Privacy

Why there is an account at all

Signing in exists for one reason: to attach an identity to an observation, so that one person cannot report the same route twenty times in a day and so that a record of past accuracy can weight what a report is worth. It is not a profile, not a social graph, and not a mailing list you were added to.

You can read every page on this site without an account.

What signing in with Google hands over

The Google button requests the three basic scopes — openid, email and profile. That returns your email address, your Google account identifier, your display name and your profile picture URL.

It does not request and cannot reach your Gmail, Drive, Contacts, Calendar, Photos, or anything else in your Google account. This site never receives your Google password, and it stores no Google credential beyond the token record Auth.js keeps to recognise you on your next sign-in.

Google sign-in is optional. The alternative is a sign-in link mailed to your address, which needs an account with nobody.

What is stored on your account

• Your email address. Required — it is how you sign in.
• A display name and profile image URL, if a sign-in provider supplied one.
• When the account was created, and when it was last seen.
• An internal weighting derived from how your past reports compared with everyone else’s. It is never shown to anyone, including you, because a visible score turns observation into a game.
• Which version of the scope notice you acknowledged, and when.

There is no password field anywhere in this application. A credential this system never holds is a credential it can never leak.

What is stored because you posted it

• Observations: the route, the date, what you saw, and the vantage point you claimed.
• Photos attached to an observation — see below.
• Votes on other people’s observations.
• Corrections and feedback, including anything you typed into the box. These are mailed to the person who runs this site.
• Email subscriptions: which venue, area or route, and an unsubscribe token so a single click works without signing in.

Photos, and the location inside them

A phone photo carries GPS accurate to a few metres. A season of uploads from one person therefore describes where they go and when, which this site has no business retaining.

So an uploaded photo is handled like this:

• The capture time and GPS are read once, in memory, to answer two questions: when was this taken, and was it taken near the route it is attached to?
• The coordinates are then discarded. They are never returned from the module that read them, never logged, and never written to the database. What is kept is two booleans — whether there was GPS at all, and whether it was within two kilometres of the route.
• The image itself is re-encoded before storage, which drops every metadata block rather than merely hiding it from the page. Hiding EXIF in the interface is not stripping it: an image served with its original bytes hands the location to anyone who downloads it.

Photos are stored privately and served through this site’s own endpoint, which re-checks moderation status on every request.

Cookies and measurement

One cookie: the session cookie that keeps you signed in. There is no advertising cookie and no cross-site tracker.

Page views are counted with Vercel Web Analytics, which is cookieless, does not fingerprint the browser and does not follow anyone across sites. It reports how many people opened a page, not who they were.

Who else touches the data

Only the services this site is built on, and only to do the job they are there for:

• Vercel — hosting, photo storage and the page-view count.
• A managed Postgres provider — the database.
• Resend — delivery of sign-in links and subscription mail.
• Google — only if you choose the Google sign-in button.

Nothing here is sold, rented, traded, or handed to an advertiser or data broker. There is no such arrangement and there is not going to be one.

Keeping it, and getting rid of it

Account data is kept while the account exists. Observations are kept as long as they are useful to the model, which is the point of collecting them — a formation date from three winters ago is what calibration is made of.

To see what is held about you, correct it, or delete the account and everything attached to it, mail oryfrazier@gmail.com. There is no self-serve delete button yet; the request is handled by a person, and deletion removes the account, its observations and its photos.

Email subscriptions can be stopped without any of that, from the one-click link at the bottom of every message.

Children

This site is not directed at children under 13 and accounts are not knowingly created for them.

Changes, and how to ask

If what this page describes stops being true, this page changes with it, and the date at the top moves. Questions go to oryfrazier@gmail.com, or through the feedback form.

What this site does and does not claim about ice is a separate question, answered in the terms of use.