Privacy notice

MapIndex is a catalogue of links to user-made maps. It needs very little data about you: there are no accounts, no tracking, no third-party analytics and no advertising. This notice explains what is processed anyway, and why.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of MapIndex, a private person in Germany.

Name: Moritz Eigenauer
Postal address: Bergmannstraße 3, 10961 Berlin, Germany
Email: [email protected]

2. When you visit

Fonts, scripts and images are served from MapIndex itself, except Google’s sign-in and file chooser on the submit page, which load only there (section 5). MapIndex uses no third-party analytics, no advertising and no trackers.

Hosting. MapIndex runs on a server of netcup GmbH in Nuremberg, Germany. Requests reach it through Cloudflare (Cloudflare, Inc., USA), which protects the site against attacks and carries the encrypted connection; for this, Cloudflare processes your IP address and the request. See Cloudflare’s privacy policy.

Server logs. The server’s system log records what the MapIndex software does, such as errors and the work of its background jobs. It is kept until its storage limit of 10 GB is reached, then the oldest entries are deleted. Requests themselves are recorded only in the request log below.

Request log. Every request to MapIndex is logged with your IP address, the time, the page requested, the response status, your browser’s user agent string and the referring page. The approximate location of the address (country, region, city) and the network it belongs to (for example your internet provider or a cloud provider) are looked up in a local copy of MaxMind’s GeoLite2 databases and stored with it; no data is sent to MaxMind. The log is used to analyse where MapIndex is used and to protect it against abuse such as the mass extraction of its catalogue. It is kept as long as its storage limit allows, then the oldest days are deleted, and it is not included in backups.

Rate limits. To protect the site from abuse, requests are counted per IP address (or its IPv6 /64 network), per its network and, for addresses of hosting providers, per provider, for at most a day.

Visitor counting. To understand how MapIndex is used and to notice abuse, the server counts requests itself, after answering them. No cookie, script or third party is involved, and nothing is shown to anyone but the operator. What is counted, per day:

requests and pages viewed per page type, response status classes, and the number of visitors and pages per visitor;
which search filters and articles were opened;
search queries, how often they were searched, by how many visitors, and whether they found nothing;
where visitors came from: only the kind of referring site (direct, search engine, social network, AI assistant, other) and its domain, such as reddit.com, never the full address of the page you came from; and the first page you opened that day;
the kind of client (browser, search engine, AI indexer, AI assistant, script, other bot); for browsers only their name and major version, such as “Firefox 131”, for bots and scripts their user agent string, shortened.

To count a visitor once a day, your IP address (or its IPv6 /64 network) is used. With it, the server keeps today’s number of your requests and page views, the maps and other things you opened (to count each once), the first page you opened, your search queries and the kind of client. These rows last for the current day: within an hour after midnight (UTC) they are folded into daily totals and deleted, and they are not included in backups. The daily totals include visitors per country and city and requests per network.

Search queries are kept as daily counts for 90 days, plus up to 30 days in backups, and are shown to the operator only when at least two different visitors searched the same query on the same day. Please do not type personal data into the search. The other daily totals are counts across all visitors that are not meant to identify anyone; they are kept, and so are their backups.

3. Cookies

MapIndex sets only cookies that are strictly necessary or that follow from your own choice. No analytics or advertising cookies are used.

Name	Purpose	Lifetime
`csrftoken`	Protects forms against forged requests.	1 year
`sessionid`	Holds a random visitor ID. Set only when you first vote or comment.	2 weeks
`theme`	Remembers the light or dark theme. Set only when you switch theme.	1 year
`messages`	Shows a short notice after you send a form.	Browser session

4. Embedded maps

A map page shows the provider’s own interactive map, from Google My Maps or uMap, directly on the page. Your browser connects to the provider when the page loads, and the provider receives data such as your IP address. For this, Google or the operator of the uMap instance is a controller of its own and responsible for its own processing. See Google’s privacy policy. Each uMap instance has its own operator and its own privacy policy. The same applies when you follow a link to a map on a provider’s site.

