Two questions the app will ask you once

I have spent two weeks telling you that Maple Maps keeps no record of where you have been. That is still true. It stays true for anyone who reads this and does nothing.

But the next build asks you two questions, and I would rather explain them here, at length, than have you meet them cold on a settings screen.

Both questions default to no. Both are about the same problem, which is that a route is only as good as two pieces of knowledge: how fast the roads actually move, and which roads and turns are actually open. Those are the two weakest things we have, and after two weeks of your reports I have run out of ways to fix them without asking you.

The first question: how fast the road is moving

Right now our traffic comes from TomTom. It is decent on the big highways at rush hour and thin nearly everywhere else, which is the usual shape of commercial traffic data in a country this empty. It is also Dutch, which was fine as a stopgap and was never meant to be the answer.

There is a second problem that matters more than the coverage. We read TomTom's live feed, and as I read their terms we may not turn that feed into our own picture of what a road is normally like on a Tuesday at 08:15. So every morning our router starts from nothing and asks them what is happening right now. It cannot know that a particular stretch of the Henday is always slow at that hour, because it is never allowed to remember.

That memory is what makes an arrival time honest. It is the difference between a route planned around what the road is doing this second and one planned around what it will be doing when you actually get there. I cannot buy it, and I cannot derive it from someone else's feed. The only way to have it is to measure it, and the only people driving these roads are you.

What the app sends, when you say yes. While you are navigating, the app times you along stretches of main roads, from one point to the next about a kilometre apart. For each stretch it keeps four things: which stretch it was and which way you were going, the quarter hour of the day, whether it was a weekday, and how fast you went as a share of the posted limit, in steps of 5% and never above 100%.

That cap is deliberate. A report cannot say that anyone was speeding, because the highest number it can carry is the speed limit.

What it never sends. No coordinates. Not your route, not your trip, not where it started or where it ended. Nothing from the first kilometre of a drive or the last 500 metres, so the road outside your house is never in it. No residential streets at all, ever.

How the reports travel. They do not leave when they are made. They sit on your phone and go out one at a time, at random moments over the following hours, so the reports from one drive never arrive together and cannot be reassembled into one. None of them carries the app's identifier. Each carries a single-use token that our server signed without being able to see it, which is a real cryptographic technique and not a figure of speech: the server can confirm the token is genuine and cannot connect it to the phone that asked for it, or to any other token.

What we keep. A count. For each stretch and quarter hour there is a tally of how many reports fell into each 5% band, and nothing else. A tally is ignored until it holds at least five reports from different drives. We keep them for ten weeks.

One more thing it may ask. If a stretch was much slower than the limit, the app may ask you what held you up, and you can answer traffic, a crash, construction, or not sure. It asks once your trip has ended, never while the app is guiding you, because tapping an answer at the wheel is not clearly legal in Ontario, British Columbia or Alberta and I am not going to design a feature that invites it.

The second question: turns that construction has closed

We already read the provincial 511 feeds, and they are good at what they cover. A highway shut by a crash shows up in minutes.

What they do not cover is a left turn closed for six weeks at a suburban intersection because a crew is replacing a water main. Nobody publishes that anywhere I can fetch it. It is not in OpenStreetMap, it is not in a provincial feed, and it will be gone before any of them notice. The only person who knows is the driver who arrives at that intersection and finds a barrier where our app just told them to turn left.

A few of you have written to me about exactly this, usually politely, usually after the app sent you around the same block twice.

What the app sends, when you say yes. If you drive past a turn your route asked you to make, it sends where that turn is, which way you were going, which way the turn led, the road's name, and the time rounded to the nearest five minutes. If you later make a turn you had driven past, it sends that too, which is evidence in the other direction and counts against the first.

What it never sends. Not where you started, not where you were going, not your route. Nothing from the first kilometre of a drive or the last 500 metres. Skipped U-turns never count at all, and neither does an ordinary wrong turn that sends you off route.

