MapMap Nav privacy policy

1. The short version

With a downloaded territory, routing, turn-by-turn guidance and search run on your device, and what you type into search never leaves it. With no connection, nothing at all is sent. If your phone does have a connection while you drive on a downloaded territory, a few drive-time features still use it: the faster-route check sends your position and destination about every two minutes, the country lookup sends your route's start and end, and the recorded voice clips your route needs, such as those with its road names, are fetched by sending the words of those spoken instructions. Section 8 lists each one.

The app also has online features: online maps, place search, routes computed by our hosted engine with landmark instructions and live traffic, speed limits, safety-camera alerts, road incidents, parking near your destination, places along your route, charging plans for an electric car, lorry clearance checks and the reachable area. Using them sends specific, listed things to api.mapmap.ai (section 8), each used to answer that request and none kept as a location history tied to you. In Online mode what you type into the search box is sent to api.mapmap.ai, because that is where the search index lives.

Every network request the app makes goes to MapMap's own servers: api.mapmap.ai, plus tiles.mapmap.ai and fonts.mapmap.ai for the traffic overlay files and the map's lettering. The app contacts no other company's servers, for search or anything else. There is no analytics and no crash reporting: if the app ever stops with an error, it offers to make a diagnostics file on your phone, and you decide who, if anyone, to send it to.

At first run the app offers to take your email address, and you can skip it. Online maps, search and routing work without one, within a monthly allowance. You need a verified email address to download a territory, and to keep using online maps once that allowance is used up for the month. An email address is the only personal detail the app asks for. Section 9 says what happens to it, and our page on deleting your data says how to have it removed.

The app can act on a few spoken commands, and the microphone is on only while you hold the voice-command control. What you say is turned into text on your phone; no recording is kept, no transcript is kept, and nothing you say is sent to us or to anyone else. There is no wake word. Section 11 has the detail.

You can switch on “Record my drives”. It is off unless you turn it on. With it on, the app keeps the positions of each drive you finish on your phone, so you can do something with a drive later; it does not send them, and it keeps them out of the backup your phone makes of itself, so a recording is not copied to iCloud or to Google either. If a drive is ever to be used for anything off your phone, you choose that one drive in Trips and approve it yourself. Section 6 has the detail.

The other things the app keeps on your phone behave differently on the two platforms, and it is worth knowing which phone you have. On Android your saved places, recent searches, settings and trip list do travel in your phone's own backup, the way most apps' data does, which is how they come back when you set up a new phone; that goes to Google, never to us. On iPhone they are not in the backup at all, which means they do not come back: a restored iPhone starts the app fresh. Section 7 has the detail.

In both modes: we do not track you, we do not build a location history of you on our servers, and we do not sell or share data with advertisers. There is no analytics SDK and no advertising identifier in the app.

2. Location

MapMap Nav asks for “While Using the App” location access so it can show your position on the map and guide you turn by turn. We do not ask for “Always” access, and the app never requests it. That position is read directly from your device's location services.

On the phone, your position is used to draw where you are and to compute guidance. It is not kept once you close the app, with two exceptions, both of which stay on your phone and neither of which is sent to us: your trip list, which records each completed journey's destination, its start and end time, and how long and far the drive actually took; and, only if you switch it on, a recording of the drive's own positions (section 6). Both are deletable in the app. On Android the two differ in one way, set out in section 7: the trip list travels in the backup your phone makes of itself and a recording does not. On iPhone neither does. We build no location history of you on our servers, in either mode.

Your position leaves the device only as part of a request section 8 lists, and only when the phone has a connection. A hosted route sends its origin and destination, and your position again if you go off-route and it recomputes. While guidance is running, the faster-route check sends your current position and destination about every two minutes, and it does this on a downloaded territory as well as online. With no connection, navigating on a downloaded territory sends nothing at all.

Location while your screen is locked. A navigation app that stops when you put your phone in your pocket is not a navigation app. So while a journey is running, and only then, MapMap Nav keeps reading your location with the screen off or the app in the background, so guidance and spoken turn instructions carry on. It starts when you press Go and stops the moment you arrive, press Exit, press Stop on the navigation notification, or close the app. There is no other time the app reads your location in the background.

