Privacy Policy

Effective July 22, 2026 · EasyPlotPlan (easyplotplan.com)

This policy describes what we collect, why, and what we never do. The short version: we collect the minimum needed to run a drawing tool and process unlock payments, we run no ads and no third-party analytics, and we do not sell or rent your personal information to anyone.

1. What we collect

Account data. Your email address and a one-way hash of your password (we cannot see the password itself). If email verification or a password reset is used, we store the short-lived tokens that make those links work.

Your plans. The drawings you save: geometry, labels, titles, and any address or parcel number you attach to a plan, plus images you upload as tracing underlays and the small preview thumbnails we generate from your plans. This is the product — we store it so you can come back to it.

Guest drawings. If you draw without an account, the drawing lives in your own browser's local storage. It never reaches our servers unless you create an account, at which point it's imported to your dashboard.

Payment records. Payments are processed by PayPal. We never receive your card number. We store what PayPal sends us to prove and support the purchase: the order and transaction IDs, the amount and currency, and the email on the PayPal account, linked to the plan you unlocked.

Operational data. Standard web server logs (IP address, request, time, browser type) kept for security and debugging, and short-lived rate-limiting counters that protect the service from abuse.

2. Cookies and local storage

We use one essential session cookie to keep you signed in, and a CSRF token that protects your account from forged requests. That's it — no advertising cookies, no tracking pixels, no analytics scripts. The editor also uses your browser's local storage for things that stay on your device: your guest drawing and small preferences like whether you've dismissed the shortcut legend.

3. Third parties your data touches, and why

PayPal processes payments under its own privacy policy.

Geocoding (OpenStreetMap Nominatim). When you search an address, our server forwards the search text to the OpenStreetMap Foundation's geocoder. The request comes from our server, not your browser, so the geocoder sees our IP, not yours.

County and state parcel services. To find a parcel we send the map coordinates — and, where it improves accuracy, the address text or parcel number you provided — to the relevant public government GIS service, again from our server.

Map imagery. Aerial and street map tiles load directly from their providers into your browser (Esri, USGS, OpenStreetMap, and Mapbox if configured). Like any website loading images from a third party, those providers see your IP address and which map areas you view, under their own privacy policies.

Building footprints (Overpass/OpenStreetMap). When you import building outlines, the current map area is sent to an OpenStreetMap query service from our server.

We share personal information with no one else, except if required by law or to protect the service from abuse, and we never sell it.

4. Emails we send

Transactional only: email verification, password resets (including ones an administrator sends at your request), and messages you initiate with support. We don't send marketing email.

5. How long we keep things

Your account, plans, and uploads: until you delete them or your account. Deleting your account removes your plans, uploaded images, and thumbnails from our servers. Payment records may be retained after account deletion as required for accounting, tax, and fraud-prevention purposes. Server logs and rate-limit data are kept briefly and rotated. Cached lookups (geocoding and parcel responses) are stored without connection to your account and expire on their own.

6. Your choices and rights

You can view and edit your plans anytime, change your email in account settings, delete individual plans, or delete your whole account from account settings. Depending on where you live (for example under the GDPR or the California Consumer Privacy Act) you may have rights to access, correct, export, or delete your personal information, and to complain to a supervisory authority. For any of these, or anything this policy doesn't answer, email support@easyplotplan.com — we'll respond to verified requests within 30 days. We do not sell personal information, so there is nothing to opt out of selling.

7. Security

Traffic is encrypted with HTTPS. Passwords are stored only as strong one-way hashes. Uploads live outside the public web root and are served only to their owner (and to share-link holders for the shared view). Staff access to account data is limited to running and supporting the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

8. Children

The service is not directed to children under 13 and we don't knowingly collect their information. If you believe a child has created an account, contact us and we'll delete it.

9. Where data lives, and changes to this policy

Our servers are in the United States; if you use the service from elsewhere, your information is processed in the US. If we make material changes to this policy we'll post the new version here with a new effective date and make reasonable efforts to notify account holders by email.

10. Contact

Privacy questions and requests: support@easyplotplan.com.