Site Maps — Privacy
Interim Pilot · Effective October 4, 2026
What we cannot see
- The property addresses you supply, in our records. No job record, log, digest or email we keep holds it.
- A list of the properties you research. The operator's daily summary counts jobs; it names no property and no person.
- Your package. Your maps, PDF and ZIP are stored locked with your link's key, and we do not keep the key. Without your link, we see only scrambled data.
What we can see
- For a few minutes, the address you enter and your link's key, while the server builds your maps (if we were looking, which we're not). It keeps neither afterwards. For those minutes, you are trusting us.
- For about 31 days, your email address, and when you ran a job.
1. The link is the key
When you submit an address, SiteMaps makes a key for that job: a random code, 32 characters long. The key travels in the link to your package, after #k=: in the page you land on, and in the email if you give an email address. Browsers never send that part of a link to a server, so opening your package never sends the key to us. Your package page opens only with it. Anyone you give the link to can open your package, so share it only with someone who may see the property.
Your browser also remembers the key, and the address you typed, so you can return from the same browser without the email. Clearing this site's data in your browser forgets both.
A list of properties gets one link for the whole batch. Each package's key is made from the batch's key, so that one link opens every package in the list. The list you entered stays in your browser; we keep only which packages belong to the batch.
2. What happens to what you send
| What | Where it goes | How long | Who can see it |
|---|---|---|---|
| The address, and your User Project ID if you give one | SiteMaps' service in Amazon Web Services, Canada (Central). It waits in a queue until the map maker takes it, usually seconds. | Gone once the maps are made; at most one day if the service is down | The service |
| Your package (maps, PDF, ZIP, and the address shown at the top of its page) | Stored locked with your link's key. | 30 days | Whoever holds the link |
| The run log | Inside your package, as 00_run_log.txt: what the map maker did, step by step. If something goes wrong, you can send it to us. | With your package | You |
| Your email address | Stored with the job so the link can be sent; the email goes out through Amazon's email service. The email holds the link, not the property address. | About 31 days | The operator |
| A help request, if you send one | The feedback form (Google Forms, in the operator's Google account), or a reply to help@site-maps.com, which reaches the operator's email. It carries the job number, never the property address unless you write it. | Kept only to answer it | The operator |
| The job record | Status, times, and a one-way code made from your link's key. No property address. | About 31 days | The operator |
| Service logs | Job number, outcome, duration, the kind of any error, how many map tiles the job fetched (by zoom level), and how many requests it made to the Province's elevation service. No property addresses, and no tile locations. | 7 days | The operator |
| Your acceptance of the terms | Terms version, time, browser description and IP address. | 7 years, as the record of your acceptance | The operator |
3. What the operator can and cannot see
The operator runs the service and can read anything stored in plain form: your email address, the job's status and times, and the service logs. The operator cannot open your package: it is stored locked, and only your link unlocks it. Every read of the job records, by the service or by a person, and every read of a stored package except through your link, is written to an audit log (AWS CloudTrail).
While your job is being made, the service handles the property address, and your User Project ID if you gave one, in plain form. It has to, to draw the maps.
4. Who else sees the property
To build your maps, SiteMaps' server asks public sources about the property: Google (by address, to find it; by location, for maps, aerial images and street views), municipal, county and provincial map services (mostly by location; some address layers by civic address), and the Ontario Heritage Trust's register (by street name). Each sees the server's request under its own privacy policy. None of them sees who asked.
5. Checked by outside tools
Mozilla HTTP Observatory: A+ (security headers). Qualys SSL Labs: A+ (encryption in transit). Both last checked 28 September 2026. The links run each test again now, so you see the current grade, not our claim: Run the Observatory test · Run the SSL Labs test.
We test this ourselves too. On 28 September 2026 we sent made-up addresses through SiteMaps (one it could find, one it could not, and a list), then searched everything the service stores: files, records, logs, queues and the audit log. They were found nowhere outside the locked packages.
6. Check it yourself
You don't have to take sections 1 to 3 on trust. The code that locks your package is published, copied from the running service: lock.py. The package page's own code, which unlocks it in your browser, is p.js. The check that stops any change to the site if a setting this page depends on has changed is privacy_check.py.
To see that your key never leaves your browser: open your package page, press F12, choose the Network tab, and reload. Your key is the part of the page's web address after #k=. It appears in none of the requests.
7. Reporting a problem
If you find a security or privacy problem (or any bug, really), please write to security@site-maps.com. We'll reply within 5 business days.
8. Changes
This page describes the interim pilot and will change before SiteMaps is offered more widely. The date at the top shows when it last changed.
Third-party software: the map picker uses Leaflet 1.9.4, under its BSD 2-Clause licence.
This page explains how SiteMaps handles your data in plain language. The binding document is the Terms of Use & Disclaimer. Questions: ask the person who invited you to the pilot.