LEGAL
Privacy statement
This statement describes the personal data this application handles, why it is handled, how long it is kept and what you can ask us to do with it. It covers the public map, the published inventory, the free account workspace and the subscription service.
The controller for your data
The controller is the operator of this site.
- Controller
- [operator name and postal address]
- Privacy contact
- [privacy contact email]
This statement covers this web application and the account service behind it. It does not cover the third-party services listed in section 8, each of which publishes its own statement.
Data held by the account service
An account is optional. The public map and the published inventory work without one, and no account record is created until you register.
| Record | Detail |
|---|---|
| Email address | Stored in lower case, so one address always resolves to one account. |
| Display name | Optional. When it is left blank, the part of your email before the @ symbol is used instead. |
| Password | Stored only as a value derived by scrypt with a random 32 byte salt. The plaintext password never reaches the database, and the stored value cannot be turned back into it. |
| Session record | A session identifier, your workspace, a SHA-256 digest of the refresh token, the issue time, the expiry time, and the time of any rotation or revocation. |
| Browser user agent | Kept on the session so you can recognise your own sessions. It is truncated to 400 characters. |
| Workspace membership | Which workspace you belong to, and your role in it. |
The session record does not hold your IP address. That is a deliberate choice, because a client address is personal data and there is no operational need for it in that table.
Location handling
Device location is used when the location button is selected, and only if an express permission to do so has been given through the browser. If permission is denied then no location will be retrieved from the network address.
Within a browser, present location coordinates are used to centre the map, mark where carbon emissions analysis is performed based on what the published map data says. Coordinates are not transmitted to account service nor stored in any database. Saved places are stored in local browser storage and are never uploaded. Coordinates are based on the WGS84 geographic coordinate system.
Carbon emissions analysis for a selected point on the map are explored without revealing the coordinates of that point to anyone. All visitors get access to the same published map data and spatial analysis methods.
Browser storage and cookies
The application sets one cookie and writes two entries to local storage. There is no advertising cookie and no analytics cookie.
| Name | Kind | Purpose | Kept for |
|---|---|---|---|
| co2locality_refresh | Cookie, httpOnly, SameSite=Strict, path /v1/auth | Renews a signed-in session. It is not readable by a script on the page. | 30 days, or until you sign out |
| co2locality:map-background | Local storage | The map background colour you selected. | Until you clear site data |
| co2locality:saved-places | Local storage | The places you saved, with their name, coordinates, radius and boundary shape. | Until you clear site data |
An access token is held in the memory of the page for 15 minutes and is discarded when the tab closes. It is never written to local storage or to a cookie.
Request budgets and service logs
The API uses a request budget to keep the service working. Budget is tracked in the memory of the API process, indexed by client address. When the process starts again, it is thrown away and never written to the database.
Every request carries an identifier. An identifier returned in a response header and in an error message so that a reported problem can be associated with the request that caused it.
An error that the service cannot process is logged in the service log with this identifier. It removes credential values from a message before it gets logged, checks the message against a known shape list of secrets and compares against both the raw name and also those which are configured to be part of secrets.
There is no record of page views or samples of pages you have opened. The pages of data that we publish are delivered without any consideration for who is reading them.
Subscription and payment data
A free account needs no payment detail. A subscription is only created after a payment is confirmed by the payment provider, and the records below are what the service keeps.
| Record | Detail |
|---|---|
| Plan and state | The plan you are on and its current state, such as active, past due or cancelled. |
| Usage count | The number of metered actions taken against the plan allowance. |
| Price identifier | The identifier of the price you agreed to. It resolves the plan, so the plan and the amount cannot disagree. |
| Provider customer identifier | The identifier the payment provider issued. It is needed to open the billing portal, which is where a subscription is cancelled. |
| Checkout attempt | The plan, the quantity, the amount and the outcome of a checkout attempt. |
No card number, expiry date or security code is stored. Payment details are entered on the payment provider's own page and never reach this application.
Activity records and calculations
The workspace lets you record an activity and calculate a footprint from it. If you use that, the service stores the asset, the start and end of the interval, the quantity, the unit, the activity type, the source status, an optional evidence reference and the time the record was received.
