Privacy

What we collect

Very little. OpnEarth is built for people whose files are confidential, so we collect only what we need to run your account.

Last updated 4 October 2026.

Web app files

Files you add to the web app are uploaded to private cloud storage on your account. Save updates the cloud copy without changing your local original. These browser files are not end-to-end encrypted like desktop file sync. You can download or delete them from Account → Storage. Opening a file does not publish it or grant access to other users.

The desktop application

Opening a local file does not upload it. Sharing, project uploads, cloud sync, collaboration and remote AI can transmit file content when you use those features. Local file viewing works offline; online basemaps and services need a connection.

One optional upload feature is file sync (Pro). Syncing is switched on one file at a time, and it uploads that file to your OpnEarth account so your other computers can open it. It is encrypted on your computer before it is uploaded, with a key made from a recovery key only you hold, so we store ciphertext and cannot read the file, its name or its path. We can see how large it is, when it changed and which account it belongs to. Turning sync off for a file deletes our copy. If you lose every computer and the recovery key, we cannot recover the file for you.

One setting sends part of what is in a file. If you share a map live (a Pro feature: Work together on a map you have published, or Can edit for a person you share it with), the edits you and the people in it make are sent through our live editing service at collab.opnearth.com so everybody in the map sees them within a second. An edit carries what it changed: a name or description you typed, an attribute value, a colour, a folder you moved something into, and, for a shape you drew or reshaped, its coordinates. The people in the map also see which places you have selected, which one you are editing, where your pointer is on the map, and your email address. The file itself is not uploaded by this; it is shared only when the map’s owner chooses to share it with the people they invited, encrypted, as described below for file sync. Nothing is sent for a map you have not shared live.

While a map is shared live, we keep its edits (not the file) so that people who join later, or reconnect after working offline, catch up: they are stored with Cloudflare, in storage that belongs to that one map. The owner can remove a person at any time, which disconnects them at once, and can choose Stop sharing live, which disconnects everybody and deletes the stored edits straight away. If the map is withdrawn or deleted, or your account is erased, the stored edits are deleted within a day. Each computer in the map also keeps a copy of the edits in the application’s own folder, so work carries on offline. Older versions of the application sent edits for Work together to our database instead; those stay in that map’s history until the map is deleted, which removes them.

Online file icons are enabled by default. Loading them sends requests to the icon provider, which can see your IP address and request time. Icons are cached on your device. Turn off Fetch icons hosted online in Settings → Map & data to prevent these requests.

The application does contact us periodically to confirm which plan you are on. That check carries your licence, not your data, and never anything about the files you have open.

What that check sends, in full: your licence key or the address it is under, a random identifier for this installation, the application version, operating system and version, processor type and update channel, and the computer’s name and model (for example “Karl’s MacBook Pro”, “macOS 26.0”, “MacBook Pro”). The name, version and model are there so you can recognise your own computers on your account page, and we keep them only while that computer is signed in to your account. You can give any computer a different name there. We keep the time of the last check so that a computer you no longer use stops counting against your plan on its own.

The installation identifier is a random number the application makes on first run and keeps in its own settings file. It is not derived from your hardware: no serial number, MAC address or user name is read or sent. Reinstalling gives you a new one, and it identifies a copy of the application rather than a computer or a person. We use it for one thing: to know how many computers a licence is being used on, and you can see, rename and remove that list on your account page. Removing one clears its name and frees its place.

When you search for an address and press Enter, the query you typed is sent directly to Natural Resources Canada and the Government of Québec's Adresses Québec geocoder, which look up Canadian civic addresses without a key. To search elsewhere you can also choose MapTiler with your own key, or your organisation's self-hosted Photon server; the query then goes to that provider too. MapTiler also receives the centre of the map view, so nearby places rank first; the Canadian services never do. Nothing is sent while you type, and no file contents or open-file details are included. OpnEarth does not proxy those queries. Working offline sends none. Coordinates are parsed locally and need no service.

A near-net quote on a spreadsheet looks up the rows that have an address and no coordinates with the same providers. Each address is sent on its own, one at a time, when you press Quote: the address text only, never the other columns, names, or anything from the map. Rows with coordinates, and the search for the nearest route, stay on your computer.

