Privacy Policy

1. General information

This policy describes personal data processing on ths2.ru, the THS2 API, and related mobile application features.

Controller: Azat Maratovich Akhmetshin, Ufa, Republic of Bashkortostan, Russian Federation. Privacy contact: akhmetshin.azat@gmail.com.

2. Data we process

• account data: email, optional first and last name, interface language, password hash, registration and login dates;
• user maps and related data: PMTiles files, titles, descriptions, sizes, checksums, technical and geographic metadata;
• library and store records: map access rights, product actions, and access-grant history;
• order data: selected plan, term, price, discount, promo code, status, YooKassa payment identifier, and receipt record;
• map seller application data: name, contact email, sample link, approximate map count, and description;
• rights complaints: name, email, claimant role, description, and evidence URL; the sender IP is retained only as a protected anti-spam hash;
• technical data: IP address, user-agent, request time and path, login, upload, download, deletion, generation, and administrative audit events;
• information voluntarily sent to support.

THS2 does not receive or store full card numbers, CVC codes, or other payment-instrument credentials. YooKassa processes those details on its protected payment page.

3. Purposes and legal grounds

We use data to create and secure accounts, store and deliver maps, operate the library and API, restore access, handle requests, comply with law, prevent abuse, and maintain security. Processing is based on performing the user agreement, taking requested pre-contractual steps, legal obligations, and consent where requested separately.

Personal data is not sold, used for advertising profiles, or supplied for marketing mailings.

4. Cookies, analytics and external resources

The site uses essential cookies for authenticated sessions, CSRF protection and service messages, and Yandex Metrica for aggregated visit statistics, click maps, link tracking and Session Replay. Metrica may receive the IP address, browser and device information, page and referrer, and interaction events, and may set its own cookies. Content of authenticated service pages is hidden from Session Replay recording. Yandex processes this data under the Yandex Privacy Policy.

Interactive maps cause the browser to contact OpenStreetMap directly. Some interface libraries are loaded from the unpkg CDN. Those providers receive normal network request data, including IP address and user-agent, under their own privacy terms.

5. Retention and security

Primary account and file data is stored on service infrastructure in the Russian Federation. Passwords are stored only as strong hashes; connections use HTTPS; map files are isolated by owner; downloads and APIs enforce access control.

Account data is retained until account deletion or service termination. User files are retained until user deletion or until the published retention period ends after plan expiry while the free quota is exceeded; the service sends warnings to the account email before automatic cleanup. Closed complaints and audit events are retained for up to three years unless longer retention is required by law or to establish or defend claims. Deleted data may remain in rotating backups for up to 14 days.

6. Data disclosures

Access is limited to the controller and providers needed for hosting, databases, backups, and email. During checkout, order information and normal request metadata are sent to YooKassa to process the payment, prevent fraud, and confirm its status. YooKassa applies its own terms and privacy policy.

Data may be disclosed to public authorities upon a lawful request. Publishing a map does not make its owner's contact details public.

7. Your rights

You may request access, correction, restriction, or deletion of your data, withdraw consent, and challenge processing. Send requests from the account email to akhmetshin.azat@gmail.com. Reasonable identity verification may be required to protect the account.

Withdrawal does not affect prior lawful processing or processing required by contract or law. Removing required data may make continued account use impossible.

8. Policy changes

The current version is always available at this address. The version date is updated for material changes.

Community publication privacy

The finds feed may display a photo, title, description, category, author-selected display name, optional region or deliberately obscured public point, likes, awards and reports. Published photos are re-encoded and embedded EXIF/GPS metadata is removed. When the service receives an exact point for obscuring, it randomly displaces the point and does not retain the submitted exact coordinate in the publication record. Supported application versions may instead obscure the point on the device and send only the public point and radius.