Skip to content

Privacy_Policy.md

Latest commit

 

History

History
262 lines (170 loc) · 7.44 KB

Privacy_Policy.md

File metadata and controls

262 lines (170 loc) · 7.44 KB

Privacy Policy

Last Updated: December 28, 2025

1. Introduction

This Privacy Policy describes how the OSM Notes API ("we", "our", or "the Service") collects, uses, and protects information when you use our service.

2. Information We Collect

2.1. Automatically Collected Information

When you access the Service, we automatically collect:

Request Information:

  • IP address
  • User-Agent string (as required by the Service)
  • Request timestamp
  • Requested endpoint/URL
  • HTTP method
  • Response status code
  • Response time

Technical Information:

  • Request headers (User-Agent, Accept, etc.)
  • Referrer (if provided)
  • Request size and response size

2.2. Information You Provide

User-Agent Header:

  • The Service requires a User-Agent header in the format: AppName/Version (contact@example.com)
  • This email address is logged for contact purposes
  • You are responsible for ensuring the email address is valid and you have permission to use it

Optional Information:

  • OAuth tokens (when authentication is implemented)
  • API keys (if provided)

2.3. Information We Do NOT Collect

We do NOT collect:

  • Personal identification information beyond what is in the User-Agent
  • Payment information (Service is free)
  • Location data beyond what is in API requests
  • Cookies or tracking technologies
  • Third-party analytics data

3. How We Use Information

3.1. Service Operation

We use collected information to:

  • Provide and maintain the Service
  • Process API requests
  • Monitor service performance
  • Detect and prevent abuse
  • Debug issues and improve the Service

3.2. Logging and Monitoring

Purpose:

  • Security monitoring
  • Abuse prevention
  • Performance optimization
  • Troubleshooting

Retention: Logs are retained for a limited period (typically 30-90 days) and then deleted.

3.3. Rate Limiting

IP addresses and User-Agents are used to enforce rate limiting and prevent abuse.

3.4. Analytics

Aggregated, anonymized data may be used for:

  • Service usage statistics
  • Performance metrics
  • Capacity planning

4. Data Storage and Security

4.1. Data Storage

Logs:

  • Stored securely on our servers
  • Encrypted at rest (where possible)
  • Access restricted to authorized personnel

Database:

  • Contains only OpenStreetMap notes data (public data)
  • No personal user data stored
  • Backed up according to our backup strategy

4.2. Security Measures

We implement security measures to protect your information:

  • Secure server infrastructure
  • Access controls and authentication
  • Regular security updates
  • Monitoring and intrusion detection
  • Rate limiting and abuse prevention

However, no method of transmission over the Internet is 100% secure.

5. Data Sharing and Disclosure

5.1. We Do NOT Sell Data

We do NOT sell, trade, or rent your information to third parties.

5.2. Limited Sharing

We may share information only in the following circumstances:

Legal Requirements:

  • To comply with legal obligations
  • To respond to lawful requests from authorities
  • To protect our rights and safety

Service Providers:

  • With trusted service providers who assist in operating the Service
  • These providers are bound by confidentiality agreements

Public Data:

  • OpenStreetMap notes data is public and may be shared as part of the Service
  • This is inherent to the Service's purpose

5.3. Aggregated Data

We may share aggregated, anonymized statistics that do not identify individuals.

6. Data Retention

6.1. Logs

  • Request Logs: Retained for 30-90 days
  • Error Logs: Retained for 90 days
  • Security Logs: Retained for 1 year

6.2. Metrics

  • Prometheus Metrics: Retained for 200 hours (8.3 days)
  • Aggregated Statistics: Retained indefinitely (anonymized)

6.3. User Data

  • No Personal Data Stored: The Service does not store personal user accounts or profiles
  • User-Agent Information: Retained in logs per retention policy above

7. Your Rights

7.1. Access

You have the right to:

  • Request information about what data we have about you
  • Request a copy of your data (if applicable)

How to Request:

7.2. Deletion

You may request deletion of your data:

  • Request log deletion (subject to retention policies)
  • Note: Aggregated, anonymized data cannot be deleted

7.3. Correction

You may request correction of inaccurate data:

  • Contact us via GitHub Issues
  • Provide details of the inaccuracy

7.4. Objection

You may object to processing of your data:

  • Stop using the Service
  • Contact us if you have concerns

8. GDPR Compliance (EU Users)

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR):

8.1. Legal Basis

We process your data based on:

  • Legitimate Interest: Service operation, security, abuse prevention
  • Legal Obligation: Compliance with applicable laws

8.2. Your Rights (GDPR)

  • Right to access
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object
  • Right to withdraw consent (where applicable)

8.3. Data Protection Officer

For GDPR-related inquiries, contact us via GitHub Issues.

9. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

10. Third-Party Services

10.1. OpenStreetMap

The Service provides access to OpenStreetMap data. Your use of this data is subject to OpenStreetMap's terms and licenses.

10.2. Hosting Providers

We use hosting providers to operate the Service. These providers may have access to technical information necessary for service operation.

10.3. Monitoring Services

We use monitoring services (Prometheus, Grafana) for service operation. These services collect technical metrics.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

By using the Service, you consent to the transfer of your information to these countries.

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. Changes will be effective immediately upon posting.

Notification: Significant changes will be announced via:

  • GitHub repository updates
  • Service status page (if available)

Last Updated: The "Last Updated" date at the top indicates when this policy was last revised.

13. Your Consent

By using the Service, you consent to:

  • This Privacy Policy
  • Collection and use of information as described
  • Data processing as described

14. Contact Us

For questions about this Privacy Policy or your data, please contact:

15. Data Controller

Data Controller: OSM Notes Team
Contact: Via GitHub Issues at https://github.com/OSM-Notes/OSM-Notes-API/issues

Note: This is a template Privacy Policy. You should review and customize it according to your specific legal requirements, jurisdiction, and actual data practices. Consider consulting with a legal professional, especially for GDPR compliance, before using this in production.