Frequently asked questions

1. Is my chat really end-to-end encrypted?

Yes. Chat in MilMap is end-to-end encrypted (E2EE). This means a message is encrypted on your device and only decrypted again on the recipient's device.

• We use sealed-box encryption based on modern, open cryptography (NaCl/libsodium).
• Every user has their own key pair; by default, the private key never leaves the device.
• Group messages are sealed separately for each recipient, so only the intended recipients can open a message.
• Our servers store nothing but unreadable ciphertext.

You can find more technical details in the Data & Security document.

2. Can MilMap read my messages?

No. Because the encryption is end-to-end, MilMap has no access to the content of your messages.

• We only store the encrypted ciphertext and cannot decrypt it.
• We do not know your private key, and if you use PIN synchronisation, we do not know your PIN either.
• This means that even MilMap staff cannot view your chat content.

3. What if I lose my device? How does the chat PIN work?

By default, your private key is stored only on your own device. That is secure, but it has a downside: if you lose the device without a backup, encrypted chat history that was intended only for that device can no longer be recovered. This is inherent to true end-to-end encryption.

For use on multiple devices, you can optionally set a personal PIN:

• Your private key is encrypted locally with a key derived from your PIN (using Argon2id).
• Only that encrypted form (ciphertext) is stored on the server, so you can regain access to your key on a new device.
• MilMap does not know your PIN and therefore cannot unlock the key itself.

4. Are voice messages and attachments also end-to-end encrypted?

Text messages in chat are end-to-end encrypted with the sealed-box encryption described above.

For attachments such as files, images, voice messages and shared locations, the following applies:

• All communication with MilMap takes place over encrypted connections (TLS/HTTPS), both in transit and when stored on our EU servers.
• However, these items are not necessarily covered by the same end-to-end sealed-box encryption as your text messages.

5. What data do you collect?

We only collect what is needed to make the service work (data minimisation). Depending on how you use MilMap, this may include:

• Account data: for example your name, email address and password (stored encrypted).
• Usage and content data: maps, routes, markers, missions/teams and (encrypted) chat messages you create yourself.
• Location data: only when you use features such as navigation or live location sharing.
• Technical data: for example device and log data needed for security and troubleshooting.
• Payment data: with a paid subscription, payments are handled by Stripe; we do not store full credit card details ourselves.

The full description per category, including the corresponding legal bases, can be found in our Privacy Policy.

6. Do you sell my data?

No. We do not sell your personal data. Your location data is not sold either, nor is it used for advertising.

• We only share data with sub-processors that are needed to deliver the service (see the question about external services).
• We have data processing agreements in place with these parties; see also our Data Processing Agreement.
• Selling data to data brokers or advertisers is not part of our business model.

7. How long do you keep my data?

We do not keep data longer than necessary for the purpose for which it was collected, or for as long as the law requires.

• We keep account data for as long as you have an account.
• If you delete your account, we delete or anonymise your data within a reasonable period, except for what we are legally required to retain (such as certain payment and invoice records).
• Location data from live location sharing is primarily intended for real-time use and is not kept longer than necessary.

Specific retention periods per category can be found in our Privacy Policy.

8. How do I request or delete my data?

Under the GDPR you have several rights, including:

• Access to the data we process about you.
• Rectification (correction) of inaccurate data.
• Erasure of your data (the right to be forgotten).
• Objection to certain processing activities.
• Data portability: receiving your data in a commonly used format.

You can submit a request via privacy@milmap.nl. We will respond within the statutory period. If you disagree with how we handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). See also our Privacy Policy.

9. Where are your servers located?

MilMap is hosted by a hosting partner within the European Union. Your data is therefore stored in the EU.

• For some features we use external services (sub-processors). Where data would be processed outside the EU, we ensure appropriate safeguards in accordance with the GDPR.
• An up-to-date overview of the parties involved can be found in our Data Processing Agreement and Privacy Policy.

10. Which external services (sub-processors) do you use?

To make MilMap work, we use a limited number of specialised services:

• Mapbox for map tiles and geocoding (converting places into coordinates).
• A weather service API for weather information.
• An elevation API for altitude information.
• A hosting partner for server hosting in the EU.
• Stripe for payments and subscriptions.
• An email/SMTP service for transactional email, such as confirmations.

We have data processing agreements in place with these parties. Location data is not sold and not used for advertising. The current list can be found in our Data Processing Agreement.

11. Who can see my live location?

Your live location is not public. You decide whether and with whom you share it.

• Live location sharing is a feature you actively enable.
• Only the people or teams you deliberately share with (for example within a mission or team) can see your live location, and only for as long as you are sharing.
• MilMap does not use your location to track you outside the features you activate yourself.

12. Is my location stored?

Live location is primarily intended for real-time use: your position is shared while you are actively sharing.

• We do not keep location data longer than necessary for the feature you are using.
• If a feature (such as a route or mission) requires storing location or route data, this is done solely to deliver that feature, and not for advertising or profiling.

You can read more about retention periods in the Privacy Policy.

13. Can I stop sharing my location?

Yes, at any time. You stay in control.

• You can stop live location sharing at any moment in the app.
• You can also revoke MilMap's location permission via your phone's system settings.
• As soon as you stop sharing, others no longer receive any new location updates from you.

14. Do you use my location for advertising?

No. Your location data is not sold and not used for advertising or building advertising profiles.

• We use location solely to deliver the features you choose to use, such as navigation, route planning, bearing calculation, MGRS coordinates and live location sharing.

15. Is there a minimum age?

Yes. You must be at least 16 years old to use MilMap.

• If you are under 16, consent or involvement of a parent or guardian is required, in accordance with Article 8 GDPR.

See also our Terms of Service.

16. Is MilMap GDPR-compliant?

Yes. MilMap is provided by Onavan B.V., established in the Netherlands, trading under the name "MilMap". Onavan B.V. is the data controller within the meaning of the GDPR and complies with European privacy legislation.

• We work according to privacy by design and privacy by default.
• We apply data minimisation: we do not collect more than necessary.
• You have the rights of data subjects (access, rectification, erasure, objection and data portability) and the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

MilMap is governed by Dutch law; disputes are submitted to the competent Dutch court. Details can be found in the Privacy Policy and the Terms of Service.

17. Do you use cookies or tracking?

We only use what is needed to make the service work properly and securely.

• We use functional and strictly necessary cookies or local storage, for example, to keep you logged in and remember your preferences.
• We do not use your data for ad tracking and do not sell it to advertisers.

Want to know exactly which cookies or similar technologies we use? You can read about this in our Privacy Policy.

18. Do you share data with third parties or governments?

We only share data when necessary.

• With sub-processors that help us deliver the service (see the question about external services), under data processing agreements.
• With government or law enforcement authorities only when we are legally required to do so, for example on the basis of a valid court order.

We never sell your data to third parties. The full explanation can be found in our Privacy Policy.

19. Can I rely blindly on MilMap for navigation?

MilMap is a powerful tool, but not a certified, safety-critical or life-saving navigation system.

• GPS signals and map data can be inaccurate, outdated or temporarily unavailable.
• You remain responsible for your own situational awareness and for operational decisions.

20. How do I get in touch about security or privacy?

We are happy to help.

• General questions and support: support@milmap.nl
• Privacy and GDPR matters (such as access or erasure requests): privacy@milmap.nl

MilMap is provided by Onavan B.V., established in the Netherlands, trading under the name "MilMap". More information can be found in our Privacy Policy, Terms of Service, Data Processing Agreement and the Data & Security document.