Privacy Policy

Who we are

Mapper (mapper.now) is a free flight-path mapping tool owned and operated by Sauces 201 LLC, a New York limited liability company. Sauces 201 LLC is the data controller for the processing described in this policy. For any privacy question or request, contact hello@pnm.now. Mailing address: Sauces 201 LLC, 85 Broad St, Floor 17, New York, NY 10004.

What we don't do

• No fingerprinting. We don’t sell personal information. You can use the map without an account. The optional flight logbook is a separate sign-in, described below.
• No Google analytics or advertising cookies unless you opt in (see below). Page-speed measurements do not set a cookie.
• Fonts, scripts, and map data are served from our own domain, so no third-party CDN receives your IP address just to load the page.

Analytics and advertising

Mapper uses Google Analytics 4 to understand aggregate usage (such as which pages are viewed, general device/browser type, and which airport routes you look up) so we can improve the tool. Analytics runs only after you click "Accept". Until then — and if you "Decline" — the analytics script is not loaded.

The pages also include the Google AdSense tag (ca-pub-1004687421104140) in the HTML so Google can verify the site and show ads. Consent Mode keeps ad cookies and ad personalization denied until you Accept. Declining leaves that denial in place. Google may still receive a request from the ad tag itself.

If you opt in, plotting a route, opening a shared route link, or choosing an example sends the airport codes for that itinerary (for example JFK-LHR) as an analytics event. That is the route you asked to see, not your name, email, or account. Restoring the last itinerary saved on your device is not sent. The iOS and Android apps do not send these events.

If you opt in, Google Analytics sets cookies (e.g. _ga, _ga_<id>) and sends pseudonymous usage data to Google LLC in the United States. Google Analytics 4 does not log full IP addresses, and we have not enabled Google Signals for analytics. AdSense may use cookies and similar technologies to serve and measure ads when you opt in. Legal basis: your consent, which you can withdraw at any time via Cookie settings (also in the site footer).

Cookies

• Advertising (Google AdSense). The publisher tag is in the page so Google can verify the site. Consent Mode keeps ad storage, ad user data, and ad personalization denied until you Accept. If you Accept, Google may set advertising cookies and serve ads. Google’s description of those technologies is at policies.google.com/technologies/ads. Ad settings: adssettings.google.com. The publisher id is in ads.txt.
• Analytics (Google Analytics 4). Loaded only after Accept. Cookies such as _ga identify a browser, not an account we hold.
• Preferences. Theme, units, and the last itinerary live in local storage on your device. They are not sent as cookies.
• Private dashboard. Opening the password-protected route tally sets a strictly necessary session cookie. Ordinary visitors never get that cookie. The page is marked noindex.

The FAQ, About, and Contact are the same site. They do not add a separate tracker. There is no contact form, so emailing us is a message you send, not a field stored by Mapper.

iOS app

The Mapper iOS app is a native shell around the same map and miles calculator as this website. It does not include analytics, does not call the flight-time service, and does not send your routes to our servers. Units and map/globe preference stay in on-device storage (Apple UserDefaults). Airport and map data ship inside the app. Opening mapper.now in Safari is the website, and that visit follows the website practices on this page.

What's stored on your device

Mapper saves functional preferences in your browser's local storage (mapper_showLegs for per-leg distances, mapper_unit and mapper_view for units and map/globe, mapper_theme for light/dark, mapper_colorMode and mapper_planeColors for route and plane-type colors, mapper_routes for the last itinerary you plotted, and mapper.pnmSignup.dismissedAt when you dismiss the pnm.now signup, kept about 30 days) and your analytics choice (mapper_consent). These stay on your device and don’t identify you. The signup email is sent to pnm.now only after you press Subscribe. Mapper’s server forwards that address to pnm.now and does not store it. Shareable links encode only airport codes in the URL — nothing about you. Google Analytics cookies are stored only if you opt in. You can clear all of it any time by clearing your browser's site data.

