Privacy Policy
This policy explains what personal data HatSpotted processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). We collect as little as possible.
Controller
HatSpotted is run as a private, non-commercial fan project. Contact for all privacy matters: hatspootter1@gmail.com.
What we store
- Account: e-mail address, display name, preferred language, role (user/admin), account creation time and, if applicable, the time an account was banned. Your e-mail address is never shown publicly. If you use a password, it is stored only as a secure one-way hash by our authentication provider – we can never see it.
- Sightings: the photo, the location you chose (latitude/longitude, plus the city and country derived from it), the sighting time, your description, when it was posted and when you gave consent to display the photo.
- Reports: which sighting you reported, the reason and when.
- Technical data: our authentication provider keeps sign-in logs (such as IP address and time) for security. We do not use analytics or advertising trackers.
Photos are re-encoded on upload and all embedded metadata (EXIF), including GPS coordinates and camera details, is removed before storage. Only the location you pick on the map is published.
Why, and legal basis
- Providing your account and publishing your sightings – performance of our agreement with you (Art. 6(1)(b)).
- Displaying your photo – your consent, given with the checkbox when you publish (Art. 6(1)(a)). You can withdraw it at any time by deleting the sighting.
- Moderation, abuse prevention and security (reports, bans, rate limits, logs) – our legitimate interest in a safe site (Art. 6(1)(f)).
Who else processes data
- Supabase – database, authentication, photo storage (data processor).
- Our web host – runs the site and receives standard request data such as IP addresses.
- Google – only if you choose “Continue with Google”; Google then confirms your identity and e-mail to us.
- OpenStreetMap – map tiles are loaded from OpenStreetMap servers (which see your IP address), and coordinates/search terms are sent to the Nominatim service to look up place names.
Some of these providers may process data outside the EU/EEA. Where that happens, transfers rely on the EU Commission’s standard contractual clauses or an adequacy decision.
Retention
Data is kept until you delete it. Deleting a sighting removes it and its photos; deleting your account (on “My page”) permanently removes your profile, all your sightings, photos and reports. Backups held by our providers are overwritten within their normal cycles.
Cookies and local storage
We only use strictly necessary cookies: to keep you signed in and to remember your language. No consent banner is needed for these, and we use no tracking cookies.
Your rights
You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent. You can edit or delete your sightings and account yourself on “My page”, or contact us at hatspootter1@gmail.com. You may also lodge a complaint with your data protection authority – in Sweden, Integritetsskyddsmyndigheten (IMY).
Children
You must be at least 13 years old (or the age required in your country) to create an account. Please do not upload identifiable photos of children without their guardian’s consent.
Last updated: