Privacy Policy

This explains what MapAds records, why, and what it deliberately does not record. The Service is operated by Galaxy Labs Limited, New Zealand. Questions or requests: contact@mapster.io.

What we do not collect

Stated first, because it is shorter than the list of what we do:

• No card details. Checkout happens on Stripe. We never see or store a card number.
• No IP addresses. Your country is derived from your IP at the edge, and only the two-letter country code is kept. The address itself is never written down.
• No city, region, postcode or coordinates, although our host offers all of them. A map can only draw a country, and the rest would make a record far more identifying for no gain.
• No name, email or account. Browsing and buying both work without one. Stripe collects what it needs for the payment under its own policy.
• No cross-site tracking, no advertising pixels, no data sold or shared with data brokers.

If you only look at the board

We set one first-party cookie, mapads-visitor:

• A random identifier. It is not derived from anything about you and links to no other service.
• httpOnly and secure, so scripts on the page cannot read it, and it lasts one year.
• Its only purpose is counting a returning visitor once instead of many times, which is what makes the visitor and country figures on the board honest.

Against that identifier we store one row: when you were last seen, and your country.

We also count outbound clicks per country. That is a counter on the country — a number that goes up — not a record of who clicked or when.

If you pay for a country

We store, alongside your claim:

• What you chose to publish: your name, link, colour and optional motto. These are public by design — that is the product.
• The amount, the country, and identifiers Stripe gives us for the session and payment.
• Your country and a device category (mobile, tablet, desktop or bot) at the moment of purchase, so we can see where buyers come from and whether checkout works badly on some devices.

Your placement also becomes a permanent entry in the public flag log: the country, your name, your link and the amount. The flag log is the history of the board and is not deleted when a placement ends.

Who else is involved

• Stripe — payments. It receives what it needs to take the payment and applies its own privacy policy.
• Vercel — hosting. It processes requests and supplies the country code described above.
• Supabase — the database holding the board and the records above.
• DataFast — privacy-focused analytics for page views and funnel events. It sets its own storage and applies its own policy. The aggregate figures it produces are public on our stats page.

Why we are allowed to do this

To perform the contract when you buy a placement, and on a legitimate interest in running, measuring and protecting a public board for the rest. Country and device data is coarse by design so that the interest is proportionate to what is recorded. Where your law requires consent for something, we ask for it.

How long

• Visitor rows persist while the board runs; they hold no personal detail beyond a country.
• Claim records are kept as long as needed for accounting and dispute resolution.
• Flag log entries are permanent and public. Assume anything published there is forever.

Your rights

Depending on where you live you may have rights to access, correct, delete, or object to our use of your information, and to complain to your data protection authority. Email contact@mapster.io and we will respond within a reasonable time.

Two honest limits. We usually cannot connect a request to a visitor row, because the row holds only a random cookie identifier and a country — there is nothing to match you against. And we will not remove flag log entries on request, because the log is the public record of a paid placement; we will remove a live placement.

You can clear the mapads-visitor cookie in your browser at any time. Doing so means you are counted as a new visitor next time.

Children

The Service is not for anyone under 18, and we do not knowingly collect information from children. If you believe a child has used the Service, contact us and we will remove what we hold.

Changes

If this policy changes materially we update the date at the top. Continued use after a change means you accept it.