LEGAL

Privacy Policy

Effective date: April 28, 2026  ยท  Maps Telemetry v1.0.0

The short version

Maps Telemetry publishes GPS and sensor data to a secure MQTT service operated by the developer in Canada (AWS IoT, ca-central-1). The developer can access this data. No data is sold or shared with third parties. A future update will let you connect to your own MQTT server instead.

Who is responsible for your data

The data controller is Andre Couture, the individual developer of Maps Telemetry, reachable at privacy@mapgeometrics.com.

What data the app collects

While the app is running (including in the background), it collects and publishes the following data over MQTT. Each message includes a Unix timestamp (ts), a session identifier (session), and the device's user-assigned name (device).

GPS payload (โ€ฆ/gps)

  • lat, lon โ€” latitude and longitude (7 decimal places, ~1 cm precision)
  • alt โ€” GPS altitude above mean sea level (metres)
  • hae โ€” height above ellipsoid (metres)
  • speed โ€” ground speed (km/h)
  • heading โ€” direction of travel (degrees, 0โ€“360)
  • accuracy โ€” horizontal accuracy estimate (metres)
  • ce โ€” circular error, 95th-percentile horizontal (metres)
  • le โ€” linear error, 95th-percentile vertical (metres)

IMU payload (โ€ฆ/imu)

  • accel โ€” total accelerometer vector {x, y, z} in m/sยฒ
  • user_accel โ€” acceleration excluding gravity {x, y, z} in m/sยฒ
  • gyro โ€” rotation rate {x, y, z} in rad/s
  • event (optional) โ€” driving event detected: type (pothole, hard_brake, hard_accel, or swerve) plus the event's GPS coordinates

Environment payload (โ€ฆ/environment)

  • pressure_hpa โ€” barometric pressure (hPa)
  • baro_alt_m โ€” barometric altitude derived from pressure (metres)
  • magnetometer โ€” magnetometer vector {x, y, z} in ฮผT and derived heading
  • gravity โ€” gravity vector {x, y, z} in m/sยฒ
  • noise_db โ€” ambient noise level (dB). Raw audio is never recorded or transmitted. Requires optional microphone permission.

Road mapping payload (โ€ฆ/road_map)

Published per-point during an active road mapping session:

  • lat, lon, alt โ€” position
  • speed โ€” speed (km/h)
  • heading โ€” direction (degrees)
  • grade โ€” road slope (%, positive = uphill, negative = downhill)
  • roughness โ€” road roughness RMS (m/sยฒ)

Status payload (โ€ฆ/status)

Published on connect, disconnect, and periodically. Retained on the broker so other devices on the same group see current online state immediately on connect.

  • online โ€” true/false
  • device โ€” user-assigned device name
  • group โ€” configured group name
  • emoji โ€” user-chosen emoji icon shown on the shared map

Battery state

Charge level (0โ€“100 %) and charging status are read locally to automatically reduce sensor sampling rate when critically low. Battery state is included in the status payload but is not published to a separate MQTT topic.

Where your data goes

By default, all telemetry is published via MQTT over TLS to an AWS IoT endpoint operated by the developer in the Canada (Central) region. The developer has access to data stored in this service. Data is not sold, rented, or shared with any third party for marketing or advertising purposes.

A future app update will introduce the ability to configure a custom MQTT server. When that feature is available, you will be able to direct data to a server you control instead.

Cross-device data sharing within a group

Maps Telemetry supports a shared-map view where multiple devices in the same group can see each other's live position and events. To enable this, every device subscribes to GPS, status, and driving-event messages from all devices on the broker, not just its own group. The app filters these in software โ€” messages for a different group are silently discarded before they reach the UI. In practice, only devices configured with the same group name appear on each other's shared map.

What this means for your data: if you are in a group with other devices, those devices receive your GPS coordinates, device name, emoji icon, and driving events in real time. The developer's AWS IoT service receives all messages from all groups by nature of operating the broker.

