Privacy Policy

• We collect what we need to run your account and show your contributions.
• What you post is public by design, with your display name, date and place attached.
• We strip embedded location data from photos and media before they're public.
• Posts are checked automatically for explicit or graphic content before they're published.
• We don't sell your personal information or use it for targeted advertising.
• We use Google Analytics to count visits and see how people find Vigil. In the EU, the UK and Switzerland it runs only if you accept, and anyone can turn it off from Cookie settings.
• You can remove what you post, or delete your account and everything you posted, at any time.

Information you give us:

• Account details: your email address and password. Passwords are stored in hashed form by our authentication provider; we never see them.
• Profile details: your username, your first name and, if you give it, your last name, whether your name is shown, and optionally where you're based.
• If you link Discord: your Discord user ID and username.
• Your email preferences, such as whether you want our newsletter.

Content you post: field reports, photos, audio, video, comments, questions, answers, reactions, activity levels, saved locations, follows, location suggestions and flags, along with the place, date and time and any coordinates you attach. A report from somewhere else also holds the spot you mark on the map.

Information collected automatically: your IP address, browser and device type, and the pages and actions you request, which appear in server logs, including any errors, and are used for security, rate limiting and preventing abuse. When you create an account, sign in or ask for a password reset, and when you post, flag a post or answer a question on a location page, a bot-protection check collects technical signals from your browser and device to tell people from automated programs.

Error reports: when a page or request fails, we send a report of the error to Sentry, our error-tracking provider, so we can fix it. A report holds the error message and where in our code it happened, the page address with any codes removed, your browser and device type, your approximate location (country and city), and the pages and requests just before the error. It doesn't include your name, email address, account, cookies or anything you type or post, and Sentry doesn't store your IP address.

Visit statistics: we use Google Analytics to understand how Vigil is used: the pages viewed and how long visits last, the website or link that brought someone here (including the campaign tags on links we share), the browser, device type and approximate location (country and city), and a few actions, such as creating an account, posting a report, answering a question about a place, sharing a place or following a link to another site. Google Analytics sets cookies that recognize a browser when it comes back to Vigil. We don't send it your name, email address, account or anything you post, and we remove sign-in and password-reset codes from page addresses before they're sent. We look at the results as totals and trends.

Invitations: if you join from a member's invite link, we record which member invited you. They see that you joined from their link, and it counts toward a badge on their page. Nobody else sees who invited you.

Photos, video and audio files often contain hidden metadata, including the exact GPS location where they were recorded and the device used. We remove that metadata before your media is published. Video is also resized on your device before it uploads. The place and any coordinates you choose to attach to a report at a place are public, and so is anything you can hear or see in a recording, including voices.

When you report from somewhere else, the exact spot you mark stays private: other people see only what you choose, an area about a mile across, the exact spot, or the town alone. Reports at a home or on private property show only the town. Our moderators can see the exact spot when they review a report. We work out the town on our own servers, and the spot isn't sent to a mapping service.

Before a post is published, a content moderation provider checks it automatically for explicit or graphic content. It sees the text of your post, a reduced copy of each photo and a few still frames from each video, with location data already removed, but not your email address or account details. Audio isn't checked automatically. A post with explicit sexual content isn't published. A post with a photo or video that may show graphic violence is held until a person reviews it. Decisions about your account, such as suspending it, are made by people.

We use cookies and browser storage for four things:

• To make the Service work: cookies that keep you signed in and protect your session, and browser storage for preferences such as your theme.
• To remember your cookie choice: a cookie that records whether you accepted or rejected visit statistics, kept for a year, and a cookie that tells the page whether you're visiting from a place where we ask first, which ends when you close your browser.
• To credit an invitation: a cookie that remembers which member's invite link brought you here, kept for 30 days.
• Visit statistics: Google Analytics cookies (named _ga and _ga_ followed by a code), which last up to two years unless you turn them off.

