Privacy Policy

Overview

MapToPlay (“the platform”) is built on a simple principle: your work belongs to you, and your data stays private. This policy explains what the platform collects, why, and what will never be done with it.

Information Collected

Access logs. When you connect to MapToPlay, the servers record basic access information — including your IP address, request timestamp, and the resource requested. This data is retained solely for security purposes: detecting abuse, preventing unauthorized access, and diagnosing infrastructure issues. It is not used for any other purpose.

Account information. If you register, the platform stores the credentials you provide (e-mail address and a hashed password). No payment data, real names, or any information beyond what is strictly required to identify your account is collected.

Google sign-in data. If the end-user chooses the optional Google sign-in flow, the platform receives only the basic profile information returned by Google’s standard authentication scopes: name, e-mail address, and profile image. No additional Google data is requested.

Google User Data

MapToPlay supports Google OAuth as an optional authentication method. When that method is used, the platform receives only the Google account data required to authenticate the end-user and link or create the corresponding MapToPlay account: the end-user’s name, e-mail address, and Google profile image URL.

That Google-provided data is used solely for sign-in, account creation, account access, and basic account presentation within the platform. No custom Google scopes are requested. The platform does not request, access, read, or store Google Drive, Gmail, Calendar, Contacts, or any other Google service data.

MapToPlay stores only the account fields needed to operate the MapToPlay account: e-mail address, display name information, and profile image URL if provided by Google. MapToPlay does not receive or store Google passwords and does not retain permission to access other Google services.

The stored Google-derived account fields remain associated with the MapToPlay account until the account data is changed or the account is deleted. Access granted through Google may be revoked by the end-user at any time through the Google Account permissions settings.

Usage Analytics

To understand how the platform is being used and where to improve it, internal usage metrics are collected — such as which features are accessed, how often, and general patterns of interaction. This data is aggregated and anonymized wherever possible and is processed entirely within the platform’s own infrastructure.

Your Content & Assets

Everything you create on MapToPlay — project files, exported maps, uploaded assets, configurations — belongs to you. The platform stores it to provide the service and for no other reason. No user content is shared, sold, licensed, or made accessible to any other user, organization, or third-party service except as needed to operate the service, where required by law, or when you explicitly choose to share content or send it through an optional third-party integration.

Third-Party Services

MapToPlay does not embed third-party trackers, advertising SDKs, data brokers, or external analytics pipelines. However, limited third-party services may be used where strictly necessary to operate the platform’s core account functions or when the end-user explicitly enables an optional integration.

This includes Google as an optional identity provider when the end-user chooses Google sign-in, and e-mail delivery providers when the platform sends transactional account messages such as verification or password reset e-mails. Those services are used only for the specific operational purpose required and not for unrelated data exploitation.

AI-assisted model generation integrations, including Meshy, are optional and run only when the end-user deliberately starts a generation request. To perform that request, MapToPlay sends Meshy the prompt, selected reference images, provider credentials, and technical request data needed for the chosen workflow. MapToPlay does not automatically send unrelated projects, maps, assets, or uploads to Meshy.

Meshy processes submitted content under its own Privacy Policy and Terms of Service. Those policies may permit retention, analysis, or AI model training depending on the end-user’s Meshy account, plan, and provider settings. MapToPlay does not control Meshy’s systems or independent data practices. End-users should review those terms before enabling the integration and should not submit content they are not authorized to share with Meshy.

MapTiler satellite preview is optional and uses the end-user’s own MapTiler API key. When enabled in the project wizard, the end-user’s browser sends the selected key and tile requests to MapTiler. MapTiler may receive the key, IP address, requested tile or location information, and other request data needed to show the preview. MapToPlay uses the key only for the preview selected by the end-user. MapTiler’s handling of that request data is governed by the MapTiler Privacy Policy.

AI & Machine Learning

MapToPlay is a tool for creators, not a data harvesting operation. Your projects, maps, assets, and other content are not used by MapToPlay to train, fine-tune, evaluate, validate, or otherwise improve an artificial intelligence or machine learning model. MapToPlay also does not sell, license, or disclose your content to a third party for the purpose of independently training its models.

This MapToPlay commitment does not mean that content is never processed by AI. When you explicitly use an optional third-party AI integration, MapToPlay sends the content you select and the information necessary to complete your request to that provider. The provider may process or use that content as described in its own terms, privacy policy, account plan, and settings, including for model training or service improvement where those rules permit it. MapToPlay does not control those independent practices.

Using an AI integration is optional. If you do not agree to a provider’s policies, do not enable or use that integration.

The MapToPlay Assistant is an optional feature. The first time an end-user opens it, MapToPlay presents this processing notice and records whether the end-user agrees or declines. The Assistant remains disabled unless the current policy notice has been accepted. A declined choice can be changed by reopening the Assistant and agreeing. An accepted choice can be withdrawn with Disable AI Assistant below the question box. MapToPlay remembers the choice and when it was made so that it is respected across sessions and devices. The choice remains until it is changed or the account is deleted.

When an end-user deliberately sends a question, MapToPlay sends OpenAI the entered question, a limited recent conversation history, the current MapToPlay page or Editor area, relevant public MapToPlay documentation excerpts, and the minimum authorized read-only team, usage, project, task, or export facts needed for the answer. MapToPlay does not automatically send project files, map contents, scene coordinates, selected features, layers, model placements, credentials, or provider keys. The Assistant cannot change platform data or perform actions on the end-user’s behalf.

OpenAI processes the Assistant information described above to generate a response. OpenAI states that data submitted through its API services is not used to train its models by default. MapToPlay does not use Assistant content to train AI models. OpenAI may retain submitted content in abuse-monitoring logs for up to 30 days by default, subject to the exceptions described in its documentation. Review OpenAI’s API data controls, Privacy Policy, and Sub-processor List.

MapToPlay stores Assistant conversations for continuity and usage control. Active conversations expire after 30 days. Authorized MapToPlay administrators may review stored questions and related account context to monitor Assistant usage, investigate misuse, and diagnose problems. MapToPlay also keeps limited technical usage information, such as request times and status, to apply team limits and protect the service. End-users should not enter secrets, unnecessary personal information, or content they are not authorized to disclose.

Data Security

Standard security practices are applied to protect data in transit and at rest, including encrypted connections and access controls. No system is perfectly invulnerable, but reasonable and proportionate steps are taken to keep your information safe.

Provider credentials saved in team settings, including optional MapTiler API keys, are encrypted at rest and used only for the integration selected by an authorized team member. Some integrations require the browser to send a selected key directly to that provider. End-users remain responsible for restricting, rotating, and monitoring their keys in the corresponding provider account.

Account Deletion

A user may permanently delete their MapToPlay account at any time through the account settings interface available within the platform.

Once confirmed by the user in the interface, the account and its associated data are permanently removed from MapToPlay systems, except where limited retention is strictly required for security, fraud prevention, legal compliance, or technical backup rotation. This deletion is irreversible and the removed account and data cannot be restored.

Changes to This Policy

If material changes are made to this policy, the effective date above will be updated and, where appropriate, registered users will be notified. Continued use of the platform after any change constitutes acceptance of the revised policy.

Contact

Questions about this policy or how the platform handles your data can be sent to contact@maptoplay.com.