Privacy policy

Draft not yet reviewed by a lawyer. Fields in square brackets must be completed.

Data controller

[Name or company], [address], gaiaspaceweb@gmail.com.

What data we process

• Account data: e-mail address, password (handled by Firebase Authentication; GAIA never sees it) or, if you sign in with Google, the name, e-mail and profile photo provided by Google, public name, optional avatar, sign-up date.
• Reports: category, date and time of the observation, the place name you choose, a position rounded to a cell of about 11 km, direction, duration, colours, description, optional photos and video links.
• Precise position: only if you choose to share it; it is stored separately and never published.
• Anti-abuse data: a non-reversible hash of the network you submit from, computed with a secret key; counters of submissions per account.
• Content reports: the reason and optional note you send to moderators.

Photos are resized in your browser before upload: this removes EXIF metadata, including the GPS coordinates added by smartphones.

Why and on what legal basis

• Providing the account and the features you request (performance of the service).
• Comparing reports and publishing anonymously those confirmed by the community (performance of the service; consent for publishing photos).
• Preventing abuse, spam and manipulation (legitimate interest).

What becomes public

Only sightings that reach the community threshold: place names, approximate area, times, anonymous excerpts of descriptions and, if you allowed it, photos and videos. Your name and e-mail are never linked to a public sighting.

Providers processing data on GAIA's behalf

• Google Firebase (Authentication and Cloud Firestore) — accounts and report data. Data region: [to be specified, e.g. europe-west].
• Netlify — website hosting and photo storage (Netlify Blobs).
• OpenStreetMap Nominatim — when you search for a place, your search text is sent from your browser to the OpenStreetMap service.
• News images are loaded directly from the publishers' servers (NASA, ESA), which can see your IP address.

How long

Account data and reports are kept until you delete your account. Anti-abuse counters reset daily. [Specify retention of providers' technical logs.]

Your rights

You can access, correct, port or delete your data, object to processing and lodge a complaint with your data protection authority. You can delete your account from the Profile page: profile, reports, precise positions and uploaded files are deleted, and sightings you contributed to are recomputed without your contributions.

Minors

[State the minimum age for registration and how it is checked.]