Privacy

Effective date: October 24, 2026

Your data and your routes

GPX routes. When you upload a GPX route, its preview, its status and the model built from it are shown only to whoever uploaded it (your account, or your browser session if you are not signed in) and to the account that owns the finished model. Alticarta does not show your route to anyone else, including us. We store only the route's points, not names, times or waypoints. The route file is deleted when your model is delivered, or 48 hours after you upload it, whichever comes first. The model built from it shows the route and is kept like any other model file.

Place searches. The place names you type are sent from our server to search services built on OpenStreetMap data (Nominatim and Photon) so we can find the place. They receive the search text from our server, not your IP address. To build your model, our server also requests elevation and map data for the area you chose from public data services.

Your location. If you allow your browser to share your location when you search for a lake, we use it to choose between lakes with the same name, and it is saved with that model's settings. We never ask for it otherwise.

Payments. Payments are handled by Lemon Squeezy, our merchant of record. They take your card details and handle sales tax; we never see your card number.

Model files. Each model file carries a coded identifier, as our Terms explain. It points to the account that made the file or, for a visitor who is not signed in, to a scrambled form of their IP address. It lets us trace files shared against the Terms. The code itself contains no name or email, but the license file in a paid download names the buyer and their email.

"Who sent you?" If you answer "Who sent you?" at checkout, the answer goes to Lemon Squeezy with your order, and we keep a record of it, with your account number, in our records so we can credit the maker or partner who sent you.

How long we keep your data.

• Your GPX route: deleted when your model is delivered, or 48 hours after upload.
• Paid model files: 30 days after your last download, so you can download again. A paid model you have not downloaded yet is kept until you do.
• Files made while signed in: 30 days after your last download.
• Files from visitors who are not signed in: about 48 hours after they were made or last downloaded, sooner if our storage is full.
• Your account: until you ask us to close it. We close accounts by hand on request; records of what you built and bought are kept until then.
• Contact messages, the security log and saved IP addresses: kept while we need them to answer you and keep the service secure, and deleted on request. A location you shared is kept with that model's settings, like the model.

We don't sell your data. We don't show ads, and we share data only with the services named on this page.

Questions and requests. Write to aaron@alticarta.com for a copy of your data, a correction, or to have your account and its data deleted.

Privacy policy

Who we are. Alticarta is a sole proprietorship registered in the Province of Ontario, Canada, at 2727 Steeles Ave West, Unit 103-891, Toronto, Ontario, M3J 3G9. We are responsible for the personal information described here. Our privacy contact is Aaron, at aaron@alticarta.com.

What we collect.

• Account details: your email address and your password, stored only in a scrambled (hashed) form we cannot read back.
• Orders and plans: what you bought, when, and your plan's status, as Lemon Squeezy reports them to us. Lemon Squeezy holds your name, billing address and card details under its own privacy policy.
• What you build: your search text, model settings and the files we generate for you.
• Your approximate location, only if you allow your browser to share it when searching for a lake, saved with that model's settings.
• GPX routes you upload, handled as described above.
• Your "Who sent you?" answer, if you give one.
• Messages you send through our contact form, with your email address and IP address.
• Technical records: your IP address and basic request details, to run the service, limit abuse and keep it secure. Our host's logs, which can include your IP address, are kept for 7 days. We also keep a security log of sign-ins and account actions (with IP addresses) and the last 20 IP addresses used on your account.
• Visit counts: for each day, how many pages were opened, previews started, models built, accounts created and purchases made, grouped by the link or website that sent the visitor (for example a tag such as "ig" on our link, or "facebook.com"). Only these totals are saved, with no IP address, browser details or email, and no cookie is used. To count each visitor once a day, our server uses a scrambled form of the IP address and browser type, with a key that is replaced every day and never saved.
• Cookies: one to keep you signed in and to protect forms against forgery and, if you arrive through a partner's link, referral cookies (ours and Lemon Squeezy's) for 30 days so the partner can be credited. No advertising or analytics cookies.

Why we use it. To make and deliver your models, run your account and plan, count visits to see how people find Alticarta, prevent abuse, enforce our Terms, answer your questions, and send account emails (verification and password reset). Lemon Squeezy sends your receipts and order emails. We send news or offers only if you agreed to receive them, and you can withdraw that consent at any time from your email settings or the unsubscribe link we provide.

Who we share it with. Only the services that run Alticarta, and only what each needs:

• Lemon Squeezy (payments, tax, subscriptions): your order and billing details, your Alticarta account number, the name of the model you bought, and any referral or "Who sent you?" answer.
• Fly.io (hosts the site and its storage, Toronto): everything the site stores.
• Resend (sends our account emails and contact-form messages): your email address and the email's content, including contact-form messages.
• Zoho (our email): emails you send us and our replies.
• Tigris (stores map data for builds): elevation, land cover and river map data only, no personal data.
• Nominatim and Photon (OpenStreetMap place search): your search text, sent from our server.
• Google Fonts, Cloudflare cdnjs and Lemon Squeezy's referral script (fonts, the 3D viewer library and partner referrals, loaded by your browser): your IP address, when your browser loads them.

We do not sell personal information or share it for advertising. We disclose it to others only if the law requires it.

Where it is stored. On servers in Canada (Fly.io, Toronto). Lemon Squeezy, Resend, our search providers and the font and script hosts named above may process data in other countries, including the United States, under their own policies.

How long we keep it. As in the list above.

How we protect it. Every page is served over an encrypted connection (HTTPS), passwords are stored hashed, and only Alticarta and our hosting provider can access the server.

Your rights. You can ask to see the personal information we hold about you, have it corrected, or have your account and its data deleted, and you can withdraw consent to optional emails at any time. Write to aaron@alticarta.com; we answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada.

Children. Alticarta is not directed at children under 13, and we do not knowingly collect their information.

Changes. If we change this policy, we post the new version here with a new effective date.