On Android you will see an ongoing notification showing your next manoeuvre, distance and arrival time, with a Stop button. That notification is not decoration: it is the Android requirement that lets an app keep using location while you are not looking at it, and it is how you end the session at any moment. The app uses the “While Using the App” location permission only; it does not request Android's separate background-location permission. On iOS the status bar shows the blue location indicator for the duration of the journey, for the same reason: so it is never invisible that navigation is running.

Nothing extra is transmitted. Reading your location in the background changes what the app can do, not where anything goes. The requests that carry a position are the ones section 8 lists, the same calls with the same handling whether your screen is on or off.

If you decline location access, MapMap Nav still works fully. Your position simply is not shown, and you can search and preview routes as normal.

3. Search queries and destinations

Where a search runs depends on which map source you chose, and the app tells you which one you are on.

On a downloaded territory (offline mode), searching for a place happens entirely against the map data stored on your device, and what you type is not sent anywhere. The destination you then drive to is used on the phone to compute the route. If the phone has a connection during the drive, the faster-route check and the country lookup in section 8 send it to our routing engine; with no connection it goes nowhere.

On online maps, the search box queries MapMap's own geocoder at api.mapmap.ai. What is sent: the text you have typed (as you type it, batched so it goes no more than once every 250 ms), and, only when the app already has a recent position from your device, a single coordinate pair used to rank nearby places above distant ones. Picking a result may send that result's id back so the index can learn which answer was the right one; that message carries the query text and the id, nothing else. Category buttons (“Petrol”, “Coffee”) send the category and the same coordinate pair.

These requests are answered, not retained against your identity, and no search history is built from them. When you pick a result, we keep what you typed and the id of the result you picked, with no key, account or position, to make search better. No search data is sent to any company other than MapMap. In Online mode a destination you route to is also sent to our routing engine, because that is what computes the route; see section 8.

Changed in an earlier version: earlier builds resolved postcodes through two third-party services (postcodes.io and Zippopotam.us), which meant a postcode-shaped query left the app for a company other than MapMap. Both have been removed; postcodes are now resolved by MapMap's own geocoder, and nothing in the app contacts either service any more.

4. Territory downloads

To work offline, MapMap Nav downloads a territory: the map, routing and search data for a region you choose, such as the UK, from api.mapmap.ai. This is a one-off download, with occasional updates. It is a request for map data, not a report of anything about you.

The request includes your licence key so we can verify your download allowance. It does not include your location, your search history or your routes.

Downloading a territory needs a verified email address. If you skipped the email at first run, the app asks for one when you tap a download (section 9).

5. Licence key

MapMap Nav carries a licence key, issued to it at first run (section 9), used to verify the app is entitled to use the MapMap SDK and to enforce fair-use limits. The app sends the key with its requests to api.mapmap.ai, and checks the key's remaining allowance so it can show it to you. That check carries the key and nothing else: no personal or location data.

6. Recording a drive (off by default)

MapMap Nav can keep a record of where a drive actually went. It is off when you install the app and stays off until you turn it on, in Settings, under Recording: “Record my drives”. With the setting off, nothing in this section happens.

What is recorded. While the setting is on, the app writes down your position about once a second during a journey you have started, and saves that list when you arrive. Each entry is a position, a speed and a heading with a time on it, and the recording also carries the destination's name and the kind of routing used. A journey you abandon is not recorded, and switching the setting off part-way through a drive discards what that drive had recorded so far.

Where it stays. On your phone, in a folder of its own that the app marks as excluded from the backup your phone makes of itself. A recording is not synced, it is not sent anywhere, and it is not copied to iCloud or to Google, so it stays on the handset it was made on. Recording makes no network request of its own: it reuses the same location the app is already reading to guide you, so it asks for no new permission and sends nothing new. Section 7 sets out what your phone's own backup does and does not carry.

How much is kept. The app keeps your last 10 recordings and deletes the oldest to make room. One drive is capped at 2,000 positions, and past that point the app records at a coarser interval rather than stopping, so a long drive is covered end to end rather than cut off part-way.

Approving one drive. In Trips, each recording has an action that marks that one drive as approved to be sent to MapMap. It covers that drive and no other, it never applies to future drives, and you can withdraw it at any time. There is no control that approves everything, and no setting that approves drives in advance.