A live layer is a map service whose address you paste in yourself, a WFS or an ArcGIS FeatureServer, such as a city's open data. When you add one, press Refresh, or turn on refreshing when the view moves, your computer asks that server directly for the features in the area on screen. That server receives the rectangle you are looking at, and the address you gave it. Nothing else is sent: no file contents, no open-file details, and nothing passes through OpnEarth. Nothing is asked while you work offline, and a layer you never add contacts no one.

Buildings passed (a Pro feature) counts the buildings near a route using OpenStreetMap. When you run a count, your computer asks an OpenStreetMap Overpass server (overpass-api.de unless you type another) for the buildings in rectangles of about 5 km along the route. That server receives those rectangles and your IP address. Nothing else is sent: no route names, no attributes and no file contents, and nothing passes through OpnEarth. The answers are kept on your computer for 30 days. Nothing is asked while you work offline, and a count you never run contacts no one.

Near-net quotes (a Pro feature) can route laterals along real roads, if you tick Follow real roads. Your computer then asks the same Overpass server for the roads, railways and rivers in rectangles of about 2 km round the near-net addresses. That server receives those rectangles and your IP address; no addresses, names or network are sent. The roads are kept on your computer for 30 days, and while you work offline only roads already kept are used.

Route packages (a Pro feature) list the roads, railways and rivers a route crosses. Your computer asks the same Overpass server for them in rectangles of about 5 km along the route. That server receives those rectangles and your IP address; no route names, attributes or file contents are sent. The answers are kept on your computer for 30 days, and while you work offline only rectangles already kept are used.

Ask the map is off until you choose who answers in Settings: the AI provider you choose, under your own key (Anthropic, or any service that speaks the OpenAI-compatible API), or an open-source model on your own computer with Ollama or LM Studio. When you ask a question, your computer sends it directly to that provider, with what is needed to answer it: the names of the open files, their folder and column names, and the names, attribute values, counts and distances the in-app tools return. The file itself is never sent. With a model on your own computer, nothing leaves it at all, and it keeps working while you work offline. The app names the provider, and the address your questions go to, beside the question box. Nothing passes through OpnEarth, we have no AI service or key of our own, and we never see your questions or the answers. Your keys stay on your computer, in a file only your account can read, each used only for the provider and address it was given for. A provider you choose handles what it receives under your agreement with them. Nothing is sent to a provider on another computer while you work offline.

AI assistants through opnearth.com (a Pro feature) is off until you turn it on in Settings. When it is on, the application keeps a connection open to our relay at mcp.opnearth.com, so an assistant you have connected to your OpnEarth account, such as Claude or ChatGPT, can ask it about the maps open in it. The application asks you before an assistant reads anything, once each session, and again before any change. What passes through our relay is what the assistant asks the in-app tools and what they answer: the names of the open files, their folder and column names, and the names, attribute values, counts and distances the tools return, as for Ask the map. The file itself is never sent. The relay passes each question and answer through in memory and does not store either. For your account page we keep which assistants you connected and when each was last used, which of your computers are connected, and, for 90 days, a line for each request with the tool’s name, the time, the size of the answer and whether it worked, never what was asked or answered. The assistant’s provider handles what it receives under your agreement with them. Disconnect an assistant on your account page, or turn the setting off, at any time. Nothing connects while you work offline.

Publishing a map is the one exception, and it is always an explicit action you take per map. What is uploaded is derived from what the application parsed, never your source file: the code that builds it is never given the file, so there is no path by which the original could be sent. Before you confirm, the application shows you what will be disclosed, read back out of the bytes that would actually go rather than from the settings you chose.

Uploading a file in your account portal is different, and just as deliberate: you choose a KMZ, KML, GeoJSON, GPX or CSV file to share, and we keep that file beside the map made from it, so that people whose link lets them download can have it as it was. It counts toward your account’s storage, and is withdrawn, restored and deleted with the map.

