Privacy policy

• Email address, name, and avatar (from Supabase Auth or Google sign-in)
• Your organization name and members
• Maps, pins, categories, schedules, photos, and settings you create
• Stripe customer + subscription metadata for paid plans
• Server logs (request paths, status codes, durations) for debugging

• Event records: map_view, qr_scan, pin_view, directions_click — keyed to the map and (if applicable) QR campaign
• A truncated SHA-256 hash of the visitor IP (not the IP itself)
• User-agent string and Vercel-supplied country code
• Referrer URL

We do not store precise viewer location. The “sort by nearest” feature uses the browser's geolocation API client-side and discards the result. Map owners see aggregate counts only — never individual viewers.

• Vercel — hosting + edge cache
• Supabase — database, auth, file storage
• Mapbox — map tiles + Permanent Geocoding for saved location data
• Stripe — billing and payments
• Resend — transactional email (magic links, invites, reports)

• Sell your data to third parties
• Use third-party advertising trackers
• Show viewer-level analytics to map owners
• Store precise GPS coordinates of map viewers

We use cookies only for authenticated sessions (Supabase Auth) and password-protected map access. No analytics cookies. No advertising cookies.

You can export or delete your data from your account at any time. Deleting an organization soft-deletes it and hard-deletes it after 30 days. For specific data requests, email privacy@mappablelinks.com.

Mappable Links is not directed at children under 13. School-event templates intentionally don't allow student names on public maps.

Material changes will be announced by email. The date at the top of this page reflects the last update.