Privacy policy

Controller

Meitaim OÜ

Registry code

17035899

Registered address

Telliskivi tn 57/1, 10412 Tallinn, Estonia

Privacy questions and rights requests go to privacy@meitaim.dev.

To generate a map, Meitaim Rust Maps receives the branch, size and seed you choose. To render a map file, it receives the file's contents, without its name. It stores each map and everything made from it. A generated map is filed under its branch, size and seed. An uploaded file is filed under a fingerprint of its contents and linked to the account that uploaded it. Generated maps also appear in a public gallery, where anyone can search them by seed, size, branch and monuments. Uploaded maps do not. The gallery does not show who made a map. You choose who can open each map you upload and each fast map you make with a shaped world. Closed lets only its owners open it, and is the default. View only shows the map to anyone with its link. Open also shows them its settings and lets them download its .map file. Everyone who uploads the same file owns that map, and the most open choice among its owners applies. These maps are kept under your account in My maps, with the name and note you give them, and only you see those. A fast map without a shaped world opens for anyone with its link, with its settings and its .map file.

While you sign in, Meitaim Rust Maps keeps a one-time code proving the sign-in started here, and the page to bring you back to, in your browser's session storage. Once you are signed in, it keeps your sign-in tokens there, with the email address, username or name it shows you. While the tab stays open, it renews the tokens before they expire. It removes the tokens when you sign out or id.meitaim.dev refuses to renew them, and the browser clears everything when you close the tab. There is nothing to consent to, so there is no banner.

Cloudflare processes your IP address to deliver each request and block attacks. The website itself keeps no request logs.

Our services also send traces, logs and metrics to monitoring we run ourselves. A trace from Meitaim Rust Maps records the kind of request, its route without the values, the response, how long it took, and your browser's user agent string. It does not record your IP address, your account or your seed.

When you contact us by email, on Discord, or by any other means, we process what you send: your name, your address on that channel, and whatever the message contains.

Signing in to Meitaim apps, such as Meitaim Rust Maps and the page where you see your payments and subscriptions, uses a Meitaim account.

The account holds your email address, your name and your username, and what you sign in with: a hash of your password, your passkeys and your second factors. If you link a Google or GitHub account, it also holds the identifier that provider gives you, and the provider tells us your email address and name when you sign in with it. We also keep security logs of sign-ins and changes to the account, with the IP address and browser user agent string they came from.

Meitaim Rust Maps needs the account for the subscription, saved maps and uploads. When you sign in, it receives the profile id.meitaim.dev returns, with your account identifier, email address, username and name, and uses only the email address, username or name to show who is signed in. It sends your sign-in token with each map request and each upload. Our map service uses it to look up whether you subscribe, remembering the answer for one minute. It also uses it to keep the list of gallery maps you save under your account, and to link each file you upload to your account. It also sends the token to our payments service to start a checkout. id.meitaim.dev sets the cookies AUTH_SESSION_ID and KC_RESTART while you sign in, and KEYCLOAK_IDENTITY and KEYCLOAK_SESSION to keep you signed in. Your sign-in there ends after 30 days without use, and after 90 days at most.

To answer you

We read and reply to what you send. The basis is our legitimate interest in responding to someone who contacted us.

To provide services

We process the settings and files you send to make your maps, and link each file you upload to your account. The basis is performance of our contract with you.

To show your saved maps

We keep the list of gallery maps you save under your Meitaim account, so you can find them again. The basis is performance of our contract with you.

To meet legal duties

Accounting and tax law requires us to keep certain records. The basis is our legal obligation.

To sign you in

We use your Meitaim account to sign you in and to give your maps the priority you pay for. The basis is performance of our contract with you.

To keep your account safe

We use the security logs to protect your account. The basis is our legitimate interest in keeping accounts safe.

To deliver what you bought

We store your orders and subscriptions, what PayNow tells us about them, and which Meitaim account they belong to. We use them to give you what you bought, to manage your subscriptions, and to show your payment history. The basis is performance of our contract with you.

To handle disputes

We use the same purchase records to answer payment disputes. The basis is our legitimate interest in settling claims about a purchase.

To restore lost data

We keep backups of our records so we can restore them after a failure. The basis is our legitimate interest in not losing them.

To protect the service

We use monitoring to detect and stop abuse and fraud. The basis is our legitimate interest in protecting our systems.

We do not sell personal data and we do not share it for advertising. These providers process it on our behalf:

Cloudflare

Serves this website and our other services, and keeps backups of our records.

Hosting provider

Hosts the servers in the EU that store your maps, your Meitaim account and purchase records.

Resend

Sends emails about your Meitaim account.

PayNow sells our products as merchant of record: you buy from PayNow, not from us. It is not our processor and decides for itself how it uses your data:

PayNow Services, Inc.

Collects your payment and billing details. We send it your account identifier and nothing else. Your card details go to PayNow, never to us. PayNow tells us what you bought and the state of your subscriptions.

Google and GitHub also decide for themselves how they use your data when you choose to sign in with them. We also disclose data where the law requires it.

Cloudflare, Resend and PayNow are based in the United States, so your data may go there. These transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.

For a copy of these safeguards, write to privacy@meitaim.dev.

Monitoring

Traces are kept for 7 days, logs for 14 days, and metrics for 30 days.

Generated maps

We don't delete generated maps. They hold no personal data. Download links for any map expire after six hours.

Uploaded maps

We keep an uploaded map while anyone who uploaded it has an active subscription. Once no one does, we delete it 7 days after the later of two dates: the last time anyone uploaded it, and the day the last of their subscriptions ended. Uploading the map again moves the first date to that day. Ask and we delete it sooner.

Saved maps

Kept until you unsave a map or ask us to delete the list.

Correspondence

Kept while it is useful to the relationship, and to prevent abuse.

Purchase records

Kept while your subscription runs, then for three years after your last order, the general limitation period for claims from a transaction under Estonian law. Which account they belong to is kept until you ask us to delete that link at privacy@meitaim.dev.

Your Meitaim account

Kept until you delete it or ask us to. Then it can no longer be used to sign in. Within 90 days of that, we delete its security logs, including IP addresses and user agent strings. After that, we keep only a record that the account existed and when it was created and deleted, with no contact details, IP addresses or user agent strings. Deleting your account does not delete your saved maps, your uploaded maps or the link to your purchases. Ask us and we delete them.

Backups

Newer backups replace older ones over time. When we delete data, including at your request, copies in older backups stay until they are replaced. We restore from a backup only to recover from a failure.

Billing records

Kept for seven years, the period Estonian accounting law requires.

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• Ask for a copy of your personal data.
• Have inaccurate or incomplete data corrected.
• Have your data deleted.
• Have our processing restricted.
• Object to processing we base on legitimate interest.
• Receive your data in a structured, commonly used format.

We answer within one month. If a request is complex we may extend that by two further months, and we tell you inside the first month if we do. If we take no action, we tell you why inside the first month.

You may also complain to the supervisory authority in Estonia (Estonian Data Protection Inspectorate), or to the one where you live.

To exercise any of these rights, write to privacy@meitaim.dev.

We may change this policy. The date at the top of this page is the date of the version you are reading.