Public route API

Anyone (including automated clients) can request great-circle distances for IATA codes at /api/route. That endpoint receives only the airport codes you send, returns unofficial distance estimates, and does not set cookies or call the flight-time model. We may use the requesting IP address to enforce a short-term rate limit. See llms.txt for how to use it, and the Terms of Use for acceptable use.

Flight-time estimates

When you plot a route on the website, the page first asks our server for a short-lived token, then sends the airport codes you plotted. The server looks up city names and distance itself and may forward that to Anthropic's API to estimate airborne times. That payload is not a name, email, or account, and we don’t link it to you. Anthropic processes the request to return an estimate; under Anthropic’s commercial API terms, API inputs are not used to train its models. If estimates are unavailable, or a daily cap on model calls is reached, Mapper falls back to a simple distance-based calculation and contacts no one. We may keep your IP address, hashed, for about a minute in Redis to rate-limit those calls. The daily cap counter does not include your IP. The public /api/route endpoint does not use this model.

Route lookup tally

When you type a route or open a route link on the website, the airport codes are sent to our server and added to a private tally of routes people look up. Choosing a sample itinerary (or opening that sample’s link) is not added. Typing the same airport codes yourself is. We store the route (for example JFK-LHR), how many times it was looked up in the last 365 days, whether those lookups were typed or opened from a link, and the UTC day of the latest lookup. We also keep the latest 100 lookups with the UTC time of each one, still only the route and whether it was typed or opened from a link. We do not store your IP address, your name, or a cookie for this tally. A count is accepted only with the same short-lived page token, so a request that only pretends to come from this site is dropped. The server may use the requesting IP address only to enforce a short-term rate limit and to slow repeated password guesses. That address is not saved in the tally. Declining analytics cookies does not turn this count off. The tally is shown only on a password-protected page. Opening that page sets a strictly necessary session cookie so it stays unlocked; that cookie is not set for ordinary visitors. Restoring an itinerary saved on your device does not add to the tally. The iOS and Android apps do not send it. Route counts, daily totals, and recent lookup times are deleted after 365 days. Newer lookups also push the oldest rows out of the latest-100 list.

The tally is kept on our host. If a Redis database is configured for it, the same counts are stored there, and that provider may be in the United States. Legal basis: legitimate interest in seeing which routes the tool is used for. The interest is limited to aggregate route counts, the data cannot be used to sell or advertise, and it is not combined with an account. You can object by emailing hello@pnm.now. Because a count is not tied to a person, we cannot remove one visitor from it; we can delete the tally.

Flight logbook

The logbook at /logbook is optional. During the closed beta, creating an account requires an invite, unless sign-up has been opened. If you create an account we store the name you choose, a username if you claim one, a scrambled password when you set one, an email when you or a sign-in provider gives us a verified one, and the flights you enter (airports, times, airline, aircraft, seat, cabin, reason, and notes). That record is private. It is not the route tally above. The flights are not sent to Google Analytics.

A username is stored so you can keep the name. It is not public yet. If public profiles launch, they will be opt-in. Until then, nothing in the logbook is shown to other people.

You can sign in with email and a password. A sign-in provider is offered only when that provider is enabled on this server. Choosing one sends you to that provider; they see the sign-in, and we store the account id they return. Some providers do not provide an email, and the logbook still works without one. A verified email is linked to the logbook that already uses it. A short-lived cookie (mapper_oauth) holds the sign-in attempt for about ten minutes and is cleared when it finishes. An invite code, when you use one, is stored with our database provider so it can be used once.

If you join the waitlist, we store the email you submit and the optional note about what you would use the logbook for. We do not send a confirmation email from the form.

Signing in sets a strictly necessary cookie (mapper_logbook) so the server knows the request is yours. The cookie is HttpOnly and lasts 30 days. You can export a CSV or delete the account, which removes the flights and the sign-in.

