Privacy
This page is generated from the platform’s own records: the processing register, the retention rules the nightly job runs, and the table-by-table manifest that the export and erasure code reads. It cannot describe a product we are not running.
Three things are true before you read any of the detail. Opening a page here does not hand your browser to another company: map tiles come through our own servers, the type is already on your device, and visits are counted on the server with nothing attached to you. The two exceptions are named below, and both wait for you: an embedded video does nothing until you click it, and the sign-in page loads a robot check from Cloudflare. Nothing about you is decided by a machine. And you can see or delete what we hold yourself, from your data page, without asking us first.
Every entry behind this page last reviewed on or after 28 October 2026.
What we hold, and why
One entry per thing the platform does with personal data. The full register, with recipients, security measures and retention per activity, is at the record of processing activities.
Account and organization management
Authenticate organizers, maintain organizations, teams and roles so projects have accountable owners.
Lawful basis: Contract (Art. 6(1)(b)). About: organizers, members. What is held: email, display name, avatar, session metadata.
Event invitations and RSVPs
SensitiveInvite named people to events, record their response, manage capacity and waitlist, and confirm attendance.
Lawful basis: Consent (Art. 6(1)(a)). About: invitees, attendees. What is held: email, display name, RSVP response, attendance, custom answers. Sensitive detail (Art. 9): dietary requirements (may reveal religion or health), accessibility requirements (health).
Trail registry
Publish walking and cycling routes submitted by organizations, and review them for official registration.
Lawful basis: Legitimate interests (Art. 6(1)(f)). About: organizers. What is held: uploader identity, route geometry.
Project updates and digests
Send followers an opt-in digest when a project they follow posts an update or schedules an event.
Lawful basis: Consent (Art. 6(1)(a)). About: followers. What is held: email, follow relationships, digest preferences.
Award voting
Run time-boxed public voting rounds with one verified vote per person.
Lawful basis: Consent (Art. 6(1)(a)). About: voters. What is held: verified identity hash, ballot choice, IP hash, user agent hash.
Moderation and audit
Review projects and trails before publication, and keep a tamper-evident record of platform decisions.
Lawful basis: Legitimate interests (Art. 6(1)(f)). About: organizers, administrators. What is held: actor identity, action metadata, IP hash.
Data subject requests
Handle access, portability, rectification and erasure requests within the statutory period.
Lawful basis: Legal obligation (Art. 6(1)(c)). About: any data subject. What is held: email, request correspondence, export bundle.
Aggregate analytics
Understand which pages are used, without identifying anyone.
Lawful basis: Legitimate interests (Art. 6(1)(f)). About: visitors. What is held: path, day, country, device class, referrer host.
How long we keep it
These are not intentions. Each row is a rule a job runs every night at three in the morning, and this table is read from those rules. The clock column says which timestamp starts the countdown, because “90 days” means nothing without it.
| Record | Kept for | Counted from | Then |
|---|---|---|---|
| AccountOAuth access and refresh tokens for accounts with no active session. | 1 year | updated at | the personal parts are cleared, the rest stays |
| Audit logRoutine audit entries: info, notice and warning. Security severity is covered separately and kept far longer. | 2 years | at | the record is deleted |
| Audit logSecurity-severity entries, kept seven years. These are what prove an erasure actually ran. | 7 years | at | the record is deleted |
| BallotsBallot network identifiers, one year after the round closes. The ballot itself is append-only and never deleted; only the abuse-detection fields expire. | 1 year | cast at | the personal parts are cleared, the rest stays |
| CheckinsNull device hashes; attendance counts remain for the organizer's records. | 90 days | checked in at | the personal parts are cleared, the rest stays |
| Chronicle contributionsA contributor's contact address existed so an editor could ask a question or acknowledge the gift; it has no basis to linger once that window has passed. The email hash stays as the erasure anchor, and the opt-in credit name stays with the entry it belongs to — only the reply channel is cleared. | 180 days | created at | the personal parts are cleared, the rest stays |
| Consent recordsNetwork identifiers captured as consent evidence. The consent record itself is retained forever (Art. 7(1)); only the IP and user-agent hashes expire. | 3 years | created at | the personal parts are cleared, the rest stays |
| Data requestsExpire the one-time download token once a request is closed. No copy of an export is kept: it is built when asked for and streamed straight to the person. The request record itself is kept as proof of compliance. | 7 days | updated at | the personal parts are cleared, the rest stays |
| Email logNull the plaintext recipient; the hash stays for suppression and abuse defence. | 180 days | queued at | the personal parts are cleared, the rest stays |
| Email logDelete send metadata entirely after 12 months (PLAN.md). | 1 year | queued at | the record is deleted |
| Event invitationsInvitations never confirmed. Holding a stranger's address indefinitely after they ignored one email has no basis. | 14 days | created at | the record is deleted |
| Moderation queueDecided moderation items, kept two years for appeals. | 2 years | submitted at | the record is deleted |
| Organization invitationOrganization invites never accepted. A third party's plaintext address must not be held indefinitely because they ignored one email. | 30 days | expires at | the record is deleted |
| Page viewsAggregate counters with no personal data; deleted purely as housekeeping. | 800 days | day date | the record is deleted |
| Project mediaUploads that never completed. The stored file is freed by the nightly object-store sweep, which runs first, and then this removes the database row. | 30 days | created at | the record is deleted |
| RsvpsDietary and accessibility notes are Art. 9 special-category data. Hard-deleted 90 days after the event; never merely anonymized. | 90 days | occurrence starts at | the personal parts are cleared, the rest stays |
| SessionExpired sessions have no purpose. | 30 days | expires at | the record is deleted |
| UserHard-clear residual profile fields 30 days after anonymization, once the erasure grace period has passed. | 30 days | anonymized at | the personal parts are cleared, the rest stays |
| VerificationSpent magic-link and verification tokens. | 7 days | expires at | the record is deleted |
47 kinds of record have no timer at all. They belong to something else and end when it ends: the chapters of a chronicle go when the chronicle goes, a waypoint goes with its trail. A timer on those would delete a village archive on an anniversary nobody chose.
