ODRMaker Privacy Policy

Effective date: 19 October 2026

This policy explains what personal data is processed when you use ODRMaker at https://odrmaker.com (the "Service"), who processes it and why, and what rights you have. It applies whether or not you have an account.

In short

• Your road files stay on your device. ODRMaker opens, edits and saves .xodr files in your browser. The editor never uploads them, and we never use them to train AI models. We see a file only if you choose to send it to us yourself, for example by email.
• We keep as little about you as we can. If you sign in, with Google or with a code we send to your email address, we store your email address, Google's identifier for your account if you use Google, which version of our Terms you accepted and when, and a session record that keeps you signed in. We do not store your name, your photo or the IP address you signed in from.
• Our server keeps short-lived logs. Like any website, it records the IP addresses of visitors. The logs are deleted after 14 days.
• Aerial imagery is off until you turn it on. When you choose an imagery layer, your browser loads it directly from the public agency that publishes it, for example ČÚZK in Czechia or IGN in France. That agency receives your IP address and the area you are viewing.
• Usage analytics only if you allow it. When you first open the editor, we ask whether we may record which editor features you use. We never record your files, their names, coordinates or the areas you work on. The usage records stay on our own server; we use no third-party analytics service. The same choice covers reports of errors in the editor, which go to our error-monitoring provider Sentry in the EU (section 3.6). You can change your choice at any time under Help → About.
• Errors of our server are reported without personal data. When our server itself fails, it reports the technical failure to Sentry whatever your choice, with nothing that identifies you (section 3.7).
• Messages to us. If you write to us from the editor (Help → Contact us) or by email, we use your message only to answer you and to improve the Service. Messages are not linked to your account or to usage analytics.
• No advertising and no cross-site tracking. Apart from the analytics you can allow, we use only the cookies and browser storage that the Service needs to work.
• You can delete your account at any time from the account menu.

1. Who is responsible for your data

The controller of your personal data is:

GEORGY FIDELIN PR, sole proprietor (preduzetnik), Republic of Serbia
Registration number (MB): 67849426 · Tax ID (PIB): 114780059
Jurija Gagarina 231, 11073 Belgrade, Serbia
Email: privacy@odrmaker.com

We process personal data in accordance with the Serbian Law on Personal Data Protection. Because we offer the Service to people in the European Economic Area (EEA), the United Kingdom and Switzerland, we also comply with the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection. We have not appointed a data protection officer, because the law does not require one for our processing.

2. What stays on your device

Your road files. Opening a .xodr file, editing it and downloading the result all happen inside your browser. The editor never sends the contents of your files to our servers or to anyone else. This includes roads, coordinates, names and any other data in them. The only way any of it reaches us is if you choose to send it to us yourself, for example by email (section 3.4). We cannot see your files, so we cannot recover them for you either.

The working copy. Your browser keeps a copy of the document you are editing in its local storage (IndexedDB) on your device. This way a page reload, or a trip to Google's sign-in page, does not lose your work. The copy is updated as you work. It stays on the device after you sign out or close the tab, and it is never sent to us. On a shared computer, remove it by clearing this site's data in your browser settings.

The provenance record in downloaded files. When you download a file that you edited over an imagery layer, ODRMaker writes a short record into it (<userData code="odrmaker:provenance">). The record holds the layer's name, licence and attribution, the capture date of the imagery where known, and the date the file was saved. It helps you meet the imagery licence when you share the file (see our Terms of Service). It contains no email address, account identifier or IP address.

3. What we process, why, and for how long

3.1 When you visit the site

Each time your browser loads the Service or contacts our server, the server records a log entry with:

• your IP address;
• the date and time;
• the address requested, and the response status and size;
• the referring page;
• your browser's user-agent string.

Purpose: to deliver the Service, keep it secure, detect and block abuse, and fix errors.

Legal basis: our legitimate interest in running a secure, working service (Art. 6(1)(f) GDPR).

Retention: logs are deleted after 14 days at the latest. To limit request rates, the server also counts requests per IP address in memory for about a minute.