As of this version, nothing is actually sent. The app contains no code that uploads a recording and there is no endpoint for one, so approving a drive records your permission on the device and nothing more. If sending is ever added, this page will say what is sent and what happens to it, in the release that adds it, and the store privacy declarations will change with it.

Deleting. You can delete one recording, or all of them, from Trips. Switching the setting off stops recording and offers to delete what is already there; it will not delete anything without asking. Deleting removes the data from your phone, and there is nothing on our side to delete because nothing was sent. Deleting the app removes everything.

7. Your phone's own backup

Your phone backs itself up. On iPhone that is iCloud Backup; on Android it is Google's backup, and the device-to-device transfer that runs when you set up a new handset. Those backups include what apps keep on the phone, unless an app says otherwise, and they go to Apple or to Google. They never come to us, and we cannot read them.

This matters because “stays on your phone” and “is not in your phone's backup” are two different statements, and until an earlier version this page only made the first one clearly.

A recorded drive is excluded from the backup, on both platforms. The app keeps recordings in a folder of their own and marks that folder so that neither iCloud Backup nor Android's backup and device transfer copies it. A recording therefore stays on the one handset it was made on: not sent to us, and not carried to Apple, to Google, or to your next phone. If you set up a new phone from a backup, your recordings do not come with it. That is deliberate.

Everything else the app keeps behaves differently on the two platforms, and it is worth knowing which phone you have.

Your email address and licence key are kept in the phone's secure storage (the Keychain on iPhone, encrypted storage on Android), set up so that they never move to a different phone through a backup, on either platform. On a new phone you sign in again.

On Android, your saved places, recent searches, settings and trip list travel in your phone's own backup, the way most apps' data does. That is what makes them reappear when you set up a new phone. None of it is sent to us, and none of it is a record of where you drove: the trip list holds each completed journey's destination name, its start and end time and how long and far it took, and nothing about the route in between. The backup also carries the random installation id described in section 9, which the app sends us only when you skip the email.

On iPhone, they are not in the backup at all. The component the app uses to store them keeps its own folder out of iCloud Backup, and has done since before recording was added. The practical effect is that restoring a new iPhone from a backup gives you the app with no saved places, no recent searches, no trip list and default settings. Nothing is lost from the phone you already have, and nothing is lost by turning the app's recording setting on or off; it is the move to a new iPhone that starts you fresh.

If you are on Android and would rather none of it travelled, your phone's own settings let you turn backup off for individual apps: Settings, Google, Backup.

On a build that cannot confirm the recordings exclusion, which would be an old development build rather than anything from the App Store or Play, the app stops saving recordings rather than saving them somewhere it cannot keep this promise about. The Trips screen says so when that happens.

What leaves the device, by mode

A summary of sections 6 to 12, so the answer does not depend on reading the whole page.

8. Online features, and exactly what each one sends

Every one of these needs a connection, and none of them runs without one. The first three run only in Online mode, and the fourth only for a route from our hosted engine; the rest also run on a downloaded territory when the phone has a connection, and say so.

Online maps. With no territory installed (or the map source set to Online), map tiles and styles are fetched from our servers as you pan and zoom. Like any online map, a tile request implies the area you are looking at; tile requests are not logged against your identity as a browsing history.

Place search. In Online mode, the search box sends the typed text (and, when available, one approximate position to bias the ranking) to api.mapmap.ai. Selecting a result may fetch that one place's public details, such as opening hours, phone and website, from the same geocoder, and may send the picked result's id back as ranking feedback. See section 3.

Hosted routes. In Online mode, when you ask for a route the request sends its origin, any stops and its destination, with your route options (such as avoiding tolls), to our routing engine, and your position and the direction you are heading again if you go off-route and it recomputes. It also sends the time on your phone, so the route and arrival time can allow for live traffic, or the departure or arrival time you set with Leave at or Arrive by. For a lorry route it sends the size, weight and axle count you entered and whether you carry a hazardous load. That is what makes landmark instructions possible, like “Turn right just after the Shell garage”, and real turn-lane guidance. The route comes back, and the request is not stored against your identity; our servers keep only a de-identified demand log with coordinates truncated to roughly 5 km cells and no key, account or IP attached.

