Privacy policy.

What we collect

Account data. When you create an account we store your name, email address, and a hash of your password. If you sign in with Google we store your name, email, and avatar image URL as provided by Google instead of a password.

Sign-in sessions. For security, each active session records the IP address and browser user-agent it was created from. You can review and revoke sessions in your dashboard settings.

API usage records. Each API request is logged with the endpoint path, response status, timing, response size, and the API key and account it was made with. We use these records for quota enforcement, billing, and aggregate statistics. Request coordinates and query parameters are not stored. Unauthenticated requests are recorded against a truncated hash derived from the IP address and user-agent, used only for rate limiting and abuse prevention.

Waitlist. If you join a product waitlist, we store your email address with our email provider until we contact you or you unsubscribe.

Support email. If you email us, we keep the correspondence so we can help you.

What we don't do

No analytics or tracking scripts, no advertising, no sale or sharing of personal data, no third-party fonts or embeds. The only cookie we set is the session cookie that keeps you signed in. Map fonts and basemap tiles are self-hosted.

Why we process it

We process account and usage data because it is necessary to provide the service you signed up for (contract). We process session and rate-limiting data to keep the service secure and fair (legitimate interest). We process waitlist emails because you asked us to (consent), and you can withdraw that consent at any time via the unsubscribe link or by emailing us.

Where your data lives

Darly is operated from France. Our database (accounts, sessions, usage records) is hosted with Neon in the EU (Frankfurt), and our services run on Google Cloud in the EU (Belgium). These providers process data on our behalf:

• Neon — database and authentication hosting (EU).
• Google Cloud — application hosting and file storage (EU). When you download data or load map tiles, your browser fetches them directly from Google Cloud Storage, so Google receives your IP address for those requests.
• Cloudflare — DNS and network proxy in front of our domains.
• Resend (relaying via Amazon SES) — transactional and waitlist email.
• Proton — inbound support mailboxes.

Where a provider processes data outside the EU/EEA, transfers are covered by the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

Account data is kept until you delete your account. API usage records are kept for up to 24 months for billing history and aggregate statistics. Short-lived operational server logs are retained for roughly 30 days. Waitlist contacts are kept until the list's purpose is fulfilled or you unsubscribe.

Deleting your data and your rights

You can delete your account yourself from the dashboard settings. Deletion is immediate: your account, sessions, and API keys are removed, retained usage records are stripped of every identifier linking them to you, and any waitlist entry for your email is removed.

You can also ask us for a copy of your data, ask us to correct it, or object to processing by emailing [email protected]. If you are in the EU/EEA or UK, you additionally have the right to lodge a complaint with a data-protection authority — for Darly, the lead authority is France's CNIL.

Changes and contact

If this policy changes materially, we will note it here and email account holders. Questions go to [email protected].