3.2 When you create an account

You can edit without an account, but downloading a file requires one. You create an account by signing in, either with Google (section 4) or with a one-time code that we send to your email address (section 3.3). If you use both methods with the same email address, they lead to the same account. For each account we store:

• your email address and whether it has been verified, by Google or by the code you entered;
• the identifier Google assigns to your Google account, if you sign in with Google;
• the version of our Terms of Service you accepted, and when. We record this when you create the account and again each time you sign in;
• when the account was created and last updated.

Purpose: to provide your account and the features that need it, such as downloading files, and to recognise you when you sign in again. We also use your email address to write to you about your account, security or changes to our terms. We do not send newsletters or marketing emails.

Legal basis: performance of our contract with you, which is the Terms of Service (Art. 6(1)(b) GDPR). Creating an account is voluntary. Without one you can still edit, but you cannot download files.

Retention: until you delete your account. Deleting it removes the account and all its sessions from our database at once. It does not delete messages you have sent us (section 3.4).

Statistics. From the account records, together with the session records in section 3.3, we derive counts: how many accounts were created in each calendar week, and how many of those accounts used the Service again in each of the following weeks. What we keep is the counts themselves — a small table of weeks and numbers, with no email address, no account identifier and nothing else in it that points back to you. We use it to see whether people come back, which the analytics in section 3.6 cannot tell us: those run only with consent, so most of the picture would be missing.

Deriving statistics from data we already hold is further processing that the law treats as compatible with the purpose the data was collected for (Art. 5(1)(b) and Art. 89(1) GDPR). It adds no new record about you: nothing is written to your account, to your device or to the analytics records, and we learn nothing we could not already read in the records described here and in section 3.3. Because the counts identify nobody, they stay after an account is deleted. You can object to this use on grounds relating to your particular situation (Art. 21(6) GDPR): write to privacy@odrmaker.com and we will leave your account out of the counts from then on.

3.3 While you are signed in

When you sign in, we create a session. A random session token is stored in a cookie in your browser (section 6). It is also stored in our database together with:

• the session's start and expiry times;
• when the session was last used, which we update at most once a day;
• the browser user-agent string the session was started from.

We do not store the IP address a session was started from.

While you sign in with Google, we also keep a one-time security code that expires after 10 minutes.

If you sign in with a code by email, we send a six-digit code to the address you enter. The code is valid for 10 minutes and can be tried at most three times. Until you use it, we keep a record of the pending code, in which both the code and your email address are stored only as hashes, not in readable form. To stop the codes being used to send mail to other people's mailboxes, our server also counts, in memory, how many codes are requested for each address (again as a hash) and from each IP address. These counts cover at most the last hour; they are held only in the server's memory, are never written to our database, and are lost when the server restarts.

Purpose: to keep you signed in and to protect your account. For example, the session record makes it possible to recognise a session that you did not start. The "last used" time is also what the weekly counts in section 3.2 are computed from, once a week; what we keep from that is the counts, not the sessions.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in account security (Art. 6(1)(f) GDPR). For the counts, see section 3.2 (Art. 5(1)(b) and Art. 89(1) GDPR); they do not make us keep any session record for longer than stated below.

Retention: a session ends when you sign out, or 30 days after you last used the Service while signed in. We delete ended sessions from our database within 24 hours. A sign-in code, from Google or by email, is deleted when sign-in completes; an unused code is deleted within 24 hours after it expires.

3.4 When you write to us

You can write to us by email or with the contact form in the editor (Help → Contact us).

What we process.

• The category you choose, for example a bug report or a feature suggestion, and your message, including anything you write or paste into it.
• Your name and the name of your company or organization, if you give them. Both are optional.
• Your email address, if you give one. It is optional in the form, but without it we cannot reply. If you are signed in, the form suggests the email address of your account; you can change or remove it.
• If you leave Include technical details on: the version of the editor, the type and major version of your browser and operating system, and your screen size. The form shows these values before you send them.
• For email: your email address, your message and anything you attach.

