Privacy policy
Effective September 29, 2026.
This policy explains what personal data Mapsel collects, why, how long we keep it, and your rights. It covers mapsel.com, the Mapsel app and the emails we send.
Who we are
Mapsel is made and run by TrackYourShelves LLC, a company in the United States. We decide how and why your personal data is used, so we're its controller.
TrackYourShelves LLC
8735 Dunwoody Place, Ste N
Atlanta, GA 30350
USA
Email hello@mapsel.com. For security issues, security@mapsel.com.
If you use Mapsel for work, your team's owners decide what goes into its maps and who can see them.
What we collect and why
We collect only what Mapsel needs to work, stay secure and get better. You need an email address to have an account, and without one we can't provide Mapsel. Everything else is optional or comes from how you use it.
Your account
- Your email address and name.
- If you sign in with GitHub or Google: the name, verified email address and account number they share with us. We don't get access to your account there.
- Your settings, such as your look.
Why: to create your account, sign you in, and send you sign-in codes and security alerts. Legal basis: our contract with you.
Sign-in and security
- The IP address and browser details of sign-ins and security changes, which you can see in Account › Security.
- The approximate location of each sign-in and security change (city, region and country), worked out from its IP address.
- A random ID for each browser you sign in on, so we can spot new devices.
- The public part of your passkeys. Your fingerprint, face or PIN never leaves your device.
- Your authenticator app and backup codes, stored in a protected form.
- Sign-in codes, which expire after 5 minutes.
Why: to check it's you, warn you about sign-ins you don't recognize, and stop abuse. Legal basis: our contract with you, and our legitimate interest in keeping Mapsel and your account secure.
Bot checks
When you sign in or join the beta, a bot check from our security provider looks at your IP address and technical details of your browser and connection, to tell people from bots. Legal basis: our legitimate interest in preventing abuse.
Your maps and content
- What you and your team put in Mapsel: maps, cards, notes, links, comments, labels, screenshots and other files.
- The history of changes, with who made each one and when, so you can undo and see what happened.
- Share links and AI connection keys you create, stored in a protected form.
Why: to provide Mapsel. Legal basis: our contract with you.
Teams and invites
Team names, members and roles, and invites: the invited person's email address, who invited them, and whether they joined. If a teammate invites you, your email address came from them, and we use it only to send the invite and let you join. Legal basis: our contract with the team, and our legitimate interest in delivering invites people send.
The beta waitlist
Your email address, and your answer to “What would you map first?” if you give one. Why: to plan the beta and invite you. Legal basis: steps you asked us to take before you have an account.
Feedback and emails to us
What you send with Send feedback, linked to your account, and what you write to us. Why: to answer you and improve Mapsel. Legal basis: our legitimate interest in running and improving Mapsel.
Usage counts
When an action succeeds, our servers may note that it happened, for example that a map was created or a view was used. Each note holds your account and team IDs, fixed choices and numbers, the app version, and your country, worked out from your IP address. It never holds your maps, anything you type, your email address or your IP address. No tracking script runs in your browser, and nothing is sent to anyone else.
Why: to learn which parts of Mapsel help people. Legal basis: our legitimate interest in improving Mapsel. You can turn this off at any time in Settings › Your data › Share usage counts.
Emails we send
Sign-in codes, security alerts, invites, beta invitations and account notices. Our email provider receives your address and the message in order to deliver it. We keep a daily count of emails by kind, with no addresses, and we don't track opens or clicks. We don't send marketing email. If we ever do, we'll ask you first, and every one will have an unsubscribe link. Legal basis: our contract with you.
Admin actions
When a Mapsel admin acts on an account or team, for example to approve a beta request or suspend an account, we record who acted, what they did, when and why. Legal basis: our legitimate interest in accountability and security.
Mapsel's admin can see your account details and sign-in history, including approximate location, to support you and prevent abuse. Every such look is logged.
Backups
An encrypted copy of our data is made every night and kept for 30 days, so we can recover from mistakes and failures. Legal basis: our legitimate interest in keeping your data safe.
Payments
Mapsel is free during the beta. When paid plans start, a payment provider will handle card details, and we'll update this policy first.
What we never do
- Receive or store your code. It never reaches our servers.
- Sell your personal data, or share it for advertising.
- Use ad trackers, tracking pixels, session recording or third-party analytics.
- Look inside your maps. Our admin tools show counts and dates, never map content.
- Use your content to train AI. Mapsel runs no AI on it; if you want AI, you connect your own.
Cookies and storage on your device
Mapsel uses only the cookies it needs to work, and one that remembers a look you choose. There are no analytics or advertising cookies, so there's no cookie banner.
| Type | What it does | How long |
|---|---|---|
| Sign-in | Keeps you signed in. | Up to 30 days |
| Security | Helps us spot a sign-in from a new device. | Up to 400 days |
| Sign-in steps | Used briefly while you sign in. | A few minutes |
| Shared links | Lets you view a map someone shared with you by link. | Until the link expires |
| Your look | Remembers the look you chose. Set only if you choose one. | 400 days |
The bot check on the sign-in and beta pages comes from our security provider. It reads technical details of your browser to tell people from bots, and doesn't track you.
