Where your data lives, and which third parties are involved
In short
Handing three hundred holiday photos to a site you have never heard of is a real decision. This page says where the files actually end up, who runs the machines, and why those machines and not others.
My goal is to get to a hundred percent in France, and the storage of your files got particular attention. Mapito was built by someone who loves travelling and computers. We all live with data leaks, and here everything has been done as well as it could be.
What is in France
Your photos, your videos and your GPS files, on OVHcloud object storage in Paris. That is the part of the setup that matters most, because it is the part that cannot be rebuilt: a server can be reinstalled in an hour, a lost holiday photo is lost.
The Paris region was chosen because it copies files across several separate data centres. OVH lost an entire data centre to a fire in Strasbourg in 2021: a single building is not a place to keep something irreplaceable.
That said, Mapito is not a backup service and does not hand your original files back — the photo it keeps is a re-encoded, size-capped copy meant for readers. Keep your own originals.
What is in Allemagne
The machine that runs the site: the code, the database, and the jobs waiting to run — an OVHcloud server in Allemagne, so inside the European Union. It is not in France, and that was not a choice: all three French locations were out of stock when it was ordered.
The European Union is what the GDPR requires. "France" was a matter of trust, not of law.
It is a move I really do intend to make — it matters to me, and probably to you. As soon as the current German server reaches the end of its term, I move to a French server straight away.
This page will be corrected the day it moves.
The third parties, and where they are
A handful of outside services do one job each. Nothing is sold, rented or handed over to anyone. They do that job very well, and honestly they would be hard to do without: rebuilding any of them alone would mean doing it worse.
- Email — Brevo, a French company, sends the address confirmations, the co-author invitations and the support replies. In short: Brevo sends the emails.
- Payment — Stripe. Your card details are typed on a page Stripe hosts and never reach the Mapito server. Stripe is the only provider in the chain that handles part of its work from the United States, and it is framed by the EU–US data privacy framework and the Commission standard contractual clauses. Nothing of your stories, photos or GPS files leaves the European Union.
- Map background — the tiles are downloaded by your browser straight from a third-party provider, which therefore sees your IP address and the area you are looking at. That is how every map on the web works, and the only alternative would be for Mapito to serve the whole world map itself.
- Elevation — the French IGN refines the climbing figures of an imported GPS file. The Mapito server sends it the coordinates and nothing else. Your browser never contacts it.
The full list, with what each one receives, is in the privacy policy.
Audience measurement runs here, not at Google
Knowing how many people read a story is useful to its author. The tool that counts is Matomo, installed on the Mapito server itself: no third party receives your visit. There is no Google Analytics, and no social network pixel anywhere on the site.
It sets no cookie, your IP address is truncated before being stored, and nothing is shared with anyone. Those three settings together are exactly why the site has no cookie banner: there is no consent to ask for when there is nothing to consent to.
It is also absent from the editor and from the admin screens. What is worth counting is readers — not an author hard at work writing you a great story.
What is not promised here
Mapito is run by one person. There is no certification to wave about, no security audit to cite, and nothing on this page claims a level of protection nobody has measured.
What can be said is what is written above: where the machines are, who runs them, and what the site does not do — no ads, no resale, no tracking, no cookie banner, and no copy of your card details.
And the one piece of advice that follows from all of it: keep your own copy of your photos. That is true of any site, including this one.
Asking about your own data
You can ask for a copy of what the site holds about you, have it corrected, or have your account erased. Deleting an account is a button in your own account screen, with a thirty-day window to change your mind.
Anything else goes to rgpd@mapito.cc, and the reply is due within a month.