Privacy Policy

1. Who we are

This Policy explains how INK & CODE LTDA handles personal data. INK & CODE LTDA is a limited liability company (sociedade empresária limitada) registered as a microenterprise (microempresa, ME), based in Curitiba – PR, Brazil.

Company

INK & CODE LTDA

CNPJ (Brazilian company ID)

59.886.586/0001-86

Based in

Curitiba – PR, Brazil

Privacy contact

privacy@inkecode.com

We are the controller of the personal data that we handle, described in this Policy. This means we are the ones who decide how that data is handled. When another company collects data on its own account, such as GitHub, the OpenStreetMap Foundation and Google, that company decides how to handle that data, according to its own policy.

This Policy applies to:

• the website inkecode.com;
• the messages you send us by email;
• the apps we publish on Google Play under the developer name Ink & Code. Today, the only app is Ferramentas Escoteiras, which has not been published yet and will be available on Google Play soon.

When we release another app, it will get its own section in this Policy.

2. Privacy channel

We are a small-scale processing agent. For this reason, the rules of the Agência Nacional de Proteção de Dados (ANPD, Brazil's data protection authority) do not require us to appoint a data protection officer (encarregado) (Resolução CD/ANPD nº 2/2022, art. 11).

Instead, we keep a communication channel: privacy@inkecode.com. Through it you can:

• ask questions about this Policy;
• ask to exercise your rights (see section 12);
• send complaints and communications;
• report violations of the rights of children and adolescents.

The ANPD can also contact us at this email. Using the channel is free of charge.

3. The inkecode.com website

The website is informational. It does not use cookies, visit analytics tools, forms or scripts. The fonts and images come from the website itself. The website does not load anything from other companies while you browse.

Hosting on GitHub Pages

The website is hosted on GitHub Pages, a service of GitHub, Inc., a United States company. When someone visits a GitHub Pages website, GitHub records and keeps the visitor's IP address for security reasons.

This collection is done by GitHub itself, which decides how to handle that data, according to its GitHub General Privacy Statement. We do not send this data to GitHub and we do not keep access logs of the website.

Links to other websites

The website has links to other websites, such as those of GitHub, Google, OpenStreetMap and the ANPD. When you open one of these links, you leave our website and the privacy rules of whoever runs the other website apply.

4. Email messages

You can write to us at support@inkecode.com (general contact, support and projects) or at privacy@inkecode.com (privacy and reports).

What data we receive

• your email address;
• your name, if it appears in the email;
• the text of the message;
• any attachments you send;
• any other information you decide to write.

Send only what is needed for your request. To reply, we need your email address.

What we use it for

We use this data only to reply and to handle your request. This includes conversations about projects, support for the apps, privacy requests and reports. We do not use your email address to send advertising.

Where it is kept

Our email is provided by GoDaddy (Professional Email service). Messages are stored on this provider's servers, which may be outside Brazil. GoDaddy handles the messages on our behalf, to provide the email service.

How long we keep it

We keep messages while the matter is open. After it ends, we keep them for up to 5 years, to meet legal obligations and to defend our rights if necessary. After that period, we delete them.

5. The Ferramentas Escoteiras app

Ferramentas Escoteiras is a field kit for scouts, scout leaders and hikers. It has a compass, Morse code, trail signs, map and trails, timer, whistle, cipher and other tools. The app is for Android and is in Portuguese.

The app has not been published yet. This section describes the app as it is today, before publication on Google Play. If a version changes how data is handled, we will update this section before publishing that version.

The data you create in the app stays on your device, under your control. We do not have access to it. Even so, we explain here everything the app does with it.

Permissions and what they are for

Android may show other technical permissions in the app's list. If the foreground service permission appears, note that the app does not use it: it has no foreground service and does not use location in the background. If the permission to write to storage appears (only up to Android 9), note that the app does not ask for it during use. On Android 5.0 and 5.1, it is granted at installation and the map library may use it to keep the map cache in a shared folder.

When the app uses location

• Only while the compass screen or the map screen is open.
• The app does not use location in the background.
• When the screen leaves the foreground, the app stops using location. This happens, for example, when you switch apps, turn the screen off or open the camera to take a photo of a point. Route recording also stops in these cases.
• The app asks Google Play services for the position. Google Play services is a Google component installed on the device. Depending on the device's location settings, Google Play services may use GPS, Wi-Fi and mobile network signals and send them to Google to work out the position, according to Google's Privacy Policy. The app itself does not send your location to Google or to us.

Data you create and where it stays

Trails

Trail name (by default, “Trilha” (Trail) with the day and time it was created; you can change it), creation date and date of the last change. These dates show when you used the trail.

