Privacy

Version: 2026-11-01. The production contact and backup retention period are pending. The service is still under acceptance review.

Sign-in protection

Sign-in protection keeps short-lived account digests and shared source counters, not passwords or raw IP addresses. Expired counters are removed during subsequent sign-in processing. Deleting an account also removes its account counter.

Data we collect and use

An account stores your name, email and password hash. Birth year, birth month, gender and region are optional. We do not collect your full date of birth. Data supports sign-in, profile settings, points, badges, footprints and evidence reviews.

Notifications and evidence review

Newsletter subscription is off by default and can be changed in your profile. Purchase-proof submissions retain images, notes, review results and review requests. Reviewers may use AI tools such as Codex to inspect relevant information; processing is not entirely offline. Confirm this before uploading. Hide unnecessary personal information such as payment card numbers and addresses.

Social sign-in and website analytics

Google and Facebook sign-in are available only after the operator configures and enables them. This site does not store provider access tokens; it stores the linked provider and identity code. Accounts with the same email are not merged automatically. Existing fan accounts must be confirmed with a password. Incomplete linking data expires after 10 minutes and is cleared when a subsequent social sign-in begins. Linked data is deleted with the account. GA4 is off by default. Even after configuration, it loads only after explicit consent in analytics preferences. Declining does not affect member features. Only public page views are processed; names, emails, account IDs and URL query strings are not sent. Third-party retention and deletion procedures must be announced before activation.

Marketing emails

We store the latest successful sign-in time for 90-day reminders. When SendGrid is enabled, subscribers’ email addresses and messages personalised with their name and level are sent to that provider. Delivery, open, click and unsubscribe events are received. This site stores event types and times, not raw IP addresses, devices or full clicked URLs. Machine opens are excluded from open rates; privacy features may make records incomplete. Unsubscribing does not affect membership or points. Pending messages are skipped; messages already accepted may still arrive. Provider retention and deletion procedures must be announced before live activation.

Location and your data rights

Location is checked only during footprint check-in. We do not continuously track you or retain your raw coordinates. Export your data and images from your profile, or verify your identity to delete all personal records.

Deleting all account data

Confirmed deletion permanently removes your account, personal details, points, growth, badges, footprints, evidence images, appeals and related personal records. No anonymous collection is retained. Offline backups expire under the announced retention policy; that period must be published before public launch.

The service contact has not been configured. For now, contact the team through itsofficial social account. This notice describes current functionality and must be updated when operational details are confirmed.