5. Choosing maps from your Google account

On Submit a map you can choose maps from your Google account instead of pasting links. This works only if you start it yourself.

What MapIndex asks for. You sign in with Google in a Google window, and Google asks you to allow MapIndex the permission “See, edit, create and delete only the specific Google Drive files that you use with this app” (drive.file). Google then shows you its own file chooser (the Google Picker) with your My Maps maps. MapIndex cannot see your files, your other Drive content, your email address or your name; it gets access only to the maps you choose.

What MapIndex receives and uses. When you confirm your choice, your browser sends MapIndex only the identifiers of the maps you chose. MapIndex uses them as it uses a pasted link: it adds the maps it does not know yet to its catalogue, then lists those that are public and show something, like every other map. It does not open, read, change or delete any file in your Google Drive. The submitted maps are not linked to you, your Google account or your visitor ID; the request that sends them is counted and logged like any other request (section 2).

What MapIndex does not keep. The access Google grants stays in your browser for the duration of the page and is never sent to or stored by MapIndex. MapIndex stores no Google account data and shares no Google user data with anyone. You can remove MapIndex’s access at any time in your Google account’s third-party connections.

Google API Services. MapIndex’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, not sold and not used to train AI models. For Google’s own processing during sign-in, see Google’s privacy policy.

6. Votes

You can like or dislike a map without an account. A vote is tied to a random visitor ID kept in your sessionid cookie, which is created only when you first vote or comment. Likes are counted per day. The public sees only the like count. Dislikes are not shown publicly.

7. Comments and AI moderation

You do not need to log in to comment. Before a comment is published, an AI model reviews it against the comment rules. The model is “Jev” by TypeSafe, accessed through the OpenRouter API. For this, the comment text, the name you wrote it under and the title of the map are sent to OpenRouter, which passes them to TypeSafe; MapIndex asks OpenRouter to use only providers that do not collect the data they receive. Jev answers only whether the comment and its name follow the rules, or which rule they break; it writes no text of its own. The operator looks over its decisions afterwards. If a comment breaks a rule, you see which rule. See the OpenRouter privacy policy.

With a comment, MapIndex stores its text, the optional name, your visitor ID, the time, and the result of the moderation (the rule, how confident the model was, and which model decided).

OpenRouter is OpenRouter, Inc., in the USA, so the comment is processed there.

8. Map content

Maps can contain personal data of their makers, for example a name in a title or description. MapIndex lists only maps that anyone can open without logging in. MapIndex takes a map’s title, description and objects from the map itself, as its maker published them. If a map listed on MapIndex contains your personal data and you want it removed, write to [email protected], and the map is hidden.

9. Legal bases

Art. 6(1)(f) GDPR, legitimate interest: operating the site, understanding how it is used and protecting it against abuse. This covers hosting through Cloudflare, server logs, the request log, rate limits, visitor counting, votes and comments with their moderation, and embedded maps from Google My Maps and uMap.
Art. 6(1)(a) GDPR, consent: choosing maps from your Google account, which you start yourself and allow in Google’s window.
§ 25(2) of the Telecommunications Digital Services Data Protection Act (TDDDG): strictly necessary cookies.

10. Retention

Rate-limit counters are kept for at most a day. The request log is kept as long as its storage limit allows and is never backed up. The per-address rows of visitor counting are deleted within an hour after the day (UTC) ends and are never backed up; search query counts are kept 90 days, plus up to 30 days in backups; other daily totals are kept. Cookies expire as listed above. The server’s system log is kept until its 10 GB limit is reached. Votes and comments are kept as long as MapIndex shows the map they belong to, or until you ask for their deletion.

11. Your rights

You have the right to:

access to your data (Art. 15 GDPR)
rectification (Art. 16)
erasure (Art. 17)
restriction of processing (Art. 18)
data portability (Art. 20)
object to processing based on legitimate interest (Art. 21)

You can also complain to a data protection supervisory authority. The authority responsible for MapIndex is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), datenschutz-berlin.de.

To exercise your rights, write to [email protected].

12. Changes

This notice may change as MapIndex grows, for example when comments launch. The version on this page is the one in force.