LocationIQ vs Woosmap

LocationIQ 3

We found no changelog, release notes or blog on 4 November (docs.locationiq.com/changelog, locationiq.com/changelog and locationiq.com/blog all return 404, and llms.txt lists none), so there's no dated API change to count. The terms were updated 31 March 2026, which isn't an API change (0). No dated entries in the last 90 days (0). No public changelog. Support is by email, which we didn't test (3). The official Python client hasn't changed since 30 March 2020 (0). Nothing current to judge package health by (0). The status page shows the service is run and watched, which this checklist doesn't capture. 0+0+3+0+0 = 3.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

LocationIQ 55

Separate tokens per application, each with scopes, HTTP referrer or IP restrictions (up to 5 CIDRs), its own rate limits, and rotation from the dashboard, which earns 30. Less 10 because the OpenAPI spec defines only the key query parameter. The free plan gets one token (20). Scopes and per-token limits give least privilege, and nothing writes (17). Results are OpenStreetMap-derived text with no prompt-injection guidance (7). The /balance endpoint shows remaining quota. We didn't check per-call logs (4). security.txt valid to 1 January 2028, re-read on 4 November, pointing to hello@locationiq.com. No bug bounty or certification found (7).

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

LocationIQ 61

Closed service with readable terms, updated 31 March 2026, under the laws of Telangana, India (15). The terms are specific on storage, 48 hours on Free and for as long as you're a customer on paid plans, with no server-side tile caching. The privacy policy at locationiq.com/privacy was last updated 22 May 2020, says IP addresses are stored to check for abuse with no retention period, and links a DPA (15). No deprecation policy or notices found (0). Stripe, Zoho and Google Analytics named without locations. Data centre regions are visible on the status page, not in the policy (10).

Woosmap 54

Editorial half only. Closed service under online terms that name WOOSMAP SAS of Montpellier and the Commercial Court of Paris (15). The privacy policy covers website visitors only, and we found no statement on how long API request data is kept (5). The pricing page says the Address API is 'being deprecated for Pro Plan subscriptions', with no date (5). The legal notice says the site is hosted by Amazon Web Services; no sub-processor list or data location for the APIs was found (6). 15+5+5+6 = 31.

LocationIQ 83

status.locationiq.com lists 15 components by data centre (geocoding, autocomplete, maps and routing in Europe, US East, US West and Asia Pacific) with RSS and Atom history back to March 2018, 74 incidents in all, per the 1 October check (20). The newest incident then was 'Network Issues' on 2 April 2026, so 6 August to 1 October was clean. On 4 November the status host answered robots.txt with its app page, so nothing more was requested there, 2 October to 4 November is unread, and the line is held at what the read part supports (30). Per-second and daily limits for every plan, and per-token and per-IP limits on top, with soft daily limits of up to 100% more on paid plans (15). Three distinct 429 messages, Rate Limited Second, Minute and Day, and a 500 that says to retry after a short wait, but no Retry-After or backoff guidance (8). No SLA. The pricing page lists custom SLAs only on its top plan and points to public uptime instead (0). GA (10). 20+30+15+8+0+10 = 83.

Woosmap 78

Hosted lines. Atlassian Statuspage at status.woosmap.com with seven components (Localities, Store Search, Geolocation, Distance, Address, Map and Indoor APIs) (20). The status home page lists no incidents from 23 October to 6 November 2026. The full history page loads by script and the site's robots.txt disallows /api/, so the rest of the 90 days wasn't read and the line is held between the unreadable and minor tiers (10). Each endpoint's reference states its own rate limit, such as 50 a second, shared by a project's keys (15). Every response carries RateLimit-Policy and RateLimit headers, and the rate-limits page says to wait t seconds after a 429, retry at most three times and back off 1, 2 and 4 seconds when the header is missing, with sample code (15). A 99.9% SLA on the Enterprise plan per the pricing page; we didn't read its terms (8). GA (10). 20+10+15+15+8+10 = 78.