Privacy Policy

Last updated: 28 September 2026

This policy explains what personal data Mapssy processes when you use mapssy.com, why, who else receives it, and what your rights are. We try to collect as little as possible: you can compare routes without an account, and Mapssy does not keep your routes on its servers.

1. Who is responsible

Mapssy (mapssy.com) is operated by Jozef Olbert, Slovakia. Mapssy is co-owned by Jozef Olbert and Maximilian Sopuch. For help, accounts and billing, email [email protected]. For legal, privacy and press questions, email [email protected].

Under the EU General Data Protection Regulation (GDPR), Jozef Olbert is the controller responsible for the personal data described in this policy. For anything about your data, email [email protected].

2. The short version

You can compare routes without an account. The places you enter pass through our server to Google so it can find them and calculate the route. We do not store them.
Your location is used only when you tap “Use my location” and allow it in your browser, to fill in your starting point and to plan the trip with Google. Mapssy does not store it on its servers or use it for ads, and it never appears in a Mapssy page address. If you open Waze from a result, its link includes it as the start point.
If you create an account, we keep your email address, your (hashed) password, the name you give us, and whether you have Mapssy Pro (and until when, if it came from a free invitation; we also note which invitation you used and when).
Stripe handles payments for Mapssy Pro. We never see your card details.
Google AdSense shows ads on our content pages. In the EEA, the UK and Switzerland, Google asks for your consent before it uses advertising cookies.
We do not sell your personal data.

3. What we process and why

Visiting the website

When you open a page, your browser sends the technical data every website receives: your IP address, browser type and version, the address of the page you asked for, and the date and time. Our site runs on Netlify and is reached through Cloudflare’s network, and both process this data to deliver the page and protect the site against attacks. They may keep short-lived technical logs under their own terms. We do not use this data to identify you.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in running a secure, working website.

Comparing routes (no account needed)

When you type a place, the text you type (from the third character) is sent to our own server function (/api/search), which asks the Google Places API for matching places and, once you pick one, for its location. When you compare a route, the start and destination (their coordinates and, for places you typed, their names) are sent to our server function /api/route, which asks the Google Maps Platform Routes API for the driving time, the distance and the route line. The map on the results page is drawn by the Google Maps Static API from that route line, fetched through our server function /api/map. If you have Pro and choose route options (roads to avoid, or a later departure time), those options go along too, together with your sign-in token, which our server checks with Supabase to confirm that your account has Pro. The token is not passed on to Google.

These requests to Google are made by our server, not by your browser, so Google does not get your IP address from them. Our route, search and map functions do not save your places to a database and do not write them to logs. The place text you type, and the coordinates when you use your location, are part of the web address of our search requests, so Cloudflare and Netlify may briefly keep them in their technical request logs (see “Visiting the website”). Comparing sends nothing to Apple or Waze: the Apple Maps and Waze times on Mapssy are our own estimates, calculated from the Google result.

Legal basis: Art. 6(1)(b) GDPR, because we need this data to give you the comparison you ask for.

Your location

The website asks for your location only when you tap Use my location on the route planner, to fill in your starting point, and your browser asks for your permission first. If you allow it, your coordinates are sent to /api/search (Google Geocoding API, to show a nearby address) and, when you compare a route, to /api/route (Google). Mapssy does not store your location on its servers and does not use it for advertising. If you have Pro, it is saved on your device as part of your search history (see “Search history (Pro)”). It is never put into a page address: the route planner hands it to the results page through your browser tab’s session storage, which is cleared when you close the tab. You can take back the permission at any time in your browser’s site settings.

Legal basis: Art. 6(1)(a) GDPR, your consent, which you give and can withdraw in your browser.

The address of your results page

The link of a results page contains the places you typed, as place names and coordinates (for example/results?toName=…&toLat=…), so it stays in your browser history and anyone you share it with can see those places. If you used your location, the link says only that you started from your location (fromCurrent=1); your coordinates are not in it.

