- Document ID
infrastructure- Version
- 1.1.0 · Revision: 2
- LastWagon components
- the request proxy, the website, the community-parking store, the durable report history, the rate limiter, Basic map tiles, satellite imagery on the truck-stop map, and future Play distribution
- Status
- Final record — counsel reviewed 2026-08-21. The Supabase section was added 2026-08-28 and is not yet reviewed.
Vercel Inc. — hosting
Role: hosts two separate projects — the marketing website, and the request proxy that keeps the shared routing credential off drivers' devices and carries community parking. They are deliberately separate projects: the website is kept static-export compatible and has no API routes.
What it receives: everything inherent to serving an HTTPS request — the request path and query string, headers, and the client IP address — plus whatever the proxy writes to its platform logs.
What the proxy logs. By design it logs failure classes and rate-limit names, never credentials, never an email address, and never the outcome of a specific sign-in. It logs the upstream routing service's own error text, which describes a request rather than a credential.
The exposure worth naming: the three geocoding endpoints are GET requests whose query string carries the text the driver typed and, for reverse geocoding, their coordinates. Request paths appear in platform request logs. Disclosed in Privacy § 3.4 and § 15, and recorded as a hardening item — moving those endpoints to POST bodies would remove address text from log lines.
Standing: a service provider / processor. Vercel's Data Processing Addendum has Vercel act as processor for customer data, with its subprocessor list published at security.vercel.com.
Sources: https://vercel.com/legal/dpa (effective 31 March 2026), https://security.vercel.com. Retrieved 2026-08-20.
Upstash, Inc. — key-value store
Role: the store behind community parking and the rate limiter, reached over the same REST protocol from the proxy. It is the same instance for both — no second service and no second credential.
What it receives and holds:
| Key | Contents | Life |
|---|---|---|
pk:log:<date> | Every parking report: schema version, POI id, status, server timestamp, an optional client-observed time (the app does not send one), and the per-POI, per-period reporter identifier with its rotation epoch | Indefinite — append-only history |
pk:p:<poiId> | The recent-report window for one POI | TTL, currently 6 h |
pk:s:<poiId> | The precomputed current status for one POI | TTL, currently 6 h |
rl:*, pk:rl:*, pk:cd:* | Rate-limit counters. Every component is a keyed hash — of the install identity, of the IP address, of the submitted account — never the raw value | 60 s, 1 h, or 24 h |
Never stored: the raw install token, a raw IP address, a raw email address, any coordinate, any password, any route.
Why the counter keys are hashed too. The report log is permanent and everything else here is a TTL'd counter, which is what made raw identifiers in counter keys dangerous: a ten-minute cooldown key holding a raw install id, sitting beside a report written seconds earlier, hands back exactly the mapping the per-POI rotating pseudonym removes. The mapping is deterministic, so every limit counts what it always counted; the store simply no longer holds the identifier. See proxy/lib/identity.js.
Standing: a service provider / processor. Upstash publishes a Data Processing Addendum and states compliance with the EU-U.S. Data Privacy Framework.
⚠️ OPEN — encryption at rest is NOT VERIFIED. Upstash documents encryption at rest as available on customer request rather than on by default. That is a statement about the product, not about LastWagon's database, and a generic provider claim is not a verification. Nobody has yet opened the console and looked at the actual configuration.
Until someone has, no LastWagon document claims the parking store is encrypted at rest. The questions that must be answered — including the eviction policy, because an LRU-configured database would silently discard the permanent, never-trimmed report log — and the procedure for answering them are in [../research/upstash-encryption-verification.md](../research/upstash-encryption-verification.md). It must be settled before the store holds real reports, because enabling encryption may require recreating the database, which is free of consequence only while it is empty.
Sources: https://upstash.com/trust/dpa.pdf, https://upstash.com/trust/privacy.pdf (both last updated April 2025), https://upstash.com/docs/common/help/compliance. Retrieved 2026-08-20.
OpenFreeMap — Basic map tiles
Role: serves the vector tiles the Basic map is drawn from, in the OpenMapTiles schema, over OpenStreetMap data. No registration, no API key, no cookies.
Required attribution:
OpenFreeMap © OpenMapTiles · Data from OpenStreetMap
LastWagon implementation: exactly this string is the map style descriptor's attribution and is drawn on the map surfaces themselves.
What it receives: tile requests, and therefore the areas of the map a driver looks at, plus their IP address. Disclosed in Privacy § 11.
Licences: the tiles are MIT; the schema is OpenMapTiles; the underlying data is OpenStreetMap under ODbL. OpenFreeMap states that commercial use is allowed and that there is no limit on map views or requests, and it publishes weekly full-planet downloads.