What it may ask you afterwards. A later build adds one more question, asked only once you have stopped, never while you are driving, and only about a turn you drove past: what happened? You could not make it (closed, construction, a crash, something on the road, a sign against the turn, a gate, no road there at all), you missed it, the trouble was on the road just past it, you stopped somewhere on the way, or it was your choice. Answering is up to you, and the question goes away after four days. The answer travels the same way as the report, under the same code for that turn and with the time of the turn, not the time you answered, and it counts in place of the report. Our server notes when the answer arrived, and that goes when the answer goes. If the trouble was on the road past the turn, the app sends one more point, about 100 metres past it, and the direction you were going. A sign, a gate or a missing road goes to a person here, who may fix the map; nothing on the map changes by itself.

How you stay uncountable. No app identifier. Instead the phone sends a key it makes itself that changes every day, so today's reports cannot be joined to tomorrow's, and a separate code for each individual turn, so that one driver counts once at that turn and cannot be followed from one turn to the next.

There is one thing we hold that I want to name plainly, because it is the most sensitive thing in either feature. So that a report can be checked against a route we actually gave out, while this setting is on, our server keeps the line of your current route in memory for one hour, under a random number, with nothing attached that says whose it is. It is never written to disk. Then it is gone. If you have not turned this feature on, we keep nothing about your route at all.

One report changes nobody's route. This is the part I care most about getting right. A single driver skipping a turn means almost nothing: they changed their mind, they missed it, they know a better way. It takes at least four different drivers refusing the same turn, or two who tell us afterwards that they could not make it, before the router will pay any extra time to avoid it, and about twice that before we will draw it on the map for everyone. For now even that is switched off: the reports are being gathered and weighed, and they change nobody's route but the phone that made them until there are enough drivers for those numbers to mean something. Belief builds by repetition and fades on its own if nobody confirms it, in days rather than months. A commuter cannot inflate a turn by driving past it every morning, because after the first time their own phone has already stopped routing them there.

The part that is the same for both

Neither feature uses your account, because there is no account. Neither sends anything that identifies your phone. On an iPhone, once a day, before its first report, the phone asks Apple to confirm that it is the real Maple Maps app on a real device, so that a script cannot simply invent a thousand closures. Our server checks that confirmation, keeps nothing from it, and hands back a pass it cannot trace back to you. Android phones do the same with Google, starting with the next Android build. A phone that cannot be confirmed can still send reports, but they are counted in a separate pile from the confirmed ones.

And here is the honest cost of doing it this way. Because these reports carry nothing that identifies you, I cannot go back and delete yours. There is no row with your name on it to find. Turning a switch off stops everything from that moment on, and what is already in a tally has already stopped being about you. That is the trade I made, and I think it is the right one, but you should know it is a trade.

You decide, at every stage

The app asks each question once, after you have already granted location access, with a plain yes and a plain no and no dark pattern between them. If you say "Not now", it never asks again.

They are two separate switches, in Settings, and both are separate from "Count me as a user". You can turn either on or off whenever you like, in either order. Saying yes to closures does not sign you up for speeds. Nothing else in the app behaves differently depending on your answers, and nothing is withheld from you for saying no.

If you are already driving with Maple Maps, the update will ask you once, the same way.

While we are talking about your data being in your hands

There is a third thing in the same build, which asks nothing of you but is part of the same idea.

You can fix the map from inside the app. A listing with the wrong hours, the wrong category, a name that changed two owners ago: tap it and suggest an edit. A business that is not on the map at all: add it, and place the pin yourself on the spot where the door actually is.

Nothing you send changes the map until a person has looked at it and pressed a button. We are steadily moving our place data in-house, out of the commercial feeds and into a map built from OpenStreetMap, Overture's open data and our own corrections, and this is the piece of that work only you can do.

What has not changed

None of this reaches TomTom. What drivers share with us stays with us. It lives on two machines in Québec and it is not for sale, not now and not later.

And TomTom's traffic stays on your screen for the time being, because I am not going to pretend otherwise. Live traffic needs a few percent of everyone on a given road to be running your app. A few thousand drivers spread across a country this size cannot produce that, and will not for a long while. What a few thousand drivers absolutely can produce is the slower, more useful thing: an honest picture of how fast Canada's main roads normally move at each hour of the week, built here, kept here, and answerable to you rather than to a licence agreement.

I did not want to ask. I would rather have found the data lying somewhere public and been able to say that Maple Maps takes nothing at all. It is not there. So I have asked in the smallest way I could work out, with the answer set to no until you change it, and with the whole mechanism written down where you can check it.

The full detail of every field is in the privacy policy, which has been updated to match.