The route tool and the sign-in pages don’t load Google’s advertising code when you open them directly. If you arrive from a page that has already loaded it, it stays loaded in that tab, but we show no ads on the route tool and send Google nothing about your route.

When you follow a link from Mapssy to another website, our security settings tell your browser to send that site only “mapssy.com”, not the full link.

Opening a route in another app

When you tap a result, Mapssy opens Google Maps, Apple Maps or Waze with your start and destination in the link. From that point, the privacy policy of that app or website applies.

Your account (optional)

If you create an account, we store with it:

your email address and your password, which our sign-in provider Supabase stores only in hashed form, so nobody at Mapssy can read it;
your first and last name, if you give them;
when the account was created, confirmed and last signed in to;
your plan (Free or Pro), whether you bought Lifetime Pro, and your Stripe customer ID once you have started a Pro checkout;
for each signed-in session, the IP address and browser type (user agent) that Supabase records, to keep your account secure;
places you save (such as home or work) where a Mapssy app offers saved places. Only you can read them;
notes you save in our internal Workbench tool, if you use it. Only you can read them.

We also keep internal business notes in the same database (for example, notes of calls with companies, which can include a contact’s name, company, phone number and website), based on our legitimate interest in running Mapssy (Art. 6(1)(f) GDPR).

We send the emails your account needs (confirming your sign-up, changing your email address, resetting your password, and 6-digit confirmation codes) through our email provider, Resend. The sign-up, sign-in and password-reset forms are protected by Cloudflare Turnstile (see “Security and bot protection” below).

Legal basis: Art. 6(1)(b) GDPR for running your account; Art. 6(1)(f) GDPR for the session records and bot protection, our legitimate interest in keeping accounts secure.

Mapssy Pro and payments

When you start a Pro checkout, we send Stripe your email address and your internal Mapssy account ID so Stripe can create a customer record. You enter your payment details on Stripe’s own checkout page. We never see or store your card details.

Pro purchases use Stripe’s Managed Payments service. The checkout, your receipts and your bank statement show the purchase as sold through Link, Stripe’s payment service. Stripe (through Link) charges you, calculates and collects any VAT, sends receipts and invoices, and handles payment questions. Stripe processes your payment data under its own privacy policy: stripe.com/privacy.

Because Stripe (through Link) sells Pro to you as merchant of record, Stripe is its own controller for the sale and the payment.

Stripe tells our server when a subscription or purchase starts, changes or ends, and we store only the result with your account: your plan, your Stripe customer ID, and whether you bought Lifetime Pro.

Legal basis: Art. 6(1)(b) GDPR for selling and providing Pro; Art. 6(1)(c) GDPR for records that tax and accounting law requires us to keep.

Withdrawing from a Pro contract

If you use our withdrawal function, we receive your name, your email address, the order or receipt number (or account email) you give to identify the contract, anything else you choose to add, and the date and time you sent the notice. The form is protected by Cloudflare Turnstile and a hidden anti-spam field. Resend delivers the notice to [email protected] and a copy to the email address you entered. We do not save the notice in our database; we keep the emails as long as we need them to handle your withdrawal and refund, and to show that we did if there is a dispute.

Legal basis: Art. 6(1)(c) GDPR, because consumer law requires us to offer this function and to confirm your notice; and Art. 6(1)(b) GDPR, because it concerns your contract.

Search history (Pro)

If you have Pro, Mapssy remembers your last 20 compared routes. This history is stored only in your browser on that device (see the Cookie Policy) and is never sent to us. You can delete it under Settings → Search History, or by clearing this site’s data in your browser. It is not removed automatically when you sign out or delete your account, so clear it on a shared device.

Contact form and email

If you use our contact form, we receive your name (optional), your email address and your message. The form is protected by Cloudflare Turnstile and a hidden anti-spam field. Your message is sent by Resend to [email protected], with your email address as the reply address. Emails to our @mapssy.com addresses are forwarded by Cloudflare Email Routing to the mailbox where we read them, which is hosted by our email mailbox provider. If you email us directly, we receive your email address and whatever you write.

