Skip to content

We only use essential cookies. Learn more

Privacy policy

Version 1.1, updated 2026-11-07

This policy explains what data about you Mapiko processes, why, who sees it, how long it is kept and how to delete it. It describes what the service actually does.

1. Who processes your data

The controller of personal data is the individual Demianov D.M. (hereinafter “we”). Questions about data: the “Contact support” form (topic “Personal data request”) or [email protected].

Mapiko is a map platform: every registered user creates their own map and decides who can add what to it. Maps can also be used without an account.

We process data in accordance with the Law of Ukraine “On Personal Data Protection”: to provide the service under the Terms of use (account, maps, pins, emails); in our legitimate interest, to protect against spam, abuse and violations (fingerprint, hashes, limits, logs, moderation); to comply with legal requirements.

2. What data we process

  • Account

    What data
    Email, password (only an irreversible argon2id hash is stored), name (optional), profile (optional): photo (JPEG up to 400 px without EXIF metadata), “About me” text and the status of its check by filters, the “Hide profile” setting; interface language and theme (light, dark or system), registration date, email confirmation date, time and version of the accepted rules, account status, platform role (platform_role), status of the name check by filters (display_name_status)
    Why
    Sign-in, contacting you, showing the author of your map
    Who sees it
    You. Your name (if set) is visible to everyone as the author of your map, to members of your maps in the member list and to anyone who opens your invite link. Your profile (photo, “About me”, month and year of registration) is visible to everyone on the profile page and next to your name as the author of a map or comment — only if your name is set and has passed the check and the profile is not hidden; if you turn on “Show my maps”, your public catalog maps are visible in the profile (up to three and the number of the rest; off by default); the “Follow” button is shown only to signed-in users and only when maps are shown — nobody can see who exactly follows you, and you see only their number in the profile settings; pins stay without an author, and the profile does not show roles on maps or activity on other people’s maps (the only role mark is “Mapiko team” next to a platform administrator’s name: a public confirmation that the profile is official). Your email is visible to the owner of a map where you are a member and to platform administrators

  • Login sessions

    What data
    Refresh token hash, browser name (User-Agent) and sign-in time; right after a sign-in refresh, an encrypted copy of the new token for 30 seconds, so that another tab of the same browser does not lose the sign-in
    Why
    Keeping you signed in, security
    Who sees it
    Only the service

  • Sign-in with Google, Telegram or Facebook

    What data
    The sign-in service name, your identifier there and the linking date. Google sends your email: we save the address confirmed by Google to an account created with Google, or to an account without an email to which you linked Google, if the address is not taken yet; if the address already belongs to a confirmed account, the sign-in is linked to it (with an email to that address) or asks you to sign in with your password. Facebook sends your email, but we neither use nor store it; Telegram does not send an email. We do not store or show anywhere the sign-in service’s nickname, name, photo or tokens
    Why
    Sign-in without a password, linking and unlinking sign-in methods in the profile, confirming your identity before deleting the account
    Who sees it
    You (in the profile and “My data”)

  • Service emails

    What data
    We send only service emails: email confirmation (only at your request from the profile), a password reset link (at your request), a notice of a sign-in method change, a reply to your request to the administration or a map team (if you gave an email in it; such an email contains only a link to the request), a warning from the administration; administrators also get failure alerts. Confirmation and password reset emails contain only a link with a one-time key. The database stores the key hash, its validity period (24 hours for confirmation, 1 hour for password reset) and the time of use. Before sending, an email waits in a queue on the server (the messenger_messages table): it holds the recipient address and the email text with the link, where the key is written in plain text (the hash is only in the keys table); an address entered in the “Forgot password?” form also enters the queue, even if no such account exists
    Why
    Email confirmation, access recovery, notices of replies to requests
    Who sees it
    Only the service and the mail server that delivers the email (see “Third parties”)

  • Email log

    What data
    Time, kind of email (email confirmation, password reset, sign-in method change, reply to a request, warning, administrator alert), status (queued, sent, delivered, not sent due to a limit or the stop list, error, bounced, marked as spam), a hidden address (the first two characters and the domain, e.g. d6***@gmail.com), an irreversible hash of the address (HMAC), the email’s identifier at the email service, a link to the account. The log has no email text or links. Addresses from which an email bounced or whose recipient marked it as spam go to the stop list (only the address hash and the reason): no more emails are sent to them until an administrator removes the address
    Why
    Email limits (no more than a few a day per address, a pause between identical emails), protection against sending emails to someone else’s address and against spam, investigating delivery problems
    Who sees it
    You (in “My data” — emails linked to your account) and platform administrators

