Privacy

Who runs this site

Evie and Chloe run this site so the people they care about can follow their trip, and Lewis helps them look after it. Anyone with the link can see the postcards. The site is kept out of search engines, so people find it through the link alone. There are no adverts, nothing is sold, and your details are never passed to anyone for their own use.

What we keep

If you only look around

The site keeps nothing about you, apart from the short technical logs that the services below keep for any website. Your browser remembers a few settings for this device, such as Calm mode, and keeps copies of pages and photos so they load faster (more about those below).

If something goes wrong on a page, the site keeps a note of the error, the page it happened on and the kind of browser, such as Chrome on Android, so Evie, Chloe and Lewis can put it right. The note says nothing about who saw it: no name, no email address, no internet address.

If you sign in

• Your name, as it appears next to your hearts and postcards back. It starts as the first name your Google account gives, the name on your personal link, or “Friend” if you sign in with an email code. It never comes from your email address, and you can change it in Settings.
• Your email address, if you have given us one. New-post emails go to the address you sign in with; only if you use a personal link without one can you give an address for them in Settings.
• The details that keep you signed in (more about those below), and when you last visited.
• The hearts you leave on the postcards, and the postcards you send back.
• Your notification choices: an email for each post, one a day or none (new accounts start with none), and the time zone your browser reports, so a daily email reaches you at 8am where you are.
• If you turn on notifications on a phone or computer, that device’s push subscription. This is an address your browser gives us so we can send it a ping, kept with a note of the kind of browser it came from, such as Safari on an iPhone. It holds no name or email address.
• A record of the emails and notifications sent to you, so nothing is sent twice.
• If you ask for an email code, a record of the request: your email address, the time, and a scrambled code worked out from your internet address, never the address itself. It lets the site limit how many codes one visitor, or one address, can ask for in an hour.
• When you type a code in, the same kind of record of the try, so that nobody can guess at a code for long: after a few wrong codes, an address rests for 15 minutes. A right code clears it.

About the trip

• The photos and short clips Evie and Chloe share. The copies you see have their GPS location removed.
• The name of each place they visit and a point on the map for it. When a post is set to town only, everyone else sees only the town or city, and the exact spot stays with Evie, Chloe and Lewis.
• Where home is. It is used to work out the distance travelled. Its exact spot is never shown to visitors or members. If a first post has no place of its own, it is put at home, under the name set for home and at the town, not the exact spot. Only Evie, Chloe and Lewis can reach the exact spot, in Studio, where they set it.
• If they choose to back up their original files, those keep their details, and only Evie, Chloe and Lewis can reach them.

Signing in and cookies

You don’t need to sign in to look around. Signing in lets you react, send postcards back and hear about new postcards. There are no passwords. There are three ways in:

• Continue with Google. Google shares your name, email address and profile picture with the site’s sign-in service, which keeps what Google sent. The site shows only your first name, and never your picture. Your account is made the first time.
• A 6-digit code sent to your email address. Asking for a code makes your account the first time (if you never use the code, the account is deleted again, as explained below).
• A personal link, if you were sent one. Opening it signs you in on that device and leaves a cookie, so you stay signed in.

We only use the cookies needed to sign you in and keep you signed in. Your browser also remembers a few settings for this device, such as Calm mode, and whether it was signed in last time, so it can tidy up after you sign out. There are no advertising or analytics cookies, and nothing follows you around other websites.

The site also keeps a copy of its own code in your browser, so it opens quickly and can show a simple page when you’re offline. Pages and photos you have looked at are kept there too, for up to a month, so they load faster next time. They stay on your device, and when you sign out, or are signed out, the copies that could be private are cleared.

Who can see what

Anyone with the link can see the postcards, photos and clips, and the hearts and postcards back on them, with the name of whoever sent each one, and any answer from Evie or Chloe under a postcard back, with the name of whoever wrote it. Nobody sees your email address except Evie, Chloe and Lewis, who look after the site and can also see when each person last visited.

Photos and clips are not public files. Each one reaches you through a private link that stops working after six to twelve hours, so a copied link soon goes dead. The photo in a new-post or daily email has a private link that lasts about a week instead, so it still shows when you open the email later.

Services that help run the site

These services handle data for us, and only to do their job for this site:

• Supabase keeps the database and handles signing in, on servers in Ireland.
• Vercel runs the site and keeps the photos and clips in a private store in London.
• Mapbox draws the street map when you dive down to a place. Your browser fetches the map from Mapbox directly, so Mapbox sees your device’s internet address, as any website would.
• Google, only if you choose Continue with Google.
• Gmail sends the site’s emails: sign-in codes, new-post and daily emails, and alerts to Evie, Chloe and Lewis about new postcards back, and a word to you when Evie or Chloe answer yours. For now they come from Lewis’s own Gmail address.
• Open-Meteo provides the weather at the latest stop. The site asks for it, not your browser, so Open-Meteo never sees you.
• OpenStreetMap’s Nominatim service turns map points into place names. A post’s exact spot is sent to it when Evie or Chloe pick or save a place, even if the post is set to town only and only the town is shown. Home’s exact spot is sent too, if a first post has no place of its own. Nothing about you is sent to it.

If you turn on notifications, they travel through your browser maker’s push service, such as Apple’s, Google’s or Mozilla’s. Each one is encrypted for your device, so the push service can’t read what it says. Like any website, these services keep short technical logs, such as internet addresses and the times of visits, to keep things running safely.

How long we keep things

We keep your details for as long as you have an account. If you are removed, you are signed out and can no longer react or send postcards back, though you can still look around like anyone with the link. Your past hearts and postcards back stay with the postcards unless you ask us to delete them. If you ask, we delete your details and everything you’ve left. If the site closes, everything in it is deleted.

The record of an email code request is deleted once it is two days old, and the record of a try at a code once it is a day old. If you ask for a code and never sign in, the account made for your address is deleted once it is a day old. A clean-up runs every eight hours, so each can take a little longer.

A device’s push subscription is deleted when you turn notifications off on it, when you sign out on it, or once your browser’s push service tells us it has stopped working.

Notes of errors are kept until they have been dealt with and room is needed for newer ones: the site keeps 500 at most.

Your choices

• Look around without signing in at all.
• Turn new-post emails on or off, or choose one a day instead, in Settings.
• Use the “stop these emails” link at the foot of any new-post or daily email. It works without signing in.
• Turn notifications on or off for a phone or computer in Settings on that device, or in your browser’s own settings.
• Sign out in Settings, on each device you signed in on.
• Ask Evie, Chloe or Lewis to change or remove your details.

For anything on this page, message Evie or Chloe, or email Lewis at lewishadden@gmail.com.