01.The short version
We collect the bare minimum we need to sell you a map pack and deliver it: your email, your name, your purchases, and the map links you've opened. That's it.
We don't sell your data to anyone. We don't run third-party advertising trackers on this site. We don't have a Facebook pixel.
02.What we collect
- Account info: your name, email, password hash, and (optionally) profile photo and travel preferences.
- Purchase info: which packs you've bought, when, in which currency, and the last 4 digits of the card used (Stripe stores the rest).
- Usage info: which packs you've viewed, opened, or favourited. We use this only to recommend better packs in your feed.
- Server logs: IP address and user agent, kept for 30 days for security and debugging.
03.What we don't collect
- We don't track your location.
- We don't read your Google Maps — we never have access to your map after you save a pack's places to it.
- We don't run third-party advertising trackers. The only analytics we use is Plausible (privacy-friendly, no cookies).
04.Who we share data with
- Stripe — for processing payments. They see your card and email; we never see your card.
- Postmark — for sending transactional email (receipts, password reset). They see your email and the message we sent you.
- Cloudflare — for hosting and CDN. They see standard server logs.
- We don't share data with anyone else. We don't sell mailing lists. We don't trade data with partners.
05.Cookies
We use exactly two: a session cookie that keeps you signed in, and a CSRF token. No third-party cookies. No tracking cookies.
06.Your rights
- You can export everything we hold about you (Account → Profile → Export my data — comes as a JSON + CSV bundle).
- You can delete your account at any time. Account deletion is permanent and unrecoverable after 30 days.
- If you're in the EU/UK: you have the right to request rectification, restriction, and to lodge a complaint with your data protection authority.
- If you're in California: you have the right to know, delete, and opt out of any sale of personal info. (We don't sell, but the right exists.)
07.Data retention
- Account data: kept while your account is active, plus 30 days after deletion (then permanently erased).
- Purchase records: kept for 7 years for tax/legal reasons (anonymized after account deletion).
- Server logs: 30 days, then deleted.
08.Contact our data team
Email privacy@mapshare.co. We respond to GDPR/CCPA requests within 30 days; usually within 3.