Privacy
Last updated 1 October 2026
mapsmaze is run by Illusio Solution LLC ("we"). This page says, in plain words, what the game keeps about you, why, who else sees it, and how to get a copy or have it deleted. Questions: info@mapsmaze.com.
The short version
- We keep the rounds you play and the name you choose. If you sign in with Google, we also keep your Google account's id and email address.
- We never ask for or use your device's location. The positions in your rounds are places in the game's copy of a city's streets, not where you are.
- No advertising, no cookies, no third-party trackers, no selling or sharing of your data for marketing.
- We count how the game is played (visits, rounds, parties) with our own simple analytics, with no IP addresses kept. Turn on "Do Not Track" or Global Privacy Control in your browser and it sends nothing.
- You can download everything we keep about you, or delete it, from the account panel in the game at any time.
What we keep
| What | Why | How long |
|---|---|---|
| A random player id, and a secret token for each device you play on (we store only a one-way hash of the token) | To know which rounds and scores are yours | A token stops working after 180 days unused. The player lasts until you delete it. |
| Your display name | Shown next to your scores | Until you change it or delete your account |
| Each finished round: which round, your path through the game's streets with timings, your time, moves, peeks and score | Your history and statistics; checking that leaderboard scores were played fairly | Until you delete your account |
| If you sign in with Google: your Google account id and, if Google has verified it, your email address | To let you sign in on any device, and to show you which account you're signed in with | Until you delete your account |
| Your IP address | Limiting how often one address can make requests, to stop abuse | Kept in short-lived rate-limit counters that reset within an hour. It isn't written to our request logs, though it can appear in an error log if a request fails; those are kept for 7 days. |
| In a party with friends: the name you play under, your route and timings in each of its rounds | Playing together: the others see your name, finishing order, points and, after each round, your route | Deleted two hours after the party's last activity; a party played at your own pace, a day after its deadline |
| If the game breaks: the error message, the page, your browser's name and version, and which version of the game you had | Finding and fixing bugs (no player id or IP address is sent with it) | As long as our logs are kept: 7 days |
| How the game is used: for each visit, how you came in (a shared link, a party, the title), the site that linked you (just its name), phone, tablet or computer, your system and browser family, your language, and your country (worked out from your device's time zone, not your IP address); and a few events during the visit, such as starting or finishing a round (with its class, city and outcome), making or joining a party, sharing or signing in. Linked to your player id once you have one. | Understanding who plays, how they find the game, where new players get stuck, and whether people come back, so we can make it better. Only we see it, as totals. | 400 days. If you delete your account, the record of your visits stays only as anonymous counts, no longer linked to you. |
| Place searches you type | Finding the place (the search goes from our server to our search provider, without your IP address or any id) | The results are cached for up to 7 days, not linked to you |
If you play without signing in, you're a guest: the same things are kept, linked to a token in your browser. Signing in later keeps them. A guest's rounds stay stored after their token expires, but nobody can reach them any more; we may delete such rounds.
In your browser
The game stores a few things in your browser's storage, not cookies. None are used for advertising or shared with anyone.
| Key | What it holds |
|---|---|
mapsmaze.identity | Your player id, token and display name, so you stay yourself between visits |
mapsmaze.best.* | Your best score on each round you've played, on this device |
mapsmaze.movement, mapsmaze.sound, mapsmaze.tutorial | Your choice of movement, whether sound is on, and whether you've done the tutorial |
mapsmaze.round | The round you're in the middle of (its route, your moves and clock so far), so a reload can carry it on. Removed when the round ends, and after a day |
mapsmaze.class, mapsmaze.delivered.*, mapsmaze.stepup.* | The class you last chose, how many letters you've delivered in each, and when you last said "not yet" to the next class up |
mapsmaze.visit (session storage) | A random id for this visit, forgotten when you close the tab, so the analytics count visits rather than page loads |
mapsmaze.party.*, mapsmaze.party.name | Your place in each party you've joined (so reopening its link keeps you yourself), and the name you play parties under |
Who else sees it
- Everyone: if you're signed in, your display name, score and time on each day's leaderboard. Player ids, emails and paths are never shown to other players.
- Our hosting provider (Railway) stores the data on our behalf.
- Google, only if you choose to sign in with Google: Google's sign-in button and its terms and privacy policy apply to that step.
- OpenFreeMap, which serves the map tiles: your browser downloads them directly, so OpenFreeMap sees your IP address, as any website you load would.
- Our place-search provider (LocationIQ) receives the text of your searches from our server, and nothing that identifies you.
Street data comes from OpenStreetMap, fetched by our servers; no personal data is sent to it.
Your choices and rights
- Download your data: Account → Download my data gives you everything above as a file.
- Delete it: Account → Delete account removes your player, rounds, scores, sign-ins and tokens, straight away and for good.
- Change your name at any time in the account panel.
- For anything else, including requests under the GDPR or similar laws (access, correction, erasure, objection, complaints), write to info@mapsmaze.com. You may also complain to your data protection authority.
We use your data to run the game you asked to play (to provide the service) and, for rate limiting, fair-play checks and our analytics, because we have a legitimate interest in keeping the game working, fair, and worth playing. You can object to the analytics at any time by turning on Do Not Track or Global Privacy Control, which the game honours.
Children
mapsmaze isn't meant for children under 13 (or the age of digital consent where you live, such as 16 in some EU countries) to sign in to. If you believe a child has signed in, write to us and we'll delete the account.
Changes
If this page changes in a way that matters, we'll say so in the game. The date at the top is when it last changed.