Who else sees it
Taken from the register, deduplicated. Only one of these is a company we pass data to: Cloudflare, which hosts the site, the database, the files and the mail. There is no analytics vendor, no advertising network and no data broker in this list, because there is none in the product.
- Cloudflare (Analytics Engine)
- Cloudflare (email delivery)
- Cloudflare (hosting)
- Cloudflare (hosting, bot protection)
- Cloudflare (hosting, database, email delivery)
- Cloudflare (hosting, object storage)
- the organizing organization
- the public
Two footnotes that belong here rather than in small print. The sign-in page loads a Cloudflare Turnstile widget from challenges.cloudflare.com to keep robots out; it sets no cookie and builds no profile, and it is the only address other than ours your browser is ever asked for. And an organization can connect its own writing-assistant endpoint for its own drafts. That is a transfer, it is off unless that organization switches it on, it is shown in their workspace before they do, and it never touches another organization’s content.
Your rights, and the link that uses them
Every one of these is a page you can open, not a letter you have to write. We answer within 30 days; the clock is recorded against the request itself.
- See what we hold, and take a copy (Art. 15 and 20). Request an export. Every table keyed to you is walked and built into a zip on the spot: the data as JSON, plus a list of the files you uploaded. It is streamed straight to you and no copy is kept, so if you lose it, ask again. The download link expires after fifteen minutes and can be used three times.
- Correct it (Art. 16). Your account page edits your name, your handle and your bio. Your email address is the anchor everything else about you is keyed to and there is no self-service way to change it yet — write to us and we will do it. This page will say so when that changes.
- Delete it (Art. 17). Request erasure. What that does and does not do is spelled out below, and on the confirmation screen, before you commit.
- Object, or ask us to pause (Art. 18 and 21). Same page. Where we rely on a legitimate interest, you can object and we stop unless we can show a reason that overrides yours.
- Withdraw consent (Art. 7(3)). Your consent history lists everything you have ever agreed to, the exact wording you were shown, and when. Withdrawing writes a new record rather than editing the old one, so the history stays honest in both directions.
- Not be judged by a machine (Art. 22). Nothing about you is decided automatically. A model can suggest wording to an organizer or flag a submission for a human to look at. It cannot approve, reject, rank or ban.
- Complain (Art. 77). You can go to your national data protection authority without going through us first. We would rather you told us as well, but it is not a condition.
If you have no account, because somebody invited you to an event, write to us with the contact details on the imprint. We confirm the address is yours before answering, which is a protection for you rather than an obstacle.
What is in an export
28 kinds of record, listed here by their names inside the system so you can check the bundle against this page: user, member, organization invitation, projects, project blocks, project media, books, chronicles, chronicle chapters, chronicle entries, chronicle entry people, chronicle collaborators, chronicle contributions, trails, places, events, event invitations, rsvps, checkins, project backings, project follows, project updates, ballots, proposal votes, proposals, consent records, data requests, email suppressions.
A few fields are left out on purpose, and they are all secrets rather than facts about you: password and token hashes, the internal notes on your own request, and the hashed network identifiers kept to detect abuse. Handing those out would make an export request a way to attack the account it came from.
What erasure does, and what it does not
Two of these will surprise you, so they are here rather than in a dialog you will click past.
Published work stays, with your name off it
A project other people are following, a trail on the public registry, a chronicle a village has been adding to, an event with attendees: these do not vanish when you leave. Ownership moves to the organization and you are detached from them. Deleting them would take away work that was never only yours, and would break things other people are relying on. If you want a project taken down as well, ask its organization, or ask us and we will pass it on.
Handed to the organization: projects, project media, books, chronicles, chronicle entries, chronicle decks, trails, places, events, project updates.
Your consent records stay
We keep the record that you consented, and the record that you withdrew it, with your email address replaced by a one-way hash. The law puts the burden on us to prove we had permission. Deleting that proof at the moment someone leaves would destroy the only evidence that we behaved correctly, including the evidence that we honoured this request. The same is true of the list of addresses that asked never to be mailed: erasing it would start the mail again.
Everything else
7 kinds of record are deleted outright: session, account, member, organization invitation, chronicle collaborators, project backings, project follows. Another 15 keep their shape and lose you: the audit trail keeps the fact that a decision was made and loses who made it, an attendance count survives without the attendee, your own user row is emptied of every field about you rather than dropped, because so much of the site points at it and orphaning all of that would break things for other people.
An erasure request has a 30-day grace period before the final sweep, so a request made in anger or by mistake can be undone. After that it cannot.
Cookies, and the rest
There is no cookie banner because there is nothing to decline. The full list, with names, is on the cookie page.
Files you upload have their embedded camera data stripped, which includes the location and the serial number. We only accept formats we can actually strip: HEIC and AVIF are refused with an explanation rather than stored uncleaned. Uploaded GPS tracks have their timestamps and any heart rate or cadence removed before they are stored, and exports are rebuilt from the stored shape rather than handing back your original file.
Private chronicles are not read by us. They do not enter the moderation queue, because moderation exists to decide what gets published and a private archive is not published. The trade is that you can take the whole thing away in one click, at full resolution, whenever you want.
We will change this page when the platform changes, and it will change by itself when the rules behind it change. If something here does not match what you see, that is a fault worth reporting: the imprint has the contact details.