Privacy Policy

Maplista is operated by Tonoid SASU, a société par actions simplifiée unipersonnelle (SASU) registered in France. Tonoid SASU is the data controller for the purposes of the General Data Protection Regulation (EU) 2016/679.

• Registered address: 4 rue Jean Rey, 78220 Viroflay, France
• Registration: RCS Versailles 879 475 788 (SIREN 879 475 788)
• Contact for anything on this page: [email protected]

We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring, and we do not process special categories of data.

This is the shortest way to understand Maplista, so it comes first. Your Google Maps lists, the places in them, your notes, your ratings and your addresses live in your own Google account. The extension reads and edits them through your own signed-in Google session, inside your browser. They are cached on your device so the app is fast offline, and they are never uploaded to, or stored on, a Maplista server.

We do not have a copy of your library. We cannot browse it, we cannot hand it to anyone, and it is not in our backups. If you delete your Maplista account, there is nothing of your library for us to delete, because there never was anything.

• Account data. Your name, email address, whether that email is verified, and a hashed password. We need these to give you an account at all. Legal basis: performance of a contract.
• Billing state. Your Polar customer and subscription identifiers, your plan status and its renewal date, and whether you hold a one-time Forever licence. We never receive or store your card number. Legal basis: performance of a contract.
• Usage counters. How many AI credits remain of your 5,000 free allowance, and how many suggested moves you have applied. These exist to enforce the plan limits and nothing else. Legal basis: performance of a contract.
• City votes. If you vote for a city on the 4.8 Club board, we record the city, the weight of your vote, a random device identifier stored in your browser, your account id if you are signed in, and a one-way hash of your IP address. The hash exists to stop one person voting a thousand times; it is not reversible into an IP address. Legal basis: legitimate interest in keeping a public vote honest.
• Launch waitlist. If you ask to be told when Maplista opens, or when a Safari or Firefox build happens, we record your email address, which of those three you asked about, a random device identifier stored in your browser, and a one-way hash of your IP address. The hash exists to stop one person filing a thousand addresses; it is not reversible into an IP address. We use your address for that one announcement and nothing else, and we do not send it to anyone. Legal basis: your consent, which you can withdraw at any time by writing to us; the IP hash rests on our legitimate interest in keeping the count honest. Asking about a Safari or Firefox build is how we decide whether to write one; it is not a promise that either exists.
• Product analytics. Which features you use, which plan you are on, counts such as how many places are in your library, and, on the public pages only, which page you opened and what sent you there. Legal basis: legitimate interest in knowing what to build next.
• Server and connection logs. Standard request logs kept briefly for security and debugging.

This is the one feature where information about your places leaves your browser, so it deserves its own section rather than a clause.

When you run auto-organize, the names, categories, ratings and cities of the places you asked it to sort, together with your list names, are sent through our server to Google’s Gemini API, which returns the suggested grouping. We do not store that content, and we do not log it. Nothing is sent unless you start a run, and nothing is applied to your Google Maps lists until you review the suggestions and choose to apply them.

If you never use auto-organize, no information about your places leaves your device through Maplista at all.

We use PostHog, hosted in the European Union, and it is configured about as narrowly as the tool allows. Session recording is off, so we never watch a replay of your screen. Autocapture is off, so we do not hoover up every click. On the public pages (the home page, pricing, the 4.8 Club, the blog) we record which page was viewed and where the visit came from. Inside the dashboard, where your saved places are on screen, pageview capture is off. Analytics requests are proxied through our own domain rather than sent to a third-party host by your browser.

We never send place names, notes, addresses or list names to analytics, on any plan. What we send are events like “a library was loaded” with a count attached, and “checkout started” with the plan name.

• A session cookie, set when you sign in. Strictly necessary; the site cannot keep you signed in without it.
• An access cookie while Maplista is in private beta, recording that you entered the access password.
• Local storage on your device for your theme, your onboarding progress, a random device id, which is attached to a city vote or a waitlist signup so one person cannot be counted a thousand times, and a note that the browser extension has been seen here before, so an install is counted once instead of on every visit.
• IndexedDB on your device, holding the cached copy of your own Google Maps library.
• An analytics cookie set by PostHog to tell repeat visits apart.

Clearing your browser storage clears all of it. Your Google Maps lists are unaffected, because they were never in there in the first place; they are in your Google account.

We use the following processors. Each one is named, with what it receives, so you can check any of them yourself.

We do not sell your personal data, and we do not share it with advertisers. Where a processor is outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses.

• Account and billing data: for as long as your account exists, then deleted. Records we must keep for French accounting and tax law are retained for the statutory period, which is generally ten years for invoices.
• Usage counters: deleted with the account.
• City votes: kept while the board runs, since deleting them would change a published tally. Your account link is removed with your account.
• Waitlist addresses: kept until the announcement they were left for has been sent, or until you ask us to remove yours, whichever comes first.
• Server logs: a matter of days.
• Analytics: retained by PostHog under their EU retention policy.

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can withdraw consent where consent was the basis, without affecting what came before.

Write to [email protected] and we will answer within one month. If you are not satisfied, you may complain to the CNIL, the French supervisory authority, at cnil.fr, or to the authority where you live.

Maplista is not intended for children under 15, the age of digital consent in France. We do not knowingly create accounts for them.

Passwords are hashed. Traffic is encrypted in transit. Our servers are in the EU and our database is not publicly reachable. The largest security fact about Maplista is architectural rather than procedural: we do not hold your saved places, so a breach of our systems cannot expose them.

No system is perfectly secure, and we will not claim otherwise. If you find a vulnerability, please write to us before disclosing it.

If we change this policy in a way that matters, we will update the date at the top and, for material changes affecting existing accounts, email you. Continuing to use Maplista after a change means you accept the updated policy.

See also the Terms of Service and the billing answers on the pricing page.