Privacy at Unfound Earth

Who we are

Unfound Earth is operated by Rory Duncan, trading as Unfound Earth. Rory Duncan is responsible for your personal information as the data controller. Our contact details are at the end of this policy.

Information we collect

• Account information: your email address, account identifier and authentication information needed to sign you in and maintain your session. Supabase, our authentication provider, also manages related account and session metadata.
• Your finds: which places you mark FOUND, when the find is recorded, and the XP awarded for that find.
• Messages you send us: your contact details and the information you include when contacting us or making a privacy request.

Our hosting and service providers may also process normal connection information, such as IP addresses, browser details and request logs, when delivering and protecting the service.

How we use your information

We use your email address to operate sign-in and identify your account, including displaying it on your Account page. Sign-in uses an email code or link; the app does not collect or store an Unfound Earth password.

We save your finds to remember your collection, prevent duplicate XP awards and show your progress. We calculate lifetime XP, levels, collection completion and regional milestones from your finds. Your discovery history is private to your account, not a public profile or feed.

We also use information you send us to respond to enquiries and privacy requests. We do not use your email address for marketing emails in the current service.

Why we use your information

UK data protection law requires us to have a reason, known as a lawful basis, for using personal information. For information needed to create and operate your account, sign you in, save your finds and provide your collection and progression, our basis is performance of a contract. This information is needed to provide the Unfound Earth account and service you ask for.

For proportionate processing needed to operate, secure and maintain Unfound Earth, including protecting the service, preventing misuse and diagnosing technical problems, our basis is legitimate interests in operating, securing and maintaining the service.

When responding to privacy or data-rights requests, some processing may be needed to meet legal obligations. We use information in ordinary enquiries to respond to those enquiries.

Location and FOUND

FOUND is an honour-system record, not verification that you physically visited a place. We do not request browser geolocation, use device GPS to verify a find or track your movements. No photograph or other evidence is required.

Maps, weather, daylight information and navigation links use the coordinates of destinations, not your personal location. Marking a place FOUND records when you save the find, not a GPS location or a verified visit time.

Cookies and sign-in

We use necessary authentication and session cookies to keep you signed in, temporary sign-in state to complete authentication, and a short-lived cookie to return you to the page you were viewing after sign-in.

These are not analytics or advertising cookies. The app does not use local storage, session storage or an offline browser database to track you. You can control cookies in your browser, but blocking necessary cookies may prevent sign-in from working.

Services we use

• Supabase provides authentication, our database and storage for official place images. It processes account and collection information to operate these features. Sign-in emails are delivered through the email service configured for Supabase Auth.
• OpenFreeMap supplies map resources loaded by your browser. It can receive normal network information such as your IP address and browser request details. We do not intentionally send it your email address, account identifier or FOUND history.
• WeatherAPI receives destination coordinates in requests from our server. We do not send it your device GPS, email address, account identifier or FOUND history. Daylight is calculated within the app using SunCalc, without sending a request to a SunCalc service.

Official place photographs are served from Supabase Storage. Photography credits may link to Wikimedia Commons or Geograph; these are source links, not embedded image feeds. Met Office forecasts are also external links. If you follow an external link, that site processes your visit under its own privacy policy.

Our primary Supabase authentication and database service is hosted in Frankfurt, Germany, in the EU. We also use other technical and service providers. Some may process limited information outside the UK or EEA. We do not claim that every request, log or email interaction stays in Germany or the EU, or that all information is stored there.

Analytics, advertising and sale of information

Unfound Earth does not currently use analytics or advertising trackers, marketing pixels or cross-site tracking features. We do not currently sell your personal information. Service providers process information as needed to operate the service. If we introduce analytics or materially change these practices, we will review and update this policy.

How long we keep information

We keep your account information and discovery history while your account exists so we can provide your collection and progression. There is currently no automatic inactive-account deletion period.

If you delete your account, we delete the account data controlled by the Unfound Earth application. Some information may remain temporarily in service-provider backups, security logs or similar systems under their retention processes, or where retention is legally required. Deletion does not mean every copy in every provider system disappears instantly.

Deleting your account

You can delete your account from Account after signing in and confirming deletion. This permanently deletes your sign-in account, application profile and FOUND records, including the data used for your collection and lifetime XP.

Shared place information and official place photography remain: they are part of the catalogue, not your personal content.

Your privacy choices and requests

Email admin@unfoundearth.com with questions about your personal information or to request access, correction, deletion or a copy of your data. We handle requests manually and may need to verify your identity. The rights available and how they apply depend on your circumstances and applicable law.

You can also raise a concern with the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Age

Accounts are intended for people aged 18 or over. We do not collect your date of birth and do not currently have an age-verification feature. Please contact us if you believe someone under 18 has created an account.

Security

We use measures intended to protect your information, including authenticated access to your account and private collection. No internet service can guarantee absolute security.

Changes to this policy

We will update this page when our information practices change and revise the date above. Please check it when you want to understand how the current service uses your information.

Contact us

For privacy questions and data requests, email admin@unfoundearth.com.