  • Anonymous identity (whether you are without an account or with one)

    What data
    A random identifier in a cookie (signed by the server), a browser fingerprint hash, a hash of the IP address from which the anonymous session was created (for IPv6, also a hash of its /64 subnet), a trust score (a number), the dates of creation and last renewal of the anonymous session, status; a link to an account if you signed in from this browser
    Why
    Protection against spam and abuse, action limits
    Who sees it
    Platform administrators see the identifier, trust, status, session creation and last renewal dates and the number of active pins; hashes are not shown in the interface

  • Comments and reactions

    What data
    Comment text, chosen emoji, time, filter marks (flags) and the comment moderation reason (moderation_reason); in the database they are linked to the author (account or anonymous identity); the comment author's nickname is visible to everyone. Pin edit suggestions: new text and fields, explanation, “closed”, filter marks, status, time and who decided; in the database they are linked to the suggestion author and are visible only to the map team and the pin author (the suggestion author is shown like a comment author)
    Why
    Discussing pins
    Who sees it
    Depends on map visibility. A comment caught by the filters is visible to its author and moderators until it is approved

  • Pins on maps

    What data
    Text and values of additional fields, if the map author added them to the pin type (the text and fields are checked by the personal data and banned words filter); an optional contact phone (only in the “Lost and found pets” template): stored apart from the other fields, kept out of the feed, pages and map export, shown to everyone behind the “Show number” button (rate-limited) and erased when the pin becomes “resolved”, expires or is removed; place on the map, type, time of creation, of last edit by the author (the author can change the text and fields until anyone else has interacted with the pin (vote, comment, reaction, report); the previous text is not kept) and of expiry, “Confirm / Dispute” votes (with the voter's subnet hash, 30 days), service filter and trust marks (flags), status, moderation reason (moderation_reason), the moderator's explanation to the point author (author_reason), time and performer of moderation. For types with a progress status — the status (“open / in progress / resolved”) and its change history: who changed it (“map team” or “pin author”, no name), when, comment; visible to everyone who can see the pin. For types where a task can be taken — who took the task (“I'll do it”, accounts only), when, and whether a reminder was sent; who exactly took it (nickname, if it passed review) is visible only to the pin author and the map team, everyone else sees “Taken by a volunteer”; the link is removed when the volunteer drops the task, is removed from it, or deletes the account. In the database a pin is linked to its author
    Why
    The core function of the service
    Who sees it
    Depends on map visibility. The pin author is not shown on the map; who voted for what is not public

  • Pin photos

    What data
    A JPEG image up to 1600 px and a thumbnail up to 400 px without metadata (EXIF), dimensions, review status, upload time; a photo is linked to a pin and, through it, to the pin author
    Why
    Illustrating a pin
    Who sees it
    Under review: the pin author and map moderators; published: everyone who sees the pin; platform administrators

  • Your maps and membership

    What data
    Title, description, settings and visibility of maps, pin types (names and field labels); members, follows (with the “Mute map” mark). Site notifications: settings, up to three “My places” for nearby notifications (coordinates rounded to about 100 m — the exact address is not stored), the “Follow / Unfollow” choice on pins, the authors you follow (their public profile key and time), and the notifications themselves (event type, map, pin or comment, read or not, time); notifications contain no email or id of other people, a comment author is shown the same way as in the discussion. Notifications are kept for 90 days from the last event, settings and places until the account is deleted; all of it is in the “My data” file; invite links (key hash, role, validity period, use limit and counter, who created it); who invited a member; an offer to transfer a map to another member (valid for 7 days, the record is deleted about a day after expiry)
    Why
    The core function of the service
    Who sees it
    Depends on map visibility; the member list is visible to members

  • Telegram notifications

    What data
    Telegram notifications (optional): if you connected the @mapiko_login_bot bot in your profile, we store your Telegram chat identifier (chat_id) to send your notifications there; their text is passed to Telegram. The identifier is deleted as soon as you turn the notifications off in the profile or with the /stop command, block the bot or delete the account.
    Why
    Duplicating your notifications in Telegram, only at your choice
    Who sees it
    You (in “My data”); the notification text — Telegram (see “Third parties”)

