Privacy Policy

Last updated: 9 October 2026

This policy explains what personal data Mapsev (mapsev.com) processes, why, and your rights. Our servers are hosted by DigitalOcean in Frankfurt, Germany (EU).

What we collect and why

• Account: when you sign in with Google we receive your email address, name and profile picture. When you sign in with Telegram we receive your Telegram user id, name, username and profile picture link, the details Telegram's login shares; Telegram does not share your phone number with us, and you allow our Telegram bot to send you messages about your account, which you can stop with the link in each message or by blocking the bot; what you write to the bot reaches our support team. Used to identify your account and your subscription. A signed session cookie keeps you signed in.
• Payments: if you subscribe, Paddle tells us the e-mail address you gave at checkout and its customer reference, used only to match your payment to your account.
• Location and routes: the app gets your position only through your browser's location permission: the browser, including the Tesla car browser, asks you first, and you can refuse it or withdraw it at any time in the browser's site settings. Linking a Tesla account or an OBD-II adapter never gives us your position: we receive only battery level, range and charging state. Your position and the places you route to are processed to compute routes, traffic, weather and charger information. They are used for the request you make and are not sold or used for advertising. Diagnostic logs may contain approximate positions and are kept only as long as needed for troubleshooting.
• Vehicle data (optional): if you link a Tesla account we store the access credentials Tesla issues, your cars' identifiers and names, and the latest charge readings. If you use an OBD-II adapter we store the readings it posts with your token. Used only to show your live charge level and plan charging.
• YouTube (optional): if you connect YouTube in the Music screen we ask Google for read-only access to your YouTube account (scope youtube.readonly). We read the names of your playlists, the videos in them, your liked videos and the results of searches you type, and store the refresh token Google issues so you stay connected. This is used only to show and play that content inside the Music screen; we never post, modify or delete anything on your account, and we do not use this data for advertising or share it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnect at any time from the Music screen or at myaccount.google.com/permissions; disconnecting deletes the stored token.
• Payments: purchases are handled by Paddle.com as Merchant of Record. Paddle collects your payment details and billing address under its own privacy policy. We receive and store only your Paddle customer identifier and the status of your subscription; we never see card numbers.
• Technical data: IP address, browser type and error reports, used for security, rate limiting and fixing bugs.
• Advertising measurement: when you arrive from an ad or an invite link, we keep which ad or link it was (its campaign fields and click id) and copy it to your account if you sign up, so we can count which ads bring customers. When you create an account or pay, we tell Meta (Facebook and Instagram ads) through its Conversions API: the event (sign-up, trial start, payment and its amount), your e-mail address and account id hashed (SHA-256), your browser's user agent, your IP address at sign-up, and the ad click id if you came from a Meta ad. Meta uses this to measure and improve our ads under its own privacy policy. Your position and routes are never sent.

How we protect your data

We apply the following measures to safeguard your information, and in particular sensitive data such as the Google/YouTube data you authorise, your Tesla vehicle credentials, and your location and routes:

• Encryption in transit: all traffic between your device, our servers and the providers we call is carried over HTTPS (TLS). HTTP Strict Transport Security is enforced across mapsev.com and its subdomains, so browsers only ever connect over an encrypted channel.
• Secure token storage: the OAuth tokens for sensitive access — your YouTube refresh token and the credentials Tesla issues — are held only on our servers, on a volume readable solely by the account service, with restrictive file permissions. They are never sent to the browser, embedded in pages, exposed to other services, or shared with third parties.
• Authenticated sessions: sign-in uses a cryptographically signed (HMAC-SHA256) session cookie marked HttpOnly, Secure and SameSite, so it cannot be read by scripts or replayed over an insecure connection. The signing key is stored server-side with restricted permissions.
• Least privilege: we request the minimum access needed — read-only for YouTube (youtube.readonly) — and never write to, modify or delete anything on your Google, YouTube or Tesla account. Payment card details are handled entirely by Paddle and never reach our servers.
• Access control and location: our servers are hosted by DigitalOcean in Frankfurt, Germany (EU), with administrative access restricted to the operator. Sensitive stores are not exposed to the public internet.
• Deletion: the YouTube token is deleted the moment you disconnect YouTube; Tesla credentials are deleted when you disconnect your car; and you can have your account and all its data deleted on request. You can also revoke our access directly in your Google or Tesla account at any time.

No method of transmission or storage is completely secure, but we work to protect your data using the measures above and review them as the service evolves. If a breach affecting your data occurs, we will notify affected users and the relevant authorities as required by law.

Third parties

We use map, traffic, weather, geocoding and charger data providers to serve your requests, Google and Telegram for sign-in, Google for YouTube content you authorise, Tesla's Fleet API for vehicle data you authorise, Paddle for payments, and Meta to measure our ads (see Advertising measurement above). Each receives only what is needed for its function.

Retention

Account and subscription data are kept while your account exists. Vehicle credentials are deleted when you disconnect your car; the YouTube token is deleted when you disconnect YouTube. Diagnostic logs are short-lived. You can ask us to delete your account and its data at any time.

Your rights

You can access, correct or delete your data, withdraw consent for vehicle or YouTube access (disconnect in the app, or revoke in your Tesla or Google account; for Telegram, end the session under Telegram's Settings › Privacy and Security › Active Websites), and object to processing. Contact [email protected]. EU residents may also complain to their data protection authority.

Cookies

We use a strictly necessary session cookie for sign-in and a guest cookie that protects map services from abuse. When you arrive from an ad or an invite link we also set our own cookie (mapsev_src, 30 days) that records which ad or link it was. We do not use third-party advertising cookies or tracking pixels.