The form sends nothing from your document or the map: no file, file name, road, coordinate or area you are viewing. It does not accept attachments. If we need a file to investigate a problem, we will ask you by email, and you decide whether to send it.

A message from the form is not linked to your account or to usage analytics (section 3.6). The form does not send your sign-in cookie or your analytics identifiers, and usage analytics records nothing about the form. Like every request, sending the form appears in the server logs described in section 3.1.

Where it goes. Our server stores the message in our database and forwards it to our mailbox at Zoho (section 7). We reply from that mailbox. We do not send automatic replies.

Purpose: to answer you, to fix the problems you report and to improve the Service.

Legal basis: our legitimate interest in answering enquiries and improving the Service (Art. 6(1)(f) GDPR). If your message is about your use of the Service, the basis is performance of the contract (Art. 6(1)(b) GDPR).

Retention: we delete messages from our database one year after we receive them. The copy delivered to our mailbox is kept with the rest of our correspondence with you: two years after the conversation ends. We keep either longer only if we need it to establish, exercise or defend legal claims. Deleting your account does not delete messages you sent us; to have them deleted, write to privacy@odrmaker.com (section 9).

Please do not send us confidential information that we do not need in order to answer you.

3.5 When the law requires it

We keep or disclose data where the law requires it (Art. 6(1)(c) GDPR), for example to comply with a binding order of a public authority. We also do so where it is necessary to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR). We disclose only what is required.

3.6 Usage analytics and error reports, if you allow it

When you first open the editor, the About window asks whether you allow usage analytics and error reports. Until you choose Allow analytics, nothing is recorded or sent, and no analytics identifier is stored on your device. Your choice covers both parts of this section: the usage analytics described first, and the error reports described after the retention paragraph. You can change your choice at any time under Help → About. Refusing does not limit what you can do in the Service.

If you allow it, the editor sends a record to our own server each time you use one of a fixed list of features, for example opening a file, creating a road or lane, placing an object or signal, or downloading a file. We run the analytics ourselves: the records are stored in our database on our server (section 7) and are not shared with any analytics provider. Each record contains:

• the name of the feature and the time;
• a few coarse details about the action, for example whether it succeeded, how long it took, the OpenDRIVE version of the file, the number of roads in ranges such as 1–5 or 6–20, and the country of the imagery layer in use;
• whether you are signed in (yes or no) — as a plain yes or no, with nothing in the record that says which account;
• random identifiers that your browser generates and stores (section 6): one for the browser, so that we can tell a returning browser from a new one, and one for the current visit;
• the version of the editor, the type and major version of your browser and operating system, your screen size, and the domain of the website that referred you to us.

We never record:

• the names or contents of your files, the names of roads or junctions, or any other text you type;
• coordinates, the map origin, or the area you view or work on;
• your screen, mouse movements or clicks outside the fixed list. We use no session recording and no automatic capture of clicks;
• your email address or any identifier of your account. The editor sends analytics records without your sign-in cookie, and our server does not read your session when it receives one, so a record cannot be traced back to your account — not by us, and not by anyone who obtained the records.

Our server sees your IP address and your browser's user-agent string with each analytics request, as with any request. It stores neither of them in the analytics record, does not read the user-agent string at all, and does not derive your location from the IP address. The browser and operating system named in the record are the coarse values listed above, which the editor puts there itself — a family and a major version, never the full user-agent string. Like every request, analytics requests appear in the server logs described in section 3.1, which are deleted after 14 days.

Purpose: to learn which features are used, where users run into problems, and whether they come back, so that we can improve the Service.

Legal basis: your consent (Art. 6(1)(a) GDPR). Storing the analytics identifier on your device and reading it back also requires your consent under the EU and UK rules on device storage (the ePrivacy Directive and PECR).

Withdrawing consent: switch analytics off under Help → About. The editor then stops sending records and deletes the analytics identifier from your browser. Records already sent are kept until the end of the retention period, unless you ask us to delete them (section 9).

Retention: analytics records are deleted 180 days (about six months) after they were recorded.

