PRIVACY
What is stored, and why.
Effective 1 September 2026, updated 18 October 2026. Applies to merestonemaps.com. The app on iPhone, iPad, Mac and Apple Watch has its own privacy policy, linked from the App Store.
If you only look at the map
Nothing about you is stored. When a layer is fetched, your browser asks merestonemaps.com for the area on screen, and merestonemaps.com asks the publishing agency's service for that area. The agency receives merestonemaps.com's request, not yours: it sees our server's address and the area, never your address. Our server keeps the answer in a short cache so the next person looking at the same area gets it faster. The base map itself (streets, coastlines, place names) comes straight from OpenFreeMap, which sees your address the way any website you visit does. Satellite and aerial imagery, if you switch the base map to one of them, also comes straight from the agencies that publish it: the Copernicus Sentinel-2 mosaic from Germany's Federal Agency for Cartography and Geodesy (BKG), and the orthophotos from the national or regional mapping agency for the area on screen. Each of them sees your address and the area you are looking at, in the same way. None of them is contacted unless you choose one of those base maps. Server logs held by Cloudflare, which hosts the site, contain your IP address for a limited time for security and abuse prevention. Searching for a place sends what you type to Nominatim, OpenStreetMap's search service, which sees that text and our server's request. A grid reference is worked out on our own server and is not sent anywhere.
If you sign in
Your email address, the date you signed in, the language you used, and a record of each sign-in session (when it started, when it was last used, and the browser it came from, so you can sign out everywhere from your account page). Sign-in emails are sent through Resend, a transactional email service, which processes your address to deliver them. Sessions last 30 days and are extended when you visit. When a sign-in link is requested we also record the IP address it came from, so the same address cannot request an unlimited number of links. That record is deleted with the expired link, within a day. In the app you can sign in with a six-digit code sent by email instead of a link: the code is stored only in scrambled (hashed) form, expires after 10 minutes and is deleted within a day. When a sign-in code, or a code to link App Store purchases, is requested from the app, the IP address of that request is recorded in the same way and deleted within a day of the code expiring. A session opened from the app records the app and system version it came from, as a browser session records the browser.
If you subscribe
Checkout is handled by Stripe as the merchant of record; the seller on your receipt and statement appears as Onelink, Stripe's merchant service. Stripe collects your payment details and billing address on its own pages and processes them as a controller in its own right under its own privacy policy (stripe.com/privacy); merestonemaps.com never sees your card number. To open checkout we pass Stripe your email address, the plan you chose and an internal account identifier. We store which plan you chose, Stripe's identifiers for the subscription, its status and a log of the payment events Stripe reports to us, so the layers you pay for unlock while it is active. The account page links to Stripe's customer portal for managing the subscription.
If you link App Store purchases
Purchases made in the App Store can be linked to your Merestone account so that they also work here. For each linked purchase we store what Apple has signed: the transaction number, the product, the date of purchase, the end date of a subscription, and whether Apple has refunded or revoked it. Apple tells us about refunds and renewals directly, and we check linked purchases with Apple each night, so a refund removes access here too. We never see your Apple Account, your name or your payment details. Unlinking a purchase, or deleting your account, removes the record. A copy of each notification Apple sends this server about a purchase, linked or not, is forwarded to a private alert service that tells the developer a sale or refund happened, as a Telegram message. It carries Apple's transaction record, never your name, email or Apple Account.
If you use the cancellation form
We store the email address you give, the contract, the kind of cancellation, the date you want it to take effect, any reason, the date and time it arrived and the IP address it came from. We need this to carry out and confirm the cancellation and to be able to show that and when it arrived; the IP address is used only to limit automated mass requests. The confirmation is sent through Resend to the address given, with a copy to support@merestonemaps.com. The IP address is deleted after seven days, the rest of the record after three years.
What is never done, cookies and local storage
No advertising, no analytics trackers, no selling of your data and no passing it on for advertising, no marketing email. The only cookie is the session cookie that keeps you signed in; it is set only after you sign in. Your browser also remembers, in its local storage, the light or dark appearance and the base map you chose; these entries never leave your device. Both are strictly necessary to provide the service you asked for, so they need no consent (§ 25(2) no. 2 of the German TDDDG and the equivalent rules elsewhere). You can delete both in your browser at any time.
Recipients and transfers outside the EU
The controller is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. We use these processors: Cloudflare, Inc. (United States) for hosting, the database and server logs; the database is held in Western Europe, but requests pass through Cloudflare's worldwide network. Resend (United States) to send sign-in and confirmation emails. Stripe receives what checkout needs and acts as a controller in its own right (see above). For linked App Store purchases, Apple receives our queries about those transactions. Transfers to the United States rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses and the UK addendum to them. Notifications about App Store purchases are passed through the developer's own alert service to Telegram, which is based outside the EU; they carry Apple's transaction record and nothing that identifies you directly.
Your rights
You can delete your account yourself, from your account page here or in the app (Settings, Merestone account). Deleting it removes your email, your sessions, your purchases made on this website and any linked App Store purchases; Stripe keeps its record of past payments for as long as the law on accounting requires. You can also see what is held about you, or ask for it to be deleted, by emailing support@merestonemaps.com from the address you signed in with. The log of Stripe payment events for the account (Stripe's identifiers and amounts, never your card) is deleted with it.
The legal basis, retention and your rights
Legal bases (Art. 6(1) GDPR): the account, subscriptions, linked purchases and cancellations are processed to perform the contract with you (point b); server logs, the short cache, abuse protection (the IP addresses kept with sign-in links and codes) and showing the map without an account rest on our legitimate interest in a secure, working service (point f); records that tax or accounting law requires us to keep rest on point c. Without an email address no account or subscription can be set up. There is no automated decision-making. Retention: account data until you delete the account; sign-in links, codes and their IP addresses until a day after they expire; cancellations as described above; the request logs we can read ourselves for no more than seven days; Cloudflare keeps its own server logs for a limited period under its own policy. You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR): write to support@merestonemaps.com, ideally from the address you signed in with. You may complain to a data protection authority, in particular in the EU country where you live or work, or to the UK Information Commissioner's Office (ico.org.uk).
Your right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. A short email to support@merestonemaps.com is enough.
Who is responsible
The controller under the GDPR is Leon Nelio Figueira, sole trader, United Kingdom; the full postal address is on the Legal notice page. Contact: support@merestonemaps.com.