Privacy Policy | Plot Along

Your privacy is important to us. We operate under the following principles:

We are thoughtful about the personal information we ask you to provide and the personal information that we collect about you through the operation of our services.
We store personal information for only as long as we have a reason to keep it.
We aim to make it as simple as possible for you to control what information is shared publicly or kept private.
We aim for full transparency on how we gather, use, and share your personal information.
We never sell your personal information to third parties. Never have, never will.

Below is our Privacy Policy, which incorporates and clarifies these principles.

Who We Are and What This Policy Covers

We are the team behind Plot Along®, a collaborative mapping platform for planning and sharing routes in real-time. Plot Along is operated by Taylor Edwards dba Plot Along (“Company,” “we,” “us,” or “our”).

This Privacy Policy applies to information that we collect about you when you use our website and services at plotalong.app (the “Service”). Throughout this policy, we refer to our website and other products and services collectively as “Services.”

Below we explain how we collect, use, and share information about you, along with the choices that you have with respect to that information.

Creative Commons Sharealike License

This Privacy Policy is adapted from the Automattic Privacy Policy, available under a Creative Commons Sharealike license, and from the Basecamp Privacy Policy, available under a Creative Commons Attribution license. You are welcome to copy, adapt, and repurpose this Privacy Policy for your own use under the same terms.

Information We Collect

We only collect information about you if we have a reason to do so — for example, to provide our Services, to communicate with you, or to make our Services better.

We collect this information from three sources: if and when you provide information to us directly, automatically through operating our Services, and from outside sources. Let’s go over the information that we collect.

Information You Provide to Us

It’s probably no surprise that we collect information that you provide to us directly. Here are some examples:

Account information: We ask for basic information from you in order to set up your account. For example, we require individuals who sign up for a Plot Along account to provide an email address and password — and that’s it. You may also provide us with your name, but that’s optional. We store your distance unit preference (metric or imperial), which is initially set based on your browser’s language.
Content you create: We store the content that you create on Plot Along, such as your maps, waypoints, routes, and any comments or descriptions you add. This is so you can use the Service as intended.
Payment and billing information: If you purchase a paid subscription (Hobby or Pro plan), you will be asked to provide your payment information. Your credit card information is submitted directly to our payment processor, Stripe, and does not pass through or get stored on our servers. We store a record of the payment transaction, including subscription status and billing period, along with your Stripe customer ID for account management purposes.
Communications with us: You may also provide us with information when you contact us for support, send us an email, or communicate with us in any other way.

Information We Collect Automatically

We also collect some information automatically:

Log information: Like most online service providers, we collect information that web browsers and servers typically make available, including the browser type, IP address, unique device identifiers, language preference, referring site, the date and time of access, and operating system. We collect this information when you use our Services — for example, when you log in to your account.
Usage information: We collect information about your usage of our Services. For example, we collect information about map creation, route calculations, sharing actions, and collaboration events. We use this information to, for example, provide our Services to you, get insights on how people use our Services, so we can make our Services better, and understand and make predictions about user retention.
Location information: We log the IP address from which you connect, both as part of your session record and to enforce per-IP rate limits on certain public endpoints. We do not perform geographic lookups on your IP address and do not use it to determine your location. Your default distance unit preference is set based on your browser’s language setting, not your IP address.
Information from cookies: A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. We use a single essential cookie (pa_session) to manage your authenticated session. Please see our Cookie Policy for more details.

Information We Collect from Other Sources

We may also get information about you from other sources. For example, if you connect to our Service through a third-party service (such as a shared collaboration link), we may receive information about your interaction from that referral.

How and Why We Use Information

Purposes for Using Information

We use information about you for the purposes listed below:

To provide our Services. For example, to set up and maintain your account, host your maps and routes, process payments, provide customer service, and verify user information.
To ensure quality, maintain safety, and improve our Services. For example, by providing automatic upgrades and new versions of our Services. Or, for example, by monitoring and analyzing how users interact with our Services so we can create new features that we think our users will enjoy and that will help them create and share maps more efficiently.
To protect our Services, our users, and the public. For example, by detecting security incidents; detecting and protecting against malicious, deceptive, fraudulent, or illegal activity; fighting spam; complying with our legal obligations; and protecting the rights and property of Plot Along and others, which may result in us, for example, declining a transaction or terminating Services.
To fix problems with our Services. For example, by monitoring, debugging, repairing, and preventing issues.
To communicate with you. For example, by emailing you to ask for your feedback, share tips for getting the most out of our products, or keep you up to date on Plot Along. If you don’t want to hear from us, you can opt out of marketing communications at any time. (If you opt out, we’ll still send you important updates relating to your account.)

Legal Bases for Collecting and Using Information

A note here for those in the European Union about our legal grounds for processing information about you under EU data protection laws, which is that our use of your information is based on the grounds that:

The use is necessary in order to fulfill our commitments to you under the applicable terms of service or other agreements with you or is necessary to administer your account — for example, in order to enable access to our website on your device or charge you for a paid plan; or
The use is necessary for compliance with a legal obligation; or
The use is necessary in order to protect your vital interests or those of another person; or
We have a legitimate interest in using your information — for example, to provide and update our Services; to improve our Services so that we can offer you an even better user experience; to safeguard our Services; to communicate with you; to measure, gauge, and improve the effectiveness of our messaging; and to better understand user retention and attrition; or
You have given us your consent — for example before we place certain non-essential cookies on your device and process information collected from those cookies.