Points

Latitude, longitude, name and description that you type, creation date, order in the trail and, if you want, a photo.

Recorded routes

Latitude, longitude and time of each position. The app records a position every few seconds, only while recording is on and the map screen is open.

Point photos

They are kept in a folder of the app itself in the device's storage, not in the gallery. The photo is taken by your device's camera app. Some camera apps may also save a copy in the gallery. Ferramentas Escoteiras does not add or remove location data in photos. If your camera app records the location in photos, that information stays inside the photo.

Settings

Scout paces per 10 meters, magnetic declination, the compass step counter (a counter that you operate with the + and − buttons, not a pedometer) and theme.

Map cache

Images of the map areas you have already viewed, kept so they load faster. They show, indirectly, the places you looked at on the map. The map library limits the size of this cache.

Morse and cipher text

It is not stored. It only goes to the clipboard when you tap copy.

Compass sensors and coordinates

The accelerometer, the magnetometer and the rotation sensor are read in real time, for the compass, the level and calibration. The compass coordinates only appear on the screen. None of this is stored.

Trails, points, routes and settings stay in the app's private area on the device. Photos and the map cache stay in app folders. On Android 5.0 and 5.1, the map cache may be in a shared folder called “osmdroid”.

What leaves the device

• OpenStreetMap. To show the map, the app downloads images from the servers of the OpenStreetMap Foundation (OSMF) over a secure connection (HTTPS). With each request, the OSMF receives the device's IP address, the app's technical name with the version number, and the map area requested. This area is usually the region where you are. When you open a saved trail, the map shows the area of that trail's points and route, so the OSMF also receives that area. The same applies to any place you move the map to. The OSMF handles this data according to its Privacy Policy, which states that its network of servers may generate a record of your location.
• Google Play services. The app asks Google Play services for the location. Google Play services is a Google component installed on the device. The app does not send data to Google on its own. Google Play services may process location and network signals, such as Wi-Fi and mobile networks, and technical data about the use of its services. This follows the device's location settings and Google's Privacy Policy. Android may also use Google Play services to get the emoji font that the app displays. The data you create in the app is not part of this.
• Android backup. On Android 6.0 or newer, if backup is turned on on the device, Android may copy the app's data to your Google account. The copy may include trails, points, recorded routes, point photos, settings and, in some cases, the map cache. The backup stays in your Google account and never reaches us. On Android 9 or newer, if the device has a screen lock (PIN, pattern or password), the backup is encrypted with it. Android has a backup limit of 25 MB per app. After you use the map, the map cache may go over this limit; in that case, Android stops backing up the app until the data is below 25 MB again.
• Exporting a trail. When you tap “Exportar trilha” (Export trail), the app copies to the clipboard a text with the trail name and, for each point, the name, coordinates, description, bearing (azimuth), distance and scout paces. The recorded route and the photos are not included in this text. The text only goes where you paste it.
• Copying Morse and cipher text. The text goes to the clipboard only when you tap copy.
• Camera app. To take a photo of a point, the app gives your camera app temporary access to the file of the new photo, so that it can save it. The app does not send the photos to anyone.
• Links in the “Sobre” (About) screen. They open your email app or your browser. The app itself does not send anything.

What the app does not do

• It has no account, sign-up or login.
• It does not show ads.
• It does not use usage analytics or crash reporting tools.
• It does not read the advertising ID or other device identifiers.
• It does not send any data to INK & CODE.
• It has no chat or social features.
• It does not use location in the background.
• It does not sell data.

How to delete the app's data

• One point: delete the point. The app deletes the point and its photo.
• One photo: remove or replace the point's photo. The app deletes the old photo.
• A trail's route: use “Limpar percurso” (Clear route). The app deletes the positions recorded for that trail.
• One trail: touch and hold the trail in the list and choose “Excluir” (Delete). The app deletes the trail, its points and the recorded route. Note: the photos of that trail's points may stay on the device. To delete them, delete the points or the photos before deleting the trail, or clear the app's data.
• Settings: you can change them at any time on the settings screen. The step counter is on the compass screen.
• Everything at once: in Android settings, open Apps, then Ferramentas Escoteiras, then Storage, and tap “Limpar dados” (Clear data) (the names vary a little from device to device). Or uninstall the app. Both options delete everything the app stores, including photos and the map cache.
• Android 5.0 and 5.1: if the map cache is in the shared “osmdroid” folder, it may stay on the device after uninstalling. You can delete it with a file manager.
• Backup: the copies in your Google account follow Google's rules. You can turn off backup and manage backups in the settings of Android and of your Google account. If you reinstall the app, Android may restore the data from this backup.
• Outside the app: text that you exported and pasted somewhere else, and copies that the camera app saved in the gallery, must be deleted where they are.