Error reports from the editor

If you allow it, the editor also reports its own failures to Sentry, an error-monitoring service operated by Functional Software, Inc. (section 7). Only errors that the browser reports as unhandled are sent, for example a script error or a promise that failed without being caught. The editor does not send anything about your actions, only about a failure. Each report contains:

• the type of the error and its message, shortened to 200 characters;
• the stack trace, which names only our own code (file names and line numbers of the editor; errors raised by scripts that are not ours are not sent), and the version of the editor that was running;
• the time of the error.

The report does not contain the address of the page, the type or version of your browser or operating system, your IP address, your email address, any identifier of you or your account, cookies, the contents of your files, coordinates or the area you view, a recording of your screen or a trail of your earlier clicks. The editor removes these from the report before sending it, and the SDK that makes the report stores nothing on your device: it sets no cookie and writes nothing to local or session storage (section 6). An error message is text produced by the browser or by our code, and in rare cases it can quote a short piece of what you typed or the name of a file you opened; we cannot filter that out reliably, which is why we shorten it and send only errors that nothing in the editor handled.

The report does not go to Sentry from your browser. It goes to our own server at odrmaker.com/sentry, and our server forwards it. In the forwarded request we remove your cookies, the page you came from and the identification of your browser, and we do not add your IP address, so Sentry does not learn it. (Sentry sees the address of our own server as the sender.) Like every request to our server, the report appears in the server logs described in section 3.1, with your IP address, and those logs are deleted after 14 days. Sentry stores the reports in its data centre in Frankfurt, Germany.

Purpose: to find and fix faults in the editor that we would not otherwise notice.

Legal basis: your consent (Art. 6(1)(a) GDPR), the same consent as for usage analytics. The error reporting stores nothing on your device (section 6).

Withdrawing consent: switch analytics off under Help → About. The editor then stops reporting errors at once. Reports already sent are kept until the end of the retention period below, unless you ask us to delete them (section 9); we can find a report only if you tell us roughly when the error happened, because it carries no identifier of you.

Retention: Sentry deletes error reports 30 days after it receives them. This is the retention of the plan we use; Sentry's own documentation lists it.

If we want to record anything beyond what this section describes, we will update this policy and ask for your consent again.

3.7 Errors of our server

When our own server fails with an error that is ours (an internal error, not a mistake in your request), it reports the failure to Sentry as well. This does not depend on the analytics choice, because the report holds no personal data: the server keeps only the type of the error, its short technical code if it has one, the stack trace of our own code, the version of the software, the runtime and operating system of our server, and the method and path of the request that failed (for example POST /api/account), without anything after a ?. It removes everything else that a request carries: the body, the headers and cookies, the query string, your IP address, any identifier of you or your account, the name of the server and the text of the error message, because a message can quote what a user typed. For the contact form even the code is dropped, and only the type of the error is sent. Error reports from the server go to the same Sentry data centre and are kept for 30 days.

Purpose: to find and fix faults of the Service. Legal basis: our legitimate interest in keeping the Service working (Art. 6(1)(f) GDPR). Because what is sent is limited to technical information about our own code, the report does not let us or Sentry recognise a person, and we consider that your interests do not override ours; if you disagree, you can object (section 9).

3.8 What we do not do

We do not sell or rent personal data, and we do not share it for advertising. We use no advertising or cross-site tracking tools. We use Sentry only to receive error reports, and none of its other products (performance tracing, session replay, user feedback). We do not make decisions about you based solely on automated processing. Before we introduce any other analytics or tracking tool, we will update this policy and, where the law requires it, ask for your consent.

4. Signing in with Google

When you click Sign in with Google, your browser goes to Google. Google signs you in and asks whether you want to share your email address with ODRMaker. Google processes your data on its side as an independent controller under the Google Privacy Policy, and it learns that you signed in to ODRMaker. The cookies Google sets on its own domains are covered by that policy, not this one.

Google then sends us your email address, whether it is verified, and your Google account identifier. We ask Google for nothing else: not your name, photo, contacts, files or any other Google data. We never see your Google password. We do not keep the access token Google issues at sign-in, and we do not use Google services on your behalf.

