Privacy Policy

About this project

Mapped Chronicles is an independently operated, free, non-commercial hobby project. For questions about personal information, email support@mappedchronicles.com or use our contact form. We do not sell personal information or use it for advertising. Use of the site is covered by our Terms.

Information we use

When you create an account, Mapped Chronicles processes your email address, authentication records, profile role and status, saved journeys, private draft and submission activity, moderation decisions, and local-import records. Public browsing may produce ordinary security and service logs. A contact or report request records the contact address and information you submit.

Why and where it is processed

We process account details and saved work to provide the features you request (performance of our agreement with you). Security, abuse prevention, moderation, and ordinary support rely on our legitimate interests in maintaining a safe, functioning service. We process rights requests and retain information where necessary to meet applicable legal obligations. An email address and authentication details are required for an account; without them you can still browse and use the guest editor.

Supabase provides authentication and database hosting; Vercel hosts the application; ZeptoMail delivers account emails and passes contact-form messages to our support inbox; Cloudflare provides domain services and forwards incoming support email to a maintained mailbox. The mailbox provider processes that correspondence. Only the information needed for each function is shared. Providers may process information outside the European Economic Area; location and transfer arrangements depend on the provider and service. Contact us for information about the arrangements applicable to your data.

Loading maps and externally hosted images sends requests to their providers, including your IP address and requested resource. The map attribution identifies the tile provider. Following a source link takes you to a separate website with its own privacy practices.

Browser storage and public contributions

Authentication uses browser storage or cookies to maintain your session. Guest bookmarks and drafts are saved in your browser without an application expiry; they are not synchronized to your account unless you use the import process. Clearing browser data can remove them. Other devices retain their own local copies.

Published routes, points, descriptions, and sources are public and may be copied or indexed by others. Private drafts are not public. Do not include sensitive personal information in contributions or reports unless it is necessary for the request.

Account deletion and retention

You can delete your account from your profile by entering your current password and confirming DELETE. This removes your authentication account, profile, saved bookmarks, private drafts and non-current revisions you own, submissions, and account-linked support records. The deletion flow also clears local drafts and bookmarks in the browser used to delete the account.

Currently published routes and their sources remain available with ownership links removed. Deletion does not automatically remove identifying information you wrote inside published text, copies held by other people, separate email correspondence, or provider logs. Contact us to request review of remaining personal information. A retained publication is not a reason to disregard a valid privacy or removal request.

Account information is kept while your account is active. Support correspondence and restricted records are kept only while needed to handle the request, security issue, or applicable legal claim. We currently keep no separate backups of the database; if we add them, deleted data will leave them on their normal retention schedule and this policy will say so. Provider logs follow the applicable service retention. We do not promise immediate erasure of every copy.

Your rights

Submit a privacy request to ask for access, correction, deletion, restriction, objection, or applicable portability. We may need proportionate identity verification. You may also complain to your competent data-protection authority.

This includes the Commissioner for Personal Data Protection in Cyprus. We normally respond to rights requests within one month; if a lawful extension is necessary, we will explain why within that period. Updates to this policy will appear here with a revised date.