  • History of opened maps

    What data
    Which maps you opened while signed in, and when (up to the last 20)
    Why
    The “Recently opened” list in search on any of your devices
    Who sees it
    Only you

  • Map views

    What data
    How many times each map was opened per day — only a number, without who opened it. To avoid counting the same view twice, the server keeps an “already counted” mark in memory for up to a day: a hash of the map, your account or anonymous identity and the date, and a counter of views from one network — a hash of the map, the IP address (for IPv6 — the /64 subnet) and the date; for a browser without an anonymous identity, an “already counted” mark for its subnet: a hash (HMAC with a secret salt) of the map, the subnet (IPv4 /24, IPv6 /64) and the date. The database keeps only the daily number of views
    Why
    The order of “Popular maps” in search
    Who sees it
    Only the service; publicly, only the order of maps is visible

  • Reports

    What data
    Reason, comment (phone numbers, licence plates and full names are automatically cut from it), who reported (account or anonymous identity) and their subnet hash (30 days), status, time and performer of the review
    Why
    Moderation
    Who sees it
    Platform administrators. The reporter is not shown to the author of the content

  • Requests to the administration

    What data
    Topic, the text of your messages and the administration's replies, the object of the request (pin, comment, photo, map or block), who wrote (account or anonymous identity), email for a reply (optional, stored only in this request), language, status and time. Phone numbers, names and other personal data in the text are not cut out: they may be needed for your request (for example, for data deletion)
    Why
    Answering your question, appealing a moderation decision or a block, a request about your data. The administration may rewrite frequent questions without personal details in the “FAQ”
    Who sees it
    You (in the account or browser you wrote from) and platform administrators. The map team does not see requests

  • Requests to a map team

    What data
    Topic, the text of your messages and the map team's replies, the map you wrote to, who wrote (account or anonymous identity), email for a reply (optional, stored only in this request), language, status and time
    Why
    A question, suggestion or appeal to the owner and moderators of a specific map. The team can block the author on its map or pass the request to the platform administration
    Who sees it
    You, the owner and moderators of this map — text only: your email, name and account are not shown to the team, and you are not shown who on the team replied. Platform administrators — if the team passed the request to them

  • Report archive

    What data
    Open reports on a deleted pin, comment, photo, map or account: target kind and identifier, reason, reporter's comment, date. Without the reporter's identifier
    Why
    So that a violator cannot hide traces by deleting
    Who sees it
    Platform administrators

  • Service records after deletion

    What data
    For deleted blocked users: an irreversible email hash (HMAC) and the same hashes of linked sign-in methods (the service and your identifier there), date and reason of the block. For an erased anonymous identity: only the random identifier of its token
    Why
    To prevent evading a block by registering again; an old token does not revive an erased identity
    Who sees it
    Only the service

  • Map blocks

    What data
    Map, who is blocked (account or anonymous identity), period (1 day, 7 days or forever), reason, whether records are hidden, who blocked and who lifted the block, time; for an anonymous identity, the hash of its browser fingerprint while the block is in force
    Why
    The map team restricts a violator's participation on its map; the author's violation counters
    Who sees it
    The team of this map (without email and the anonymous identity's identifier), platform administrators

  • Restrictions and warnings

    What data
    The end date of “read-only” mode for an account or anonymous identity and, while the restriction is in force, the fingerprint and network hashes (IP address, for IPv6 the /64 subnet) of its browsers; a warning is a request from the administration with the reason in “My requests” and an email to the confirmed email address
    Why
    Graded responses of the administration before a block
    Who sees it
    You and platform administrators

  • Moderation log

    What data
    Which action, on what, for what reason and when a moderator or administrator performed
    Why
    Moderation accountability, protection against abuse
    Who sees it
    Platform administrators

  • Technical logs

    What data
    IP address, time, method and address of the request without parameters (an invite token in the address is hidden), response code, size and time in the web server access logs, without the browser name (User-Agent) and the page the request came from (Referer); temporary limit counters in server memory (up to a day); a “someone has signed in to the account from this network” mark — a hash of the email and the network (IP address, for IPv6 — the /64 subnet), 30 days; web server and application error logs may contain, on a failure, the IP address, the request address with parameters (for example, a map area) and the address of the page the request came from (Referer), but not tokens — except for the rare emergency termination of a hung invite request; a counter of visits by a link tag (?ref=) from the landing page and map pages: only a count per day, without IP address, browser name, cookies or data about you (stored for 400 days)
    Why
    Security, diagnostics, brute-force protection
    Who sees it
    Platform administrators

