Privacy

Who is responsible

The World Radar is a personal, non-commercial project operated from Spain. Its operator is the data controller for everything described here and can be reached at [email protected]. That address reaches a person, and it is the right one for any request under this policy.

If you never sign in

This is how most people use the site, and it asks for no account or profile. Only a language choice and your analytics decision can follow you between visits. These things still happen:

• The server keeps access logs. Each request records an IP address, the time, the URL asked for, the response status, your browser’s user-agent string and the page you arrived from. They exist to keep the site running and to defend it — rate limiting, abuse, diagnosing a fault — and they are deleted after 14 days. Because the map is a single page whose state lives inside it, those logs do not record which theaters, events or intelligence reports you opened.
• Your browser remembers how you like to read. These entries stay in its storage, signed in or not:
  • app:analytics-consent:v1 — Your accept or reject choice for Google Analytics, with its date. Expires after 180 days; you can change it on this page.
  • app:theme — Dark or light.
  • app:density:v2 — Map detail: Standard or All.
  • app:density — The reading profile an earlier version saved (Novice, Explorer or Analyst), read once to carry your choice over to map detail.
  • app:clock — Whether event times are shown in your zone or in UTC.
  • app:reader-preferences — Conflicts followed in this browser before following needed an account. The first time you sign in here they are added to your account and this entry is deleted.
  • app:reader-session:v2 — Where Back returns to and where the map was, so a reading can take you back. Only for this tab. Session storage: it goes when the tab closes.
  Your manual language choice is kept separately in the strictly necessary app_locale cookie, so the server can render the right language before the page reaches you. Clearing site data removes the browser choices. Preferences saved to an account remain until you change them or delete the account.
• Your browser fetches the map from other people’s servers. The imagery, the terrain and the labels are not ours to host, so your browser asks for them directly and those servers see your IP address. They are named below.

The legal basis for the logs is our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). The entry count sent from our server contains no reader personal data. The fuller browser analytics has a separate, optional legal basis: your consent (Article 6(1)(a) GDPR). No decision about you is made automatically.

If you create an account

An account is optional. The map, every conflict with its activity, the intelligence reports and the probability readings are the same with or without one. What it adds is personal: following conflicts, reading their events together in Following, and world activity, the list of events from every conflict by date. The legal basis is the agreement between us — you asked for an account, and this is what providing it takes (Article 6(1)(b) GDPR).

What is stored

• Your email address, lowercased. It is the account.
• Your name, if you add one, or the one Google supplied when your account had none. You can change or erase it. It is shown on your profile, and its initials on the profile button.
• The conflicts you follow, one entry each with the date you followed it. Conflicts followed in a browser before following needed an account are added the first time you sign in on it.
• Your preferences: the event types in Following, language, local or UTC time, and appearance. They let you keep your choices on other devices.
• An identifier from Google (the sub claim), if you sign in with Google or connect it, so that the same Google account is recognised next time — and the address Google reported for it, which your profile shows.
• Timestamps: when the account was created, when it was last changed, and when the address was verified.
• Sessions: for each browser you are signed in on, a hash of the session token, when it started, its expiry, and the user-agent string that browser sent. Your profile lists them, with the browser and system read from that string.
• Sign-in emails: for each one sent to your address, a hash of its link and one of its code, the wrong codes tried, where you were going and what you asked to follow, with the times. It is what enforces the limit of three emails per address per quarter hour.

What is not stored

• No password. There are none to store: you sign in with a one-time link or code, or with Google.
• No reading history. The site does not record which theaters, events or intelligence reports you open, how long you stay, or where you zoom.
• No “last seen”. The pages that render the map read the database through a role that has no permission to write, so looking at the map cannot leave a mark on your account even by accident.
• No IP address attached to your account. The access logs above are not joined to it.

The sign-in link, its code and the session token exist in readable form only in your mailbox and in your browser. What this server keeps are SHA-256 digests, which cannot be turned back into a working key; the code’s is also keyed with a secret that only the browser that asked for it holds. A copy of the database is not a way into anyone’s account.

