Privacy policy

Who we are

No Mylar Left Behind is a project that maps foil balloons found in nature and packed out. It is run by CaliCoders LLC.

When you sign in

You can browse the site without an account. Signing in is only needed to add finds, and for now only site admins can add them.

Sign-in goes through Google or Apple, handled by our sign-in provider, Supabase. Supabase receives and stores what that account shares with us: your email address, the account's ID, and usually your name and a link to your profile picture. We never show that name or picture on the site. Supabase also keeps a record of your sign-in sessions, including your IP address and browser, for security.

If you sign in with Apple, we also keep the sign-in token Apple gives us, so that when you delete your account we can tell Apple to revoke it. We don't use it for anything else.

Each account gets a randomly generated display name, like an adjective and an animal. You can't set it, and it never uses your real name. Only you see it, in the header while you're signed in.

Joining the beta

If you join the beta from the form at the bottom of the page, we store the email address you enter and the date you signed up. You don't need an account to join.

We use that address only to invite you to the beta and send you updates about it. We never show it on the site or share it with anyone else. For now we don't send any email automatically.

To limit spam, the site briefly counts sign-ups from each IP address in its memory. It doesn't store your IP address with your sign-up.

To be removed from the list, email us at the address below.

Finds and photos

When a find is added, the photo is uploaded, processed into smaller copies, and then the original upload is deleted. Any uploads left over from an unfinished attempt are deleted automatically within about a day.

Processing removes all metadata from the photo, including the camera details and the GPS position. The location of the find is stored separately in our database.

The location comes from the photo's own GPS data, from your device's location if you tap "Use my current location" (your browser asks first), or from the spot you tap on the map.

What everyone can see

A new find stays off the public site for 24 hours, so nobody can see where it was found in real time. The person who added it can choose to show it right away instead.

Once a find is public, anyone can see the photo, its exact spot on the map, the number of balloons and the day it was published. The site never shows the time of day a find was added.

Nobody can see who added a find. Your email, account ID and display name are never shown to other visitors.

When a find is removed, we delete it and its photos. Browsers and networks may keep cached copies of a photo for up to a year, so a removed photo can sometimes still appear for people who viewed it before.

Services we use

Supabase stores the database (including beta sign-up emails), the photos and sign-in accounts. Your browser loads the photos and some sign-in settings directly from Supabase, so Supabase also sees your IP address and browser type.

Vercel hosts the website. Like any web host, it logs requests, including your IP address and browser type.

The map is drawn from OpenStreetMap. Your browser loads the map tiles straight from OpenStreetMap's servers, so they see your IP address and which part of the map you view.

Cloudflare Web Analytics counts visits to the site: which pages are viewed, the referring site, how fast pages load, and the visitor's country and browser type. Your browser loads its script from Cloudflare and reports each page view there, so Cloudflare also sees your IP address. It doesn't use cookies or identify individual visitors.

We don't sell your information or share it with advertisers.

Cookies

The site sets cookies only when you start signing in, to complete your sign-in and keep you signed in. Signing out removes them.

We don't use advertising or tracking cookies. Our visitor counts, from Cloudflare Web Analytics, don't use cookies either.

Keeping and deleting your information

We keep your account, your finds and your beta sign-up until you or we delete them.

You can delete your account yourself, while signed in, on the Delete your account page (linked at the bottom of every page). That deletes the account, its sign-in details and display name, and any unfinished uploads, revokes your Apple sign-in token if you have one, and signs you out. Finds you added stay public, with no link to you.

To see what we hold about you, to have a find or your beta sign-up deleted, or to delete your account if you can't sign in, email us at the address below.

Changes to this policy

If what the site collects changes, we'll update this page and its effective date.

Contact

Email privacy questions and deletion requests to info@calicoders.com.