The principle
Merak runs in your browser. If you never make an account, we do not have an account for you, and your maps never leave your machine — they live in your browser's own storage and in files you save yourself. Accounts exist because cloud saving needs somewhere to save to, not because we want the data.
What we collect, and why
| Data | Why | Kept |
|---|---|---|
| Email address | To sign you in and connect a purchase to your account | Until you delete your account |
| A one-way hash of your password | To check your password without ever storing it | Until you delete your account |
| Your display name, if you give one | To show you who is signed in. Optional, and you can leave it blank | Until you delete your account |
| Failed sign-in counts, by email and IP | To stop password guessing. Deleted the moment you sign in successfully | 15 minutes |
| Maps, fonts and symbols you choose to save to the cloud | So you can open them on another device | Until you delete them, or your account |
| Plan and expiry from Polar | To know which features to unlock | As long as required for tax and accounting records |
| Error reports and basic request logs | To find out what is broken | 30 days |
What we do not do
We do not sell personal data. We do not use your maps to train machine-learning models. We do not run advertising trackers, there is no third-party analytics script following you around the app, and there is no third-party sign-in that could report your use of Merak to anyone else. We do not read your maps except where you have asked support to look at a specific one.
Your account
Accounts are ours. You create one with an email address and a password, and there is no third-party sign-in involved — no Google, no Facebook, no identity provider that learns you use Merak. Your password is never stored; what we keep is a slow one-way hash of it (PBKDF2-HMAC-SHA256), which cannot be reversed back into your password.
An account exists only so cloud saving has somewhere to save to. If you never make one, we hold nothing about you at all.
Payments
Payments are processed by Polar Software Inc. acting as our merchant of record. Polar is the seller of record for the transaction and an independent data controller for your billing information — not our processor. It collects your payment details, billing address and the tax-residency evidence it is legally required to keep, under its own privacy policy.
Merak never receives, transmits or stores card numbers, CVCs or bank details. There is no payment form anywhere in this application: checkout happens entirely on Polar's own domain, which is why Merak is out of scope for PCI DSS.
What comes back to us from Polar is deliberately minimal: a plan name
(premium or lifetime), an expiry date, and an opaque customer and
subscription identifier so a renewal or cancellation can be matched to the right account. That is
the entire payload we store. We do not receive your card details, your billing address or your
tax status.
Checkout sessions carry your Merak user id as an external_customer_id so that a
completed payment can be matched to your account without matching on email — people
frequently pay with a different address than they signed up with.
Where it is stored
Anything you save to the cloud lives on Cloudflare's network: map files in Cloudflare R2 and account records in Cloudflare D1. Cloudflare distributes data across regions; their data-processing terms and standard contractual clauses govern transfers.
What stays on your own machine
Most of Merak never touches a server at all. Autosave writes to your browser's own private
storage so you can close the tab and come back to the same map, and the optional
save folder writes ordinary files into a directory you pick, holding your maps, your art
in assets/ and your fonts in fonts/.
Neither is uploaded. A font or an image you put in that folder is read by your browser and used to draw your map; it is not sent to us, and we could not read it if we wanted to. You chose the folder, you can open it in any file manager, and deleting Merak from your life is a matter of keeping the folder and closing the tab.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deleting your account removes your account record and everything stored under it. Email merakmapmaker@gmail.com and we will action it within 30 days. If you are in the UK or EU you also have the right to complain to your data protection authority.
Cookies
Merak sets one cookie, and only once you sign in: your session. It is strictly necessary for the service to work, cannot be read by page scripts, and is not used for tracking. There are no advertising or analytics cookies, which is why you are not being asked to click a consent banner. Signed out, Merak sets no cookies at all.