Your choice: if you're in the European Economic Area, the United Kingdom or Switzerland, we ask before Google Analytics runs, and it doesn't load until you accept; there, it runs on your consent, which you can withdraw at any time. Everywhere else it's on by default. Wherever you are, you can accept or reject it at any time from Cookie settings at the bottom of every page. When you reject it, we stop sending visit statistics and remove the Google Analytics cookies from your browser. We don't use advertising cookies.

Some of what our pages show is loaded from other services: maps from OpenFreeMap, built from OpenStreetMap data, and photos of places from Wikimedia Commons. Your browser requests that content from them directly, so they receive your IP address and browser details, under their own privacy policies. When you move a map, OpenFreeMap sees which area you're viewing.

We don't track you across other websites. Google Analytics' advertising features, including Google signals, are off, so Google doesn't use what we collect to show you ads or to link your visits here with your activity elsewhere. There's no common standard for Do Not Track signals, so we don't respond to them; you can turn off visit statistics from Cookie settings instead.

• To create and run your account and let you sign in.
• To publish your contributions with their provenance, which is central to how Vigil works.
• To show you personal features such as saved locations and the people you follow.
• To keep the Service safe: preventing spam and abuse, enforcing our Terms and Guidelines, and investigating flags.
• To send service emails such as confirming your address or resetting your password, and our newsletter if you opted in.
• To understand and fix problems and improve the Service.
• To see how people find Vigil, including which of our links and partners bring them.
• To meet legal obligations.

Your username, your first name and last initial (unless you choose to hide your name), the "based in" field if you fill it in, your public profile, the people you follow, and everything you post, with its date, time and place, are visible to anyone, including search engines. Your email address and the private details listed above are never shown publicly. Who invited you to Vigil isn't public.

We share information only with service providers who help us run Vigil, under agreements that limit how they can use it:

• Hosting, database, account sign-in and media storage providers.
• An email delivery provider.
• A bot-protection provider, which checks that sign-ups, sign-ins and password resets come from people rather than automated programs.
• Google, which provides Google Analytics and processes visit statistics for us as our service provider, under Google's data processing terms.
• Sentry, which receives error reports for us as our service provider.
• A content moderation provider, which automatically checks the text, photos and video frames in posts for explicit or graphic content before they're published.
• Discord, only if you choose to link your account.

We may also disclose information if the law requires it, to protect the safety of any person, to address fraud or security issues, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information. As US law requires, we report apparent child sexual exploitation to the National Center for Missing & Exploited Children.

We don't sell your personal information and we don't share it for cross-context behavioral advertising.

When you remove a post, it's taken off the Service right away. We keep a hidden copy, with any flags and moderation notes about it, to handle abuse reports and legal requests, until you delete your account.

We keep your information while your account exists. When you delete your account, your profile and everything you posted, including photos, are deleted from the Service. Copies may remain in routine backups for a limited period before they're overwritten, and we may keep limited records where the law requires or to handle abuse and disputes. Server logs, and the scrambled form of your IP address we use for rate limits, are kept only briefly. Visit statistics are kept in Google Analytics for 14 months and then deleted. Error reports are kept in Sentry for 30 days and then deleted.

• Edit your profile and email preferences in your account settings.
• Remove individual posts, or delete your whole account, at any time.
• Unsubscribe from the newsletter using the link in any newsletter email.
• Accept or reject visit statistics at any time from Cookie settings at the bottom of every page.
• Ask for a copy of your personal information, or ask us to correct or delete it, by emailing legal@joinvigil.app.

Depending on where you live, including California and the European Economic Area, you may have additional rights, such as the right to know what we collect, to object to or restrict certain uses, or to complain to a data protection authority. We honor these requests and won't treat you differently for making them. We may need to verify your identity before acting on a request.

Vigil is not for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we'll delete it.

We protect information with measures such as encrypted connections, hashed passwords, restricted database access and rate limiting. No system is perfectly secure, so we can't guarantee absolute security.

Vigil is based in the United States, and our service providers may process information in the United States and other countries. By using the Service, you understand your information will be processed there.

If we change this policy materially, we'll give notice on the Service or by email before the change takes effect.

Privacy questions and requests: legal@joinvigil.app.