Privacy policy

Last updated: 2 November 2026

OpenGeocoding v/Théo Mathieu, Geislersgade 14, 4., 2300 Copenhagen S, Denmark, a Danish sole proprietorship, is the controller of the personal data described here. Contact us about privacy at [email protected] or +45 50 39 72 24.

What we collect and why

Data	Why	Legal basis (GDPR)
Email address, name, and your GitHub account ID, username, profile name and picture if you sign in with GitHub (we don’t keep GitHub access tokens)	Your account, verification, recovery, service and billing emails	Contract
Encrypted authenticator secret and recovery codes, verification attempts and temporary lockouts (if you enable 2FA)	Protecting your account with two-factor authentication	Contract, legitimate interest
Password hash (never your plaintext password)	Authenticating email/password sign-ins	Contract
Sign-in sessions: IP address, browser user agent, timestamps	Keeping you signed in, security	Contract, legitimate interest
API keys (stored only as a one-way hash), the website origins allowed for browser keys, and the number of calls per key, operation and day	Enforcing plan limits, billing, your usage dashboard	Contract
Counts of rejected API requests per key, reason and day, and for browser keys the website origin that was refused; never the request itself	Telling you why requests fail, in support and getting-started emails	Contract
Connected-app authorizations, client identifiers, scopes, tokens and usage counts (if you connect an MCP app)	Authorizing the app and attributing its credit usage	Contract
Billing records: Paddle customer, subscription and transaction identifiers, plan, amounts, billing periods and payment status (if you buy a paid plan)	Providing paid plans and handling billing questions	Contract
Messages you send us	Answering you	Legitimate interest
Campaign labels and capture/consent timestamps, linked to your account only if you sign up after consenting	Measuring which campaigns lead to signups	Consent
Your optional answer to “How did you hear about us?”	Measuring which channels lead to signups and API use	Consent
Public-page paths, validated campaign labels, referral origins, demo use, signup starts and browser/network information sent to Umami	Measuring traffic, visits and referral sources	Consent

Geocoding queries. Our application does not persist query addresses or coordinates with your account or intentionally include them in application logs. The JSON API accepts queries in POST bodies and, for search, autocomplete, retrieve and reverse, also as URL parameters of GET requests. API keys are accepted only in headers, never in a URL. API traffic does not pass through Cloudflare, our ingress keeps no access logs for it, and API responses are marked not to be cached, so query URLs sent to the API are not recorded in our infrastructure logs. The website demo sends addresses and coordinates in URL parameters, so those values can appear in infrastructure logs (see How long we keep it) and pass through Cloudflare’s network. If your queries contain personal data, see the data processing note below.

Browser keys. If you create a browser key, we store the website origins you allow for it with the key. Your website’s visitors’ browsers then call our API directly, which exposes their IP address and your page’s origin to us. We compare the Origin header with the key’s allowed origins and do not store it; IP addresses are handled as for any other API request (see API authentication lockouts below). Tell your visitors about this in your own privacy notice.

Live demo. To prevent abuse, we store a keyed hash of your IP/network (IPv6 /64), rate-limit counters and up to 30 (lookups) or 180 (autocomplete) recent attempt timestamps in Postgres. These identifiers are pseudonymous, not anonymous. Inactive records are eligible for deletion after 15 minutes and are removed by a minute-based cleanup task. Exceeding the request limit can send Sentry a warning containing the hashed network identifier and limit details, not the query or raw IP. We process these records for our legitimate interest in preventing abuse. The demo map’s tiles come from OpenFreeMap, but your browser loads them through our own server, so OpenFreeMap does not receive your IP address.

Signup abuse prevention. We keep a server-only hash of your email address to identify duplicate accounts, including common Gmail aliases. We also store keyed hashes of signup IP addresses (IPv6 addresses are grouped by /64) with counters to limit new accounts across our servers. We also use keyed email hashes with one-minute counters to limit password attempts and email requests across our servers. Failed passwords and temporary lockouts are recorded with keyed email hashes, timestamps and outcomes, without passwords, tokens or additional raw IP addresses. Separate failure counters can temporarily lock password sign-in for an account or an IP address/network (IPv6 /64) for 15 minutes; network counters combine failures across accounts. Network identifiers are keyed hashes. You can review recent password failures and manage your sessions in Account security; authorized administrators can also review these records and revoke sessions. These are pseudonymous identifiers, not anonymous data. We use them for our legitimate interest in preventing abuse of the free tier; no additional raw IP address is stored by these counters. Separately, our authentication library rate-limits sign-in requests with counters keyed by your raw IP address; we delete these within 10 minutes of your last request. The sign-in/signup page also loads Cloudflare Turnstile to distinguish people from bots. Cloudflare processes browser and network information, including your IP address, for this security check. We use it for the same legitimate interest in preventing abuse.