Live traffic in routes. Our servers download live traffic for England's motorways and major A roads from National Highways and apply it themselves. Nothing about you or your route is sent to National Highways.

Speed limits, safety cameras and road incidents. For a route from our hosted engine, the app sends the route's line (the planned route, not your live position) with your licence key to fetch the posted speed limits, the fixed safety cameras and any reported road incidents along it, such as closures and lane restrictions. Incidents are asked for once for each route the preview offers, up to three, again every five minutes during guidance (so a report other drivers made after you set off can reach you), and again whenever a new hosted route replaces the one you are on. On a downloaded territory this happens only if you accept a faster route, because that route comes from our hosted engine. Camera alerts are off unless you switch them on; with them on, the app also sends the route's start, stops and destination to ask for level crossings and average-speed zones along it.

Parking near your destination. When you are about 800 metres from your destination, with a connection, the app sends the destination's position to find parking near it.

Places along your route. When you tap a category such as fuel, charging or coffee during a route, or search along it, the app sends the route's line, what you are looking for (and, for fuel or charging, your fuel type or connectors), and how far you would go out of your way.

Charging plans for an electric car, off unless you switch on “Plan charge stops” in Settings, Vehicle. For a car route longer than your range, the app sends the route's start and destination with your battery size, connectors and charge levels, to plan where to stop.

Lorry clearance checks. For a lorry route, the app sends the route's line with the height and width you entered, to check for low bridges and narrow roads along it.

Place details. Picking a place in search may fetch that place's public details, such as opening hours, from our geocoder, by sending the place's id.

Reachable area. If you tap Reachable area in Explore, the app sends the centre of the map on screen to work out how far you could drive in 10 or 20 minutes.

Checking for a required update. When you open the app, and when you come back to it, it asks api.mapmap.ai whether this version still works with our service, sending the version number only: no key and no position.

Your car on the map. The pictures of the car you choose to show on the map are downloaded from api.mapmap.ai and kept on your phone. The request names the car and colour, and carries no key and no position.

Faster-route checks, on either map source. During guidance with a connection, the app re-asks the routing engine about every two minutes whether a faster route exists from roughly where you are to your destination. This runs on a downloaded territory too, whenever the phone has a connection. Same data, same handling, as a hosted route request.

Country lookup, on either map source. To draw the right speed-limit sign for the country you are in, the app may send your route's start and end points to look up which country they are in, when it cannot tell from the speed-limit data. This also runs on a downloaded territory when the phone has a connection.

Naming a dropped pin, on either map source. Tapping an empty spot on the map sends that spot's coordinate, when the phone has a connection, to find the street or place there.

Voice clips, on either map source. When you have chosen a route and the phone has a connection, the app fetches the recorded clips that route needs and does not already have, such as the instructions that name a road or a landmark, by sending the words of those sentences. Section 10 has the detail.

Reporting a map problem, on either map source. If you report a problem, on screen or by voice command, the app sends the spot, the kind of problem and any note you typed, with your licence key. No contact detail is asked for or sent. Reports are kept, with the key that sent them, so we can check the problem and fix the map, with no set end date. Each new report's spot, kind, note and time, without your key, is also read by Anthropic's Claude model, which drafts a diagnosis for our map team (section 14).

Live traffic. The traffic overlay downloads country-wide traffic files with fixed names. The request carries no location, no route and no query; turning traffic on reveals nothing about where you are. It is off by default.

Every one of these degrades silently without a connection, and with no connection, navigating on a downloaded territory makes no network request at all.

9. What the app does not collect, and the one thing it asks for

No password and no sign-in beyond the optional email step below. No advertising identifiers. No analytics SDK. No crash reporting. No contacts, no photos and no camera access.

If the app ever stops with an error, its recovery screen offers Share diagnostics. That writes a short text file to your phone's cache, with the app and phone versions, the error and the app's last 200 log lines, with keys, email addresses and positions removed, and opens your phone's share sheet. You decide whether to send it and to whom; the app itself sends it nowhere.

The app does use the microphone, and only in the one way section 11 describes: while you hold the voice-command control, so that a short spoken command can be turned into text on your phone. No recording is kept, nothing is stored, and no audio and no transcript is sent to us or to anyone else.