3. What we do not do

  • We do not sell your data or share it for advertising. There are no ads or ad trackers in the service. We do not send newsletters or promotional emails.
  • We count anonymous visit statistics without cookies through our delivery and protection network (see “Third parties”): page, the site you came from, country, browser, system, device type, page load speed; no cookies, no identifier, no interest profile. We do not use third-party analytics services such as Google Analytics.
  • We do not track your location. The “My location” button on the map requests the device's geolocation only after you press it and with your permission in the browser: the coordinates are used only in your browser to show you on the map; they are not sent to the server and not stored. But the map moves to you, and the browser, as for any area, loads this area's pins from our server and the base map from OpenFreeMap: the bounds of the visible area around you are received by our server (it does not write them to logs) and by OpenFreeMap. The location button on the demo page works the same way. Sorting the pin list by “Near me” also requests geolocation only with your permission, and the distance is calculated only by the browser. Map search shows “In this part of the map”: for this, the bounds of the visible part of the map, rounded to about 10 km, are sent to the server. After you press “Near me” and give your permission, the map moves to you, so these bounds effectively describe your area. The server does not store them, does not write them to logs and does not link them to you. Only a pin you placed manually has coordinates.
  • We do not show who the author of a pin is and do not store the history of your routes.
  • We do not keep metadata of pin and profile photos: the file is re-encoded, and EXIF (including shooting coordinates and phone model) is not kept.

4. Browser fingerprint

To tell real people from spam bots, your browser calculates a fingerprint: a number derived from browser and device characteristics (using the open-source FingerprintJS library, which runs on your device). We consider the fingerprint personal data.

The fingerprint is calculated and sent to the server only before an action that writes data (a pin, vote, reaction, comment, report or request), or when you press the button of such an action or move into its field; a browser without an account gets an anonymous session (the anon_token cookie) at the same moment if it does not have one yet. Before an anonymous session is created, the browser passes a check by a bot protection service (see “Third parties”): it sees the IP address and technical features of the browser; we keep only the result. Viewing maps and pages does not calculate the fingerprint or create an anonymous session. We do not store the raw fingerprint or write it to logs: the server immediately turns it into a hash (HMAC-SHA256 with a secret salt stored in the server settings, not in the database) and stores only this hash. The IP address hash and, for IPv6, its /64 subnet hash are stored the same way: with them an admin may temporarily close access from the address of a rule breaker and, for IPv6, from their /64 subnet (for a breaker with an account, by the hashes of their latest browser sessions; vote subnets are not used for this). When a session is obtained again, the new hashes replace the previous ones: only the latest fingerprint, IP and subnet hashes are kept. A hash does not allow reading the fingerprint or the address, but someone who knows the salt can check whether a hash matches a given value, so we consider hashes personal data.

Why: pin limits are counted by anonymous identity or account, fingerprint hash and IP hash together; votes, reactions and reports are limited by anonymous identity or account, fingerprint hash and subnet hash (IPv4 /24, IPv6 /64); to remove a pin by votes or flag it by reports, only votes and reports from different devices and networks count. A hash match means “looks like the same person”, not “this is definitely them”. The fingerprint is not a key to your identity and is not used for advertising or for tracking you on other sites; we make no automated decisions based on the fingerprint alone.

An anonymous identity is a random identifier in the anon_token cookie, signed by the server (HMAC-SHA256 with a secret key) so that it cannot be forged; the cookie contains no other data about you. The IP address and subnet hashes are erased 30 days after the anonymous session is created or renewed. During an attack or abuse an admin may temporarily (up to 30 days) close access from an address, a subnet (IPv4 /24, IPv6 /64) or a browser: only the hash (the same HMAC), the reason and the term are stored, never the address itself; the record is deleted 30 days after the block ends. The fingerprint hash is kept as long as the anonymous identity record exists; you can erase it in the “Your rights and data management” section. If a map team has blocked an anonymous identity on its map, its fingerprint hash is also kept in the block while the block is in force (even after the identity is erased): the block also applies to new anonymous sessions with the same fingerprint on that map. Likewise, while a “read-only” restriction by the administration is in force, it also applies to new anonymous sessions with the same fingerprint on the same network (the same IP address, for IPv6 the /64 subnet), even after the account is deleted or the identity is erased. The fingerprint hash of a blocked anonymous identity is not erased with the button, only together with the linked account.

