Privacy

Who is responsible

Luca Fries, Lindenstrasse 13, 5632 Buttwil, Switzerland.
hello@safebackpack.app

If you think your data has been handled wrongly, write to that address. You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner, and in the European Union the authority where you live.

The short version

• No account, no advertising, and nothing that follows you from site to site.
• Your email address is used once, to confirm your report, and is never shown to anyone.
• The position you pick is blurred by about 100 metres before it is published, and the exact one is then deleted — not kept until the report expires, deleted the moment it goes on the map. It never leaves our server and does not stay on it either.
• After two months — longer if others confirm it, three months at the very most — your report leaves the map and everything personal in it is deleted.
• If you never confirm the link we email you, the report is never published and is deleted outright. Changing your mind by closing the tab leaves nothing behind.

What we store when you file a report

• Your description, category and time of day.
• The position you picked, and a separate blurred position — only the blurred one is ever served to anyone.
• Your first name and home country, both shown with the report unless you choose to publish without your name.
• Your email address, encrypted, used to send the confirmation link and nothing else.

What happens when it leaves the map

Your report leaves the map and is stripped: the email address, your name and the description are deleted. The exact position is already long gone by then. What remains is the category, the country, a roughly 11 km grid cell, the month and the time of day — figures that cannot be traced back to you and that let us publish statistics later.

A report starts with two months. Each confirmation from another traveller keeps it for a month from the day that confirmation was given, and nothing stays on the map more than three months after it was published.

Technical data

Your network address is never stored as itself. It goes through a keyed hash — a one-way function mixed with a secret only this server holds — and only the result is kept, for at most seven days, to stop one machine flooding the map. It is never linked to your report. Without that secret the result cannot be turned back into an address; a plain hash could be, because there are only about four billion IPv4 addresses and a graphics card works through all of them in minutes.

One cookie is set, and only after you confirm an email address: a signed token that lets you file and confirm reports for 30 days without going back to your inbox. It holds no readable data about you and is not used to track anything.

Measurement

We count page views and page speed through Vercel Analytics and Speed Insights. Neither sets a cookie, neither stores an identifier for you, and neither can recognise you on a later visit or on another site. What they produce is a number of visits per page, not a record of anybody.

Where the data is

Databases and file storage are in the European Union. Email is sent through Resend. Map tiles come from OpenFreeMap and place search from Photon; both see the search terms you type, not who you are.

Your rights

You can ask what is stored about you, ask for it to be corrected, or ask for it to be deleted, at any time and without giving a reason. Write to hello@safebackpack.app.