The one thing the app asks for is an email address, and you can skip it. When the app first runs, the Account screen asks for one and offers “Skip for now”.

If you skip, the app asks api.mapmap.ai, operated by MapMap AI Ltd, for the licence key described in section 5 with no email address. With that request it sends a random id this installation of the app made for itself. It is not your phone's advertising identifier. Deleting the app deletes it, although on Android your phone's own backup of the app can bring it back on a new phone (section 7). Our servers keep only a keyed hash of it, for two days, to limit how many keys one installation can ask for in a day. When we issue a key without an email address, our servers record when it was issued and the IP address and user agent of that request, and keep the IP address (or, for IPv6, its network) for two days to limit how many keys without an email address one network can ask for in an hour. The key works for online maps, search and routing up to a monthly allowance; it cannot download territories.

You can add an email address later: when you tap a territory download, when that monthly allowance is used up, or in Settings, Account. The app sends the address with your licence key, and we email an 8-digit code to it. Typing the code into the app attaches the address to your key and unlocks territory downloads. The code lasts 30 minutes; if it is never entered, the address is deleted within about an hour and a half of your asking for the code. If the address already has a MapMap account, nothing is merged: the app offers to sign in with that address instead, which emails you a link, and once that sign-in is confirmed, the account without an email address that this phone used before is deleted. If the link is never opened, the phone goes back to that account.

If you enter an email address at first run instead, the app sends it once to api.mapmap.ai to be issued its licence key, and we send a verification email to that address.

However you give it, the email address is used to issue and verify the app's licence key, and to email you if that key comes close to or reaches its monthly allowance, and for nothing else; it is not used for marketing and it is not passed to anyone else, except our email provider (section 14), to send those emails. As for every key we issue, our servers also record when the key was issued, and the IP address and user agent of that request, as the main privacy policy describes. The email address and the key are stored together in your phone's secure storage and removed when you sign out or delete the app. Settings, Account does not offer Sign out for an account with no email address, because nothing could sign back in to it; you can delete it instead. To have them deleted from our servers, choose Delete my account in the app (Settings, Account), which deletes them straight away, or see section 12. Deleting covers MapMap Nav only: if the same address also has a Tellway account or a MapMap API key, the address is kept until that is deleted too.

An account with no email address is deleted the same way, with Delete my account in Settings, Account. Its key stops working, and we erase the IP address and user agent recorded when it was issued, and any address you had started to add but not confirmed.

We do not track your location in the background in the sense that phrase usually means: there is no always-on collection, no profile built from where you go, nothing about where you go collected on our servers, and no “Always” location permission. The app reads your location in the background only while a journey you started is running, purely to keep guiding you, and stops when it ends. That is described in full in section 2.

The app does keep a trip list on your phone, and, if you switch it on, a recording of each drive. Both are yours, both are deletable in the app, and neither is sent to us. A recording is never in your phone's own backup; the trip list is, on Android only. See sections 6 and 7.

10. Voice guidance

Spoken turn-by-turn directions are recorded audio clips in a MapMap voice, female or male, which you choose in Settings, Voice, played from your phone, including while your screen is locked. The app does not use your phone's text-to-speech engine at all.

The most common sentences, the ones with no place name in them, come built into the app for both British English voices. The others, including every sentence that names a road or a landmark, are fetched when you have chosen a route and the phone has a connection: the app sends the words of the sentences it does not already have, the guidance language, which voice you picked and your licence key to api.mapmap.ai, and plays the clips once they are on the phone. Your position is not sent with them, but the road names in them do describe the route you chose. With no connection, the app plays the clips it already has, and an instruction it has no clip for is shown on screen with a chime rather than spoken.

On our side, each clip is recorded once and stored under a code made from its words, and every driver who needs the same sentence is served the same file. Clips are stored with their words and no key or account attached, with no set end date. A sentence we have never recorded before is recorded by our own voice service, an open-source voice model running on our own servers in the European Union, which receives the words, the language and the voice only. Versions of the app built before 5 October 2026 could ask for a voice that ElevenLabs, a speech service, records; for those, ElevenLabs receives the words of a new sentence only, never your key, account or position. We keep a daily count of how many new sentences each key asks us to record, which sets a daily limit, and clear out counts older than 7 days whenever our server restarts. If a key reaches that limit or asks for an unusual number, our team is alerted by email; the alert names only the first few characters of the key's id. Each request counts against your key's allowance like any other.

