Controller: Spaghetti Code, Hesseløgade 6, 3. tv., 9000 Aalborg, Denmark. Contact: [email protected].
Deliberately little: your email address, a password hash, a display name you choose, the squares you own, and the payment references our processor gives us. That is the whole account record.
If you arrived through a link that names a campaign, the order records that campaign's name — the words in the link, nothing more — so we can tell which of our own posts brought anybody here. Nothing is stored on your device for it.
We count visits, on our own server. For each day we keep the country your connection appears to be in, the page you arrived on, the site you came from if you clicked a link, the language your browser asks for, a guess at whether it is a phone, and a number saying how many pages were looked at. Your address is not stored. It is turned into an identifier together with the day itself, so today's count cannot be joined to tomorrow's and nobody can be followed from one day to the next. Nothing is stored on your device for this, and nobody outside is told you were here.
Somebody else's address, when you name one. Buying a square as a gift or giving one you already hold to somebody means typing their email address, and we store it: it is the address the square is registered to and the address we have to write to. We use it for that and nothing else — no marketing, no list, and no message about anything but the square they were given. If somebody has named your address and you would rather we had not, write to [email protected] and we will remove it.
No card numbers — Stripe handles payment and we never receive them. No advertising or analytics trackers: nothing is put on your device, no third party is told you were here, and nothing follows you between days or between sites — see the visit counting above, which is ours alone and does neither. No location data: we strip EXIF, including GPS, from every image before it is stored.
To perform the contract when you buy a square, to meet our legal obligations for tax and invoicing, and for the legitimate interest of keeping the map free of abuse.
Your display name and anything you publish on your square are public by design. Your email is not. We share data only with the processors that run the service: Stripe (payments), our hosting and object-storage providers, and our email provider.
The globe draws itself from map tiles served by OpenFreeMap, and your browser fetches those directly — so it reaches them with your IP address, the way any image on any page does. We send them nothing about you.
When you type in the search box, the text goes to our server, and our server asks a geocoder (Photon, run by Komoot, on OpenStreetMap data) where that place is. The geocoder never sees you — not your IP address, not your browser, not anything identifying the person who typed it. It sees our server asking about a string of text. We do that on purpose rather than letting your browser call out.
We remember the answer to a search for a week so the same query does not have to be asked twice. What is kept is the place and the answer — “this street is at these coordinates” — and never who asked. Searches are not attached to your account, not logged against your address, and not used for anything but drawing the map where you asked.
We never ask your browser where you are. There is no button that requests your location and the page does not call for it, so the question is never put to you and no coordinates of yours reach this site by any route. Where the map opens is worked out from the country your connection appears to be in, and nothing more precise than that.
Account data for as long as you own a square, then 12 months. Invoices for as long as tax law requires of us. Moderation records for two years. A day's visit count for 13 months, then it is deleted.
Access, correction, erasure, portability, objection and restriction — write to [email protected]. You may also complain to the data protection authority of the country you live in.
You can do it yourself, at any time, from your squares. It is immediate and it cannot be undone: your account, your name, your address and your settings are deleted.
You choose what happens to your squares, and both answers are final.
Either way the cell is not put back up for sale. Nobody else can buy a square you paid for, and closing your account does not change that.
An offer to give a square away that nobody has answered is closed when you close your account, in both directions: one you sent stops working, and one sent to you stops working rather than making a fresh account at the address you have just had deleted. The address on it is deleted with the rest.
What we keep is the record of what you were charged — the amount, the date and the payment reference — with your address and the link to your account removed from it. We are required to be able to produce that, and it is the one thing erasure does not reach. Records of a moderation decision are kept for the same reason, for as long as stated above.
One session cookie and one CSRF cookie, both strictly necessary. Nothing else.