A calculation stores the conversion factors it applied and the vintage of each one, so a result can be explained later rather than only reported.
An account with no recorded activity holds no activity record. Nothing is inferred from your map use.
Third-party services
Four kinds of request leave this site. Each one is listed with what it carries and when it happens.
| Service | What it receives | When |
|---|---|---|
| OpenFreeMap | The map area you are viewing, and your network address. | When the map loads, and as you pan or zoom. |
| Groq, or Google Gemini as the fallback | The text of the messages you send to the assistant. | When you send an assistant message. |
| DeepSeek, or OpenAI | The text of the messages you send to the assistant. | Only when a paid plan has selected that provider and the owner has enabled paid providers. Both are disabled by default. |
| The payment provider | Your email address, the plan and the amount. | When you start a checkout or open the billing portal. |
Mathematical notation on the Science page is rendered inside your browser from files served by this site. No remote rendering service is contacted. No analytics script, advertising script or third-party error reporter is loaded.
Purposes and lawful bases
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating an account and signing in | Email address, display name, password derived value, session record. | Performance of a contract with you. |
| Serving the map and the published inventory | Nothing beyond the request itself. | Legitimate interests in publishing the data. |
| Keeping the service available | Client address, held in memory for request budgets. | Legitimate interests in preventing abuse and outages. |
| Taking and managing payment | Subscription and checkout records, provider customer identifier. | Performance of a contract, and a legal obligation for accounting records. |
| Answering an assistant question | The text of the message you send. | Performance of a contract, when you use that feature. |
Processing based on legitimate interests is limited to what keeps the service working. You can object to it, as described in section 12.
Retention periods
The retention plan records a period for each class of record. It is defined in the pipeline as a policy with a number of days per class.
| Record | Period |
|---|---|
| Account and session records | For as long as the account exists. |
| Serving and analytics records | 30 days in serving, 365 days in analytics. |
| Assistant conversation traces | 90 days. |
| Encrypted backups | 90 days. |
Deletion is carried out when you ask for it. A copy that is already inside an encrypted backup is not rewritten, because doing so would defeat the purpose of the backup. That copy ages out on the backup schedule and is not used for any other purpose in the meantime.
Security measures
- Passwords are hashed with scrypt and a random 32 byte salt. You only save the derived value.
- The application role is not able to read the credential table. Each function resolves one email at a time so, even if the sign-in path is broken, it cannot return all stored values simultaneously.
- Refresh tokens reside in the form of SHA-256 digests. One can not replay a copy of that table into a functioning token.
- Since a second presentation of the refresh token means that it was captured or reused, this ends the session.
- Each private row comes with its own workspace identifier and row level security is enforced on the table owner as well as other roles.
- Since this is the session cookie, it has httpOnly and SameSite=Strict, so a script on the page cannot read it and a cross-site request does not carry it.
- The credential values are stripped from a message prior to logging it.
Your rights
Subject to the law where you live, you can ask to:
- receive a copy of the personal data held about you
- have anything inaccurate corrected
- have your account and its records deleted
- receive a portable export of your activity records
- object to processing that relies on legitimate interests
- complain to your data protection authority
A request goes to the privacy contact in section 1. It is answered within the period the law allows. You do not have to give a reason to receive a copy of your own data or to close an account.
Analytics and advertising
This application runs no analytics, no advertising and no tracking pixel. No third-party analytics script is loaded and no profile of your browsing is built. The published data pages set no cookie at all.
A page view on the public site is a request for a document. It is not counted, attributed or joined to any other record.
Children
The service is intended for professional and general public use and is not directed at children. An account is not knowingly created for a child, and a request to delete such an account is honoured without question.
International transfers
Map tiles and assistant replies are served by providers that may process a request outside the United Kingdom and the European Economic Area. Where that happens, the transfer relies on the safeguards the provider publishes in its own terms.
The account service and the operational database run on the host that serves this site, so an account record is not transferred by this application to another country.
Changes to this statement
A change to this statement is published on this page with a new version number and a new effective date. A change that alters what is done with your data is described in the summary at the top of the page rather than only in the section that was edited.
Contact
Privacy questions, rights requests and security reports all go to the privacy contact named in section 1. A security report is acknowledged and the reporter is told what was found.