Privacy Policy

• • We set no cookies on visitors. Browse the whole map without an account and nothing of ours is written to your device. That is why you see no cookie banner.
• • We have no passwords. You sign in with a link sent to your email, or with Google.
• • What you post is public. Spots, photos and comments are visible to everyone, by design — that is the point of a shared map.
• • We never sell your data, never run ads, and never track you across other websites.
• • Ask us to delete your account and everything in it, and we will.

Sea Glass Map (https://seaglassmap.com) is published by Room 46 LLC, 1021 E Lincolnway, #8138, Cheyenne, WY 82001, United States. Under the GDPR, that company is the data controller for everything described here.

For anything at all — a question, a correction, a deletion — write to hello@seaglassmap.com. A human reads it.

If you only browse: nothing that identifies you. Our analytics keep no cookie and no identifier on your device, so we measure visits, not people (more on that below). Our hosting provider processes your IP address for the seconds it takes to serve the page, as any web server must.

If you create an account: your email address, and the display name you choose. Optionally — only if you fill them in — a profile photo, a short bio, and a home country. If you sign in with Google, we receive your email, name and profile picture from Google; we never receive your Google password.

What you publish: the spots you drop (their title, your notes, the beach's coordinates, the sea glass colours and quantity you saw, how hard it is to reach), the photos you upload, the comments you write, and the spots you save. All of it is public.

Photos carry metadata. A photo taken with a phone often embeds the exact GPS position and time it was taken. We store your photos as you send them, so that metadata travels with them. Strip it before uploading if the picture was taken somewhere you would rather not disclose.

This deserves saying plainly: when you drop a spot, you publish precise coordinates on a public map, attached to your display name. Never drop a spot on your own home, a private property, or anywhere that would reveal where you live. Once a spot is public, other people may have already seen it, screenshotted it, or shared the link — even if you delete it afterwards.

• • Performing our agreement with you (Art. 6(1)(b) GDPR): your account, your spots, your comments. Without them there is no service to give you.
• • Our legitimate interest (Art. 6(1)(f)): keeping the site up, keeping it free of spam and abuse, and understanding — in aggregate, without identifying you — which parts of it work.

We use PostHog, on its European cloud, to see how the site is used: which pages are opened, whether people find a spot, where they abandon the form for adding one. It runs in a deliberately crippled mode — no cookie and no local storage — so a visit cannot be linked to a previous one, and you cannot be recognised when you come back. We do not record your screen and we never send the text you type into the search box.

We also use Vercel Analytics, which counts page views without cookies either.

The map itself is served by Mapbox. Their library stores a random identifier in your browser's local storage and sends them anonymous usage data about how the map is panned and zoomed. We do not control that and we cannot switch it off for you — but you can: open the ⓘ button in the corner of the map and choose the telemetry setting. Mapbox's own privacy policy governs what they do with it.

We use a small number of providers, each for one job, each bound to process data only on our instructions:

• • Supabase — the database, the accounts, and the photo storage. Your data is hosted in its Singapore (ap-southeast-1) region. Supabase also sends your sign-in links.
• • Vercel — hosting and delivery of the site (United States).
• • PostHog — analytics, on their European cloud.
• • Mapbox — the map (United States).
• • Google — only if you choose to sign in with it.

Your data leaves Europe, and you should know it. Accounts, spots and photos live on Supabase's Singapore (ap-southeast-1)servers; Vercel and Mapbox are in the United States. Singapore has no adequacy decision from the European Commission, so those transfers are covered by the Commission's Standard Contractual Clauses, agreed with each provider; the American ones also rely on the EU–US Data Privacy Framework where it applies.

We will also disclose data if a law or a court obliges us to. We will not do it quietly if we are allowed to tell you.

There is no cookie banner because there is nothing to consent to. The only cookies involved are the ones that keep you signed in after you log in, and the security cookies our providers set to block bots. Both are strictly necessary to deliver a service you asked for, which is exactly the case the law exempts from consent.

Your account and what you posted stay until you delete them. Delete a spot or a comment and it goes; delete your account and we remove your profile, your spots, your photos and your comments. Analytics events, which are not linked to you, are kept for up to 12 months and then rolled up into anonymous totals.

Under the GDPR you can ask us for a copy of your data, correct it, delete it, take it elsewhere, or object to how we use it. Write to hello@seaglassmap.com and we will answer within a month. Most of it you can also do yourself, from your profile.

If you think we have handled your data badly, you may complain to your national data protection authority — in France, the CNIL. We would rather you told us first, and gave us the chance to fix it.

Sea Glass Map is not intended for children under 16. If you believe a child has created an account, tell us and we will remove it.

If we change how we handle your data, we will update this page and move the date at the top. If the change is significant, we will tell account holders by email rather than hope they notice.