Own your map.

The no-expiry guarantee

Offline maps ship as signed territory packages. Your maps are files you hold, not entitlements we extend.

• Verified on the device, entirely offline. ed25519 signatures over BLAKE3 content hashes.
• Nothing to expire, nothing to phone. No expiry field in the manifest, no licence server, no clock in the verification path, no account behind it.
• Ten years from now, air-gapped, still routing. A package you installed today will install, verify and route whether or not we still exist.

No telemetry by default, and no way to upload a trajectory

The device SDKs (Android, iOS, web) contain no analytics, no crash reporting and no phone-home. By default they produce only the network traffic you configure: your own gateway, or ours. Two honest nuances, in full:

• MAU billing identifier, hosted API only. When an app is licensed per monthly active user, requests to the hosted API carry an opaque, hashed install identifier (X-MapMap-User) so we can count distinct users for billing. No personal data, hashed again before storage, and only on hosted-API requests; offline use sends nothing, to anyone, ever.
• Opt-in fleet telemetry, off by default. It does nothing unless a fleet operator enables it (crates/sn-nav-core/src/probe.rs), and even switched on it is architecturally incapable of uploading your GPS trace: it map-matches on the device and emits only aggregate road-segment statistics: mean and 85th-percentile speeds and stopped time in day-of-week and time-of-day buckets, with the first and last ~500 m of every trip discarded and no location beyond a coarse ~5 km origin/destination cell. Your positions and your route never leave the vehicle. That is not a policy we ask you to trust; it is what the code can do.

Keys meter the hosted API, that's all

An API key counts calls against a quota and a ledger: keys stored only as cryptographic hashes, usage as counters per key, day and endpoint. Keys never gate the SDK or offline packages you already hold: revoking one stops hosted routing, and nothing on any device stops working offline. Full data inventory in the privacy policy; it is short.

What we do collect

We measure our own service, not your users: everything below is derived from traffic the gateway must handle anyway. The full disclosure, with retention and hosting, is at /legal/telemetry.

• Usage counters. Metered calls per API key, per day, per endpoint: the same numbers that drive your quota, your bill and the usage panel on your account page. Kept 365 days at daily granularity, then aggregated or deleted.
• Error classes. Counts of response status codes (401, 402, 422, 429) per key and endpoint, so we can see when developers hit friction.
• A coarsened demand log. Where routing is asked for, truncated to ~5 km cells and 5-minute buckets before the line is written, carrying no key, no account and no IP.
• MAU hashes and activation events. A salted, irreversible hash per active user when you meter SDK seats, and service milestones like your first successful route.
• Website analytics. Cookieless and aggregate, EU-hosted: page views and playground interactions, never tied to an API key.

What we don't collect

• Location history. The SDKs never upload your GPS positions or route. Guidance, replay and territory management run on the device; the opt-in fleet-telemetry module (off by default) uploads only aggregate road-segment statistics, never a trajectory.
• Routes tied to you. The hosted API meters calls (key, day, endpoint, count): it does not store route coordinates against your identity for profiling. It does keep a demand log of where routing is asked for, but the coordinates are truncated to ~5 km cells and the time to 5 minutes before the line is written, and the line carries no key, account or IP, so it records that demand exists in a place, never that you were there.
• Accounts for devices. Offline packages install and verify with no account, no activation and no sign-in. Identity exists only where billing needs it: an email behind an API key.
• Advertising identifiers. There is no ad tech anywhere in the product. Nothing to opt out of.
• Cookies. This website sets no analytics or advertising cookies; traffic is measured cookieless, in aggregate.

Check, don't trust

Every claim above is a property of code you can read. Start here:

• Package signing & verification
  crates/sn-package: ed25519 signatures over BLAKE3 content hashes; the manifest has no expiry field and verification takes no clock.
• The SDKs' network surface
  crates/sn-nav-core, web-sdk/: the only endpoints called are the ones you configure.
• What the gateway stores
  crates/sn-gateway: keys as BLAKE3 hashes, per-key usage counters, the prepaid ledger; the coarsened demand log (routes/probe.rs: geohash-5 and 5-minute truncation applied before the write); and, only where an operator enables the opt-in stores, de-identified road-segment aggregates (never a trajectory).
• Licence posture
  THIRD-PARTY-NOTICES.md and the CycloneDX SBOM published with every release: permissive licences only in every distributable.

Source access: hello@mapmap.ai · prefer to run the whole stack yourself? /docs/self-host