Privacy during the pilot

Updated 8 September 2026. This community is operated by Tac. This page describes the information the application stores and the controls available during the pilot.

What is public

Your handle, public profile, reports, replies and uploaded photographs can be read by visitors and search engines. Your real name is displayed only if you choose to show it. Public edit histories may retain earlier wording after a correction; editing is not a way to erase a previous disclosure.

What we store privately

We use your email for sign-in and notifications you request. We store hashed sign-in and session tokens, session device information and IP addresses, reading and contribution counters for trust levels, notification preferences, and moderation and upload records. Your email is not shown on your public profile. The pilot has no advertising trackers.

Cookies and services

Four things are kept in your browser and nowhere else. Nothing here counts what you read, follows you to another site, or is sold to anybody.

  • Signed in. A cookie set when you sign in, lasting up to a year unless you sign out.
  • The sign-in request. A cookie set when you ask for a link, so the six-digit code works in the browser that asked. It lasts thirty minutes.
  • Your colour choice. A cookie, set only when you pick one in your account.
  • Your map choices. Which layers you want and whether you have allowed the map background, kept in this browser’s own storage and set only when you choose.

The map is the one screen that contacts somebody else. Its background comes from OpenStreetMap, and the terrain option from OpenTopoMap, and loading either sends your IP address to them. The map asks before it does, and until you say yes it draws the rivers, pins, access sites and gauges from this site alone. You can change that answer at any time on the map itself.

Email delivery uses Resend when configured. Hosting, database and photograph storage providers process the data needed to run the site; photographs may be stored in a private Supabase bucket.

Photographs and location

Uploaded photographs are re-encoded and their metadata is stripped before storage. Reports use water or reach names, not precise coordinates. Visible landmarks and text can still reveal a location. Upload reservations count toward your daily allowance even if you later remove the photograph or storage fails.

Retention

Scheduled maintenance collects unattached photographs after 1 day, photographs on removed content after 30 days, sign-in token records after 7 days, expired sessions after a further 30 days, and read notifications after 90 days. These are collection thresholds, not promises of immediate erasure; maintenance must run to remove them.

Unread notifications, account records, public contributions, edit histories and moderation records do not have automatic expiry in the current application. Copies in backups or external search engines may outlive removal from the site.

Your choices

You can change your profile and notification preferences, sign out other sessions, and correct your own contributions. To request access to your information, removal of a sensitive disclosure or account deletion, use help and contact. We verify ownership and handle these requests manually during the pilot.