Privacy

This page was written by reading the code that runs, not by describing an intention. Every claim below names the thing that enforces it.

Your plot may carry a small flag showing your face or, if you choose, your initials, and where several people hold plots within 100 miles of each other the map shows one flag with the number of people; neither ever shows a street address.

What leaves your device

Seven hosts, and that is the whole list:

1. Our own backend

   Supabase, at hemixeqzwnqavyyfluyo.supabase.co. It holds your account and anything you choose to upload. Nothing else.

2. NASA satellite imagery

   gibs.earthdata.nasa.gov, for the pictures of the ground. It is a public, keyless service of the United States government and it receives the map tiles you look at, which is to say roughly where on Earth your screen is pointed. It never receives who you are.

3. Aerial photographs of a plot, only when you open one

   basemap.nationalmap.gov and imagery.nationalmap.gov (the United States Geological Survey's National Map, public domain) for ground inside the United States, and tiles.maps.eox.at (EOX's Sentinel-2 cloudless 2016 picture, CC BY 4.0) everywhere else. Neither is contacted until you open a plot and the map comes down close; each receives the map tiles you look at, which is to say roughly where on Earth your screen is pointed. Neither ever receives who you are.

4. Two geocoders, only as a fallback

   nominatim.openstreetmap.org and photon.komoot.io, and only when you type a place name the app's own offline index cannot answer. They receive the words you typed. They are not contacted at all unless you use the search box.

There is no analytics, no advertising, no tracking and no third-party SDK of any kind. The app contains no Google Analytics, no Facebook SDK, no Segment, Mixpanel, Amplitude, Sentry or anything of that family. This is checkable: the shipped bundle is plain JavaScript, and you can read it.

What we store about you

1. Your email address

   Because that is how you sign in, with a password you choose. Your address is used to sign you in, and to send a password-reset link when you ask for one, and nothing else. It is never sold, shared, or used for marketing.

2. A profile, if you make one

   A handle, a display name, a few words about yourself, a country, links you choose to add, and a portrait if you upload one. All of it optional, all of it visible to anyone using the app, because the point is to be findable by the people who hold nearby ground.

3. The plots you hold

   A plot is a public entry in a public registry. Its 12 m cell, the region it sits in, and the name you claimed it under are visible to everyone. That is the product, not a side effect.

4. Footage and photographs you upload, and where they were taken

   The file, its type and size, when it was captured, and the coordinates of the shot. Location on a contribution is required — a record of the land that does not say where is worth nothing — and it is recorded as either measured (read from the file) or stated (you placed it on the map yourself), and which of the two is shown.

5. Your consent, with its date

   Every upload stores that you confirmed it is your own work, that anyone identifiable consented, and that you understand it can be withdrawn — with the version of the policy you agreed to and the moment you agreed.

Your device's location

The app asks for location only when you press Where I am, and only while the app is open. It is used to move the map to the ground you are standing on. It is not sent to our servers and it is not stored. The coordinates recorded against a contribution are the coordinates of the shot, which you can see and correct before it is queued.

Your camera, microphone and photo library

The camera and microphone are used only while you are filming a plot, and never in the background. The photo library is read only when you choose files to upload, and written to only so a clip you record in the app is also saved to your own library — so you keep a copy of what you gave away.

Children

Ecoregions is not directed at children under 13 and we do not knowingly collect anything from them. An account requires an email address.

Taking it back

You can withdraw any contribution. The record of the withdrawal is kept — that is what withdrawn_at is for — because a registry that can be silently rewritten is not a registry, but the file stops being published. To delete your account, sign in and choose Delete my account: your profile, uploads and sign-in are removed. Plots you hold stay in the registry under “Deleted account”, because who held a plot is the record. Questions: joshuakloss@gmail.com.