Note for the offline-corridor feature: LastWagon currently refuses tile pre-fetching on this provider in release builds, pending confirmation that bulk prefetching from the public instance is acceptable. OpenFreeMap's published FAQ — commercial use allowed, no request limits, planet downloads offered — appears to answer that. Recorded as a finding, not acted on, because it is a behaviour change outside the scope of this work.
Source: https://openfreemap.org/. Retrieved 2026-08-20.
Supabase, Inc. — the durable report history
Role: hosts the Postgres database holding the second, durable copy of accepted community parking and weigh-station reports — the copy built to be queried by place and time, so the app can one day say "this lot usually fills on weeknights". The live serving state stays in Upstash; ratings are not copied here at all.
What it receives: for each ACCEPTED report, exactly five values — the LastWagon place identifier, the reported state, the server's own timestamp, a schema version, and an opaque event code. The event code is a one-way digest that exists so a retried request cannot insert the same report twice; it cannot be reversed into any identifier and does not connect one report to another. No installation token, no reporter identifier, no IP address, no client timestamp, and no coordinates are ever sent to Supabase. The anchor of every row is the place, not the person.
Access control: the table is provisioned locked. Row-level security is enabled with no policies, every privilege is revoked from Supabase's public client roles, and the proxy's own server-side credential is granted insert and read only — no update, no delete. The history is append-only against everyone, LastWagon included, and no key that could reach it ever ships in the app.
What it does NOT receive: requests from drivers' devices. Only the LastWagon proxy talks to this database, server to server; a driver's IP address is seen by Vercel (above), never by Supabase.
Limits: the feature is dormant until the proxy is explicitly configured with the database's address and server credential; unconfigured, nothing is sent anywhere and reporting works exactly as before. Retention is indefinite by design and is disclosed in Privacy §§ 3.4 and 7.3.
U.S. Geological Survey — The National Map — Satellite imagery
Role: serves the orthoimagery tiles ("USGS Imagery Only") the truck-stop map shows when a driver switches it to Satellite. No registration, no API key, no cookies. Off by default; the tiles are requested only while satellite view is on.
Required attribution: USGS-authored works are in the U.S. public domain (works of federal employees made in the course of their duties) and may be copied, distributed and adapted without permission; USGS asks for a clear text credit, in one of its standard forms — for products and data, *"[Product or data name] courtesy of the U.S. Geological Survey"*. Two exceptions in the same policy: content USGS itself uses under licence from third parties is marked as copyrighted and is not public domain; and the USGS identifier/logo is a trademark that may not be used to imply endorsement or partnership.
LastWagon carries the standard-form credit in attribution.md (*"The National Map orthoimagery courtesy of the U.S. Geological Survey."*) and, on the map, the service's own copyright string without the refresh date it appends (which changes as the cache is rebuilt):
Imagery: USDA, USGS The National Map: Orthoimagery
LastWagon implementation: exactly this string is the imagery descriptor's attribution (UsgsNationalMapImagery, MapStyleProvider.kt) and is drawn on the map, with the basemap credit, whenever the imagery is visible. The imagery is slotted under the basemap's labels and over its fills, so the OpenFreeMap/OpenStreetMap credit remains required and remains shown. The exceptions are checked against the service, not assumed: its metadata credits only USDA and USGS (both federal), no third-party copyright is declared on the layer, and LastWagon displays no USGS logo or identifier anywhere.
What it receives: tile requests, and therefore the areas of the map a driver looks at in satellite view, plus their IP address. Disclosed in Privacy § 11.
Limits: the service is served to level 16 (1:9,028); the map over-scales that level past it rather than requesting deeper tiles. Coverage is the United States. USGS publishes no request quota for the base-map services; LastWagon fetches tiles interactively only and never pre-fetches or bulk-downloads them.
Sources: service metadata https://basemap.nationalmap.gov/arcgis/rest/services/USGSImageryOnly/MapServer (copyright text "USDA, USGS The National Map: Orthoimagery. Data refreshed June, 2024."), retrieved 2026-08-22; USGS copyrights and credits policy https://www.usgs.gov/information-policies-and-instructions/copyrights-and-credits — the page answered 403 to the build box's datacenter address, and the owner supplied its substance (public domain; standard credit forms; third-party-content and logo exceptions) on 2026-08-22, which is what the paragraph above records.
Google LLC
Play distribution (future). LastWagon is sideloaded today. The Play compliance checklist is [../research/google-play-checklist.md](../research/google-play-checklist.md).
Android backup. If a driver has Android backup enabled, Android copies app data to their Google account under Google's terms. LastWagon excludes credentials, tokens and the HERE trip cache from it. See Privacy § 2.
External maps hand-off. Where LastWagon offers to open a destination in an external maps app, that is the driver's own app under Google's terms — and it is not truck routing, which the app says at the point of offering it. The bundled directory also carries a Google Maps search link per record for the same purpose.