🇷🇺 Русская версия: PRIVACY.md

This policy applies to the KotoMap — наша карта extension (Chrome/Edge/Chromium) and
its pages (popup.html, map.html, options.html).


The extension does not collect personal data and does not send any to the developer,
and contains no analytics, trackers or ads. Everything the extension stores stays in the
user's browser. Network requests are made only to the data sources needed to render the
map or to the sources the user has chosen themselves.


| Data | Where | Why |
|---|---|---|
| Settings (layers, sources, basemap keys, panel position, start view) | chrome.storage.local | so the extension behaves the way the user configured it |
| Cache of source data (KML/CSV/JSON) | IndexedDB | faster loading and operation without a network (offline mode) |
| Downloaded map tiles (offline map) | IndexedDB | viewing the map without a network |
| Drawings and their style | chrome.storage.local | keeping what was drawn between sessions |
| Local files attached to own maps/layers/events | IndexedDB (or chrome.storage.local) | loading your own data without an external URL |

This data never leaves the browser, is not sent to the developer, and can be removed with
the built-in controls: settings — with the “Reset” button on the settings page, cache and
tiles — with the purge buttons, files — with “Delete all files”, or by removing the
extension.


The extension talks directly from the user's browser (the developer has no server):

• layer sources — divgen.ru, api.divgen.ru, www.creamy-caprice.net,
  карта-сво.рф: KML/CSV/JSON map data is downloaded;
• weather layers — api.rainviewer.com, OpenWeatherMap (when the user has entered
  their own key), api.divgen.ru;
• map basemap — the tile hosts of the provider chosen by the user (OpenStreetMap,
  Google, Yandex, CARTO, MapTiler, ArcGIS, Wikimapia, OpenTopoMap, CyclOSM, MtbMap);
• geocoding (search field) — nominatim.openstreetmap.org (primary) or
  photon.komoot.io (fallback), and api.maptiler.com when a MapTiler key is set.
  The query string and the current map view bounds are sent (so that nearby places can be
  found);
• vector borders map preset — raw.githubusercontent.com (Natural Earth GeoJSON);
• optional extra source — deepstatemap.live (control-zone slices). It is off by
  default: no requests are made to it until the user enables the corresponding toggle in
  the settings;
• the user's own sources — arbitrary URLs the user added in the settings; access to a
  specific host is requested separately.

Each of those services sees the data common to any web request (IP address, User-Agent,
requested URL) — only as much as is needed to answer. Their own privacy policies apply to
those requests.


If the user enables divgen PRO layers, the request to divgen.ru is made with the user's
cookies for that site — that is their own session, which stays in the browser and is used
only to fetch layer data. Cookies are not passed to the developer or to third parties.

• it does not collect or send personal data, statistics, device identifiers or browsing
  history to the developer;
• it does not read or modify page content, except on the maps of divgen.ru and
  www.creamy-caprice.net, where it adds its own layers;
• it does not share data with third parties, apart from the source requests listed above;
• it does not sell data and does not use it for advertising.

The current version of this policy is this file in the repository. Changes that affect
data handling will be described in CHANGELOG.md.


Questions and comments — via the repository issues:
<https://gitlab.com/kot_enjoyer/koto-map-overlay/-/issues>