Risks and precautions

• Whoever gets hold of your device can open the app and see your trails, points and photos. Use the screen lock.
• The exported text has exact coordinates, accurate to about 1 meter. Share it only with people you trust.
• Photos may show faces and, depending on the camera app, contain the location where they were taken.
• On Android 12 or earlier, other apps and the keyboard may read what is on the clipboard.
• On Android 10 or earlier, other apps with storage access permission may be able to read the point photos.
• The OSMF learns which area of the map you are viewing.
• The compass, GPS and map help, but they can fail. See the outdoor safety precautions in the Terms of Use.

6. Purposes and legal bases

The Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Data Protection Law, Law No. 13.709/2018) only allows data to be handled with a legal basis. The table shows each purpose, the data involved and the legal basis.

7. Children and adolescents

Ferramentas Escoteiras can be used by scouts of all ages, including children and adolescents. We handle any data of children and adolescents always in their best interest, as the LGPD (art. 14) and Enunciado CD/ANPD nº 1/2023 (ANPD Statement No. 1/2023) require.

How the app protects its users

• It has no sign-up. Nobody has to give a name, age or email to use the app.
• Nothing a child creates in the app is sent to us.
• It has no ads, does not build behavior profiles and does not measure use.
• It has no chat or contact with other people through the app.
• On Android 6.0 or newer, the location and camera permissions are optional. The other tools work without them.
• Location is only used while the compass or the map is open, never in the background.
• The data stays on the device (and, if Android backup is turned on, in a copy in the device's Google account) and can be deleted at any time.

Choices that change the protection

Some choices make more data leave the device or become visible. Parents, guardians and young people can decide together:

• Give precise or only approximate location, or give no location.
• Leave on the Google options that improve location accuracy, in Android's location settings. They may send Wi-Fi and mobile network signals to Google.
• Use the map, which sends the IP address and the area viewed to OpenStreetMap.
• Let the camera app record the location in photos.
• Keep Android backup turned on, which copies the app's data to the device's Google account.
• Export trails, since the exported text has exact coordinates.

See also the app's risks and precautions.

Guidance for parents and guardians

• Supervise the use of the app, especially in outdoor activities. Follow the safety rules of the scout movement.
• Check the app's permissions in Android settings. You can withdraw them at any time (on Android 6.0 or newer).
• Use the parental controls available on Android and Google Play.
• Learn how to delete the app's data.
• Talk with the child about not sharing trails and photos with strangers.

Parents and guardians can exercise the child's or adolescent's rights through the email privacy@inkecode.com. If we notice that a message was sent by a child, we may ask a parent or guardian to take part in the conversation.

Reporting channel

To report a violation of the rights of children and adolescents related to our website or our apps, write to privacy@inkecode.com. The channel is free of charge (Law No. 15.211/2025, art. 28; Decree No. 12.880/2026, art. 41). We will review each report and reply. When the law requires it, we will notify the competent authorities.

If a child or adolescent is at immediate risk, also contact the authorities, such as the police or the Conselho Tutelar (Guardianship Council, Brazil's local child protection body).

8. Who data is shared with

We do not sell personal data. We do not share data with advertisers.

• GoDaddy: provides our email and stores the messages on our behalf.
• GitHub: hosts the website and records visitors' IP addresses, on its own account, according to its policy.
• OpenStreetMap Foundation: receives map image requests directly from your device, according to its policy.
• Google: Google Play services provides the location to the app and may process location and network signals. Android backup, when turned on, stays in your Google account. Google Play distributes the app. If you post a review of the app on Google Play, we will see your profile name and the text, and we may reply publicly. Google may also show us statistics and technical reports about installs and crashes of the app, according to Google's rules and settings. In all these cases, Google handles data according to its own policy.
• Authorities: we may have to provide data when the law or a court order requires it.

If we correct, anonymize, block or delete data at your request, we will immediately inform those who received that data from us, so that they do the same, unless this is proven impossible or requires disproportionate effort (LGPD, art. 18, § 6).

9. Data outside Brazil

• Email: GoDaddy's servers may be outside Brazil. Storing your messages there may be an international data transfer made by us. We do it on the basis of art. 33, IX, of the LGPD, when it is necessary to perform a contract or preliminary procedures at your request, to comply with a legal obligation or to exercise rights (art. 7, II, V and VI).
• Website: GitHub is in the United States and collects the IP address directly from visitors. This is a collection made by GitHub itself, not a transfer made by us.
• App: the OSMF and Google receive data directly from your device, and their servers may be in several countries. In these cases too, the collection is made by them, not a transfer made by us.