We share information about you in limited circumstances, and with appropriate safeguards on your privacy. These are spelled out below:

Third-party service providers: We may share information about you with third-party service providers who need the information in order to provide their services to us, or to provide their services to you or your site. See the list of sub-processors below.
Legal and regulatory requirements: We may disclose information about you in response to a subpoena, court order, or other governmental request.
To protect rights, property, and others: We may disclose information about you when we believe in good faith that disclosure is reasonably necessary to protect the property or rights of Plot Along, third parties, or the public at large.
Business transfers: In connection with any merger, sale of company assets, or acquisition of all or a portion of our business by another company, user information would likely be one of the assets that is transferred or acquired by a third party. If any of these events were to happen, this Privacy Policy would continue to apply to your information and the party receiving your information may continue to use your information, but only consistent with this Privacy Policy.
With your consent: We may share and disclose information with your consent or at your direction. For example, we may share your information with third parties when you authorize us to do so, like when you share a map link with collaborators.
Aggregated or de-identified information: We may share information that has been aggregated or de-identified, so that it can no longer reasonably be used to identify you. For instance, we may publish aggregate statistics about the use of our Services.
Published content: When you make maps public or share them, that content is visible to anyone with the link. Collaboration invitations share map access with specified users.

Sub-Processors

We use the following third-party service providers to help operate our Services:

Service	Purpose	Data Shared
Cloudflare	Hosting, CDN, database, real-time collaboration, image storage, caching	All request data, user data, maps, routes, sessions
Stripe	Payment processing	Email, name, user ID, payment method info
Mapbox	Map rendering, geocoding, route directions	Map coordinates, waypoints, route geometry
Resend	Transactional email delivery	Email address, name, email content

How Long We Keep Information

We generally discard information about you when it’s no longer needed for the purposes for which we collect and use it — described in the section above on How and Why We Use Information — and we’re not legally required to keep it.

For example:

We keep server logs that record information about a visitor to our Services for approximately 30 days and then delete them.
When you delete your account, we delete your account data, maps, routes, and other content within 60 days. Some information may persist in backups for up to an additional 30 days.
Session data is retained for up to 7 days from last activity and then automatically expires.

Security

While no online service is 100% secure, we work hard to protect information about you against unauthorized access, use, alteration, or destruction, and take reasonable measures to do so. We employ the following security measures:

All data is encrypted in transit via SSL/TLS.
Passwords are cryptographically hashed and never stored in plain text.
Database backups are encrypted.
Session tokens are generated using cryptographically secure random values.
We use Cloudflare’s infrastructure for DDoS protection and network security.

Your Rights

We strive to apply the same data rights to all users, regardless of location. Here are the rights you have with respect to your personal information:

Right to Know. You have the right to know what personal information is collected, used, shared, or sold. We outline both the categories and specific bits of data we collect, as well as how they are used, in this privacy policy.
Right of Access. This includes your right to access the personal information we gather about you, and your right to obtain information about the sharing, storage, security, and processing of that information.
Right to Correction. You have the right to request correction of your personal information.
Right to Erasure / “To Be Forgotten.” This is your right to request, subject to certain limitations under applicable law, that your personal information be erased from our possession and, by extension, from all of our service providers. Fulfillment of some data deletion requests may prevent you from using our Services because our applications may then no longer work. In such cases, a data deletion request may result in closing your account.
Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
Right to Restrict Processing. This is your right to request restriction of how and why your personal information is used or processed, including opting out of sale of your personal information. (Again: we never have and never will sell your personal data.)
Right to Object. You have the right, in certain situations, to object to how or why your personal information is processed.
Right to Portability. You have the right to receive the personal information we have about you and the right to transmit it to another party. You can export your maps in various formats (GPX, GeoJSON, KML, CSV) depending on your subscription tier.
Right to Not Be Subject to Automated Decision-Making. You have the right to object to and prevent any decision that could have a legal or similarly significant effect on you from being made solely based on automated processes. This right is limited if the decision is necessary for performance of any contract between you and us, is allowed by applicable law, or is based on your explicit consent.
Right to Non-Discrimination. We do not and will not charge you a different amount to use our products, offer you different discounts, or give you a lower level of customer service because you have exercised your data privacy rights.

If you have questions about exercising these rights or need assistance, please contact us at privacy@plotalong.app.

How to Reach Us

If you have a question about this Privacy Policy, or you would like to contact us about any of the rights mentioned above, please contact us at privacy@plotalong.app.

Privacy Policy Changes

Although most changes are likely to be minor, Plot Along may change its Privacy Policy from time to time. We encourage visitors to frequently check this page for any changes to the Privacy Policy. If we make material changes, we will notify you by email (sent to the email address specified in your account) or by means of a notice on our website prior to the change becoming effective. Your continued use of the Services after any change in this Privacy Policy will constitute your consent to such change.

Attribution

This Privacy Policy is adapted from the Automattic Privacy Policy (CC BY-SA 4.0) and the Basecamp Privacy Policy (CC BY 4.0). This document is licensed under Creative Commons Attribution-ShareAlike 4.0 International.