Signing in with Google

Google sign-in is one of two ways in and it is never required. You can also connect it, from your profile, to an account you opened with your email. Either way, this is exactly what is requested and what happens to it.

• openid — A stable identifier for your Google account (the "sub" claim).
• email — Your email address and whether Google has verified it.
• profile — Your display name, used only if your account has none yet. Nothing else in the profile is read, and the picture is never fetched.

Those three are the whole request. The World Radar does not ask for and cannot read Gmail, Drive, Contacts, Calendar, Photos or any other Google service. It does not request offline access and holds no refresh token, so it cannot act on your behalf at Google after you have signed in.

The data received is used for one purpose: to create your account or connect Google to it, and to recognise you when you come back. When you connect Google, a notice is emailed to your account’s address. The data is not used for advertising, not used to build a profile, not sold, not shared with anyone, and not read by a human. If Google reports that it has not verified the address, the sign-in is refused — an unverified address would let someone claim an account that belongs to another person.

“Disconnect” on your profile removes Google from your account at any time: the identifier and the address kept for it are deleted, and your email keeps working. You can also revoke this app’s access from your Google account permissions. Neither deletes the account itself, which you can do on your profile.

Cookies

The four app cookies are strictly necessary: language and sign-in. Google Analytics can also set the two cookie families below, but only after you accept. Rejecting or leaving the choice unanswered keeps its tag unloaded. Withdrawing consent deletes its cookies in this browser and stops further browser analytics requests after the page reloads. A single entry event is then sent from our server on the next page load.

• app_locale

  Remembers the language you chose so the server can render the next page in that language before it reaches your browser.

  1 year, or until you clear site data. · HttpOnly · Secure · SameSite=Lax
• app_session

  Keeps you signed in. It holds a random token; the account it belongs to is looked up on the server.

  30 days, or until you sign out. · HttpOnly · Secure · SameSite=Lax
• app_session_oauth

  Carries the one-request proof (state, PKCE verifier and nonce) that the answer coming back from Google is the one this browser asked for, and whether it was to sign in or to connect Google to your account.

  10 minutes, and it is cleared as soon as Google answers. · HttpOnly · Secure · SameSite=Lax · scoped to the Google sign-in route
• app_session_email

  Ties the six-digit code in a sign-in email to the browser that asked for it. It holds a random secret, and the code only works together with it.

  15 minutes, and it is cleared as soon as the code is used. · HttpOnly · Secure · SameSite=Strict · scoped to the email sign-in route
• _ga

  Google Analytics distinguishes visits after you accept analytics.

  Up to 2 years, or until you withdraw consent or clear site data. · First-party · only after analytics consent
• _ga_*

  Google Analytics keeps session state after you accept analytics.

  Up to 2 years, or until you withdraw consent or clear site data. · First-party · only after analytics consent

If you reject, your browser sends one empty request to our server without cookies or a referrer. Our server sends Google Analytics only an anonymous_entry event, a fresh random identifier needed by its protocol, and the time of that event. The identifier is never stored or reused. Google sees our server IP and generic server headers, not your IP, browser details, account or page URL. This happens once per page load on public pages; moving within the site does not send another entry. It is an entry count, not an exact count of distinct people. The ordinary server access log still records your request as described above.

If you accept, browser analytics measures visits on the map, public conflict and event pages, the guide, the key, and these legal pages. Enhanced measurement also records when a page is scrolled to 90%, clicks to other sites (including the destination URL), form starts and submissions (form identifiers, destination and submit-button text), and playback of supported YouTube videos. Site search and file downloads are off. Google may also generate session-start, first-visit and engagement events. Page locations omit URL parameters and fragments; an outbound destination URL may have its own parameters. The tag pauses while the in-page sign-in form is open and on personal pages, including Following, activity and profile. We do not attach account IDs or reader email addresses to page views. Google receives your IP address when the tag is loaded and may process data outside the EEA. The choice stays in this browser for up to 180 days; you can change it here at any time.

