Privacy.

This is a notebook of places, so what it holds is mostly what you wrote in it. Here is all of it, who else can see any of it, and how to take it back.

Last updated 5 August 2026

Who holds it

mapd.me is run by TO BE COMPLETED, at TO BE COMPLETED. In the language of the GDPR that makes us the controller of everything described here. Write to hello@mapd.me about any of it — a person reads that address.

What we hold

Your account

Your email address, so you can sign in and so we can send you a confirmation or a reset link. Nothing else is ever sent to it.
Your password, if you set one, stored as an argon2id hash. We cannot read it, and neither can anybody who takes a copy of the database.
Your name, handle, and — only if you write them — a short bio and a home city.
A Google or Apple identifier, if you chose to sign in that way. If Apple gave us a relay address instead of your own, the relay address is all we have.

What you saved

The places — their names, coordinates, and the area they sit in.
Your notes, your lists, your tags. These are the point of the thing, and they are yours.

What the machinery needs

A session for each browser or device you sign in on, so it stays signed in. We keep a hash of the session token, never the token.
Your IP address, when you register, sign in, or ask for a password reset — kept for 24 hours and used for nothing but counting how often those things are attempted. It is not attached to your account or to anything you saved.
A count of page views, in aggregate. There is no identifier in it, nothing carried between visits, and no way back to a person.

That is the whole list. There is no advertising network here, no tracking pixel, no third-party analytics script, and nothing that follows you to another site.

Why we may hold it

To give you what you signed up for — the account, the atlas, the pages. This is a contract between us, and it is the basis for everything in the two sections above except the last.
To keep the place standing — the rate limits, the abuse reports, the moderation, the aggregate view count. Our legitimate interest in a service that works and is not overrun, which we think sits easily beside your interests because none of it identifies you.
Because the law says so, in the rare case it does.

You will notice consent is not on that list. That is deliberate: a consent box you have to tick to use the thing at all is not consent, and the honest basis for running an account you asked for is the agreement to run it.

What is public

You decide, list by list, and the decision starts at private. A new list is private until you change it, and a private list is visible to nobody but you.

Public — anybody can read it, and search engines are told where to find it. Your name, handle, bio, city and the notes on those places are all part of what they read.
Unlisted — reachable only through a link containing a secret of its own. We do not list it anywhere and we keep it out of the sitemap, but anyone you send the link to can pass it on.
Private — yours.

A public page is public to the whole internet, and search engines keep copies of what they find. Making a list private again removes it from mapd.me at once, but it cannot reach into somebody else’s cache. Think about that before you publish a note about where you live.

Turning off findable in search in your account keeps your profile out of the sitemap and adds a no-index instruction to the pages themselves, immediately. Public lists stay reachable by their own address either way.

Cookies

There is one, it is called mapd_session, and it exists so that signing in keeps you signed in. It is set only when you sign in, it cannot be read by scripts, and it goes when you sign out.

There is nothing else. No analytics cookie, nothing in local storage, no fingerprinting. That is why this site does not greet you with a consent banner: the rules require one for storage that is not strictly necessary, and we have none to ask about. A banner here would be theatre.

Who else sees it

We do not sell anything to anybody. These are the services it takes to run the site, each doing one job under contract to us.

Who	What they do	Where
Vercel	Runs the site and the API, and counts page views in aggregate.	United States, serving from Europe
Neon	Hosts the database — the accounts, lists, places and notes themselves.	United States
Resend	Sends the confirmation and password-reset messages.	United States
ImprovMX	Forwards mail sent to hello@mapd.me.	France
OpenFreeMapdirect	Serves the map tiles. Your browser fetches these itself, so your IP address reaches them whenever a map is drawn.	European Union
MapTiler	Looks up places when you search for one to save. What you typed and roughly where the map was pointing are sent; your account is not.	Switzerland
Googleonly if you choose	Identifies you, only if you choose to sign in with Google.	United States
Appleonly if you choose	Identifies you, only if you choose to sign in with Apple. Apple may give us a relay address rather than your own, and that is all we ever see.	United States

Marked direct means your own browser talks to them, so they see your IP address without it passing through us. That is unavoidable for map tiles — the alternative is a map that does not draw.

Leaving Europe

Some of the services above are based in the United States. Where data reaches them we rely on the EU–US Data Privacy Framework where they are certified under it, and on the European Commission’s standard contractual clauses otherwise. Switzerland, where the place search runs, has an adequacy decision of its own.

How long we keep it

Your account and everything in it — until you delete it. We do not expire accounts for going quiet.
Sessions — 180 days, then you sign in again. Signing out ends one immediately.
Confirmation links — 24 hours. Reset links — 1 hour, and one use.
Rate-limit records — 24 hours.

Deleting your account deletes it. The lists, the places, the notes, the sessions and the sign-in identities go with it, in the same moment and for good — there is no thirty-day grace period from which we could bring it back, because there is no copy left to bring back from. Export first if you want to keep any of it; the export is on your account page and it includes your private lists.

Your rights

The GDPR gives you these, and where we could build the answer into the product rather than make you ask for it, we did.

To see it — your account page exports every place and note you hold, as GeoJSON, at once.
To correct it — the same page edits all of it.
To take it elsewhere — that export is the portable copy, in a format other mapping tools read.
To erase it — also that page, also immediate.
To restrict or object to what we do on the basis of our legitimate interests — write to us and say so.
To complain — to Datu valsts inspekcija (Latvia), or to the supervisory authority where you live. We would rather you told us first, but it is your right and not conditional on that.

One exception worth naming: the address on an account cannot be changed in the product. Too much hangs off it — sharing, resets, sign-in — for a form to move it safely. Write to hello@mapd.me and we will move it by hand.

Age

You need to be 16 to have an account here. We do not knowingly hold anything about anyone younger; tell us if we do and it will be gone the same day.

Changes

If this changes in a way that matters, the date at the top moves and we email the address on your account before it takes effect. Changes that do not matter — a clearer sentence, a processor renaming itself — just appear.