Privacy Policy

What We Collect

When you use ShowMeOnMap — whether or not you are signed in — we collect:

• Account information: Name, email address, and profile image from your OAuth provider (Google or GitHub) or the email you use for magic link sign-in.
• Query history: The text of your map queries, for generating responses and improving the Service.
• IP address (limited use): For both signed-in and logged-out requests we use your IP address transiently to prevent abuse (rate limiting). For the logged-out free trial we additionally store only a salted, one-way hash of your IP for that day — never the raw address — to enforce a per-visitor trial limit; that daily counter is cleared each day.
• Billing data: Credit balance and transaction history. Payment processing is handled by Stripe — we do not store your card details.
• Shared maps: Map configurations and thumbnails you choose to share publicly.
• Usage data: Token counts, query costs, and error rates for service monitoring.
• API keys and connected apps: If you create an API key or connect an AI assistant (such as Claude) to your account, we store only one-way hashes of the key or of the access tokens we issue — never the key or tokens themselves — plus the app's self-reported name and when it was created and last used. The assistant sends us the map requests it makes on your behalf (plus, only if it chooses to include one, a short label for each map edit), and we process them like queries you type. Your conversation with the assistant stays with that assistant's provider; we receive only these requests. You can revoke a key or disconnect an app at any time from the account menu, and both are deleted with your account.

What We Don't Collect

• We do not use third-party analytics or tracking cookies.
• We do not sell or share your data with advertisers.
• We do not store your precise location unless you explicitly share it for a query.

How We Use Your Data

• To provide the map visualization service
• To process payments and manage your credit balance
• To display the maps you publish on Discover
• To monitor and improve service reliability
• To understand which kinds of maps people ask for — including queries we could not answer — so we can prioritize what to build next

Third-Party Services

We use the following third-party services that may process your data:

• Anthropic (Claude AI): Your queries are sent to Anthropic's API for processing. See Anthropic's privacy policy.
• Stripe: Handles payment processing. See Stripe's privacy policy.
• Cloudflare: Hosts the application and database. See Cloudflare's privacy policy.
• OAuth providers: Google and GitHub provide authentication. Only your name, email, and profile image are shared.

Data Storage and Security

Your data is stored in Cloudflare D1 (database) and R2 (file storage). All connections use HTTPS. Authentication tokens are managed by NextAuth with secure, HTTP-only session cookies.

Data Retention

Account data and credit balances are retained while your account is active. The text of your map queries is kept in two places: a service-improvement log of queries and their outcomes, where the query text itself is removed after 90 days (aggregate route and outcome statistics are kept without the text); and alongside the maps you save (in our database and file storage), retained until you delete that map or your account. Aggregate service-monitoring logs (token counts, error rates) are retained for up to 90 days. When you delete your account, we permanently erase your saved maps — including their query text and thumbnails — your sign-in tokens, and your personal data within 30 days; the service-improvement query log is unlinked from your identity at the same time, and your billing ledger is kept in anonymized form only as long as required for tax and accounting.

Your Uploaded Data

When you upload a file (CSV, GeoJSON, spreadsheet) to make a map or run an analysis:

• Your upload is processed only to render your maps and analyses.
• We never use your uploaded data to train AI models — ours or anyone else's. Queries and analysis steps are processed by Anthropic under its commercial API terms; we do not authorize any training use of that data.
• We never sell, share, or pool your uploaded data. It is never visible to other users unless you publish a map that contains it.
• Uploads live inside your workspaces. Signed in: retained until you delete the workspace or your account (erased within 30 days of account deletion). Signed out: automatically deleted after 30 days.
• Service-improvement telemetry about uploads is aggregate and content-free (file format, row counts, geocode hit rates) — never the rows themselves.

Your Rights

You may:

• Request a copy of your data
• Request deletion of your account and associated data
• Delete any shared maps at any time

To exercise these rights, email contact@showmeonmap.com.

Changes to This Policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent revision.