Payments. Paid plans are sold by Paddle, our reseller and merchant of record: Paddle.com Market Limited (United Kingdom), or Paddle’s US or Canadian company for buyers in those countries. When you start a checkout, we send Paddle your email address and account identifier. Paddle collects your payment details, billing address and any business name or tax number directly and processes them as an independent controller under its privacy notice. We never receive your full card details. Paddle sends us the identifiers, plan, amounts, billing periods and payment status we need to grant your requests. We share this data to perform our contract with you.

Getting-started emails. If your account stalls (email not verified, no API key, no successful request) or after you have used the API for a while, Théo may email you personally from Fastmail to help. To write that email, an AI assistant (Anthropic) receives your account’s stage and signals: key names and types, allowed origins, the operations you used, rejected-request counts and your answer to how you heard about us, but not your name or email address. If you signed up with a company email address or use a browser key on a public website, the assistant may read that website’s public homepage to choose a relevant example. Every email is reviewed and sent by a person. We use this for our legitimate interest in helping customers start using the service. Reply “stop” to any of these emails, or object at [email protected], and we won’t send them again.

Slack notifications. We send your email address to a private Slack channel when you sign up, including for accounts not yet verified, together with your GitHub username if you signed up with GitHub and, if you allowed Campaign attribution, the campaign source and name labels. When an account’s API use on a day crosses an alert threshold, we send its email address, plan, rate limit and that day’s call counts per operation type to a private Slack channel, at most once per alert type and day. A daily report in a private Slack channel also includes aggregate search trends and the email addresses, search counts and share of total searches for the previous UTC day’s ten highest-volume customer accounts. When a payment completes (a new subscription, renewal, upgrade or credit pack), we send your email address, the plan or pack and the amount paid to a private Slack channel. No passwords, tokens, API keys or geocoding queries are included. We use these notifications for our legitimate interest in monitoring account creation and payments, preventing abuse and operating the service.

Connected apps. If you authorize an MCP app, we store its authorization, scopes and credentials and attribute its requests to your account. The app receives an account identifier and authorized geocoding results, not permission to manage your account. You can disconnect it in Dashboard → Connected apps. The app provider handles data it receives under its own privacy policy; authorize only apps you trust. Disconnecting does not delete data already held by the app provider.

Error monitoring. Server-side website and API errors, including the demo abuse warnings described above, are reported to Sentry (Functional Software, Inc., United States), which stores them in its EU (Germany) region, for our legitimate interest in security and service reliability. Optional browser error reporting is separate: it starts only after you consent to Browser error reports in Cookie settings. Reports include technical information such as error types and stack traces. We exclude request bodies, headers, query parameters, account identity and breadcrumbs, and do not enable session replay. Browser connections expose your IP address to Sentry as part of network communication. Withdrawing browser consent stops future browser reporting; it does not disable server-side security monitoring.

Optional support chat. Chatwoot loads only after you consent to Support chat in Cookie settings and click “Chat with us” on a public page without URL query parameters. It processes your messages, any contact details you provide, browser and network information (including your IP address), and the page URL. Consent covers loading the optional widget and its cookies/storage; we use the content you send to answer your support request based on our legitimate interest in customer support. We do not automatically send your signed-in account details, API keys or demo queries. Do not include API keys or personal address data in chat messages. Chatwoot Cloud is hosted in the United States. Email support remains available without chat consent.

Campaign attribution. With your consent, we remember the first valid campaign link you visit using a first-party cookie. We accept only utm_source, utm_medium, utm_campaign and utm_content, up to 100 letters, digits, dots, underscores or hyphens each; utm_source is required. Do not put personal information in campaign labels. We do not store the full landing URL, referrer, query strings, click identifiers or browsing history for attribution. On account creation through email or GitHub, we validate your consent again, associate these labels and capture/consent timestamps with the account, and delete the attribution cookie. These labels are user-editable and are not proof of referral or eligibility for rewards. The attribution cookie and account-linked attribution records are not sent to Umami; validated campaign labels in public-page URLs can separately be sent as described below.

How you heard about us. The dashboard asks once how you heard about OpenGeocoding, with a fixed list of answers such as search engine, GitHub or a colleague. Answering is optional, and you can choose not to be asked again. We store your answer, or that you declined, with your account to measure which channels lead to signups and API use. It is not sent to Umami or any other third party. To withdraw your answer and have it deleted, contact [email protected].

