Privacy
What we keep, and what we don’t
This describes what the site actually does today, not a template policy.
In your browser
Public reading pages set no cookies. They store display preferences in your browser's local storage when you change a setting on the preferences page: your theme choice, your timezone choice, your clock format and whether relative dates are shown. These never leave your device, and clearing site data removes them. If local storage is blocked, the site still works and says so on the preferences page.
The map also saves display settings and public satellite segments on this device. Downloaded segments are stored in IndexedDB for offline access and checked against the latest segment index when online. The browser may be asked to keep this storage persistently; it can refuse, run out of space, or remove data. Clearing this site's browser data removes these copies. Visited public pages and assets are cached for offline reading; admin content and sign-in tokens are excluded.
There is no analytics, no tracking pixel, no advertising and no third-party script on public reading pages. The feedback form and map-link creation load Cloudflare Turnstile for spam protection when enabled. The restricted admin page loads Google sign-in. The site loads no remote fonts. Links to source material point at other organisations' websites, which have their own policies.
Shared map links
Creating a map link saves the public view settings on our servers. A selected observer location is included only when its sharing checkbox is checked. Device location starts unchecked and requires your confirmation. Anyone with the link can read the saved coordinates, see the person marker and explore satellites above that position. Leave the checkbox unchecked to share without observer coordinates. Opening a shared link does not request the recipient's device location.
Links expire after the lifetime shown when created; the default is one year. Expired links stop restoring the view, and storage cleanup follows asynchronously. Link creation uses Cloudflare Turnstile for abuse protection. Copying a link does not publish it. Share on X opens X with suggested text and the link; you decide whether to post.
Suburb and city search
Place search runs only when you submit a search. Our server sends the suburb or city name and optional country to OpenStreetMap Nominatim. Do not enter street addresses, names of people or confidential details. Your device coordinates and browser IP are not included in that provider request. Public place results are cached for up to three days and then cleaned up asynchronously. Queries are not written to application logs. Choosing a result positions the person at an approximate locality centre; creating a public map link has the separate sharing controls above.
Search uses Nominatimand is subject to the OpenStreetMap Foundation privacy policy. It may be rate limited or unavailable; globe selection and coordinate entry remain available.
On the server
Most pages are static files; the updates feed is rendered from reviewed editorial records. The restricted admin has Google login and authenticated editing endpoints. The content-delivery network that serves the site keeps standard request logs: request time, requested path, response status, browser user agent, referring page and the requesting address. They are stored privately, encrypted, and deleted after 90 days.
Once a week an automated job turns those logs into counts: page views per page and per day, how many distinct address-and-browser pairs visited each day, referring sites, response codes, edge locations and which crawlers called. The counts are kept; no address, user agent or individual request is copied into the summary, and nothing is shared with any third party. There is still no analytics script, cookie or tracking pixel on any page.
Feedback
When feedback submissions are enabled, the form uses Cloudflare Turnstile to check for automated abuse. Cloudflare processes technical browser and network information under its privacy policy. Your feedback text and optional email are not sent to that spam-checking service.
Submitting sends your feedback, optional reply email and the originating public page path through Amazon SES to operations@spcx.today. We leave out URL query strings and fragments. Your email is optional and unverified; providing one lets our team reply. Messages remain in our operations mailbox for handling. They are not automatically published or sent to AI.
The feedback service keeps submission IDs, timestamps and a daily keyed hash of the requesting IP address to limit abuse and duplicate sends. It does not save message text or email addresses in this abuse-control store. Its records expire after three days under the storage lifecycle policy; physical deletion can take longer. Application diagnostic logs exclude message content and contact details and expire after seven days. Existing hosting logs described above have their own retention period. The form keeps an unsent draft only in the current page and does not queue messages for offline delivery.
Editorial administration and AI
The admin page loads Google's sign-in service, which processes the administrator's sign-in under Google's policies. We verify the Google identity token and allow only the designated administrator. The browser keeps the token in memory, not local storage. Private editorial history stores edits, review evidence and the administrator's Google account identifier.
OpenAI receives public source articles and draft summaries for summarisation and a separate source check. API requests disable response storage; provider processing and retention remain subject to OpenAI's API policies. Reader visits, Google tokens and API keys are not included in those model requests. Credentials are stored separately in AWS Secrets Manager. AI processing and its limitations are described in the methodology.
Changes
If monetisation, analytics or any other data collection is ever added, this page will be updated before the change goes live, and the change will appear in the updates feed.