5. Cookies and local storage

We use only technical cookies without which the service does not work. There are no advertising or analytics cookies. In the browser's local storage (localStorage) we store only the cookie_notice_ack mark that you closed the cookie notice, map_style — the chosen map look (Safety, Dark, Positron or Liberty), map_panel — whether the map card is expanded and which tab is selected in it, point_sort — the order of the pin list on maps where you changed it (map number and chosen order), route_stops — the route stops you added (pin, coordinates and pin title), and recent_maps — up to 5 maps you opened without signing in (map address and title), for the “Recently opened” list. cookie_notice_ack, map_style, map_panel, point_sort and route_stops are not sent to the server; map addresses from recent_maps are sent to the server before the list is shown only for checking (unavailable maps are removed, titles are updated; the server does not store them), and after you sign in, recent_maps is moved once to your account's history of opened maps and erased from the browser. While you sign in with Google, Telegram or Facebook, the tab storage (sessionStorage) holds social_return — the language and the page to return to after sign-in; it is erased as soon as sign-in is complete and is not sent to the server. The browser remembers no other settings.

  • access_token

    Purpose
    Account sign-in (access token valid for 15 minutes, renewed automatically). Not accessible to scripts (HttpOnly)
    Period
    Up to 30 days

  • refresh_token

    Purpose
    Renewing sign-in without entering the password. HttpOnly, sent only to the sign-in section
    Period
    30 days

  • csrf_token

    Purpose
    Protection against forged requests. It is read by the page to sign requests
    Period
    30 days when signed in, 1 year without

  • anon_token

    Purpose
    Anonymous identity: a random identifier signed by the server (HMAC). HttpOnly
    Period
    1 year

  • social_flow

    Purpose
    An unfinished sign-in with Google, Telegram or Facebook: checks that the sign-in service’s answer came back to the same browser. Signed by the server, HttpOnly, sent only to the sign-in section
    Period
    10 minutes

  • social_signup

    Purpose
    A first sign-in with a sign-in service before you agree to the rules: the service name, your identifier there and the email, if the service sent it. Before you agree, no account is created and nothing is stored. Signed by the server, HttpOnly, sent only to the sign-in section
    Period
    10 minutes

  • social_reauth

    Purpose
    Confirming your identity with a sign-in service before deleting the account or linking a sign-in method, if you have no password. Signed by the server, HttpOnly, works once
    Period
    5 minutes

  • i18n_locale

    Purpose
    Interface language (Ukrainian, Russian or English)
    Period
    1 year

  • theme

    Purpose
    Chosen interface theme (light or dark); no cookie for “system”. Functional, read by the page before it is shown so it does not flicker
    Period
    1 year

  • last_map

    Purpose
    Address (slug) of the last opened map: to take you back to it from the studio and admin. Functional; it is read by the page
    Period
    1 year

All cookies have the SameSite=Lax attribute. In the production version of the service, access_token, refresh_token, csrf_token, anon_token, social_flow, social_signup, social_reauth, i18n_locale, last_map and theme have the Secure attribute (sent only over HTTPS).

