Privacy Policy

1. Controller and Contact

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Florian Rachmann
Bergstr. 25
52062 Aachen, Germany
Email: hello@openmapx.org

We are not legally required to appoint a Data Protection Officer and have therefore not designated one. For any data-protection matters, you can reach us at the email address above.

2. Overview of Data Processing

OpenMapX is an open-data mapping platform. We are committed to minimizing the personal data we process. We do not use any analytics, tracking, or advertising services. We do not sell or share your personal data with third parties for marketing purposes.

Data processing occurs in the following contexts:

• Providing the mapping service (map tiles, search, routing, isochrones, elevation profiles)

• Displaying third-party data layers (traffic, transit, air quality, natural disasters, hiking trails, street-level imagery, place photos, parking, fuel prices, EV charging, shared mobility)

• User account management (if you create an account)

• Client-side storage of preferences and saved places on your device

• Server-side caching for performance optimization

3. Hosting and Server Logs

When you visit OpenMapX, your browser automatically transmits certain technical data to our server. This may include:

• IP address

• Date and time of the request

• Browser type and version

• Operating system

• Referrer URL

This data is processed to ensure the technical operation and security of the service. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing a secure and functional service). Server logs are automatically deleted after 30 days.

Our servers are hosted by OVH GmbH, St. Johanner Str. 41-43, 66111 Saarbrücken, Germany, who processes data on our behalf and exclusively according to our instructions (data processor pursuant to Art. 28 GDPR). A data processing agreement is in place. The data centers are located in Frankfurt, Germany.

4. Geolocation Data

OpenMapX may request your device's location only when you explicitly click the "My Location" button. Your browser will ask for permission before sharing this data. Location data is:

• Used exclusively to center the map on your position

• Processed only in your browser (client-side)

• Not stored on our servers and not transmitted unless you actively use features that require coordinates (e.g., routing, nearby search, transit departures)

The legal basis is Art. 6(1)(a) GDPR (your explicit consent via the browser permission prompt).

5. User Accounts

You can use OpenMapX without creating an account. If you choose to register, we process:

• Name and email address — for account identification and communication

• Password — stored only as a cryptographic hash (never in plain text)

• Passkeys (WebAuthn) — if you register a passkey, a public-key credential is stored on our server; the private key never leaves your device

• Session data — authentication cookies to keep you signed in

• Saved places — if you save places while signed in, the place name, coordinates, and associated metadata are stored in our database so they can be synchronized across devices

• Mangrove review keypair — if you opt in to the review feature, an ECDSA P-256 signing keypair is generated and stored for you. The public key is stored in cleartext on our server (it is, by design, public). The private key is stored according to the protection mode you choose:

  • Passphrase (recommended) — the private key is encrypted in your browser with a passphrase you choose, using the audited age encryption format (scrypt key-stretching plus ChaCha20-Poly1305). We only ever see the ciphertext.

  • Passphrase and/or WebAuthn passkey— you may additionally or alternatively unlock the private key with one or more registered passkeys (e.g. your phone's biometrics, a hardware security key). We store one age-plugin-fido2prf identity string per passkey. That string encodes the credential id, relying-party id and transport hint — it contains no secret material.

  • Unencrypted (explicit opt-in) — only if you actively choose this, the private key is stored in cleartext on our server. In this mode, anyone with access to the database (including the operator) could cryptographically sign reviews in your name. We show a warning before you make this choice.

• Review content— if you submit a review, the content you provide (rating, free-text review, optional images, optional affiliations, optional experience context, place reference) is cryptographically signed in your browser and then forwarded by our server to the Mangrove.reviews network. See Section 6 below for the publication model.

You may also sign in via third-party OAuth providers (OpenStreetMap, Mapillary). In that case, we receive your public profile information (name, profile picture URL) from the respective provider. Your browser is redirected directly to the selected provider during authorization, so that provider may receive your IP address and browser request metadata. We do not receive or store your password for these providers.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract / provision of the service you requested). You can delete your account at any time via the account settings.

The provision of personal data is neither a statutory nor a contractual requirement. You can use OpenMapX without providing any personal data. Creating an account requires an email address; without it, account-dependent features (such as saved places synchronization) cannot be provided.

6. Reviews (Mangrove Open Reviews Standard)

OpenMapX integrates the Mangrove.reviews decentralized review network (Open Reviews Standard, operated by the Open Reviews Association, Zürich, Switzerland). Using the review feature has privacy implications that go beyond our own servers, so please read this section carefully before submitting a review.

• Reviews are public and permanent.When you submit a review, it is cryptographically signed with your keypair (see Section 5) and published to api.mangrove.reviews. From there it is mirrored and re-published by independent aggregators we do not control. Deletion of a review is a best-effort request to aggregators; we cannot guarantee removal from all copies already propagated.