You decide what goes with it. Attribute columns are off unless you tick them, the detail can be reduced so the published coordinates are genuinely coarser rather than merely displayed that way, and the link expires on a date you choose. You can withdraw a published map at any time, which stops every link to it, including links you have forgotten you sent, and keeps the map so you can restore it later. You can delete a map at any time, which removes it for good. If you send it to named people, each gets a link of their own, so one can be cancelled without cancelling the others.

We keep the published map, the links to it and a record of when each link was opened. That record is which link, and when. It holds no address and no location, except in the open log described next.

Open log. When a map belongs to an account with the Security module, and its owner has not turned the log off for that map, we also keep a line for each time someone opens it in the viewer, downloads it as KMZ or as its original file, or unlocks it with its password. The line holds the time; who it was, as the email address they confirmed with a code or the OpnEarth account they were signed in with, or otherwise only that it was someone with the link; their IP address; the approximate location Cloudflare derives from that address (country, region and city), with no other lookup; and their browser and operating system, summarised from what their browser reports (for example “Chrome on Windows”). We keep it so the person who shared the map can see who opened it, and notice a link being used by someone it was not meant for. The open log is shown only to the map’s owner and, for a map that belongs to an organisation, that organisation’s owners and admins, on the map’s page in the account portal, where they can filter it and export it as a CSV file. It is never shown to the people the map was shared with. The viewer tells everyone who opens such a map that its opens are logged for the sender. Each line is deleted automatically one year after the open it records, or sooner when the map or the account is deleted. Without the Security module, none of this is recorded.

Field notes. When the person who shared a map lets a link comment, whoever holds that link can add a field note from a phone: a pin with a category, a note and up to three photos. When a recipient adds a note, we store the photos, the position of the pin and, when they placed it where they were standing, the GPS position their phone reported, with its accuracy and direction of travel. The address they confirmed to comment and the time go with it. The phone makes each photo smaller before it is sent. The viewer reads your location only after you turn on Field mode and your browser asks you to allow it, and your position is sent only as part of a note you save. Notes and their photos are shown to the map's publisher and to others holding a link to that map, and are stored with Cloudflare. For use without a signal, the viewer keeps a copy of the map, and of the background you last looked at, on the phone itself; that copy is not sent to us.

Comments. On a shared map, people you let comment can leave comments on a place, on a feature or on the whole map, reply, and name each other with @. We store what they write, who wrote it (the address they confirmed, or their OpnEarth account), when, and where on the map it is. Comments are shown to everybody who can open the map. A comment its author deletes is removed; if it has replies, its words and author are removed and the replies stay. Deleting a map deletes its comments.

Notifications. When there is a comment on a map you own, a reply in a thread you are in, a mention of you, or a thread of yours is resolved, we keep a notification for your bell in the app and your account, and may email you, from [email protected], as your settings say. You choose what is emailed and how often, or turn it off, in your account settings, and you can mute a map. Every email has a link to unsubscribe in one click. The email includes the comment text. Notifications are deleted with the comment, the map or your account.

Lite and optional product diagnostics

The same choices apply to Lite, trials and paid editions. Using the free edition does not automatically enable optional reporting. These reports help us improve performance and reliability; they do not tell us the contents or business purpose of your maps. Plan checks and account linking are separate from these reports.

Crash reports are off unless you turn them on. If you do, what is sent is a fixed list: where in our own code the crash happened, as line numbers in our bundle, the application and operating system versions, the processor architecture, how much memory the computer has, and two numbers identifying the graphics chip. No file name, no path, no error message, no address, and nothing that identifies your computer or you. The application will show you the exact contents before you decide, and again afterwards, in Settings. An organisation deploying the application can switch the whole thing off by policy for everyone.

There is a second, separate setting for how long files take to open, and it is off unless you turn it on as well. Agreeing to send crash reports does not turn it on and does not imply it. If you do turn it on, what is sent is the format you opened, roughly how many features it had and roughly how long it took, in bands rather than exact numbers, along with the application version, the operating system and the processor architecture. Bands, because an exact feature count is close to a fingerprint of one particular file. No file name, no path, no file size, no folder or attribute names, no coordinates, and nothing about what you did after the file opened. It helps us keep OpnEarth fast on the files and computers our customers use. The application shows you the exact contents before you decide, and again afterwards.

