Privacy
Last updated 2 November 2026
MapWorld has no player accounts and collects as little as it can. This page explains what happens to a
search and what the server keeps.
What a search sends
When the world plays a MapWorld URL, the video player in VRChat requests it from this server. That request
carries what you typed, your network (IP) address and the player's user-agent string, as any web request does.
Who looks up place names
Coordinates typed as lat,lon and the prebuilt place buttons are handled on this server alone;
nothing is sent to anyone else. A place name or address is geocoded by Microsoft Azure Maps,
through an Azure Function that MapWorld runs in Microsoft Azure. Microsoft receives the search text and a
language setting, and returns matching places. The request reaches Microsoft from MapWorld's own servers,
so Microsoft does not receive your IP address or anything else about you or your VRChat account. Microsoft
processes that request under its own privacy statement.
What this site keeps
-
Search text is not stored or logged by this site. It is not written to the database, to
the web server's access log (which records the page address without the part holding the search) or to
error reports, and it is never passed to the tile builder on a command line.
-
Search results are kept under a one-way hash. So that everyone who sends the same search
lands in the same place, the server keeps the result (coordinates, the place name Azure Maps returned and
any alternative matches) filed under a one-way hash of the tidied-up search text, for 48 hours. The hash
can't be turned back into the text, though someone holding the database could test whether a particular
guessed search had been made.
-
Client IP addresses are held in memory only, for rate limiting. The rate limiter counts
each address's requests over the last minute and builds over the last hour. Those counts live in the
server's memory, are never written to disk or the database, and are gone when the server restarts.
-
Web server access log. Like most web servers, the server's access log records the time,
IP address, page address (without the search text), response status and user-agent of each request. It
is used to keep the service running and to deal with abuse.
-
Destination videos are kept for 24 hours and shared by everyone who visits that place.
They contain the place, not who asked for it.
Cookies
The video endpoints the world uses (/v3/) set no cookies and use no session. These web pages set
one security cookie that protects forms against cross-site request forgery. Sign-in cookies are set only
for the administrators who sign in to the back office. There are no analytics, advertising or tracking
cookies.
Things to keep in mind
Whoever is in your VRChat instance can see what destination you load, because the destination is shared
with everyone there. Please don't search for a private person's home address.
Your choices
Because MapWorld doesn't tie anything it keeps to you, there is usually nothing to look up or delete. If you
have a question or request, use
the contact page.
Changes
If what MapWorld collects changes, this page will be updated first, with a new date at the top.