ODRMaker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove ODRMaker's access in your Google Account under Third-party apps and services. This does not delete your ODRMaker account. To delete it, use Delete account in the account menu.

5. Aerial imagery from public agencies

The editor can show aerial imagery (orthophotos) under your map. Imagery is off by default. The editor contacts no imagery provider until you choose a layer in the Basemap menu or click Show imagery on a suggestion. After that, the editor remembers your choice on this device (section 6) and uses it on later visits, until you choose No basemap.

When a layer is on, your browser loads its image tiles directly from the server of the agency that publishes the layer. The requests do not pass through us. As with any web request, the agency's server receives:

• your IP address and your browser's user-agent string;
• the address of each tile, which shows the area and zoom level you are viewing;
• our site's address, https://odrmaker.com/, as the referrer.

The editor sends no cookies with these requests, and these servers cannot set cookies through it.

Each agency processes this data as an independent controller under its own privacy notice, linked in the table below. We receive none of it. Our page causes your browser to send the request, so we share responsibility with the agency for that transmission. Whatever the agency does with the data after it arrives is the agency's own responsibility.

Purpose: to show you the imagery you asked for.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR), because you asked to see the layer and it cannot be shown without requesting it from the agency. Also our legitimate interest in offering imagery directly from its official publishers (Art. 6(1)(f) GDPR).

The editor always shows the publisher of the active layer. We update this table when we add or remove layers.

Outside the EEA. Switzerland has an EU adequacy decision. The layers for Japan and the United States are served by government agencies in those countries, whose laws may protect your data less than the GDPR does. Your browser contacts them only if you choose one of those layers, normally because you are working on a map of Japan or the United States. The request is needed to show you the imagery you asked for (Art. 49(1)(b) GDPR).

6. Cookies and storage on your device

Most of the cookies and browser storage we use are needed for the Service to work, or remember a choice you made. These are exempt from consent under EU and UK law. The exception is analytics storage: it is written only if you allow usage analytics (section 3.6), and it is removed when you switch analytics off. The error reporting of section 3.6 sets no cookie and writes nothing to the local or session storage of your browser. We use no advertising or other third-party cookies.

To remove all of them, clear this site's data in your browser settings. This signs you out, deletes the working copy and resets your analytics choice, so the editor will ask again.

7. Who receives your data

• Hosting. OVH SAS (France) hosts our server, including the account database, the usage analytics records and the logs, in its data centre in Strasbourg, France. OVH processes the data only on our instructions, under a data processing agreement (Art. 28 GDPR).
• Email. Mail sent to our @odrmaker.com addresses, and messages you send with the contact form in the editor, are delivered to our mailbox at Zoho Mail, which is provided by Zoho Corporation B.V. (Netherlands) and stored in Zoho's EU data centres. Zoho processes the mail only to deliver and store it for us, under a data processing agreement (Art. 28 GDPR). Zoho also delivers the sign-in codes we send by email (section 3.3). It is not routed through any other provider, and it does not leave the EEA.
• Error monitoring. Functional Software, Inc., doing business as Sentry (United States), receives the error reports described in sections 3.6 and 3.7. It stores them in its data centre in Frankfurt, Germany, and processes them only on our instructions, under its data processing agreement (Art. 28 GDPR), which incorporates the EU Standard Contractual Clauses.
• Google, when you sign in with Google (section 4), as an independent controller.
• Imagery agencies, for the layers you choose (section 5), as independent controllers.
• Authorities and advisers. Public authorities, where the law requires it (section 3.5). Our lawyers, accountants and other professional advisers, where needed; they are bound by confidentiality.
• A successor. The Service may be transferred to another entity, for example a company we set up to run it. In that case your data passes to that entity, which remains bound by this policy. We will tell you before it happens.

We do not share your data with anyone else.

8. Where your data is processed

The account database, the usage analytics records and the logs are stored on our server in France. We operate the Service from Serbia, which is outside the EEA. The EU has not adopted an adequacy decision for Serbia; Serbian data protection law closely follows the GDPR. The GDPR applies to us directly, so you have all the rights it gives you. You exercise them with us, at the address and email in section 1.