The app also keeps copies of maps you've opened in your browser so they open quickly, and changes that haven't been saved yet so nothing is lost if you go offline. They're cleared when you sign out, lose access to a map, or delete your account. A few display settings are kept there too.
To remove the look cookie, clear this site's cookies in your browser. You'll see the default look.
Who we share it with
- Service providers that help us run Mapsel: hosting, database, file storage and backups, bot checks and network security, and email delivery. They handle data only on our instructions, under data processing terms, and they operate in the United States. Ask us for the current list.
- The people you work with. Your name and what you add are visible to the teams and maps you're in, and to guests given a share link.
- AI you connect. An AI connection key lets your AI read, and if you allow it, change the one map it's for. Your AI provider's own terms apply to what it receives.
- When the law requires it. If we get a valid legal demand, we give only what's required, and tell you first unless we're not allowed to.
- If Mapsel changes hands. If TrackYourShelves LLC or Mapsel is sold or merged, your data would move with it under this policy, and we'd tell you before it did.
Where your data is
We're in the United States, and so are the providers that help us, so your data is stored and processed in the US. If you use Mapsel from another country, you send it to us there. US law may protect it less than the law where you live, and we protect it as this policy says wherever it is.
Mapsel isn't available in the EU, EEA, UK or Switzerland yet because of data laws there. We don't offer it to people there, and you may not sign up from there.
How long we keep it
| What | How long |
|---|---|
| Your account and content | Until you delete them or your account. Content you added to a team that others still use stays with that team, without your name. |
| Things you delete from a map | 30 days in Trash, then removed. Earlier versions stay in the map's history. |
| A map's history, including earlier versions | As long as the map exists. On request, a map's admin can erase a card's earlier text from it. |
| Comments | Until deleted. Deleting one removes its text at once, and leaves a note of who wrote it and when. |
| Sign-in sessions | 7 days after you last use Mapsel, and 30 days at most |
| Sign-in codes and invite links | 5 minutes for codes, 7 days for invites |
| Share links | Until they expire (30 days unless set otherwise) or are revoked |
| Security log | 12 months. Full IP addresses are shortened after 30 days. You can see your last 90 days in Account › Security. |
| Usage counts | 13 months. Totals with no IDs are kept. |
| Feedback | 13 months |
| Beta waitlist | Until we invite you or decline. Your answer is cleared 90 days after that. The entry is deleted when you create an account, or 12 months after the invite or decline. |
| Records of admin actions | 24 months |
| Emails you send us | As long as we need to help you and keep a record of what we agreed |
| Backups | 30 days. Anything deleted leaves our backups within 30 days. |
If the law requires us to keep something longer, we keep it only for that purpose.
How we protect it
- Your data is encrypted in transit and at rest, and sign-in secrets are stored in a protected form.
- There are no passwords. Every sign-in takes two steps.
- Access to our systems is limited and logged. Admins can't read map content or act as you.
- Backups are encrypted.
If a breach puts your personal data at risk, we'll tell you and the authorities as the law requires. To report a security issue, write to security@mapsel.com.
Your rights
Wherever you live, you can ask us to:
- give you a copy of your personal data, in a format you can take elsewhere;
- correct it;
- delete it;
- stop or limit using it, including where we rely on our legitimate interests.
Some of this is in Settings: change your name in Profile, turn off usage counts or delete your account in Your data, and export a map you manage from its settings. For anything else, write to hello@mapsel.com from your account's email address. It's free. We reply within a month, and may ask you to confirm it's you.
We don't make decisions about you by automated means alone that have legal or similarly significant effects. Automatic safety checks, such as bot checks and sign-in limits, can pause a sign-in for a while. Write to us if one gets it wrong.
If you're in California
In the past 12 months we've collected these categories of personal information: identifiers (name, email address, IP address, account and device IDs); internet activity (the security log and usage counts); approximate location (city, region and country); sign-in credentials (passkey and authenticator details); and the content you add. They come from you, your teammates, your browser, and GitHub or Google if you sign in with them. We use them for the purposes above and keep them for the times above.
We don't sell or share personal information, as California law defines those terms, and never have. We use sign-in credentials only to provide Mapsel and keep it secure. You have the right to know, delete and correct your personal information, and we won't treat you differently for using these rights. Someone you authorize in writing can ask for you.
Children
Mapsel isn't for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, write to us and we'll delete it.
Changes to this policy
We post every change here with a new effective date. If a change matters, we'll email account holders before it takes effect.
Contact
Write to hello@mapsel.com, or by post to the address at the top of this page.