Privacy policy
Last updated: 19 October 2026
[Company legal name], [Registered address], is the controller of the personal data described here. Contact us about privacy at support@opengeocoding.com.
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address, name, and your GitHub profile name and picture if you sign in with GitHub | Your account, verification, recovery, service and billing emails | Contract |
| Encrypted authenticator secret and recovery codes, verification attempts and temporary lockouts (if you enable 2FA) | Protecting your account with two-factor authentication | Contract, legitimate interest |
| Password hash (never your plaintext password) | Authenticating email/password sign-ins | Contract |
| Sign-in sessions: IP address, browser user agent, timestamps | Keeping you signed in, security | Contract, legitimate interest |
| API keys (stored only as a one-way hash) and the number of requests per key per day | Enforcing plan limits, billing, your usage dashboard | Contract |
| Connected-app authorizations, client identifiers, scopes, tokens and usage counts (if you connect an MCP app) | Authorizing the app and attributing its credit usage | Contract |
| Messages you send us | Answering you | Legitimate interest |
| Campaign labels and capture/consent timestamps, linked to your account only if you sign up after consenting | Measuring which campaigns lead to signups | Consent |
| Public-page paths, validated campaign labels, referral origins and browser/network information sent to Umami | Measuring traffic, visits and referral sources | Consent |
Geocoding queries. Our application does not persist query addresses or coordinates with your account or intentionally include them in application logs. The JSON API accepts queries in POST bodies; send API keys in a header, never in a URL. Infrastructure access logs may include request URLs and network information. The website demo sends addresses and coordinates in URL parameters, so those values can appear in infrastructure logs. Infrastructure logging and retention must be confirmed before launch; see the draft retention details below. If your queries contain personal data, see the data processing note below.
Live demo. To prevent abuse, we store a keyed hash of your IP/network (IPv6 /64), rate-limit counters and up to 30 recent attempt timestamps in Postgres. These identifiers are pseudonymous, not anonymous. Inactive records are eligible for deletion after 15 minutes and are removed by a minute-based cleanup task. Exceeding the request limit can send Sentry a warning containing the hashed network identifier and limit details, not the query or raw IP. We process these records for our legitimate interest in preventing abuse. The demo map also connects directly to OpenFreeMap, exposing your IP address and requested map tiles to that provider.
Signup abuse prevention. We keep a server-only hash of your email address to identify duplicate accounts, including common Gmail aliases. We also store keyed hashes of signup IP addresses (IPv6 addresses are grouped by /64) with counters to limit new accounts across our servers. We also use keyed email hashes with one-minute counters to limit password attempts and email requests across our servers. Failed passwords and temporary lockouts are recorded with keyed email hashes, timestamps and outcomes, without passwords, tokens or additional raw IP addresses. Separate failure counters can temporarily lock password sign-in for an account or an IP address/network (IPv6 /64) for 15 minutes; network counters combine failures across accounts. Network identifiers are keyed hashes. You can review recent password failures and manage your sessions in Account security; authorized administrators can also review these records and revoke sessions. These are pseudonymous identifiers, not anonymous data. We use them for our legitimate interest in preventing abuse of the free tier; no additional raw IP address is stored by these counters. The sign-in/signup page also loads Cloudflare Turnstile to distinguish people from bots. Cloudflare processes browser and network information, including your IP address, for this security check. We use it for the same legitimate interest in preventing abuse.
Signup notifications. When signup notifications are configured, we send your email address and verification status to a private Slack channel, including for accounts not yet verified. No passwords, tokens or API keys are included. We use these notifications for our legitimate interest in monitoring account creation and operating the service.
Connected apps. If you authorize an MCP app, we store its authorization, scopes and credentials and attribute its requests to your account. The app receives an account identifier and authorized geocoding results, not permission to manage your account. You can disconnect it in Dashboard → Connected apps. The app provider handles data it receives under its own privacy policy; authorize only apps you trust. Disconnecting does not delete data already held by the app provider.
Error monitoring. Server-side website and API errors, including the demo abuse warnings described above, are reported to Sentry for our legitimate interest in security and service reliability. Optional browser error reporting is separate: it starts only after you consent to Browser error reports in Cookie settings. Reports include technical information such as error types and stack traces. We exclude request bodies, headers, query parameters, account identity and breadcrumbs, and do not enable session replay. Browser connections expose your IP address to Sentry as part of network communication. Withdrawing browser consent stops future browser reporting; it does not disable server-side security monitoring.
Optional support chat. Chatwoot loads only after you consent to Support chat in Cookie settings and click “Chat with us” on a public page without URL query parameters. It processes your messages, any contact details you provide, browser and network information (including your IP address), and the page URL. Consent covers loading the optional widget and its cookies/storage; we use the content you send to answer your support request based on our legitimate interest in customer support. We do not automatically send your signed-in account details, API keys or demo queries. Do not include API keys or personal address data in chat messages. Chatwoot Cloud is hosted in the United States. Email support remains available without chat consent.
Campaign attribution. With your consent, we remember the first valid campaign link you visit using a first-party cookie. We accept only utm_source, utm_medium, utm_campaign and utm_content, up to 100 letters, digits, dots, underscores or hyphens each; utm_source is required. Do not put personal information in campaign labels. We do not store the full landing URL, referrer, query strings, click identifiers or browsing history for attribution. On account creation through email or GitHub, we validate your consent again, associate these labels and capture/consent timestamps with the account, and delete the attribution cookie. These labels are user-editable and are not proof of referral or eligibility for rewards. The attribution cookie and account-linked attribution records are not sent to Umami; validated campaign labels in public-page URLs can separately be sent as described below.