This section used to say guidance was produced by the operating system's text-to-speech engine. That was true until 17 September 2026 and is not true of the current app.

11. Voice commands

The app can act on a small, fixed set of spoken commands, such as “report a closed road”, “report roadworks”, “what is ahead”, “repeat that”, “mute” and “unmute”, and one that opens the search along your route for a kind of place, such as fuel. It is not an assistant and holds no conversation: there is a list of accepted phrases and the app acts on those and nothing else.

The microphone is on only while you hold the voice-command control. Not before, not after, and there is no wake word: nothing in the app listens for its name, and nothing listens while you are not holding the control. Let go and the microphone closes.

What you say is turned into text on your phone, by your phone's own speech recognition, with nothing sent anywhere to do it. On iPhone the app requires the phone's on-device recognition and will not run the feature without it; on Android it uses the phone's on-device recogniser, which needs Android 12 or newer. If your phone cannot recognise speech without sending it away, voice commands are switched off rather than sent away.

No recording is kept. On Android the phone's recogniser listens and hands the app only the words. On iPhone the app passes the sound from the microphone straight to the phone's recogniser as you speak, in memory, and never saves it. Either way, no audio is written to your phone or sent anywhere.

No transcript is stored. The words are compared with the list of accepted phrases, acted on, and discarded. Nothing you say is transmitted: not the audio, not the text, not a summary, and not for training anything.

Two commands do send something, and it is not what you said. “Report a closed road” and “report roadworks” file a map report (section 8) with your current position and a fixed, standard note, exactly as the on-screen report does. The command that opens the search along your route then works exactly as it does when you tap it.

Traffic questions, off unless you switch them on in Settings. With the setting on, when your phone works out that you are held up, the app may ask “Slow here. Is it a queue?” out loud. Your phone works that out by comparing your speed with the speed expected on the road you are on, on the phone, and nothing it works out is sent anywhere. You answer the way you give any voice command, by holding the voice-command control: the microphone does not open on its own. Your answer is compared on your phone with a short list (yes, no, accident, roadworks, broken-down car and closed), and no recording or transcript is kept. An answer of yes, accident, roadworks, broken-down car or closed is sent to api.mapmap.ai as a traffic report: your current position, the direction of the road you are on, which answer you gave, a fixed, standard note and your licence key, the same way as a map report. “No”, and no answer at all, send nothing. Traffic reports are deleted 24 hours after they are sent, or sooner if you delete your account, and are never published or read by any other company. Other MapMap drivers are shown one only once a second driver reports the same thing nearby, travelling the same way, and they never see your key, your account, the note or the position you were at.

On iPhone the app asks for two permissions the first time you hold the control: speech recognition and the microphone. Both are needed for the phone's own recognition to run, and neither is used for anything else. On Android it asks for the microphone. Refusing them turns voice commands off and changes nothing else about the app.

12. Data retention and deletion

With no connection, journeys on a downloaded territory leave nothing on our servers to retain or delete. Online requests (search, routes, faster-route checks, tiles, speed limits, camera and traffic data) are answered and dropped; what persists from routing is the de-identified roughly 5 km demand log described above, which cannot be traced back to you, and from search only the keyless pick feedback described in section 3.

What our servers hold that is linked to your key: the email address the key was issued to, if you gave one; the record of when and from what IP address and user agent the key was issued, with or without an email address; the key itself, stored as a hash; per-day usage counts for the key (which kind of request, how many, and whether it succeeded), which enforce your allowance; and any map reports you sent. Traffic reports (section 11) are kept for 24 hours only, and deleting your account deletes them straight away. Voice clips are stored with the words they speak and no key attached.

How long we keep each of these, today: the email address and the key (as a hash), until you delete your account; the record of when, and from what IP address and user agent, the key was issued, for as long as that agreement could be relevant, with the IP address and user agent erased when you delete in the app and nothing else of ours uses your email address; the daily usage counts, while the key is active and after it is revoked, with no set end date, carrying no email address; map reports, with the key that sent them, with no set end date; traffic reports, 24 hours; the daily count of new voice sentences per key, cleared after 7 days; our team's alerts about unusual use, 14 days; voice clips, with no set end date and no key.

