Privacy, cookies and data handling

Effective and last updated: 28 August 2026

Encharted Media AB uses the minimum personal data needed to run this website, provide accounts and map access, prevent abuse, answer messages and—only if you actively opt in—send occasional marketing emails. We do not sell personal data, use advertising trackers or make decisions about you by automated profiling.

The data controller is Encharted Media AB, organisation number 559474-0200, VAT number SE559474020001. Contact [email protected] for privacy questions or to exercise your rights.

When you visit

Our hosting and security systems receive ordinary request information such as IP address, date and time, requested URL, browser or device information, referrer, and security events. We use it to deliver the site, keep it secure, diagnose faults and prevent misuse. The legal basis is our legitimate interest in operating a reliable and secure service.

When you create or use an account

We process your email address, account identifier, authentication method, confirmation and recovery events, and any basic profile information returned by a sign-in provider you choose. For map access, we also process the projects available to you, access status, generated key metadata, limits, expiry and revocation times, and daily usage counters. Secret map keys are protected server-side; you are responsible for keeping a generated link private.

We need this information to create and secure your account, sign you in, provide requested map access, enforce limits, and let you manage or delete the account. The legal basis is performance of our agreement with you and our legitimate interests in security and abuse prevention. You do not have to create an account, but we cannot provide personal map links without the required account information.

When you contact us

We process the details and content you send so we can reply, prepare or perform an agreement, and keep necessary business records. The legal basis depends on the request: steps toward or performance of an agreement, our legitimate interest in answering correspondence, or a legal obligation.

We do not intentionally collect special-category personal data through the website. Please do not send sensitive personal data unless it is necessary and we have agreed how it will be handled.

Your account email is used for essential messages such as address confirmation, password recovery, security information, material service changes and replies you request. These are service messages, not marketing.

Marketing is separate. We use your account email for occasional news about Encharted projects and services only when you select the optional, unticked marketing box. Creating an account or using a map is not conditional on that choice. We record the current choice and when it changed so we can respect it. The legal basis is your consent.

You can withdraw consent at any time in Account → Settings → Email preferences, by using the unsubscribe method in a marketing email, or by writing to [email protected]. Withdrawal does not affect earlier lawful processing. We will stop marketing after the request is processed; account and necessary service emails can continue.

We use carefully selected providers only where needed to operate the service:

• Supabase provides authentication and the database for account, consent-preference and map-access records. Account requests go directly from your browser to Supabase. Supabase acts primarily as our data processor for this information. Supabase privacy information
• Cloudflare provides website delivery, the map-access gateway, request security and Turnstile anti-abuse checks. It may process request and device information, including IP address, needed to deliver and protect the service. Cloudflare privacy information
• Your chosen sign-in provider, currently Google where enabled, authenticates you and returns the account details described during sign-in. That provider also processes the request under its own privacy terms.
• External map and media sources may receive ordinary browser request information when their content loads. Interactive map views may request resources from OpenStreetMap, unpkg and Cloudflare Turnstile. Video cards may load thumbnails from YouTube/Google. Following any external link takes you to a service with its own terms and privacy practices.

We may also disclose information when required by law, to protect legal rights or service security, or in connection with a business reorganisation subject to appropriate safeguards. We do not sell or rent personal data.

Some providers and their subprocessors may process information outside Sweden or the EEA. Where GDPR requires it, we rely on an adequacy decision or approved safeguards such as the European Commission's Standard Contractual Clauses. You may contact us for more information about safeguards relevant to your data.

We currently use only storage that is necessary for a feature you request. We do not use analytics, advertising or behavioural-marketing cookies. Because there are no optional cookies to accept or reject, the site does not currently show a cookie banner. We will add an appropriate choice before introducing any non-essential cookie or similar technology.

The technologies currently used are:

• Supabase account session (localStorage) — the browser stores access and refresh tokens so you stay signed in and can make authenticated requests. This is browser storage, not a cookie. It remains until you sign out, clear the site's stored data, or the session is no longer valid.
• Pending social sign-up preference (sessionStorage) — if you create an account through an external sign-in provider, the browser temporarily keeps your privacy acknowledgement and marketing choice across the redirect. It is removed after the preference is saved.
• Map preview session cookies (enc_tile_session_oldmap and enc_tile_session_topo) — after an anti-abuse check, the applicable map view stores a signed, HttpOnly, Secure, SameSite session cookie, scoped to that map path, for up to four hours. It contains a random session identifier and expiry information and is needed to apply the map's temporary usage allowance.
• Essential security mechanisms — Cloudflare may use short-lived technical signals needed to detect automated or malicious traffic and provide Turnstile. These are used for security, not advertising.

You can clear cookies and site storage in your browser. Blocking essential storage may prevent sign-in, account features or interactive maps from working.

Account and active map-access records are kept while your account exists. Deleting the account removes the live account and associated map-access records. Providers may retain limited backups or security records for their documented retention periods, and we may retain a minimal record where necessary to meet a legal obligation, resolve a dispute or demonstrate a consent or withdrawal.

Marketing is enabled only while your current preference is on. Contact records are kept until the matter is resolved and then only as long as reasonably needed for the relationship, legal claims or mandatory accounting and record-keeping. Technical and security information is retained only for the time needed to protect, troubleshoot and operate the service, according to the nature and risk of the event.

We use access controls, encrypted transport, restricted server-side credentials, row-level access rules and protected map-key storage. No internet service is risk-free. Please use a unique password, protect secret map links, and tell us promptly if you suspect unauthorised access.

Subject to the conditions in data-protection law, you may ask us to:

• give you access to your personal data;
• correct inaccurate or incomplete data;
• delete data;
• restrict processing;
• provide data you supplied in a portable form;
• stop processing based on legitimate interests; and
• withdraw consent at any time for future marketing.

You can update your email, password and marketing preference or delete your account in Account → Settings. For other requests, email [email protected]. We may need to verify your identity before acting and will normally respond within one month.

You may lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or the data-protection authority where you live or work. Contact IMY

We may update this notice when the service or law changes. The date at the top shows the current version. If a change materially affects account holders, we will provide a suitable notice before it takes effect when required.

Encharted Media AB
Organisation number: 559474-0200
Email: [email protected]