6. Who sees your data

  • All visitors: the content of public maps (pins without authors), the map title and description, and the map author's name if you set it.
  • Map members: the member list and their roles. The map owner also sees members' emails.
  • The map team in the Map studio: the owner and moderators of a map see the pins, comments and photos of their maps (without authors), as well as the number and reasons of reports on them (without who reported and without the report text), and can escalate a report to the platform (who escalated it is recorded in the moderation log); the owner also sees members with emails and the action log of their maps, where actions of platform administrators are marked “Platform admins” without a name; an editor sees pin types and settings. The studio does not show fingerprint and IP hashes, the trust score or filter words. Next to a record, the team sees counters for its author on its own map only: how many reports on their records there were and how many of them were upheld, how many records moderators removed, how many times they were blocked on this map — without name, account or data from other maps; Automation flags — only as a reason (“looks like a TCC”, “phone number”), without words or rules. In the “Blocked” section, the team sees those blocked on its map: the checked account name (for an anonymous identity — without the identifier), period, reason and the record they were blocked for.
  • Platform administrators: reports, the moderation log, account statuses. They can hide a pin, block a map or a user regardless of the map author's settings, and for moderation and support they see and change any map, including a private one, with its pins, members (with emails) and settings; their changes to other people's maps are recorded in the moderation log. Administrators see a person's counters across the whole platform: as an author (reports on records, upheld reports, records removed by moderators, blocks on maps) and as a reporter (how many reports were filed and how many were upheld); the counters are calculated from existing data and are not stored separately. If an author has more violations than the threshold set by the administration, their new records get the “repeat offender” mark — this is not a block; a person makes the decision. Platform moderators (people or an AI-based assistant), on the administration’s instructions, view and moderate platform records: moderation queues, reports, pins, comments and photos with their text, the author’s counters as an author and the moderation log — without emails, IP addresses, reporter counters or support requests. They can approve, reject or hide a record, handle a report, warn the author or restrict them to “read only” for 1 or 7 days; every action is recorded in the log with a reason. Platform moderators cannot block accounts or maps, see support requests, or change rules and settings.
  • Private and “link only” maps are visible only to those who have access or the link, and to platform administrators.
  • Anyone who sees a map can download its pins as a file (GeoJSON, KML, CSV): text, additional fields, type, place, time and votes, without authors.
  • Public and “link only” maps can be embedded on other sites (widget): then visitors of those sites see the map with its pins.
  • The title, description and number of pins of a public map from the catalog appear in social media previews and in the sitemap for search engines.
  • Anonymity is not absolute. The pin author is not shown publicly, but the service keeps the link between a record and an account or anonymous identity, the anonymous identifier and fingerprint hash, the IP address and subnet hashes (30 days) and IP addresses in the web server access logs (up to 14 days) and error logs. At the lawful request of an authorised body (for example, a court or the police), we may hand over this data.

7. Third parties

The browser loads the base map (tiles, fonts and styles) from tiles.openfreemap.org (OpenFreeMap). Like any website, this service sees your IP address, browser name and which area of the map you are viewing. Map data © OpenStreetMap contributors (ODbL licence). Your pins are not passed to OpenStreetMap; to determine a pin’s address, its coordinates (without text, author or your IP address) are sent to OpenStreetMap Nominatim. The platform’s reference maps contain data from open sources (OpenStreetMap — ODbL, open data — CC BY), including contacts of organisations and sole proprietors (name, phone, website, email, opening hours) as given in the source; we show them as reference information in the legitimate interest of users. To remove your data, report the pin with the reason “personal data”; the report is handled by the platform administration.

Real-time map updates come from the service's own server (Mercure): when you open a map, the browser sends it your IP address and a short-lived token with the map number. This is our service, not a third party.

Processors that work with data on our behalf: a hosting provider (server, database, backups), an email service (delivering emails; sees the address and the email text with the link and tells us whether an email was delivered, bounced or marked as spam by the recipient), an artificial intelligence service that runs the platform moderation assistant (it receives only what a platform moderator sees, and only when the administration has asked it to moderate), an error tracking service (server and browser crash reports: error text, place in the code, request method and address without parameters; the reports contain no account data, cookies or headers, and emails, IP addresses and tokens are cut from the error text; a browser crash report is sent by the browser itself, so, like any website, the service sees the connection's IP address) and a delivery and attack protection network (all traffic between the browser and the server passes through it, so it sees the IP address, requests and responses; it is used to deliver pages, protect against attacks and count anonymous visit statistics; it is also the bot protection service that checks the browser before an anonymous session is created). We will name the providers on request. The pages connect no other external services (other analytics, advertising, social networks, fonts from other servers). You choose the sign-in services Google, Meta (Facebook) and Telegram yourself: their scripts are not on our pages, and the browser goes to the service’s site only after you press the sign-in button. The sign-in service processes your data under its own privacy policy, including outside Ukraine, and sends us only your identifier and email (see “What data we process”); we do not send it our data about you. Telegram also receives the text of the notifications you turned on in the profile (see “What data we process”); it processes them under its own privacy policy.

We do not pass data to other persons, except in the cases described in this policy and lawful requests of authorised bodies.