Our request log. For each request to api.mapmap.ai, our server logs the time, the kind of request (the address path only, never the text you searched for, the coordinates of a route or anything else from the rest of the address), whether it worked, how long it took and the IP address it came from. It does not record your key or your email address. A map report also writes its position and an id for your key to the log, a traffic report writes an id for your key and which answer, without its position, and an email to you that fails to send writes your address to it. There is no fixed period: the log is cleared each time we update our server software, and it is not backed up.

Backups. Our data is backed up every night to a separate Hetzner server, and each nightly copy is overwritten within 7 days. Copies taken before an update to our servers are kept on our own server until we delete them. After you delete your account, your data can stay in these copies until they are overwritten or deleted; we use them only to restore the service if something goes wrong.

For a key issued to an email address, we also record two things about the request that asked for it. One is a coarse device class worked out from its user agent, such as “iPhone” or “Android device”, so the page where you confirm the key can show what kind of device asked for it; it is deleted when the key is revoked or, if unconfirmed, expires. The other is a keyed tag of the network the request came from (never your IP address or location), which cannot be reversed without our secret key; it is deleted when the key is revoked or, if unconfirmed, expires, and otherwise 90 days after a key request or sign-in last came from that network. A key issued without an email address gets neither.

If you skipped the email, our servers keep a keyed hash of the installation id the app sent, for two days, to limit how many keys one installation can ask for in a day.

Recent searches, saved places, your trip list and any drive recordings are stored on your device, not on our servers, as are territory files and your licence key, and all of them go when you delete the app. Drive recordings are held back from your phone's own backup on both platforms; what the rest do depends on which phone you have, and section 7 sets out the difference. Trip history and recordings can each be deleted from inside the app without deleting anything else, and a territory can be removed in Settings.

How to have your email address, your key and what is held with them deleted: deleting your MapMap Nav data.

13. Your rights, and the lawful bases we rely on

Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. Email hello@mapmap.ai and we will act on a verified request within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Performance of a contract, the MapMap Nav terms of use: to issue and run your licence key, answer your searches and routes and the other online features in section 8, record and serve spoken instructions, send the emails your account needs, and delete your account when you ask.

Our legitimate interests: to keep the service secure and free of abuse (allowances, sign-up limits, the request log and alerts about unusual use); to check and fix the map from the map reports you choose to send; and to warn other drivers using traffic reports, without identifying you. We have weighed these against your interests, and you can object to any of them by emailing us.

Legal obligation: to keep the records the law requires of us and to respond to lawful requests.

We do not use your data for marketing, advertising or profiling, and no decision with legal or similarly significant effect on you is made by automated means.

14. Who else handles your data

We use a small number of service providers, each acting on our instructions. Hetzner: the servers our API, our voice service and our backups run on, in the European Union. Resend, our transactional email provider: the verification email, the code for adding an email address, allowance emails, and our team's alerts about unusual use, which name only the first few characters of a key's id. Anthropic: its Claude model reads each new map report's spot, kind, note and time, without your key, and drafts a diagnosis for our map team; it never receives traffic reports. ElevenLabs, a speech service: only for voices that versions of the app built before 5 October 2026 could ask for, and then only the words of a new sentence.

The full list, with what each can see and where it processes, is at mapmap.ai/legal/subprocessors.

15. Children's privacy

MapMap Nav is a navigation app for adults and is not directed at children. On Google Play its target audience is 18 and over. Its content ratings say only that it contains nothing unsuitable for any age, not that it is meant for children. We do not knowingly collect personal data from children.

16. Changes, and who to ask

If this policy changes we will update the date above and, for any material change, note it in the app's release notes.

MapMap Nav is published by MapMap AI Ltd, registered in England and Wales (company 17345596), trading as MapMap. Registered office: Vantage Point, New England Road, Brighton, England, BN1 4GW. MapMap AI Ltd is the controller of the personal data described here.

Questions about this policy, your data or your rights, and company and legal correspondence: hello@mapmap.ai. Help with the app or your account, and deletion requests: support@mapmap.ai.