Privacy Policy: Meridian One

The short version

We never collect your real location, and the places you spoof are not sent to us.
Your saved places and settings stay on your PC, encrypted.
To check your licence, the app sends us your key, an ID for your PC and the app version. We see your IP address when it does, and delete it after 90 days.
An account is optional. If you make one, we store your email address.
This website has no cookies, no analytics and no tracking.
We don't sell personal data, and never will.

"Meridian One", "we" and "us" mean the people who make Meridian One. "The app" means the Meridian One Windows app.

Kept on your PC

The app stores these in your Windows user profile, encrypted with AES-256-GCM, and does not send them to us:

your settings, such as theme, map style and search language;
your saved places, recent places and saved routes;
your licence record and the last answer from our licence server.

You can clear your recent places at any time in Settings, then Privacy, then Clear history. Uninstalling the app and deleting its folder removes the rest.

Sent to our licence server

When you activate a key, and then about every five minutes while the app is open, it sends our server:

your licence key, so we can check it is valid, unexpired and not revoked;
a device code: a 16-character ID derived from your PC's hardware, so one key stays on one PC;
the app version, so we know which versions are in use and can offer updates.

Our server records when the key was first activated, when it last checked in and how many times. Like any web server it sees the IP address the request came from. We keep that IP address so we can spot a key being shared across many places, and clear it automatically after 90 days.

The app also asks our server whether a newer version is available, sending its current version number.

We use this information to provide the licence you bought and to stop keys being shared or resold. Under UK GDPR our lawful bases are performing our contract with you, and our legitimate interest in preventing licence abuse.

Accounts

You don't need an account to use Meridian One. If you sign in, we store:

your email address, and when you joined and last signed in;
the IP address of your latest sign-in, cleared after 90 days;
a session for the PC you signed in on, which lasts 30 days.

Sign-in codes are six digits, expire after ten minutes, and are stored only as a keyed hash, never as the code itself. Licences you activate while signed in are linked to your account. We send sign-in codes through an email delivery provider, which sees your email address and the message.

Map, search and route services

To draw maps, find places and plan routes, the app talks directly to these services. They receive your IP address and the information below, and handle it under their own privacy policies. We don't receive it.

MapTiler (map tiles and map styles): the areas of the map you look at.
Photon by Komoot (place search): the text you type into search.
Nominatim by OpenStreetMap (place names): the coordinates of points you look up.
OSRM (road routes): the stops on routes you plan with Follow roads on.

The location you spoof goes to your iPhone over the USB cable. Apps on your iPhone then see it, and may handle it under their own policies.

This website

This site sets no cookies, runs no analytics and loads nothing from other companies: fonts, images and scripts are all served from here. It is hosted by Netlify, which processes your IP address to deliver the pages.

If you use a form, we receive what you type:

Early access: your email address, the plan and use you pick, your iPhone model if you give it, and your consent. We use it only to tell you when Meridian One is ready for you.
Contact: your name, email address, topic and message. We use it only to reply.

Form entries are stored with Netlify. We keep them only as long as we need them for that purpose, and delete them sooner if you ask.

We don't sell or rent personal data, and we don't share it for advertising. We use a small number of providers to run Meridian One: our server host, Netlify for this website and its forms, and an email delivery provider for sign-in codes. They process data on our instructions. Some are based outside the UK; where that happens we rely on the safeguards UK law requires. We'll disclose data if the law requires it.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to you in a portable format. To do any of these, contact us and choose "Privacy or data request". We'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Meridian One is not meant for children under 13, and we don't knowingly collect their data.

Contact and changes

For anything about privacy, use the contact form. If we change this policy, we'll update the date at the top, and for significant changes we'll say so in the app.