8. How long we keep data

  • Account, your maps, votes, follows

    Period
    Until the account is deleted (see below)

  • Sign-in method link (Google, Telegram, Facebook)

    Period
    Until unlinked in the profile or the account is deleted; setting or changing the password via the emailed link removes all links

  • Telegram chat_id

    Period
    While Telegram notifications are on; deleted as soon as you turn them off in the profile or with the /stop command, block the bot or delete the account

  • History of opened maps

    Period
    90 days from the last opening of a map (daily cleanup) and no more than 20 maps; cleared with the “Clear history” button in the profile, deleted together with the account

  • Map views

    Period
    Daily counters — 90 days (daily cleanup); the “already counted” mark — up to a day

  • Login refresh tokens

    Period
    30 days from the last sign-in refresh (the token is reissued at every refresh); after sign-out, the browser name is erased within a day, and the record itself without it is kept until the end of the period to detect token reuse. Once the 30-day period ends, the record is deleted after one day (daily cleanup)

  • Keys from emails

    Period
    Valid for 24 hours (confirmation) or 1 hour (password reset), deleted within a day after expiry

  • Email queue

    Period
    A message with the address and link is deleted from the queue immediately after sending. An email that could not be sent after several attempts stays in the failed queue (address and link with the key) with no automatic period until an administrator clears it manually; the key in the link still expires on its own schedule (24 hours or 1 hour)

  • Email log

    Period
    30 days, then deleted automatically; immediately when the account is deleted. The address stop list — until an administrator removes the address

  • IP address and subnet hash of an anonymous identity

    Period
    30 days after the anonymous session is created or renewed, then erased (for a blocked identity too); the subnet hash in a vote or report — 30 days after the vote or report

  • Fingerprint hash and anonymous identifier

    Period
    As long as the anonymous identity record exists or until you erase it. An unblocked anonymous identity without pins, votes, comments, reactions, reports, requests and bans is deleted 30 days after the last visit. For a blocked identity — until the linked account is deleted; without an account — with no time limit, for manual check by an administrator in the database; new sessions are currently not checked against this hash automatically

  • Comments

    Period
    The text is kept until the pin, the map or the author's account is deleted. If a comment was deleted by its author (within 10 minutes) or by a moderator, it is not shown but stays in the database with status “deleted”. Edit suggestions are kept until the pin, the map or the suggestion author's account (anonymous identity) is deleted

  • Pins

    Period
    Shown on the map for a limited time (hours or days depending on the type), then disappear from the map. They remain in the database until the map or the author's account is deleted

  • Pin photos

    Period
    Up to 3 photos per own pin — when creating it or later, until anyone else has interacted with the pin; re-encoded to JPEG up to 1600 px without metadata, together with a thumbnail up to 400 px. Depending on the map setting, a photo is published immediately, without prior review (the default), or only after approval by a map moderator; the map owner can also turn photos off. Photos must not show people or licence plates. On a map with review, the map owner's or a moderator's own photo is approved by another map moderator, and on a blocked map photos are approved only by the platform administration. A rejected or hidden photo is deleted immediately together with its thumbnail; photos of a deleted pin — during the nightly cleanup, within a day. A photo of a pin that has expired from the map is kept until the pin is deleted (see “Pins”). A published photo can be reported; “personal data” reports are handled by the platform administration. A profile photo is deleted immediately when you replace or remove it, when the administration removes it or when the account is deleted; a profile can be reported — such reports are handled by the platform administration

  • Reports

    Period
    Deleted together with the pin, photo or map. Open reports on deleted content go to the report archive; reports from your account remain without your name after the account is deleted

  • Requests to the administration

    Period
    Closed — 1 year after closing (daily cleanup), open — until closed. Also deleted together with the account or anonymous identity

  • Requests to a map team

    Period
    Closed — 1 year after closing (daily cleanup), open — until closed. Also deleted together with the map, account or anonymous identity

  • Map blocks

    Period
    Lifted and expired blocks are kept for violation counters while the map and the account or anonymous identity exist; deleted together with them. The fingerprint hash in a block is erased immediately when the block is lifted or replaced, and within a day after it expires; an active block of an erased anonymous identity stays without a link to it, only with the fingerprint hash, until it ends or is lifted

  • “Read-only” restriction

    Period
    Lasts until the end of the period (1, 7 or 30 days) and is lifted automatically; the end date stays in the account or anonymous identity until the next restriction or their deletion. The fingerprint and network hashes of the restricted person’s browsers are erased immediately when the restriction is lifted or replaced, and within a day after it expires; deleting the account or erasing the identity does not erase them before that

  • Report archive and service records after deletion

    Period
    Up to 1 years from the record

  • Moderation log

    Period
    Up to 1 years from the record. The reason field written by a moderator may contain free text

  • Web server logs

    Period
    Access logs — up to 14 days, then deleted automatically. Web server and application error logs — up to 7 days (and within a size limit), then deleted automatically

  • Backups

    Period
    Up to 30 days; older copies are deleted automatically. Deleted data disappears from the copies as they rotate

9. Your rights and data management

You have the rights provided by Article 8 of the Law of Ukraine “On Personal Data Protection”: to know what data about you is processed and to obtain it, to demand correction or deletion, to object to processing, and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court. Requests: via the “Contact support” form or to [email protected]; we reply within the period set by law.

