Favourite parcels | The parcel key, and the label, folder and note that you type. They are stored with your account. |
| Messages | The message from the contact form or from the app, and the name, e-mail address or phone number that you type. From the app we add the app version, the iOS version, the screen, the mode and the key of the parcel you view. For signed-in users we take the name and e-mail address from the account. |
| Payments | Stripe processes the payment. We receive and keep the payment status, the Stripe customer identifier, the plan and the expiry date. We do not see or keep the card number. We send the e-mail address of the account to Stripe at payment. |
| Cadastre lookups | We get data about owners and encumbrances from the public register (eKatastar, Real Estate Administration) at your request. A search by owner name sends the term that you type to the register. We count lookups for the daily limit. We do not show the personal ID number (JMBG) or the address of an owner to users without a special role. |
| Server logs | Network address, time, requested path, response status and the type of browser or app, in the logs of the server and of Cloudflare. We record errors of the app and the browser without an account. |
We apply the Montenegrin Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR).
| Data | Period |
|---|---|
| Account and data stored with it (favourite parcels, counters, plan) | Until you delete the account. |
| Log of sign-ins and registrations with the network address | 180 days. |
| Network address in the daily counters per address | 60 days. |
| Network address with the anonymous daily counter | 60 days. The counter without the address stays. |
| Daily data budgets per account or anonymous identifier | 60 days. Map cells touched: 1 day. |
| Cookie "emapa_auth" (web session) | 90 days. |
| Cookie "emapa_anon" | About 180 days. |
| Cookie "ek_human" | 1 hour. |
| Refresh token in the app | 60 days, and a new one at each renewal. |
| Device proof (identifier, key, counters) | 60 days after last use. A revoked device: 180 days after revocation. A device token is valid 24 hours. |
| App usage statistics | Install identifier: 90 days. The server holds the counters in memory until the next server update. Retention in Umami for the app: 1 year. |
| Web visit statistics (Umami) | 1 year. |
| Beach crowd and price reports | 3 years. We delete the reports of your account at once when you delete the account. |
| Water sources that you added | The source stays on the map because it helps everyone. When you delete the account, we remove the link to you. |
| Messages | We do not keep the text of a message in a database. The message arrives in our Telegram and stays there until we delete it: until we answer, at most 1 year. |
| Server logs (containers) | Rotated by size: 5 files of 10 MB per service. Old lines are overwritten. Access logs of the reverse proxy and of Cloudflare: 1 year. |
| Payment records at Stripe | According to legal periods and Stripe rules. Deleting the account with us does not delete them. |
| Cache of register answers (eKatastar) | Limited time, up to 30 days. |
We share data only with processors and services that a function needs:
We do not sell data. We do not use it for advertising and we do not profile you. The app has no advertising ID and does not ask for tracking permission (ATT). We can give data to a competent authority when a rule requires it.
Cloudflare, Stripe, Google, Apple and Telegram also have servers outside Montenegro and outside the European Economic Area. Data can move there so that these providers can deliver their services. We rely on the safeguards of these providers (for example standard contractual clauses). The eMapa server is located in Montenegro.
Send requests through the contact form or to the e-mail address in section 1. We can ask for proof that the account is yours.
Traffic is encrypted (HTTPS). We store passwords as an Argon2id hash. We store refresh tokens as a hash. The app keeps tokens in the secure storage of iOS. Only authorised administrators have access to the databases. No system is fully secure. If a data breach puts you at risk, we tell you and the competent authority as the rules require.
eMapa is not for children under 16. We do not knowingly collect their data. If you think a child opened an account, tell us and we delete it.
When we change how we process data, we change this page and the date of the version. For important changes we tell users in the app or on the portal.