Privacy policy
Last updated 9 November 2026
This page explains what MapSocket collects when you visit mapsocket.com, use the dashboard at app.mapsocket.com or call the API, what we use it for and who helps us run it. Questions or requests: [email protected].
Your account
When you sign up we store your name, email address and a hash of your password (never the password itself), and, if you turn it on, your two-factor secret. We use these to sign you in, send you account emails and contact you about your account. Sign-in sessions last 30 days. Rate limits on sign-in and the API use your IP address in memory only; we don't store it with your account.
Data you connect or send
You decide what goes into MapSocket: the PostGIS databases you connect, files you upload, and the geofences, users, locations and events your apps send to the geofencing API. We process it only to provide the service to you. For this data you are the controller and MapSocket is your processor.
- Database connection strings are encrypted at rest (AES-256-GCM) and never shown again after you save them.
- Tiles are generated from your database and served only to requests with your project's keys.
- Locations and events your apps send are kept until you delete them, through the dashboard or the API. Deleting a tracked user deletes their events and trips too.
If your apps send us people's locations, you are responsible for telling those people and having a legal basis for it.
Analytics and error tracking
We use PostHog to understand how the website and dashboard are used, such as which pages are visited and where people get stuck, and to find and fix errors.
- Without your consent (before you answer, or if you decline), PostHog stores nothing on your device. We count page views and errors anonymously, and each visit can't be linked to the next.
- With your consent, PostHog keeps an id in a cookie and local storage so visits can be connected. In the dashboard, we then link that id to your account id and plan, never to your name or email.
- Inputs are always masked. Session recording is off in the dashboard, which shows API keys and connection strings.
- Error reports from the API are stripped of passwords, tokens and connection-string credentials before they're sent.
- We respect your browser's Do Not Track setting.
Cookies
| Cookie | What it's for | When |
|---|---|---|
ms_session | Keeps you signed in to the dashboard (30 days). | Always: strictly necessary |
ms_consent | Remembers your cookie choice (1 year). | Always: strictly necessary |
ph_* | PostHog analytics id. | Only if you accept |
| Tawk.to cookies | Keep a live-chat conversation going between pages. | Only if you accept |
We also keep a few settings in your browser's local storage, such as theme, language and your last project. These never leave your device. You can change your cookie choice at any time: .
Who processes data for us
- Fly.io: Runs the MapSocket API and tile servers (Tokyo, Japan).
- Supabase: Hosts our account database: accounts, projects, keys, geofences and location events (Tokyo, Japan).
- Cloudflare: Serves this website and the dashboard, and forwards email sent to @mapsocket.com.
- Resend: Sends account emails, such as address confirmation and password reset.
- PostHog: Product analytics and error tracking (United States).
- Tawk.to: Live chat, only if you accept cookies.
- Stadia Maps: Routing for isochrone geofences and trip arrival times. Receives coordinates, never who they belong to.
- Paddle: Sells paid plans as our reseller and merchant of record: takes payment, sends invoices and handles sales tax. We never see or store your card details.
Some of these companies are outside your country, including in the United States and Japan. Where the law requires it, transfers are covered by the processor's data processing terms, such as the EU Standard Contractual Clauses.
Legal basis
- Running your account and the service: the contract between us.
- Security, abuse prevention and anonymous error tracking: our legitimate interest in a working, safe service.
- Analytics cookies and the live chat: your consent, which you can withdraw at any time.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, object to how we use it, or withdraw consent. Email [email protected] from your account's address, and we'll answer within 30 days. Deleting your account deletes its projects, keys, geofences and events. If you're unhappy with our answer, you can complain to your local data protection authority.
Changes
If this policy changes, we'll update the date at the top. If a change materially affects how we use your data, we'll also email account holders.