Legal basis: Art. 6(1)(b) GDPR where your message is about your account, a purchase or a possible purchase; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering the people who write to us.

Security and bot protection

All traffic to mapssy.com passes through Cloudflare, which protects the site from attacks and abuse. On the sign-up, sign-in, password-reset, contact and withdrawal forms we use Cloudflare Turnstile, an “I’m not a robot” check. To tell people from bots, Turnstile processes your IP address and browser signals such as the user agent and a TLS fingerprint. Cloudflare uses these signals to detect bots and, as its own controller, to improve its bot detection. See the Turnstile privacy addendum.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the site and its forms free of abuse.

Advertising (Google AdSense)

We show ads from Google AdSense on our content pages, such as the About page and our guides and articles. We do not show ads on the route tool, account pages or legal pages. The AdSense code loads only on the home page, About, How it works and the guides, so there Google may receive technical data such as your IP address and the page you are viewing. Other pages don’t load it when you open them directly; if you reach them from a page that already loaded it, it stays loaded in that tab, and pressing Cookie settings loads it too.

Third party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
Google’s use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
Other third-party vendors and ad networks that Google works with may also use cookies to serve ads on this site. Google’s consent message lists each of these partners by name, with links to their privacy policies, and you can accept or refuse each one there. Google also publishes the list of ad technology providers it works with in the EEA and UK.
You can opt out of personalised advertising in Google’s Ads Settings. You can opt out of other vendors’ use of cookies for personalised advertising at www.aboutads.info/choices or, in Europe, at www.youronlinechoices.eu.
Google explains how it uses data from websites that show its ads in How Google uses information from sites or apps that use our services.

Your consent. If you are in the European Economic Area, the United Kingdom or Switzerland, Google’s consent message asks for your choice before advertising cookies are used. It is a Google-certified consent management platform that follows the IAB Transparency & Consent Framework. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page. If you do not consent, Google may still show ads that are not personalised and use limited or no data about you. Outside those regions, Google may use cookies for ads under its own policies, and you can use the opt-out links above.

Google processes advertising data as its own controller under the Google Privacy Policy.

Legal basis: for advertising cookies and personalised ads, Art. 6(1)(a) GDPR, your consent, together with § 109(8) of the Slovak Electronic Communications Act (Act No. 452/2021 Coll.). For loading Google’s code and consent message, and for ads without cookies if you refuse, Art. 6(1)(f) GDPR, our legitimate interest in financing Mapssy through advertising. Google and its partners decide for themselves how they use this data.

Affiliate links

The results page can show affiliate links, for example to car rental or parking providers. These links are switched off unless we have set them up. When shown, they are labelled as affiliate links and marked rel="sponsored". They are plain links: nothing is sent to the partner unless you click, and we do not pass your route to them. If you click and buy something, we may earn a commission, and the partner processes your data under its own privacy policy.

Fonts

Our typefaces are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser connects to Google, which receives your IP address. The route map is not loaded from Google by your browser: it comes from our own server (see “Comparing routes”).

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing the site properly.

4. Who receives your data

We share personal data only with the services we need to run Mapssy:

Netlify (USA): hosting of the website and our server functions. Processor.
Cloudflare (USA): network, security, Turnstile and email forwarding. Processor; for improving Turnstile, its own controller.
Supabase (USA): accounts and sign-in. Our database is hosted in the EU (Ireland). Processor.
Resend (USA): delivery of account emails, contact-form messages and withdrawal notices. Processor.
Our email mailbox provider: hosting of the mailbox where we read emails sent to support@ and [email protected]. Processor.
Google: place search, route calculations and the route map (Google Maps Platform), ads (Google AdSense) and fonts (Google Fonts). Independent controller for ads; for routes and fonts under Google’s own terms.
Stripe, including Link (Ireland/USA): sells Mapssy Pro to you as merchant of record and takes the payment. Independent controller.
Affiliate partners: only if you click one of their links.
Authorities and courts: only where the law requires us to disclose data.