Optional traffic measurement. With your consent and when configured, we send public-page views to Umami Cloud. This includes our public website identifier, the public page’s hostname/path, the same validated campaign labels described above, and only the origin (scheme and host) of an external referring website. We exclude account, login, administration, OAuth, API and error pages, URL fragments and all other query parameters. Events contain no account identifier, email, API key or geocoding input. Do not put personal information in campaign labels. Browser requests expose your IP address and User-Agent to Umami, which uses these to derive visitor counts, approximate location and browser/device statistics; see its privacy notice. We do not send account-linked attribution records, distinct visitor identifiers, signup events, payments or API usage to Umami. This integration adds no analytics cookies, local storage, session replay or third-party scripts, and does not retain Umami cache tokens. Declining consent sends no traffic events; withdrawing consent stops future events, not events already received by Umami. Reports cover consenting visitors only.
Cookies
Necessary cookies support sign-in sessions, GitHub sign-in, temporary two-factor authentication challenges and resuming an app authorization after sign-in. Our first-party og_consent cookie remembers your optional-service choices for 180 days; it contains the preference version, timestamp and your chat/error-reporting/analytics choices, not an account identifier. Preference version 4 covers Umami traffic measurement as well as first-party campaign attribution; older preferences require a fresh choice. It is host-only, uses SameSite=Lax and is Secure over HTTPS.
Support chat, Browser error reports, Traffic measurement and Campaign attribution are off by default. Choose Approve all to allow these optional purposes or Disallow all to keep them off. Necessary cookies remain enabled with either choice. Approval is not required to use the website, API or email support. Chatwoot can set conversation cookies (including cw_conversation) and use browser storage only after chat consent and opening the widget. We do not use advertising cookies.
The host-only og_attribution cookie stores the first valid campaign’s labels and capture timestamp for up to 30 days, without extending its expiry on later visits. It uses Path=/, SameSite=Lax and Secure over HTTPS. It is set only after consent on the homepage, pricing, enterprise or documentation pages, and survives navigation and sign-in redirects. Withdrawing consent removes pending attribution from this browser and stops future collection. To withdraw consent for attribution already saved with an account and request its deletion, contact support@opengeocoding.com; clearing browser cookies does not identify or delete the account record.
Use Cookie settings in the footer to accept, reject or change optional choices at any time. Withdrawing a previously allowed category reloads the page to stop the loaded SDK. Withdrawing chat consent also removes Chatwoot’s accessible first-party cookies. It does not erase past support messages or storage on Chatwoot’s own domain; contact us to request deletion of support records. Preferences synchronize between open tabs where supported and are checked again when a tab regains focus. After expiry, or if a preference is invalid, we ask again and optional services remain off.
Providers and other recipients
- [Hosting provider and region], which runs our servers and database
- Brevo, for email verification, password recovery and service emails
- Slack, when signup notifications are configured, for private account-creation alerts (privacy policy)
- GitHub, if you choose to sign in with GitHub
- Cloudflare, for Turnstile verification on the sign-in/signup page (privacy policy)
- OpenFreeMap, which serves the demo’s map tiles to your browser
- Sentry, for website and API error monitoring (privacy policy)
- Umami Cloud, if configured and you consent to traffic measurement, for public-site traffic statistics (privacy notice)
- Chatwoot, if you consent to and open support chat, for customer support conversations (privacy policy)
These recipients do not all act in the same role: for example, GitHub and an app you choose to connect may process data independently under their own terms. Before launch, we must confirm each provider’s role, processing locations, data processing agreement where required, and any international-transfer mechanism. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. The provider-specific arrangements and how to obtain copies of safeguards remain subject to legal review.
How long we keep it
- Accounts and usage: account records, email fingerprints, revoked API-key records and daily usage counts do not currently have an automated deletion schedule. Request account closure or deletion at support@opengeocoding.com; there is no self-service deletion. A final retention schedule, including backups and any legally required records, must be set before launch. We do not claim that all usage data must be retained for tax purposes.
- Signup and email-rate counters: expire after their configured windows (one minute to 30 days) and are removed at the next signup. Password-failure counters expire after their 15-minute window or lockout and are likewise cleaned up on signup.
- Password-failure history: entries older than 30 days are deleted by a minute-based cleanup task.
- Demo rate limits: inactive records are removed by a minute-based cleanup task once their last update is more than 15 minutes old. Continued activity refreshes that time.
- Sessions and connected apps: session and token validity ends on expiry or revocation; expiry is not a promise of immediate record deletion. Disconnecting an app deletes its authorization and stored access/refresh-token records and revokes its metering key. Daily usage records remain.
- API authentication lockouts: SHA-256 network identifiers and expiry timestamps are valid for up to 15 minutes and removed on the next background sync. These identifiers are pseudonymous, not anonymous.
- Campaign attribution: the browser cookie lasts up to 30 days and is cleared on signup or withdrawal of browser consent. Account-linked attribution older than 90 days is deleted by the minute-based cleanup task; it can be deleted sooner on request and is automatically removed if the account is deleted.
- Cookie preferences: 180 days, unless replaced or cleared sooner.
- Provider records: access-log, Sentry-event, Slack-alert, Umami analytics, support-message and backup retention settings must be confirmed before launch. We do not promise an unverified 14-day log retention or a particular Chatwoot plan’s retention.
Your rights
You can access, correct, export or delete your personal data, object to or restrict its processing, and withdraw consent where we rely on it. Write to support@opengeocoding.com. You can also complain to your data protection authority.
Data processing for customers
For account administration and our own security operations, we act as controller as described above. Where you determine the purposes of geocoding personal data, we act as processor on your behalf to answer your requests. Contact support@opengeocoding.com to put a data processing agreement in place before submitting personal data for processing. Do not submit such data until the agreement is in place.
Changes
We will post changes here and email account holders about material ones.