Privacy policy
Product-specific disclosures
These pages describe the audited Studio product, not every feature present in experimental code. Google sign-in and cloud-draft synchronization are implemented. Paddle checkout is currently restricted to Sandbox/Test Mode. Optional providers run only when configured and requested. Operator identity, the working support mailbox, production retention settings and supplier permissions still require confirmation before paid launch.
Who is responsible
The planned service operator is an individually owned business registered in China. Its registered legal name and contact address have not yet been supplied. The intended privacy and support contact is support@map-animation.com, which must be activated and tested before publication. This notice describes Map Animation's own handling of information; Paddle, identity providers and map-data providers may also act under their own privacy notices.
Google sign-in: information and purpose
When you choose Google sign-in, Google provides the account identifier, email and verification status, name and profile image needed to create and authenticate your account. Better Auth runs within our application; authentication records in our database can include session IP address and user agent, OAuth tokens, granted scopes and token-expiry fields when supplied. This integration requests openid, email and profile, not access to Gmail messages, Drive files, Calendar or Photos. When you start checkout, your account email is sent to Paddle for billing.
Project content and local processing
The editor processes selected places, coordinates, boundary and route resources, scene settings, labels, project titles, uploaded materials and exported results. Local-only projects may remain on your device in IndexedDB or other browser storage. A place search, route request or map view can still contact a third party even when a project has not been saved to the cloud. User-created labels or files may contain personal information, so avoid including it unless authorized and necessary.
Supabase database and synchronized drafts
The verified platform implementation uses Supabase-managed PostgreSQL for account, authentication, subscription and cloud-draft records. Eligible local drafts may synchronize automatically after sign-in when cloud sync is enabled. These records include project identifiers, title, revision, scene/action settings and geographic resource data, which can reveal the locations you chose. The Studio snapshot is stored in the database; the separate R2/S3 upload implementation is not evidence that object storage or automatic video uploads are enabled. We have not verified a production object-storage upload in this audit.
Paddle: checkout and subscription information
In the current sandbox flow, price previews send country information to Paddle. Starting checkout additionally sends the account email, selected price and quantity, and an opaque server-generated checkout reference that links the purchase to the account. Paddle collects the payment and billing details entered in its checkout under its own privacy notice. Our integration stores the customer, subscription and completed-transaction fields needed to reconcile access. Refund, adjustment and dispute event processing is not implemented by the current sandbox webhook, so we do not describe it as an existing automatic feature.
Vercel hosting and service requests
The deployment records identify Vercel as the web/API hosting platform and Supabase as the database provider. Requests to the application may expose IP address, request time, browser headers and error/security information to the hosting infrastructure. This is distinct from optional advertising analytics; this code audit did not find a deployed advertising or general-purpose analytics integration. Production log settings, storage regions, support access and backup retention must still be verified. We do not claim that all data stays in China or in any other single country.
Cookies and browser storage
The application uses browser storage for local projects, preferences and workflow state. Authentication may use cookies for secure sessions. Homepage language selection uses a preference cookie, currently configured to last up to one year, and explicit language URLs remain accessible. Browser controls can remove or block storage, but doing so may sign you out or delete local-only projects. Non-essential tracking, if introduced, needs appropriate disclosure and choices before it runs where required.
Why information is processed
The purposes are to deliver requested editing and export features; save, synchronize and restore selected work; administer accounts and subscription entitlements; respond to support requests; maintain service security; and meet applicable legal and accounting obligations. Where a legal basis is required, the basis depends on the purpose and jurisdiction, such as performing the requested agreement, complying with a legal obligation, an applicable legitimate interest or consent. Required consents cannot be replaced merely by this notice.
Place searches, routes and map resources
Place searches are forwarded by our server to LocationIQ with the search text and relevant search options; requesting an area can return its boundary. Depending on configuration and transport mode, routing can send endpoint coordinates or OSM identifiers to Overpass/OpenRailRouting, Google Routes, HERE or Geoapify. These server-side calls disclose relevant request data and the server's network information. Basemap, imagery, font and elevation requests can instead go directly from your browser to OpenFreeMap, MapTiler or the public AWS terrain endpoint, exposing browser network information and the requested map area. See the source guide for each route and licence.
Optional AI and tutorial video
The normal manual Studio workflow does not send your editing text to an AI model. If an enabled optional or legacy AI endpoint is deliberately used, relevant prompts and context can be sent through OpenRouter to its configured model provider; provider retention and training settings need separate verification. A configured homepage tutorial uses a youtube-nocookie.com player only after you press play. Playing it or following the external YouTube link sends requests to Google/YouTube; privacy-enhanced embedding is not a promise of zero data collection.
Retention: what is known and what is not
Local projects and exports remain subject to your browser storage until you remove them or the browser evicts them. Authentication records have expiry fields, but credential expiry is not proof the database row is erased. No fixed production purge schedule for account records, drafts, API usage records or backups was verified. Financial and fraud-prevention records may need retention for legal obligations. Before release we must set and publish appropriate category-specific periods or criteria and verify provider backup/log settings; this draft does not invent a 30-day deletion promise.
Your requests and choices
Depending on applicable law, you may be entitled to access, correct, delete or obtain a copy of personal information, object to or restrict certain processing, withdraw consent or complain to a competent authority. Contact the verified privacy channel once active. We may need proportionate identity verification and will explain applicable limitations. You can also manage browser storage and cancel a subscription separately; cancelling billing is not itself an instruction to delete account data.
International processing
The operator is based in China, while hosting, payment, authentication and geographic services may process information in other countries. The actual destinations and transfer safeguards must be reviewed against the production setup and applicable rules before launch. This notice does not itself create a lawful transfer mechanism or establish that consent, contractual safeguards or localization requirements have been satisfied.
Children, security and updates
The product is not designed for children. If you believe a child has supplied personal data without required permission, contact support so the situation can be reviewed. No online service can guarantee absolute security; keep your account and device secure and report suspected exposure promptly. Publish an effective date and give appropriate notice of material changes, particularly new data uses or providers. The remaining operator, provider and retention details must be completed before this becomes a final privacy notice.
API usage records are separate from project content
When API-usage accounting is enabled, the application can record user/project identifiers, provider and operation, timestamps, status, request counts, token counts and known or estimated costs. Browser map-resource observations are best-effort telemetry, not authoritative charges. The ledger intentionally does not persist raw prompts, query strings or arbitrary request paths. This does not mean coordinates are never stored: a saved project may contain them. The feature is disabled by default, and its existence in code does not prove it is enabled in a particular deployment.
Deleting a draft is not deleting an account
The current cloud-draft delete operation marks the database record deleted and removes it from normal listing/loading. The stored payload is not physically erased by that operation, and no hard-purge job was found. Local project copies and downloaded videos are separate and can remain on devices. There is currently no verified self-service account-deletion flow. Once support@map-animation.com is operational, it is the intended channel for access, correction and deletion requests; verification and lawful retention exceptions may apply. This draft does not postpone or waive statutory response obligations.
Paddle references
Paddle Buyer Terms · Paddle Refund Policy · Paddle Privacy Notice · Paddle buyer support