Optional traffic measurement. With your consent, we send public-page views, demo use and signup starts to Umami Cloud, operated by Umami Software, Inc. in the United States. This includes our public website identifier, the public page’s hostname/path, the same validated campaign labels described above, and only the origin (scheme and host) of an external referring website. We exclude account, login, administration, OAuth, API and error pages, URL fragments and all other query parameters. The first time you use the homepage demo on a page load, we also send one demo-used event saying how (search, example, suggestion or map click), without the address, coordinates or results. When you submit the signup form or continue with GitHub from the signup page, we send one signup-started event with the path /login and the method (email or GitHub), without your email address or whether the signup succeeded. Events contain no account identifier, email, API key or geocoding input. Do not put personal information in campaign labels. Browser requests expose your IP address and User-Agent to Umami, which uses these to derive visitor counts, approximate location and browser/device statistics; see its privacy notice. We do not send account-linked attribution records, distinct visitor identifiers, completed signups, payments or API usage to Umami. This integration adds no analytics cookies, local storage, session replay or third-party scripts, and does not retain Umami cache tokens. Declining consent sends no traffic events; withdrawing consent stops future events, not events already received by Umami. Reports cover consenting visitors only.

Cookies

Necessary cookies, which are always on:

better-auth.session_token (named __Secure-better-auth.session_token over HTTPS): keeps you signed in. It expires 7 days after you last used your account, or when you sign out.
Short-lived sign-in cookies set by our authentication library, such as better-auth.two_factor for a pending two-factor challenge and the state cookie for GitHub sign-in: deleted after at most 10 minutes.
og_oauth_resume: remembers an app authorization while you sign in, for at most 10 minutes.

Our first-party og_consent cookie remembers your optional-service choices for 180 days; it contains the preference version, timestamp and your support chat, error reporting, traffic measurement and campaign attribution choices, not an account identifier. Preference version 5 records each of these separately; older preferences require a fresh choice. It is host-only, uses SameSite=Lax and is Secure over HTTPS.

Support chat, Browser error reports, Traffic measurement and Campaign attribution are off by default. You can allow each of them separately and choose Save choices, or choose Approve all or Disallow all. Necessary cookies remain enabled with either choice. Approval is not required to use the website, API or email support. Chatwoot can set its conversation cookie cw_conversation (365 days) and cw_snooze_campaigns_till (1 hour), and use browser storage, only after chat consent and opening the widget. Withdrawing chat consent deletes these cookies. We do not use advertising cookies. The Paddle checkout loads only on the dashboard billing page when you start a purchase. It can use cookies and similar technologies on Paddle’s domains for payment security and fraud prevention, which are necessary for the payment you requested.

The host-only og_attribution cookie stores the first valid campaign’s labels and capture timestamp for up to 30 days, without extending its expiry on later visits. It uses Path=/, SameSite=Lax and Secure over HTTPS. It is set only after you allow Campaign attribution, on the homepage, pricing, enterprise, documentation, product or comparison pages, and survives navigation and sign-in redirects. Withdrawing consent removes pending attribution from this browser and stops future collection. To withdraw consent for attribution already saved with an account and request its deletion, contact [email protected]; clearing browser cookies does not identify or delete the account record.

Use Cookie settings in the footer to accept, reject or change optional choices at any time. Withdrawing a previously allowed category reloads the page to stop the loaded SDK. Withdrawing chat consent also removes Chatwoot’s accessible first-party cookies. It does not erase past support messages or storage on Chatwoot’s own domain; contact us to request deletion of support records. Preferences synchronize between open tabs where supported and are checked again when a tab regains focus. After expiry, or if a preference is invalid, we ask again and optional services remain off.

Providers and other recipients

Hetzner Online GmbH (Germany), which hosts our servers, database and backups in its EU data centres, mainly in Finland (privacy policy)
Brevo (France), for email verification, password recovery and service emails (privacy policy)
Slack (United States), for private signup, usage and payment alerts (privacy policy)
GitHub (United States), if you choose to sign in with GitHub (privacy statement)
Cloudflare (United States, global network), which proxies and protects traffic to our website and dashboard (not the API), and runs Turnstile verification on the sign-in/signup page (privacy policy)
Anthropic (Anthropic, PBC, United States), whose AI assistant helps draft getting-started emails from pseudonymous account signals (privacy policy)
Fastmail (Fastmail Pty Ltd, Australia; servers in the United States), which hosts our support and sales mailboxes and sends the personal emails we write to you about getting started with your account (privacy policy)
Paddle (United Kingdom; its US or Canadian company for buyers there), if you buy a paid plan, as reseller and merchant of record (privacy notice)
Sentry (Functional Software, Inc., United States), for website and API error monitoring, stored in its EU (Germany) region (privacy policy)
Umami Cloud (United States), if you allow traffic measurement, for public-site traffic statistics (privacy notice)
Chatwoot (United States), if you allow and open support chat, for customer support conversations (privacy policy)

Hetzner, Brevo, Slack, Cloudflare, Fastmail, Anthropic, Sentry, Umami and Chatwoot process data on our behalf under data processing agreements. GitHub, Paddle and any app you choose to connect process data as independent controllers under their own terms.

