You should always view OpenStreetMap systems and software with a questioning mind, and feel free to raise any concerns you have about matters of privacy via our Contact channels.
As well as privacy issues, users and contributors must also be aware of the OpenStreetMap License. This includes disclaimers. We also have an Acceptable Use Policy covering various types of server usage.
GPS Trace Data
GPS data is uploaded in the form of individual GPX files. These are kept as raw files, as well as imported into the database. GPX files can be marked "public" by the uploader; this is completely unrelated to the option of making one's edits "public".
When GPS data for an area is downloaded via the API no indication is provided of which user uploaded a point, or of the timestamp that was associated with the point. Points are however returned in timestamp order. GPS data downloaded in this way will include points from traces which were not marked as public.
If a GPS trace is marked as public when it is uploaded then the raw trace may be downloaded from the web site or using an API call. In this case the user's display name is shown (regardless of whether the user has made their edits public) and the timestamps in the GPX file will be included. Also, any additional information placed in the GPX file will still be present, e.g. waypoints with their names and/or notes entered, associated symbols, elevation data, etc.
All edits made to the map are recorded in the database with the user ID of the user making the change, and a timestamp at the time of change upload. In general all of this information is also made available to everyone via the website, including links to allow everyone to easily cross-reference which user has made which edit.
Historically OpenStreetMap offered an option to make "anonymous edits". This means the website does not display an association between edits and user ID. We intend to continue respecting the wishes of those users who (in the past) made edits in this mode, however we no longer allow users to make further edits in anonymous mode. This is because revealing the user ID of a user making a change, is not deemed to be present a serious privacy problem (a user ID does not necessarily need to reveal a user's real name or any other personal information), whereas hiding this information creates serious problems when tracing vandalism and otherwise understanding map editing history. You can find out more about this, on the Anonymous edits page.
If a user selects the "make my edits public" option and also sets a home location then they will appear on the "nearby mappers" list for other people with a home location near theirs.
The registered email address for an OSM user account, will never intentionally be published on the internet anywhere, shared with third party organisations, or revealed directly to other logged in users. Email addresses will be used by the server to notify the user if another user has sent a message through the website. Only System Administrators will have direct access to email address data. It may be used by these people to contact users directly about their edits or other OpenStreetMap related issues.
Note that some other types of Accounts used by developers/community do expose email address information more publicly (due to technical limitations of the software used, rather than policy decisions) The Trac system exposes your email address in plaintext on the page if the email address (rather than the display name) is used to login. The mailing list system exposes email addresses of people posting messages, in the archive web pages, but with obfuscation. If you want to post to the list, the system also requires you to register with your proper 'from' address, not a forwarding address.
As mentioned above, feel free to raise any concerns you have about matters of privacy via our Contact channels.