• Your public key is a persistent pseudonym. Every review you submit is signed with, and linked to, your public key. The public key is stored in cleartext by Mangrove and aggregators and ties all of your reviews together into a pseudonymous identity, even across sessions and devices. Anyone who learns a connection between your public key and your real-world identity can link it to all prior and future reviews you sign. The key is not a direct identifier (name, email, etc.), but treating it as anonymous would be misleading.

• What is submitted. Each review submission contains: the subject identifier (for places this is a geo:URI with the place's coordinates and uncertainty radius), your rating, optional free-text opinion, optional experience tags, optional affiliation disclosures, optional uploaded images, your public key, and your signature.

• Image uploads.Optional review images are uploaded to Mangrove's image service (files.mangrove.reviews). Images are served publicly once uploaded. Before your image leaves your browser, we re-encode it through an HTML canvas to strip EXIF, XMP, IPTC, GPS and similar embedded metadata that cameras often attach. The visible pixel content of the photo itself is retained and published as-is.

• Reading reviews. When you view a place in OpenMapX, our backend fetches any existing reviews for that place from api.mangrove.reviews, forwarding the place's geo: URI (coordinates). Your IP address is not transmitted to Mangrove for read operations because these go through our server.

• Editing and deleting your own reviews. Edits and deletions are themselves signed follow-up reviews. They are propagated in the same way as the original review and are subject to the same caveats about mirrors and retention by third parties.

The legal basis for the storage and signing of your keypair is Art. 6(1)(b) GDPR (performance of the review service you requested). The legal basis for the publication of review content to the Mangrove network is Art. 6(1)(a) GDPR (your explicit consent, given when you accept the in-app Terms/Privacy checkboxes in the review dialog and press “Publish”). You may withdraw future consent at any time by not publishing further reviews; already-published reviews cannot be unpublished unilaterally because of the decentralized design of the system. Where your review is thereby transferred to aggregators in countries outside the European Economic Area (EEA), that transfer is based on your explicit consent pursuant to Art. 49(1)(a) GDPR.

7. Third-Party Services and Data Transfers

To provide its mapping features, OpenMapX sends requests to various third-party APIs. When you use a feature, certain data (typically map viewport coordinates, search queries, or route waypoints) is transmitted to the respective provider. Our backend server acts as a proxy for most of these requests, meaning third-party providers generally see our server's IP address rather than yours. Below is a comprehensive list of all external services:

Core Map Rendering

Authentication Providers

Software Registries and Catalogs

Note on data flow:The "Data Access" column above indicates how each service is contacted. "Server-only" and "Proxied (server)" mean requests are routed through our backend server — the third-party provider only sees our server's IP address, not yours. "Direct (browser)" means your browser connects directly to the provider, exposing your IP address and browser fingerprint to them. "Mixed" means catalog or metadata requests are server-side or proxied, but specific media/player assets may be loaded directly by your browser after you take an explicit action, such as confirming a viewer notice or clicking "Load media". The vast majority of services are server-only or proxied. MapTiler map assets are routed through our API proxy by default. If an operator configures public map, style, or tile URL templates to point at external providers, your browser will contact those configured providers directly for those assets.

International transfers: Some of the above services are operated by entities in the USA or other countries outside the European Economic Area (EEA). A transfer of personal data to a third country only occurs where your data (such as your IP address or coordinates) actually reaches that provider:

• Direct browser connections to US providers:The MapillaryJS street-view viewer (Meta Platforms, Inc.) is loaded only after you confirm an in-app notice. It then connects directly from your browser, exposing your IP address, browser/device request metadata, selected image ID, and viewed coordinates. Some webcam video/player providers may also receive your IP address when you click "Load media" or otherwise open the live media. Meta is certified under the EU-U.S. Data Privacy Framework (DPF).

• Proxied requests to non-EEA providers: MapTiler Cloud receives proxied map asset requests when it is configured as the map provider. MapTiler AG is based in Switzerland, which has an EU adequacy decision.

• Server-proxied requests forwarding coordinates: For services like Flickr, Wikimedia Commons, TransitLand, and Link, our backend may forward map viewport coordinates (not your IP address) as part of the query. These coordinates reflect the area displayed on the map and are not inherently linked to your identity or physical location.

• No personal data transferred: Several US-based services (NASA FIRMS, USGS, GitHub API) receive no user-related data at all. Our server fetches public data feeds or repository files without transmitting any coordinates, search queries, or user identifiers. No transfer of personal data occurs in these cases.

The legal basis for all third-party service requests is Art. 6(1)(f) GDPR (legitimate interest in providing the mapping service you are using).

8. Cookies and Local Storage

OpenMapX uses first-party storage mechanisms only. Storage that is necessary for the service is used without a consent banner. The optional recent map-data cache is disabled by default and is only enabled when you switch it on in Settings.

• Session cookie — If you sign in, an HTTP-only session cookie is set to authenticate your requests. This cookie is essential for the login functionality and is deleted when you sign out or when it expires.