Each of these providers also has its own privacy policy. We do not sell your personal data.

5. Transfers outside the EU

Several of our providers are based in the USA or may process data there (Netlify, Cloudflare, Supabase, Resend, Google and Stripe). Where personal data goes to the USA, we rely on the EU–US Data Privacy Framework for providers certified under it, or on the European Commission’s Standard Contractual Clauses. For other countries outside the EU and EEA, transfers rely on an adequacy decision of the European Commission or on Standard Contractual Clauses.

6. How long we keep data

Places, routes and your location: not stored by Mapssy’s servers. They are used only to answer your request. Pro search history stays on your device only.
Your account: until you delete it. You can do this yourself under Settings → Delete account; the account and the data linked to it in our database are deleted straight away. Copies can remain in our providers’ backups for a short time until those are overwritten.
Sign-in sessions and sign-in logs: until you sign out or the session expires; Supabase keeps its technical sign-in logs for a short time under its own retention.
Payments: Stripe keeps payment records under its own policies and the law. Records we must keep for tax and accounting are kept as long as Slovak tax and accounting law requires. Deleting your Mapssy account does not delete the customer record at Stripe and does not cancel an active subscription: cancel it first with Manage subscription on the Pro page.
Messages to us: as long as we need them to deal with your request and any follow-up, unless we need them to establish or defend legal claims. Resend keeps a copy of each email it delivers for a limited time under its own retention settings.
Browser storage: until you clear it. See the Cookie Policy.
Advertising data: Google keeps it under its own policies.

7. Cookies and browser storage

Mapssy itself sets no cookies. It uses your browser’s local storage to keep you signed in and to remember your settings. Cloudflare may set short-lived security cookies, and Google sets advertising cookies (in the EEA, the UK and Switzerland only with your consent). The full list is in our Cookie Policy.

8. Your rights

Under the GDPR you have the right to:

get a copy of the personal data we hold about you (access, Art. 15);
have wrong data corrected (rectification, Art. 16);
have your data deleted (erasure, Art. 17);
have its use restricted (restriction, Art. 18);
receive the data you gave us in a common, machine-readable format (portability, Art. 20);
object to processing based on our legitimate interests (objection, Art. 21);
withdraw your consent at any time, without affecting what happened before (Art. 7(3)). For ads, use Cookie settings at the bottom of every page; for location, use your browser’s site settings.

Right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. Email [email protected]. We then stop unless we have compelling legitimate grounds or need the data for legal claims.

You can change your email address and password and delete your account yourself in Settings. For everything else, email [email protected]. We may ask you to confirm that the account is yours, for example by writing from its email address. We answer within one month.

You also have the right to lodge a complaint with a data protection authority. In Slovakia this is the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Galvaniho 7/B, 821 04 Bratislava, [email protected], dataprotection.gov.sk. You can also complain to the authority in the EU country where you live or work.

9. Do you have to give us data?

No. You can use the route tool without an account; it only needs the places you want to compare. To create an account, you need an email address and a password. To buy Pro, Stripe needs your payment details.

10. Automated decisions

Mapssy does not make decisions based solely on automated processing that have legal or similarly significant effects on you. When you pay, Stripe may run its own automated fraud checks, as described in Stripe’s privacy policy.

11. Children

Mapssy is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email [email protected] and we will delete it.

12. Security

The whole site uses HTTPS with strict security headers. Passwords are stored only in hashed form. Our database only lets each account read its own data. The keys for Google and Stripe stay on our server and never reach your browser.

13. Changes to this policy

We update this policy when Mapssy or the law changes, and the date at the top shows the latest version. If a change significantly affects how we use the data of account holders, we will also tell them by email.