# Usage policy

Carpathian Maps is free to start and fair to share. These rules keep it fast for everyone and keep the map's data sources credited.

## Keys

- Get a key in Carpathian: open **Services**, turn on **Carpathian Maps**, then create an app. Each app gets its own key, shown once.
- Use one key per app, and keep it on your backend. A key in a browser or a mobile app can be copied by anyone who opens it.
- A key that leaks can be rotated in Carpathian. The old one stops working within a minute.

## Limits

Each app has a limit of requests a minute and a limit of requests a day, shown on its page in Carpathian.

| Answer | Means |
| --- | --- |
| `429 Too many requests.` | Over the app's requests a minute. `Retry-After` says how many seconds until the next minute starts. |
| `429 Daily limit reached.` | Over the app's requests a day. It resets at midnight UTC. |
| `403 This key is suspended.` | The app or its organization is suspended. Check its page in Carpathian. |

Every request the engines answer counts toward the limits and usage, including `422 No route was found.` Requests refused with a `5xx` do not count.

## Map files

- A browser may read the map files only from a website listed on an app in Carpathian. Add every address your map is shown on, such as `https://app.example.com`. A browser on any other website gets `403`.
- Apps and servers that are not browsers are held to a per-address limit of requests a minute. A normal map view stays well under it.
- Do not download the map in bulk through this server. Planet files are published by [Protomaps](https://protomaps.com) and [OpenStreetMap](https://planet.openstreetmap.org).

## Pricing

Each Carpathian organization gets a free monthly allowance of route and isochrone requests. Beyond it, requests are billed through Carpathian at the rate on the Carpathian Maps service page, and appear on the organization's invoice. Map files are not billed.

## Credit

Keep the OpenStreetMap credit visible on every map. The Open Database License requires it. See [Connect](connect.md#credits).

## Privacy

Carpathian sees how many requests each app made each day, by kind. Coordinates, routes and addresses never leave this server and are never logged.