Privacy Policy (English)

Edition 01.07.2026; updated 07.09.2026 (Roskomnadzor change notification). https://mynodemap.com

Русская версия / Russian version

1. Who we are

This Privacy Policy describes how MY NODE MAP™ (including the TOMATO BATTLE™ module) at https://mynodemap.com processes personal data. The controller is Мокробородов А.В. (INN 502913815113).

If you disagree with this Policy, please do not use the Service.

2. Data we may process

• Identity: display name, username, e-mail, optional phone (OAuth/profile); structured full legal name is not required;
• Age check: date of birth stored for registration age-gating and to block Dating/forum/Tomato for ages 13–17; gender mainly browser-local;
• Travel data: countries/cities, map nodes with lat/lng, notes, photos;
• Social: messages, forum, Tomato Battle, dating bio (no religion), friends/blocks;
• Parental consent queue for ages 13–17 (no child password stored server-side);
• Credentials: password only as a server-side hash (bcrypt); licensed cryptographic protection tools (SKZI) are not used; notebook may sync as client-side ciphertext;
• Technical: IP, browser/device, cookies, localStorage, sessions, error logs;
• We do not collect religion, health data, biometric templates, passport IDs, or payment cards.

3. Purposes

• Registration, authentication, and providing the Service;
• Map, social features, Tomato Battle, support;
• Security, abuse prevention, legal compliance;
• Aggregated analytics after cookie consent (Yandex Metrika).

3.1. Friend map visibility

Travel nodes with coordinates are stored for your account. Accepted friends may see your places on the map (travel preview). You control this in Privacy settings via Show me on map and Location precision (exact point, city only, region only, or hidden). If map sharing is off or set to hidden, friends receive no node coordinates. The Operator still stores your full nodes in the cloud; Mapbox only receives technical map-request coordinates without your MY NODE MAP account id.

4. Legal bases

Consent; performance of the user agreement; legitimate interests in securing and improving the Service; legal obligations under applicable law (including Russian Federal Law No. 152-FZ for RF residents).

5. Where data is stored (by residence)

Cloud accounts (live): users with residence country RU / BY / KZ — primary PostgreSQL storage in Russia via Timeweb (117545, Россия, г. Москва, ул. Подольских Курсантов, д. 15Б, стр. 1 (дата-центр Timeweb Cloud, зона MSK-1), api-ru.mynodemap.com). Other users — international API zone on the same Timeweb RF infrastructure (api-intl.mynodemap.com), based on consent and the user agreement. Media (photos, attachments) — Timeweb Cloud Storage S3 (117420, Россия, г. Санкт-Петербург, ул. Цветочная, д. 21, корп. А (Timeweb Cloud Storage S3, регион ru-1)). The browser may keep a local cache for offline drafts.

5.1. Cross-border transfer

The Operator carries out cross-border transfers to the extent necessary for the Service, based on consent and/or the user agreement (RF Federal Law No. 152-FZ arts. 6, 12). A cross-border transfer notification was filed with Roskomnadzor (07.09.2026). Primary storage of RF users’ accounts and core personal data remains in Russia (117545, Россия, г. Москва, ул. Подольских Курсантов, д. 15Б, стр. 1 (дата-центр Timeweb Cloud, зона MSK-1)); the database is not relocated abroad.

Categories that may be transferred abroad: e-mail; other data (display name, IP, User-Agent, cookies/sessions, map request coordinates without MY NODE MAP account id, user message texts to LLM APIs, CDN metadata, embed data from foreign video hosts including YouTube). Destination country: United States (Cloudflare, Mapbox, Google/YouTube, Resend, OpenRouter). Yandex Metrika is processed in Russia and is not part of this transfer.

The Operator does not disclose personal data to an indefinite circle of persons (no “distribution” under RF law).

6. Processors / helpers

• Cloudflare — DNS, CDN, SSL/TLS, DDoS protection, email routing;
• Cloudflare Pages — static front-end hosting;
• Timeweb Cloud — PostgreSQL database and API (api-ru, api-intl) in RF;
• Timeweb Cloud Storage (S3) — media object storage in RF (117420, Россия, г. Санкт-Петербург, ул. Цветочная, д. 21, корп. А (Timeweb Cloud Storage S3, регион ru-1));
• Mapbox Inc. (US) — map tiles/geocoding: request coordinates, IP, and browser metadata; MY NODE MAP user id is not sent. The map cannot work without Mapbox;
• YouTube / Google LLC — city travel video suggestions and embeds via official YouTube Data API Services; we do not download or host videos. Subject to the YouTube Terms of Service and Google Privacy Policy;
• Resend — transactional e-mail for intl zone only (api-intl). RF-zone users do not use Resend;
• Yandex Metrika — analytics only after cookie banner consent;
• UptimeRobot — uptime checks (no profile PII);
• GitHub — source code (no user PII in the repository).

We do not sell personal data. Cross-border transfers to processors occur under consent / contract necessity (RF 152-FZ arts. 6, 12). Passwords are stored as bcrypt hashes; licensed SKZI are not used.

7. Retention & your rights

Account data until you delete the account; sessions until token expiry (purged by API cron); backups up to 30 days; server logs up to 90 days. You may request access, correction, deletion, or withdraw consent via /privacy-request or [email protected]. RF residents may also contact Roskomnadzor. We aim to respond within 30 calendar days.

8. Cookies

Essential/functional cookies and storage (including Cloudflare CDN, Mapbox, fonts) are required for the app. Analytics cookies load only after consent. See /cookies.

8.1. Ad placeholders

Dating and Forum may show demo ad blocks labeled “Ad”. As of this edition these are not third-party ad networks (no personal targeting, no ad-partner data sharing). Placement contact: [email protected], Telegram @bossagroup, Max (mynodemap). External networks will require an updated Policy, cookie banner, and ad labeling rules.

9. Minors

Registration: 18+, or 13–17 only with a legal guardian’s consent checkbox. Under 13 — registration is refused by client and server.

10. Contact

[email protected] · [email protected] · 125364, г. Москва, ул. Народного Ополчения, д. 13, кв./офис 16А

Telegram (@bossagroup, community @mynodemap) — for general questions and project discussion. Personal-data subject requests (access, correction, deletion, withdraw consent) only via [email protected] or /privacy-request.

This English text is provided for global users; the Russian edition remains the primary text for RF regulatory purposes where required.