Privacy policy for OPMaps
Last updated 19 September 2026
The short version: you can use the map, search and navigate without an account, and then we store nothing about you. If you create an account we store a username, an encrypted password and, if you choose, an e‑mail address. There are no ads, no analytics, and nothing is sold on.
Who is responsible
The data controller for OPMaps is Simon Ramezan (a private person, Sweden), who runs OurPrivacy.nu. You reach us at [email protected]. When a company takes over OurPrivacy.nu, it becomes the controller, and we will update this page.
Without an account
The map, search, routes, guidance, traffic and places work without an account. Then this applies:
- Searches and routes are sent to our server, which asks the map services on your behalf. The services see our server, not your phone. We do not log these requests or link them to anyone.
- Your position is used on the phone to show where you are and for guidance. It is read only while the app is open, never in the background. When the app fetches cameras, traffic and places it sends which map area you are looking at, not your exact position, and without any login.
- Saved places, recent searches, filters and settings stay on your phone. They are never sent to us and disappear when you uninstall the app.
With an account
You need an account to submit cameras, report traffic and vote on reports.
| What | Why | How long |
|---|---|---|
| Username | Login, and the leaderboard where usernames and points are shown openly. You can change it in the app once every 30 days | Until you delete the account |
| Password, stored as a one-way hash (bcrypt) that cannot be read | Login | Until you delete the account |
| E‑mail address, optional | Only to reset a forgotten password: we then send you a code and your username. A code works for 30 minutes and is stored only as a one-way hash. A new address is saved only after you have typed in a code we sent to it; until then it is kept for at most 30 minutes | Until you delete the account, remove the address yourself (Profile → Edit profile) or ask us to remove it |
| Points | The leaderboard | Until you delete the account |
| Moderation, only if it happens: a suspension and its reason, and a history of what a moderator did to the account (new password, changed username, suspension, removed e-mail) and when | To enforce the terms and to be able to answer you. The reason for a suspension is shown to you when you try to log in | Until you delete the account. The reason is removed when a suspension is lifted; the history stays with the account |
| Cameras you submit: photo, the camera's place, kind and direction, time | Review and, if approved, display on the map | Approved ones stay on the map. Rejected photos are deleted at once on rejection. |
| The place where the photo was taken | So the reviewer can see that the photo was taken on site | Deleted when the submission has been reviewed |
No real name, no phone number and no identification is needed. Feel free to pick a username that does not reveal who you are.
Photos
Before a photo is stored, the server removes all hidden information in the file (EXIF), such as GPS position, time and phone model. Until a photo is approved, only you and the reviewers can see it. An approved camera does not show who submitted it.
Traffic reports and votes
A report (queue, accident, object, police) is stored as a place, a kind, a direction and a time. It is stored without any link to your account and deleted when it has expired. To stop double votes, to be able to award a point and to be able to take the reports of a suspended account off the map, the server remembers in working memory, not in the database, which account made the report, until the report has expired. When you vote, the server checks that you are nearby. Your position is used for that check and is not stored.
Contributing to the traffic picture (optional, off from the start)
If you switch this on in the settings, the app sends, during guidance, which stretch of road you are on, your speed and an approximate time. No coordinates, no login and no trip that could be followed are sent. The beginning and the end of the trip are never sent, and nothing closer than 500 metres to the start or the destination. The server keeps averages per stretch of road only. You can switch it off at any time.
Others involved
- OpenFreeMap delivers the map pictures. Your phone fetches them directly, so OpenFreeMap sees your IP address and which map tiles are fetched. That is the only thing your phone fetches from anyone but us.
- Photon (search, run by komoot in Germany) and Valhalla (routes, run by the FOSSGIS association in Germany) receive the search text, or the start and destination, from our server. They never see your phone, your IP address or your account.
- Strato (Germany) runs our e‑mail: the mailbox you write to, and the one that sends our codes (a new password, confirming an address) and a notice to your old address if it is changed or removed. These e‑mails pass through Strato with the address, your username and the code; we keep no copy of them.
- The Swedish Transport Administration, the Swedish Transport Agency and OpenStreetMap are sources our server fetches open data from. They receive nothing about you.
- Cloudflare (Cloudflare, Inc., USA) currently sits between the app and our server, and between this website and you. The server is our own and stands in Sweden, but all traffic to it passes through Cloudflare's network. Cloudflare therefore sees your IP address and can read the traffic on its side, for example what you search for and the start and destination of a route. Cloudflare processes this on our behalf under its data processing agreement and is certified under the EU–US Data Privacy Framework. We plan to remove Cloudflare and receive the traffic directly; when that happens, we will update this page.
The app contains no ads, no analytics tools and no trackers from other companies. We do not sell data and do not hand it over, unless Swedish law forces us to.
Technical information
The server keeps no log of who asks for what. To stop overload and abuse it counts, for a short while and in working memory, the number of requests per IP address. That count is not stored. Your login is kept as a key in the phone's secure storage and is valid for 30 days. It ends earlier if the password is changed or the account is suspended.
Legal basis
- The account and your contributions: to provide the service under the terms (contract, Article 6.1 b GDPR).
- Protection against abuse and display of approved cameras: our legitimate interest in a working and reliable map (Article 6.1 f).
- Contributing to the traffic picture: only if you switch it on yourself.
Deleting your account and data
You delete the account in the app: Profile → Delete account. It happens at once. Username, password, e‑mail and points are deleted, and so are submissions waiting for review or rejected, with their photos. Approved cameras stay on the map without any link to you. More on the page Delete account.
Your rights
You have the right to know what we have stored about you, to have errors corrected, to have data deleted, to object to or restrict the processing, and to receive your data. Write to [email protected]. If you are not satisfied with our answer you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Children
OPMaps is not directed at children under 13.
Changes
If we change something that affects you, we update this page and the date at the top, and tell you in the app if the change is a large one.