Data & privacy

The survey stays on your PC. Points, walks, AP pins and everything the reports are built from live in a SQLite database in the HollowMap data folder (%LOCALAPPDATA%\HollowMap). HollowMap has no account, and it does not upload your survey anywhere.

There are, however, a few places where a map app has to talk to the internet. They are listed here in full.

What leaves your PC

Goes out	To whom	What exactly
Weather while you walk	Open-Meteo (api.open-meteo.com)	The coordinates, rounded to 2 decimal places (about 1 km) before they are sent, to fetch temperature, humidity, dew point and wind. Results are cached per 1 km cell, so a whole walk is a handful of calls. This is what the humidity column in the reports is for. Points sent late from the tablet's offline queue get no weather.
Map imagery	Esri (server.arcgisonline.com) for satellite and topo, CARTO (basemaps.cartocdn.com) for street labels and the dark basemap	The tile coordinates of whatever part of the map is on screen — which is, in practice, where you surveyed. Standard for any map. No samples are sent.
Address search	OpenStreetMap Nominatim (nominatim.openstreetmap.org)	Only what you type into the map's search box, when you use it.
Your controller, if it is in the cloud	Cisco Meraki (api.meraki.com)	Only when Meraki is the configured controller: the API key and organization you entered, to read the client list. Other controllers are reached at the address you type, normally on your own network.
A support ticket	LTC Labs	Only when you press send: your message, your email, the app version, Windows version, a hashed machine ID, a per-launch session ID and a small diagnostics block (your settings and the last lines of the desktop log, under 4 KB). Passwords and keys are left out, and user names in file paths, key-shaped strings and any email address other than yours are scrubbed before sending. Untick Include diagnostic logs to send none of it. Your survey is never attached.

No usage tracking. HollowMap sends no telemetry, no analytics and no crash reports today.

Location never leaves as location, except for the 1 km-rounded weather lookup above. The full-precision track is only ever written to your own disk.

On your own network

• The PC serves the survey over HTTPS on your LAN with a self-signed certificate, which is why phones show a warning the first time.
• A device other than the PC needs the access key to read or write anything. It travels in the connect URL and QR code, so possession of that link is the credential — treat it like a password. The 6-digit walk code is derived from it, and ten wrong guesses from one device locks that device out for 15 minutes.
• The key is handed out only to the PC itself. A phone that asks for the connect address gets a link without it.

What you can delete

• Clear points on the map: this walk, today, duplicate pins, landmark pins, or everything.
• RETENTION_DAYS in config.env deletes points older than N days automatically. See Settings & controllers.
• Deleting the data folder removes the survey entirely.

Related

• Settings & controllers
• FAQ