Privacy policy

Your photos

When you add a photo, your browser makes two smaller copies of it (1280 px and a small square) and saves them anew. That removes everything hidden in the original file: location, camera, date and any other metadata. The server checks every file again and strips anything left. The original file never leaves your device.

The photo’s location is read in your browser and sent to the server once, only to measure how far the photo was taken from the marks within 150 m. The server keeps those distances and the “Verified location” badge, and throws the location away. It is not stored in the database, in files or in logs.

With your photo the site keeps: the date and time it was taken (and its time zone), the mark it belongs to, the name or nickname you typed, and whether it is waiting for my check, published or hidden.

If you sign in with Google

Signing in gives the site your Google name, email address and profile picture. Your name and picture are shown next to your photos and your reactions; your email address is never shown to anyone. You can change your name on your profile page.

Reactions are public: anyone can see who reacted to a photo. Reports are private: only you and I see the reason you gave.

Limits against spam

To stop scripts from flooding the site, it counts uploads per network and reports per account. It stores a scrambled code made from your IP address or account (a keyed hash), never the address itself, and deletes these counts after two days.

If you post without signing in, your browser gets a cookie with a random code (wm_guest, kept for a year). It only lets the site count how many of your photos are waiting for my check, at most 5 per mark. The database keeps a scrambled version of the code, not linked to your name.

Your location on the map

“Near me” and the distances in the list use your location only if you allow it in your browser. It stays in the open page, is used to find marks within 10 km, and is never saved.

Cookies and storage in your browser

The site uses only the cookies it needs to work: the sign-in session and, for guests, the wm_guest code above. Your theme choice (light or dark) is kept in your browser. There are no analytics, no advertising and no tracking cookies.

Services the site runs on

Vercel hosts the site. Supabase keeps the database and the photos, in the EU (Ireland). MapTiler draws the map. Cloudflare Turnstile checks that whoever posts a photo is a person. Google handles signing in. Each of them sees the technical data any website sees, like your IP address, and handles it under its own privacy policy.

Removing your photo or your data

Want a photo taken down, whether it is yours or you are in it, or want your account and everything you posted deleted? Write to me at @okolenchuk_ on Instagram with a link to the photo or the mark. I’ll remove it, usually within a few days, and the files are deleted for good, not just hidden. You can also ask me what the site keeps about you.

Signed-in visitors can also press Report on any photo.

Changes

If this policy changes, the new version will be on this page with a new date at the top.