• Language preference cookie (NEXT_LOCALE) — If you explicitly switch the interface language, your choice (e.g., "en" or "de") is stored in a first-party cookie (max-age: 1 year, SameSite: lax) so the interface remembers it across visits. This cookie is only set when you actively select a language. If you have not made an explicit choice, your browser's language setting is used automatically without storing a cookie.

• View preferences — A small number of display settings (e.g., globe vs. flat map projection) are saved in localStorage so the interface restores your last-used view. No personal data is involved.

• Service Worker cache— A Service Worker caches static assets (HTML, CSS, JavaScript), map tiles, and downloaded offline areas using the browser's Cache Storage API. This enables offline functionality and faster loading. Cached entries expire automatically (static assets: 30 days; map tiles: 3–7 days). Runtime API response caches for search, route, place, autocomplete, weather, and photo lookups are only written when you enable the recent map-data cache.

• Browser memory cache — API responses are additionally cached in browser memory (via TanStack Query) during your session for performance. This data is discarded when you close the tab.

• Optional recent map-data cache— If you enable "Remember recent map data on this device" in Settings, OpenMapX stores a curated set of recent map-related API responses in localStorage and Cache Storage. This can include typed search text, route waypoints, place details, weather lookups, photo lookup results, nearby results, and exact map coordinates. Entries expire automatically according to their cache type (usually within minutes to 24 hours; photo lookup caches can remain for up to 7 days). You can disable the setting or clear this data at any time in the Storage settings.

We do notuse any tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required for strictly necessary storage (§ 25(2) TDDDG, implementing Art. 5(3) ePrivacy Directive). The optional recent map-data cache is off by default and is controlled through an explicit first-party setting rather than a tracking banner.

9. Server-Side Caching and Databases

To improve performance and reduce load on third-party APIs, our server caches API responses in Redis (an in-memory data store). Cached data typically includes map search results, transit schedules, routing responses, and catalog data from external registries. Cache entries expire automatically (usually within minutes to 48 hours). The cache does not store personal data such as IP addresses or account information.

We also operate a PostgreSQL database for user accounts, saved places, and cached place knowledge data (e.g., Wikidata facts, Wikipedia summaries). If GTFS transit feeds are imported, schedule data (stop names, routes, departure times) is stored in separate database schemas. None of this data constitutes personal data of end users.

10. Email Communication

If you register an account, we may send transactional emails for:

• Email address verification

• Password reset requests

• Two-factor authentication codes

These emails are sent via an SMTP server we operate or commission. They contain only information necessary for the respective action. We do not send newsletters or marketing emails. The legal basis is Art. 6(1)(b) GDPR (performance of a contract / provision of the service you requested).

11. Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You can request information about which personal data we process.

• Right to rectification (Art. 16 GDPR) — You can request correction of inaccurate data.

• Right to erasure (Art. 17 GDPR) — You can request deletion of your data. You can also delete your account directly in the account settings.

• Right to restriction of processing (Art. 18 GDPR) — You can request that we restrict the processing of your data.

• Right to data portability (Art. 20 GDPR) — You can request to receive your data in a structured, commonly used, machine-readable format.

• Right to object (Art. 21 GDPR) — You can object to processing based on legitimate interests at any time.

• Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on consent (e.g., geolocation), you can withdraw it at any time by revoking the browser permission.

To exercise any of these rights, contact us at the email address listed above. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de.

No automated decision-making.We do not use your personal data for automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Data Retention

We retain personal data only as long as necessary:

• Account data — retained until you delete your account.

• Saved places — retained until you remove them or delete your account.

• Mangrove keypair — retained until you regenerate it or delete your account. Deleting the keypair on our servers does not retract previously published reviews from the Mangrove network.

• Published review content— lives on the Mangrove network and its mirrors, outside our control. Within OpenMapX's own display, reviews can be hidden upon request; on external aggregators, retention is governed by their respective policies.

• Server logs — automatically deleted after 30 days.

• Cache data — automatically expires within minutes to 48 hours.

• Local storage and Service Worker cache — remains on your device until you clear your browser data or the cache entries expire automatically.

13. Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS/HTTPS), hashed passwords (using modern key-derivation functions), secure session management, and parameterized database queries. However, no method of transmission over the Internet is 100% secure.

Trust model for the Mangrove keypair (Section 5).In passphrase mode and passphrase + passkey mode, the private signing key never leaves your browser in cleartext. Even a full compromise of our database would only reveal age-encrypted ciphertext, which cannot be decrypted without your passphrase or a registered passkey. In contrast, the “unencrypted” opt-in mode stores the private key in cleartext; anyone with database access could therefore sign reviews in your name. We recommend choosing one of the encrypted modes and never sharing your passphrase.

14. Children's Privacy

OpenMapX is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so we can delete it.

15. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available at /privacy. Material changes will be indicated by updating the "Last updated" date.