Privacy

What this site collects, why, and how to get it taken down. Short, because the site does very little.

Not finished. The contact details below are placeholders. Fill them in before this goes public.

Who runs this

Heart Shaped Sightings is run by [CONTROLLER NAME], who decides what is collected here and what happens to it. Reach them at [CONTACT EMAIL].

What gets collected

When you submit a sighting

• The photo. It is resized in your browser before it is uploaded, which strips the embedded camera data, including any GPS coordinates your phone wrote into the file.
• The caption and place name you type.
• The location you choose, as coordinates. This comes from whichever method you used: your device location, an address search, a pasted map link, or dragging the pin.
• Your Instagram handle, only if you enter one. It is optional and exists so you can be credited.
• A one-way hash of your IP address. Not the address itself. It is mixed with a secret value and hashed, so it cannot be turned back into an address, and it is used only to stop one person flooding the site.

When you heart a post

The same kind of hashed value, so each post can be hearted once per network. Your browser also remembers which posts you hearted, on your own device, so the button looks right when you come back. That never leaves your browser.

What is not collected

No accounts, no cookies, no analytics, no advertising or tracking scripts, no email addresses.

What becomes public

This is the part worth reading twice.

If a sighting is approved, the photo, caption, place name, the exact coordinates and your handle become visible to anyone on the internet. The pin sits where the location was set, not approximately.

So do not submit a photo of somewhere you would not want strangers locating, and move the pin off your front door if the heart was at home. The form asks you to avoid faces, number plates and house numbers, and that is why.

Nothing appears automatically. Every submission is looked at by a person first. That review is a check on obvious problems, not a guarantee.

Why any of this is held

• Photo, caption, location, handle: to run the map and the feed, which is the thing you were submitting to. You provide them knowingly and voluntarily, and submitting is the consent.
• Hashed IP: to keep the site usable by limiting how much one person can post, and to keep heart counts roughly honest.

How long it is kept

• Published posts stay until removed, by you or by the person running the site.
• Rejected submissions: the photo files are deleted straight away. A record of the rejection is kept so the same thing is not reviewed twice.
• Hashed IPs live alongside the post for as long as it exists.

Where it is stored

In a Supabase database and file store hosted in Mumbai, India. The site and its images are served through Cloudflare, which has servers in many countries, so images may be cached outside India. Map tiles come from OpenFreeMap and address search from MapTiler; both see the fact that a request was made, and MapTiler sees what you typed into the address search. Cloudflare Turnstile checks that submissions come from a person rather than a script.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to see what is held about you, have it corrected, or have it deleted. You can also withdraw your consent, which means taking your post down.

Email [CONTACT EMAIL] with enough detail to find the post, such as a link to it or roughly when and where it was submitted. There is no account system, so a post cannot be matched to you automatically.

If something is wrong

Complaints go to the Grievance Officer:

[GRIEVANCE OFFICER NAME]
[GRIEVANCE EMAIL]

If you are not satisfied with the answer, you can complain to the Data Protection Board of India.

Someone else's photo or property

If a sighting shows you, your home, your vehicle or something you own, and you want it gone, email the address above. It will be taken down while it is looked at rather than after.

Children

This site is not aimed at children and should not be used by anyone under 18 without a parent or guardian agreeing.

Changes

If this page changes in a way that matters, the date below changes with it.

Last updated: [DATE]