On Vercel the logbook is stored with our database provider, Upstash, in the United States. A local copy of the site stores it in a file on that computer instead. Legal basis: contract — you asked us to keep the log — and legitimate interest in securing the sign-in. Email hello@pnm.now to access, correct, or delete it. Deleting the account in Settings does the same thing.

Hosting & logs

The site is hosted on Vercel. Like any web host, Vercel may briefly process your IP address and request metadata in server logs to operate and secure the service (our legitimate interest). We don't use those logs to identify or profile visitors, and we keep no separate copy.

The website also loads Vercel Speed Insights, which measures how fast pages load and respond (Core Web Vitals). The script and the measurements stay on mapper.now, Speed Insights does not set a cookie, and it does not record a name or email. The iOS and Android apps do not include this script. Legal basis: legitimate interest in keeping the site fast.

The website also loads Vercel Web Analytics, which records a page view when someone opens a page (the map, a shared route, the embed, and the other pages on mapper.now). A view includes the page address, the referrer, and coarse device and location details. Web Analytics does not set a cookie, does not record a name or email, and is not used for custom events. The script and the view stay on mapper.now. The iOS and Android apps do not include this script. Legal basis: legitimate interest in seeing which pages are used.

Security

The site is served over HTTPS. Where we store secrets or passwords, we store them hashed, not in plain text. We use reasonable administrative and technical safeguards appropriate to a service of this kind. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or alteration will never happen. If we learn of a breach of personal data and the law requires us to notify affected people, we will notify affected users as required by law.

Legal bases (GDPR)

• Consent for Google Analytics — set only when you click "Accept", and withdrawable at any time.
• Legitimate interest for operating and securing the site, rate-limiting the public route API, generating the flight-time estimate you requested on the website, counting which routes are looked up, measuring page speed with Vercel Speed Insights, and counting page views with Vercel Web Analytics.
• The on-device preferences are strictly necessary to honor choices you made. The dashboard session cookie is strictly necessary to keep that private page unlocked, and it is not set for ordinary visitors.
• Contract, if you create an account or save content, to provide that part of the service, and legitimate interest in securing it.

California (CCPA / CPRA)

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not show Google ads unless you opt in on the consent banner. If you believe we hold personal information about you, email hello@pnm.now and we will help as the law requires.

International transfers

Our hosting (Vercel), AI provider (Anthropic), and — if you opt in — Google (Analytics and AdSense) are based in the United States. A Redis database configured for the route tally may be as well. Where applicable, transfers rely on their respective safeguards (such as Standard Contractual Clauses).

If you create an account or save content

If you create an account, we process the information you give us — such as a name, an email address, and sign-in credentials — to operate the account. Any content you save, including maps, flights, or other material, is processed so we can host and display it as the service requires. If you turn on a public profile, the content you choose to show there may be displayed publicly. You can ask us to delete an account or saved content by emailing hello@pnm.now. Asking does not require us to keep a copy for you.

Retention

We are under no obligation to store, keep, back up, or maintain any data, maps, flights, accounts, or other content. We may delete, lose, or stop storing any of it at any time, with or without notice, for any reason. Any retention period in this policy is a maximum, not a promise that we will keep the data that long or at all. You are responsible for keeping your own copies.

Preferences stored on your device stay there until you clear them. The route tally keeps aggregate counts for up to 365 days, not a history tied to you, and is then deleted. Host server logs are retained only for our provider's standard short period and then deleted. If you create an account or save content, we may delete that at any time as well.

Your rights

If you're in the EEA or UK, you have the right to access, rectify, erase, restrict, object to, or port your personal data, and you may lodge a complaint with your local data protection authority. Email hello@pnm.now. For ordinary use of the map we typically hold no personal data tied to you. If you create an account, email us, or save content, tell us what you want corrected or deleted. We are not required to keep a copy after we delete it.

Changes

We may update this policy at any time. The new policy is effective when we post it, and the date above will change. A material change will be noted on this page and, if an account has an email address, we will email that address. How you may use Mapper is in the Terms of Use.