Privacy Policy

1. Data we collect

• Account data: when you sign in with Google, we store your name, email address, and profile picture to identify your account and enable features such as saving bookmarks.
• Newsletter subscriptions: if you subscribe, we store your email address and the date of subscription. No welcome or marketing email is sent automatically.
• Usage analytics: Cloudflare Web Analytics collects aggregated, privacy-preserving page-view data (no cookies, no fingerprinting, no personal identifiers).
• Server logs: standard Cloudflare Workers request logs (IP address, browser, referring URL) retained for up to 30 days for security and debugging.

2. How we use your data

• To provide and improve the Site, including personalised features.
• To send newsletter updates (only if you opted in).
• To detect abuse, fraud, and security incidents.
• To comply with legal obligations.

We do not sell, rent, or trade your personal data to third parties.

3. Cookies

We use one cookie, strictly necessary for authentication. We do not use advertising or analytics cookies.

4. Third-party services

• Google OAuth: sign-in provider (Google LLC, USA)
• Cloudflare: hosting (Workers), database (D1), CDN, and privacy-preserving web analytics (Cloudflare Inc, USA)
• Cloudinary: image hosting (Cloudinary Ltd, Israel / USA)
• Upstash: caching (Upstash Inc, USA)

Where these providers are based outside the EU/EEA, transfers are covered by Standard Contractual Clauses or equivalent safeguards.

5. Your rights

Under GDPR and the Philippine Data Privacy Act you have the right to:

• Access: request a copy of data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing for marketing purposes.
• Withdraw consent: unsubscribe from newsletters at any time.

To exercise any of these rights, email privacy@springsatlas.com. We will respond within 30 days.

6. Data retention

• Account data is retained while your account is active. Deletion requests are processed within 7 days.
• Newsletter emails are removed within 24 hours of unsubscription.
• Server logs are purged after 30 days.

7. Security

All data is transmitted over TLS. Database credentials are stored as Cloudflare Workers secrets and never committed to source code. We conduct regular dependency audits and apply security patches promptly.

8. Children

SpringsAtlas is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us for immediate removal.

9. Changes to this policy

We may update this policy periodically. Significant changes will be announced via a site notice. The "Last updated" date at the top of this page always reflects the current version.