Your data leaves the EEA in only three other ways:

• Sentry stores error reports in Germany, but Functional Software, Inc. is a company in the United States, so its staff and sub-processors there may have access to them. The transfer rests on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), which are part of Sentry's data processing agreement. The reports contain no IP address, email address or other identifier of you (sections 3.6 and 3.7);
• when you sign in with Google, you deal with Google directly under its own policy (section 4);
• if you choose the Japanese or US imagery layers, your browser contacts those agencies (section 5).

Email to us and messages from the contact form do not leave the EEA: they go to our server and our mailbox in the EU (section 7).

9. Your rights

Under the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and Serbian law, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected if it is inaccurate;
• have it erased. You can delete your account yourself with Delete account in the account menu, which erases the account and its sessions immediately. For any other data, write to us;
• restrict processing in certain cases;
• object to processing based on our legitimate interests (sections 3.1, 3.3, 3.4 and 5), on grounds relating to your particular situation;
• receive the data you gave us in a structured, machine-readable format (data portability);
• complain to a supervisory authority (section 10).

We rely on your consent only for usage analytics and the error reports of the editor (section 3.6). You can withdraw it at any time under Help → About, as easily as you gave it. Withdrawing does not affect the lawfulness of the processing before you withdrew.

To exercise your rights, email privacy@odrmaker.com. Please write from the address of your account if you can, so that we can confirm the request is yours. We reply within one month. For complex requests we may take up to two more months, and we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

Analytics records (section 3.6) are the one exception to identifying you by your email address: nothing in them points to your account, so we cannot find them from your email address. They can be found only by the random analytics identifier of your browser, which — while analytics is on — your browser keeps in local storage under the name odrmaker:analytics:client-id (section 6) and which you can read there through your browser's developer tools. Please include it if your request concerns analytics records. Without it we are not able to tell which records are yours, and the law does not require us to collect more data about you in order to find out (Art. 11 GDPR).

Error reports (sections 3.6 and 3.7) carry no identifier of you at all, so we cannot find yours among them, and the law does not require us to collect more data to do so (Art. 11 GDPR). If you tell us roughly when an error happened, we can look at the reports of that time, but we cannot tell which of them came from you.

Messages you sent us (section 3.4) are found by the email address you gave. If you sent a message from the editor without one, tell us roughly when you sent it and what it said.

We do not hold your road files, your working copy or the areas you view (sections 2 and 5), so we cannot provide or delete them. For data that an imagery agency holds, contact that agency.

If you live in a US state with a consumer privacy law, such as California, these rights apply to you too. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

10. Complaints

Please contact us first at privacy@odrmaker.com, and we will try to resolve your concern. You also have the right to complain to a data protection authority, in particular:

• Serbia: Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade (poverenik.rs);
• EU and EEA: the authority in the country where you live or work, or where the alleged infringement took place (list of authorities);
• United Kingdom: the Information Commissioner's Office (ico.org.uk);
• Switzerland: the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

11. Children

The Service is not directed at children. You must be at least 16 years old to use it and to create an account. We do not knowingly process data of anyone under 16. If you believe a child has created an account, write to us and we will delete it.

12. Security

We protect personal data with measures appropriate to the risk, including:

• encryption in transit (HTTPS) for every connection to the Service;
• session cookies that scripts on the page cannot read and that are sent only over HTTPS;
• keeping only the data we need: no names, photos, passwords or road files;
• limits on request rates, and restricted administrative access to the server.

If a personal data breach is likely to put your rights at risk, we will notify the competent supervisory authority and, where the law requires it, you.

13. Changes to this policy

We update this policy when the Service or the law changes, and always before we introduce any new processing of personal data. We will publish the new version on this page with a new effective date. For significant changes, we will also inform account holders by email or in the Service before the changes take effect.

14. Contact

Questions about this policy or your data: privacy@odrmaker.com

GEORGY FIDELIN PR
Jurija Gagarina 231, 11073 Belgrade, Serbia