You can do many things yourself: your name, profile photo, “About me” and “Hide profile” are changed in the profile; your account, maps and data are deleted in the profile (the “Delete account” section); an archived map can be deleted permanently on the “My maps → Archive” page; the history of opened maps is cleared with the “Clear history” button in the profile; the “Download my data” button in the profile downloads all your data as one JSON file (the data of this browser's anonymous identity — with the button below; if the account is blocked — with the same button on the sign-in page after entering your email and password).

We currently have no anonymous data linked to this browser.

10. How to delete your data

You delete your account and all data linked to it yourself: sign in and open Profile → the “Privacy and data” tab → “Delete account” → “Delete account…”. What disappears and what remains is described in “What happens after deletion”.

If you sign in without a password — with Google, Telegram or Facebook — confirm the deletion by signing in again with the same service: the button is in the “Delete account” section, the confirmation is valid for 5 minutes.

Unlinking a sign-in method (profile → “Sign-in methods” → “Unlink”) and deleting the account erase the link in Mapiko, but do not withdraw the permission you gave in the sign-in service itself: you withdraw it in your Google, Facebook or Telegram account settings.

If you cannot sign in or delete the account yourself, write to [email protected] or use the “Contact support” form (topic “Personal data request”): we will delete the account as soon as we make sure it is yours. Data without an account is erased with the button in “Your rights and data management”.

11. What happens after deletion

Deletion is irreversible. When an account is deleted:

  • your email, password, sessions, keys from emails, your maps with everything in them, your votes, follows, map memberships, history of opened maps, notifications, their settings and “My places” disappear; your reports on other people's content remain, but without your name;
  • anonymous identities linked to the account (including blocked ones) are erased, as is the identity of the browser from which you delete the account if it belongs to no one: fingerprint, IP and subnet hashes, votes, pins and comments (at your choice);
  • open reports on pins, comments, photos and maps you deleted, as well as on the account itself, go to the report archive (without the reporter's data), so that deletion does not erase traces of violations;
  • if the account is blocked, only the operator can delete it upon request; in that case an irreversible email hash is kept so that the blocked person cannot return by registering again;
  • the account cannot be deleted while you own a map blocked by the platform or have the administrator role: contact support;
  • you choose yourself what happens to your pins and comments on other people's maps: delete them or keep them without a link to you;
  • in the moderation log, actions you performed as a moderator or map owner (transfer, import and copying of a map) remain, but their author becomes the service record “deleted user”; records of actions on your data remain under an identifier by which you can no longer be recognised;
  • backups are cleared according to the period stated above.

An anonymous identity is erased with the button in the “Your rights and data management” section: fingerprint, IP and subnet hashes and votes disappear; reports you filed remain, but without a link to you; pins and comments can be deleted or kept without an author. A blocked anonymous identity cannot be erased with the button (one linked to an account is erased by deleting the account): its fingerprint hash is kept for manual check by an administrator in the database (new sessions are currently not checked against it automatically). If you have lost your browser cookies, we cannot determine which data is yours and therefore cannot delete it.

12. Security

  • The password is stored only as an irreversible hash (argon2id).
  • Sign-in cookies are not accessible to scripts (HttpOnly), requests that change data are protected against forgery (CSRF), and password guessing attempts and abuse are restricted by limits.
  • Administrators' access to data is limited by roles; their moderation actions are recorded in the log.
  • No service guarantees complete data security; we take the measures described and, to the extent permitted by law, are not liable for access obtained through the actions of third parties in breach of these measures.

13. Children

The service is not intended for persons under 16. If you know that a child under 16 has left data, write to us and we will delete it.

14. Changes to the policy

If we change what data we collect or why, we will update this page, its version and date. We may additionally notify you of significant changes in the service.

15. Contact

Data controller: Demianov D.M. Email: [email protected]; the “Contact support” form in the service menu.