Some of these providers are outside the EU/EEA or can process data there. Each transfer relies on one of these safeguards:

Cloudflare, GitHub, Slack and Sentry (Functional Software, Inc.): the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which each is certified.
Fastmail, Anthropic, Umami Software, Inc. and Chatwoot, Inc.: the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) in their data processing agreements.
Paddle: the Commission’s adequacy decision for the United Kingdom, for the data we send to Paddle.com Market Limited. Paddle’s own onward transfers, including to its US and Canadian companies, are covered by its privacy notice.

Contact [email protected] for a copy of the relevant safeguards.

How long we keep it

Accounts and usage: account records, API-key records (including revoked keys), daily usage counts and the email fingerprint used to prevent duplicate free accounts are kept while your account exists. Request account deletion at [email protected]; there is no self-service deletion yet. Within 30 days of a verified request we erase your email address, name, GitHub username, profile picture, password, email fingerprint, sessions, two-factor data, connected apps, sign-in provider links, campaign attribution and your answer to how you heard about us, and revoke your API keys. Usage counts and credit records stay linked only to an anonymous account ID. Authorized administrators can perform this irreversible anonymisation, or permanently remove an unused account without API keys or billing records. An active paid plan must be cancelled first, and billing records stay as described below. Deleted data leaves our database backups when they expire, within 14 days.
Payment records: if you buy a paid plan, invoices and payment records are kept for 5 years from the end of the financial year, as Danish bookkeeping law requires. As merchant of record, Paddle keeps its own invoices and transaction records under its privacy notice.
Sessions: session records, including the IP address and browser user agent, are deleted 30 days after the session expires. Signing out or revoking a session deletes it immediately.
Signup and email-rate counters: expire after their configured windows (one minute to 30 days) and are deleted by a minute-based cleanup task once expired. Password-failure counters expire after their 15-minute window or lockout and are deleted the same way. The authentication library’s IP-keyed request counters are deleted within 10 minutes of the last request.
Password-failure history: entries older than 30 days are deleted by a minute-based cleanup task.
Demo rate limits: inactive records are removed by a minute-based cleanup task once their last update is more than 15 minutes old. Continued activity refreshes that time.
Rejected-request counts: deleted after 90 days, and when your account is deleted.
Connected apps: disconnecting an app deletes its authorization and stored access/refresh-token records and revokes its metering key. Daily usage records remain with the account.
API authentication lockouts: keyed hashes of network identifiers and expiry timestamps are valid for up to 15 minutes and removed on the next background sync. These identifiers are pseudonymous, not anonymous.
Campaign attribution: the browser cookie lasts up to 30 days and is cleared on signup or withdrawal of consent. Account-linked attribution older than 90 days is deleted by the minute-based cleanup task; it can be deleted sooner on request and is removed if the account is deleted.
How you heard about us: kept while your account exists, unless you ask us to delete it sooner.
Cookie preferences: 180 days, unless replaced or cleared sooner.
Infrastructure logs: the web servers in front of our website record the IP address, requested URL (including demo queries), user agent and time of each request (API requests are not logged), for our legitimate interest in security and troubleshooting. These logs are rotated by size, normally within a day, and kept for at most 7 days.
Database backups: 14 days.
Error reports: Sentry keeps events for at most 90 days.
Slack alerts: deleted from Slack within 12 months. The record that an alert was sent (account, day and alert type) is kept with the account.
Traffic statistics: Umami keeps them for 6 months. They contain no account identifier.
Support conversations: kept while needed to handle your request and deleted within 24 months after the conversation ends, or sooner on request.

Your rights

You can access, correct, export or delete your personal data, restrict its processing, and withdraw consent at any time where we rely on it, without affecting processing before the withdrawal. Write to [email protected]; we answer within one month. You can complain to the Danish Data Protection Agency (Datatilsynet) or the data protection authority where you live.

Your right to object. Where we rely on our legitimate interests (security and abuse prevention, error monitoring, Slack alerts, infrastructure logs and support), you can object at any time, on grounds relating to your particular situation, by writing to [email protected]. We will then stop that processing unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

You need to give us an email address to create an account; everything else is optional or generated by your use of the Service. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell personal data or use it for advertising.

The Service is not directed at children. Accounts are for people aged 18 or over; if we learn that an account belongs to a minor, we delete it.

Data processing for customers

For account administration and our own security operations, we act as controller as described above. Where you determine the purposes of geocoding personal data, we act as processor on your behalf to answer your requests. Contact [email protected] to put a data processing agreement in place before submitting personal data for processing; we offer one based on the European Commission’s standard contractual clauses for processors (Implementing Decision (EU) 2021/915). Do not submit such data until the agreement is in place.

Changes

We will post changes here and email account holders about material ones.