Privacy policy

What is collected, and why

Urlopo holds what an account needs to exist and what an entry needs to be published. There is no advertising here and nothing is sold to anybody.

From signing in: your name, your email address and your profile picture, as your provider gives them. The email address is used to tell you what a moderator decided about an entry, and to tell you when somebody comments on one — nothing else. Every one of those letters carries a link that stops them, which needs no sign-in. It is never shown on the site: a public profile has no address in what it reads, deliberately.

From writing: the entries you write, the pictures you upload and the places you mark on a map, with the times they were created and changed.

From commenting: the text of the comment and when it was written, published under your name and your profile link. A comment is public the moment it is posted — there is no queue it waits in.

Coordinates

A guide is a list of places on a map, and the whole point of a route is that it can be followed — so treat every place you mark as public the moment you save it.

What that means in practice: a route that starts at your front door starts at your front door. Begin it at the car park instead. The line between the places is not stored at all — it is asked for from Mapbox when somebody looks at the guide — so what is published is the places you chose and nothing finer.

A reader’s position is a different thing, and the rule for it is: this site never stores one. The browser is asked where you are only when you press a button that says so — never as a page loads — and refusing leaves the site working. What you get back is an answer, not a record: there is no table of positions, nothing writes one to a log, and there is nothing to export or delete afterwards because nothing was kept.

Two things follow from that, and they are the whole mechanism. The coordinate travels in the address of the page that answers, because that is what lets the answer be rendered and shared — so it is in your own browser history like any other page you visited. And it is rounded to about a hundred metres first: a search with a radius of kilometres gives the same answer either way, and the rounding is what stops your doorstep being the thing that travels.

Uploaded pictures

A photograph off a phone carries metadata the camera wrote into it, which on a phone recording location includes where it was taken — often to a few metres.

That metadata is removed. Pictures are decoded and written back out on upload, so what is stored is the image and nothing else. The only exception is what is visible in the picture itself, which is yours to judge.

Where it is kept

Entries and account records are in a PostgreSQL database; pictures and track files are in object storage. Both are hosted in the European Union.

Files are stored under a prefix belonging to your account, which is what makes it possible to remove all of them at once when the account goes.

Who else sees it

Google, because signing in goes through them and they know you signed in here. Their own policy governs that.

Mailjet, which sends the messages telling you what a moderator decided. They see the address and the message.

Nobody else. There is no analytics profile built about you, no data broker, and no third-party embed on a page that could watch you read it — an image in an entry is served from this site, by id, precisely so an author cannot point one at a host that would.

How long it is kept

Published entries stay while they are published. Drafts stay until you delete them or delete the account.

Deleting the account removes your entries, your waypoints, your pictures, your track files and your comments, and the files leave object storage rather than being marked hidden. Search engines and archives may still hold copies of pages that were public, which is outside anybody’s control.

What you can ask for

A copy of everything the site holds about you, as a file, from the author area. It includes your account record, your entries with their bodies, the places along their routes, your comments, and a list of the files you uploaded.

Deletion, also from the author area, immediately and without asking anybody.

Anything else — a correction, a question, an objection: [email protected].

Cookies

One, and it is the session: it says you are signed in and it is signed so it cannot be forged. Without it there is no way to stay signed in.

No advertising cookies, and no consent banner, because there is nothing to consent to beyond the cookie that makes signing in work.