Security and transport

All MQTT traffic is encrypted in transit using TLS 1.2 or higher (the AWS IoT Core endpoint enforces a minimum of TLS 1.2). Authentication uses mutual TLS (mTLS):

  • Device certificate โ€” on first launch the app generates a unique X.509 key pair and registers it with AWS IoT Core via the fleet provisioning API. The private key is stored in the iOS Keychain and is never transmitted or included in iCloud backups.
  • AWS IoT device policy โ€” each device certificate is attached to an IoT policy that restricts what the device may publish and subscribe to:
    • Publish is allowed to any topic under the telemetry/ prefix (the app always uses its own group and device name).
    • Map event publish is restricted to topics matching the device's own TLS client ID, preventing a device from publishing map events under another device's name.
    • Devices are explicitly denied publish access to dispatch/* topics (only the operator dashboard may send route assignments).
    • Subscribe is permitted to telemetry/+/+/gps, telemetry/+/+/status, and telemetry/+/+/events โ€” these span all groups on the broker. Group filtering is enforced in software inside the app.

The developer may access all data published to the broker in the capacity of the service operator.

Device certificate (AWS IoT provisioning)

On first launch, the app automatically generates a device-unique TLS certificate and registers it with the AWS IoT service. This certificate identifies your device on the MQTT service. The device's private key is stored in the iOS Keychain and never transmitted. The certificate's public portion is stored in AWS IoT and can be revoked by the developer upon a deletion request.

How long data is retained

Telemetry published to the MQTT service is retained for a maximum of 90 days, after which it is automatically deleted. You may request earlier deletion at any time by contacting privacy@mapgeometrics.com.

Session data recorded locally on your device (position trails, road mapping sessions) remains on your device until you delete it or remove the app.

Purpose and legal basis for processing

Data is collected for the following purposes:

  • App functionality โ€” GPS and sensor data are the core output of the app. Processing is necessary to provide the service you have requested.
  • Road condition analysis โ€” aggregated, non-identifiable road quality data may be used to improve the app and road mapping accuracy.

Under GDPR, the legal basis for processing is legitimate interests (providing and improving the service) and, where required, consent obtained at first launch.

GDPR โ€” Rights of EU/EEA residents

If you are in the European Economic Area, you have the following rights:

  • Access โ€” request a copy of the data held about your device.
  • Rectification โ€” request correction of inaccurate data.
  • Erasure โ€” request deletion of your data ("right to be forgotten").
  • Portability โ€” request your data in a machine-readable format.
  • Objection โ€” object to processing based on legitimate interests.
  • Restriction โ€” request that processing be limited while a dispute is resolved.

To exercise any of these rights, contact privacy@mapgeometrics.com. Requests will be responded to within 30 days.

PIPEDA โ€” Canadian residents

The app is developed in Canada. Personal information (GPS location, motion data) is collected with your knowledge and consent, obtained at first launch. You may withdraw consent at any time by stopping use of the app and requesting data deletion. Contact privacy@mapgeometrics.com for any privacy concerns or to exercise your rights under PIPEDA.

CCPA โ€” California residents

Maps Telemetry does not sell your personal information. You have the right to know what personal information is collected and to request deletion. Contact privacy@mapgeometrics.com to make a request.

Your responsibilities

Do not use this app to record location or motion data of other people without their knowledge and informed consent. You are responsible for ensuring your use complies with all applicable local laws.

Third-party services

The app makes read-only requests to the following public services. No personal data is included in these requests:

  • 511 Ontario / Quรฉbec / BC / Alberta โ€” public road condition feeds.
  • NAAD โ€” national emergency alert feed.
  • OpenRouteService / OSRM โ€” routing. Origin and destination coordinates are sent when you request directions.
  • Nominatim (OpenStreetMap) โ€” place search queries.

Children

Maps Telemetry is not directed at children under 13 and does not knowingly collect data from children.

Changes to this policy

If this policy changes materially, the updated version will be posted here with a new effective date. Continued use of the app constitutes acceptance of the updated policy.

Contact

Privacy questions, data requests, or deletion requests: privacy@mapgeometrics.com or via the support page.