This website

If you join the waitlist we store:

We do not store your IP address, your user agent or any device fingerprint. Rate limiting works from a one way hash of the address being emailed rather than from anything identifying the visitor.

Signing up does not by itself put you on the list. Nothing is sent until you open the link in the confirmation email, and if you never open it the address is never mailed.

Analytics

This section is about the website, not the application. The desktop application sends us no analytics at all: it contacts us to confirm your plan and, if you ask it to, to publish a map, and that is the whole list. Nothing counts what you open, what you look at or how long you stay. The website offers Google Analytics, behind the choice below, so we can see which pages help visitors most.

Google Analytics is off unless you allow it, and nothing is requested from Google and no cookie exists until you do. If you allow it, Google receives a page view with your IP address truncated, and sets cookies to recognise a returning browser. It never receives your email address.

Cloudflare counts page views for us whether or not you allow Google Analytics. That count sets no cookie and builds no profile. It is switched on at the network level rather than by this site, so the choice below does not cover it.

Who else touches it

• Cloudflare hosts the site, stores the waitlist database, runs the bot check on the forms, and counts page views without a cookie. It also runs the relay for AI assistants, so the questions and answers that pass through it do so on Cloudflare’s network, in transit only, and the live editing service, which carries the edits of a map shared live and stores them while it is.
• Resend delivers the confirmation email, and receives the address it is being sent to.
• Stripe takes payments. They see the address on the account and whatever billing details you give them. We never see or store a card number: the payment form is theirs, and what comes back to us is an identifier and a subscription status.
• Google Analytics, only if you allowed it above.

Nothing is sold, rented or shared for anybody else's marketing. These providers store and process data outside Quebec, including in the United States, which means it can be subject to the laws of those countries.

The full list, what each one handles, and what happens before we add another, is on the subprocessors page.

Business customers whose personal data we process in the hosted service are covered by our data processing agreement.

How long it is kept

Waitlist entries are kept until the beta opens and the announcement has gone out, or until you ask for removal, whichever comes first. An address that is never confirmed is deleted once its confirmation link has expired. Removing yourself deletes the row outright rather than flagging it, so nothing is left behind.

A published map is kept until you delete it. Withdrawing a map stops it opening for anyone and keeps it, with its links, comments, approvals and field notes, so you can restore it. Deleting a map removes the map itself and everything about it: its links, the people it was shared with, comments, approvals, field notes and their photos, and the record of its opens, including its open log. We keep only a note that a map was deleted, by whom and when, with nothing from the map in it. Backup copies of deleted maps expire within 30 days. If you ask us to erase your account, your published maps, their links and the record of their opens go with it, and so do the files behind them.

For AI assistants through opnearth.com, the activity lines (tool name, time, size) are kept for 90 days; the list of connected assistants and computers until you disconnect them or your account is erased. Questions and answers are never kept.

Crash reports are kept for 90 days and then deleted. The same 90 days applies to the file-opening timings, which carry no account, no address and no identifier, so there is nothing in them to attribute to anybody or to erase on request.

Your rights

Under Quebec's Law 25 you can ask to see what we hold about you, correct it, have it deleted, receive it in a portable format, or withdraw consent you previously gave. Every email we send carries a one click removal link, and removal is immediate.

Write to hello (at) opnearth.com for any of these. We answer within 30 days.

If you ask us to delete your data, it is removed from our systems within 30 days of the verified request. Backups roll off within a further 30 days, so your data leaves them too.

If a security breach affects a customer's personal information, we tell that customer within 72 hours of becoming aware of it.

Who is responsible

This site and the product are operated by BEST SOLUTIONS & STRATEGIES, in Quebec, Canada. The person accountable for the protection of personal information, and the person to contact about it, is reachable at hello (at) opnearth.com.

Changes

If this page changes in a way that affects what is collected or why, the date at the top changes with it, and anyone on the waitlist is told before the change applies.