10. How long we keep data

• Email messages: while the matter is open and, after that, for up to 5 years, to meet legal obligations and defend rights. After that, we delete them.
• App data: it stays on your device until you delete it (see how to delete). If Android backup is turned on, the copy in your Google account follows Google's rules. We do not keep a copy.
• Website visits: we do not keep logs. GitHub keeps the IP address for the time set in its policy.
• OpenStreetMap and Google: the retention time is set by each one's policy. The OSMF's policy does not state how long it keeps the records of map requests.

When the purpose ends, we delete the data. We only keep it in the cases the LGPD allows, such as to comply with a legal obligation (arts. 15 and 16).

11. Security

• We collect as little as possible. The website has no forms or scripts, and the app does not send your data to us.
• The website is static and is served over a secure connection (HTTPS).
• The app downloads the map images over HTTPS.
• The app's data stays on your device, in the app's own areas. Its protection also depends on the device: keep the screen lock turned on and Android up to date.
• Our email is provided by GoDaddy, which looks after the security of its servers.

No system is completely secure. If a security incident may cause a relevant risk or harm to people, we will notify the ANPD and the affected people, within the deadlines of the ANPD's rules (LGPD, art. 48).

12. Your rights

The LGPD (art. 18) guarantees you the right to:

1. confirm whether we handle data about you;
2. access your data;
3. correct incomplete, wrong or outdated data;
4. ask for the anonymization, blocking or deletion of unnecessary or excessive data, or data handled in breach of the law;
5. ask for the portability of your data to another provider;
6. ask for the deletion of data handled on the basis of your consent;
7. know who we share your data with;
8. know that you may refuse consent and what happens if you do;
9. withdraw consent.

You may also object to handling carried out without consent, if it does not comply with the LGPD. And you can file a complaint with the Agência Nacional de Proteção de Dados (ANPD) and with consumer protection bodies, such as Procon (Brazil's state consumer protection agencies).

How to make a request

• Write to privacy@inkecode.com. You or your legal representative can make the request.
• The request is free of charge.
• We will only ask for data to confirm your identity when this is necessary to protect you.
• If we cannot respond right away, we will explain why.

Deadlines

We follow the deadlines of the LGPD (art. 19) and of the ANPD's rules for small-scale processing agents (Resolução CD/ANPD nº 2/2022, arts. 14 and 15). To confirm whether we handle your data or to give access to it, we may reply in a simplified form within 15 days, or with a complete statement within 30 days.

Data that stays on your device

The app's data stays on your device and, if Android backup is turned on, in a copy in your Google account. You can view and correct it yourself in the app, and delete it in the app or in Android settings (see how to delete). We do not have access to it, so we cannot show it to you or delete it for you. If you need, we will explain how to do it. For data handled by GitHub, the OSMF or Google, you can also contact those companies directly. We can help point the way.

13. Accounts and data deletion

Our apps do not create accounts. So there is no account to delete. To delete the data of Ferramentas Escoteiras, follow the steps in how to delete the app's data.

To delete messages you sent us, write to privacy@inkecode.com. We will delete what we do not need to keep because of a legal obligation or to defend rights.

14. Changes to this Policy

We may update this Policy. The date of the last update and the version are at the top of the page.

If we change the purpose, the manner or the duration of the handling, who the controller is, or who we share data with, we will publish the new version on this page with a prominent summary of the changes. When the change affects an app, we will also mention it in the release notes of the new version on Google Play. When the handling is based on your consent and you do not agree with the change, you may withdraw your consent.

Version history

• Version 1.0, of November 7, 2026: first version.

15. Law and contact

This Policy follows Brazilian law, in particular:

• Lei Geral de Proteção de Dados Pessoais (LGPD, General Data Protection Law, Law No. 13.709/2018);
• Marco Civil da Internet (Brazil's Internet Civil Framework, Law No. 12.965/2014);
• Estatuto da Criança e do Adolescente (ECA, the Child and Adolescent Statute, Law No. 8.069/1990);
• ECA Digital (the Digital Child and Adolescent Statute, Law No. 15.211/2025) and Decree No. 12.880/2026, which regulates it;
• the rules of the Agência Nacional de Proteção de Dados (ANPD).

Controller

INK & CODE LTDA, CNPJ 59.886.586/0001-86, Curitiba – PR, Brazil

Privacy and reports

privacy@inkecode.com

General contact

support@inkecode.com

Data protection authority

Agência Nacional de Proteção de Dados (ANPD)