Privacy Policy

Last updated: 31 August 2026

Who we are

MyPaperMaps is run by a private individual in the United Kingdom. It is a free hobby website for keeping track of a paper-map collection. If you have any questions about this policy or your data, email hello@mypapermaps.co.uk.

What we collect

You can browse the map without an account. If you create one, we hold:

• Your email address and a display name you choose.
• Your password is stored as a one-way hash.
• If you sign in with Google, the identifier Google gives us, never your Google password.
• If you turn on two-factor authentication: your authenticator secret, stored encrypted, and one-time recovery codes, stored only as one-way fingerprints.
• Your map collection - including any personal maps you add, which only you can see - and any map submissions, corrections or problem reports you send in.
• Sign-in and security event records. These are pseudonymous: they keep only a truncated one-way fingerprint of your IP address, never the address itself.
• For each signed-in session, a coarse device label such as "Firefox on Windows" - the full browser identification string is never stored - and the time of your last sign-in.

Your IP address is also used transiently to limit abusive traffic (rate limiting); it is not kept as part of your account.

Why we use it

• To provide the service you asked for - your account, your collection, and emails such as verification and password-reset links.
• Legitimate interests - keeping the site secure, preventing abuse, and keeping basic service records.
• Consent - analytics, only if you accept it (see below).

Cookies

By default, the site uses only essential cookies needed to keep you signed in, protect forms against forgery, support two-step sign-in (including, if you choose it, remembering a device you have verified for thirty days) and, during a private preview, carry your access pass. These cookies do not track you across other sites.

Google Analytics runs only if the site operator has set it up and you choose "Accept analytics" on the cookie banner, with IP addresses anonymised. Choosing "Essential only" means no analytics at all, and your choice is remembered in your browser.

Who else is involved

• Our hosting provider stores the site and its database.
• Our email delivery provider sends verification, reset and notification emails to you.
• Google - Google Identity Services is loaded when Google sign-in is available so that the button can be displayed. This makes an ordinary connection to Google, which can include your IP address and browser information. MyPaperMaps receives a Google sign-in credential only if you choose the button and complete sign-in.
• Cloudflare Turnstile - an anti-abuse challenge on the sign-in, registration, reset and access forms, when configured.
• Google Analytics - only when configured and you consent.

Some of these providers may process data outside the UK under their own legal safeguards. We never sell your data or share it for advertising.

How long we keep things

• Your account data: until you delete your account. Deletion is built in (Account settings), permanent and complete - no hidden marker of you is left behind. Contributions that became shared map outlines are kept, but permanently de-attributed from you.
• Security event records: 180 days.
• Signed-in sessions: at most 30 days, less if idle.
• Email verification links: 3 days. Password-reset and email-change links: 1 hour.
• Database backups are kept for up to 90 days. A deleted account can persist in a backup for up to that long.

Your rights

Under UK data protection law you can:

• Access your data - download everything we hold about you from Account settings → Data.
• Correct it - change your display name, email address and password yourself in Account settings.
• Erase it - delete your account yourself, permanently.
• Object to how we use it, or ask us anything, at hello@mypapermaps.co.uk.
• Complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If this policy changes, the new version will appear here with an updated date. See also our Terms of Service.