What your browser fetches from elsewhere

The map is assembled in your browser from sources we do not host. The map providers see your IP address, your user-agent and which tile you asked for. We send them no account identifier or referrer. Your browser contacts Google Analytics only after you accept it; on rejection, our server sends the limited entry event described above.

• OpenFreeMap

  Serves the vector base map and the fonts its labels are set in.

  Every time the map draws, with or without an account.
• NASA EOSDIS GIBS

  Serves the satellite imagery the map is built on: the night earth and current night lights of the dark map, and the daytime Earth of the light map.

  Every time the map draws, with or without an account.
• Amazon Web Services (Open Data)

  Serves the elevation tiles that give the map its relief.

  Every time the map draws, with or without an account.
• X (Twitter)

  Serves an embedded post or video when an event cites one as its source.

  Only after you open that event and ask for the embed. Never on arrival.
• Telegram

  Serves an embedded post when an event cites one as its source.

  Only after you open that event and ask for the embed. Never on arrival.
• Google Analytics

  If you reject, our server sends one anonymous_entry event per page load, with a new disposable random client ID and no page, browser, IP or account data from you. If you accept, its browser tag measures public-page visits, scrolling, outbound clicks, form interactions and supported videos; that tag receives your IP and browser details.

  Our server sends only the entry event after rejection. Your browser contacts Google Analytics only after acceptance. No analytics request is made before you choose.

X and Telegram are different in kind: nothing is fetched from them until you open an event that cites one of them and ask for the embed.

Who else handles data for us

These are processors: they act on our instructions, under contract, to run the service.

• Cloudflare

  Runs the network edge: DNS, the public TLS certificate and the CDN. Every request to this site passes through it.

  Always.
• AlphaVPS

  Hosts the virtual server the site runs on, in Germany.

  Always.
• Resend

  Delivers the emails this site sends: the sign-in code and link, and the notice that Google was connected to your account. It handles your address and the message itself.

  Only when you ask for a sign-in email, or connect Google to your account.
• Google

  Identifies you if you choose to sign in with Google, or to connect it to your account: a redirect to Google and then an exchange between Google and this server.

  Only if you press "Continue with Google" or "Connect". Never otherwise.

The server itself is a virtual machine in Germany, and the database on it is the only place account data lives. It is not copied anywhere else, and no third party is given access to it.

Where data goes

Hosting is inside the European Economic Area. Some of the services above are based outside it and may process data — chiefly an IP address, and in Resend’s case the emails it delivers — in other countries, including the United States. Each relies on the transfer safeguards it publishes, which for these providers are the European Commission’s standard contractual clauses and, where they are certified, the EU–US Data Privacy Framework. Their own policies are linked above.

How long anything is kept

• Server access logs (IP address, time, the URL asked for, status, user-agent, referrer)

  Rotated daily and deleted after 14 days.

• Your account: address, name, the conflicts you follow, preferences and ways in

  Until you delete it. Deletion is immediate and permanent.

• Sessions (a hash of the session token, when it started, its expiry, and the user-agent that opened it)

  30 days, or until you close it: your profile lists every session and closes any of them. A closed or expired session is erased a day later, at the next sign-in on the site.

• Sign-in emails (hashes of the link and the code, the address, wrong attempts, where you were going and what you asked to follow, and the times)

  The link and the code die in 15 minutes, on first use or after five wrong codes. The record enforces the limit of three emails per address per quarter hour, and is erased a day after it was sent, at the next sign-in on the site — at once if you delete your account.

Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Two of those you can exercise yourself, immediately, without asking anyone:

• Your profile shows everything held about you: address and name, the conflicts you follow, your preferences, your ways in and your open sessions. The only record it does not list is the short-lived one of each sign-in email, described above. There is no hidden record behind it.
• “Delete account” is immediate and permanent. It removes the account, the conflicts you follow, your preferences, every way in attached to it, every session, and the record of every sign-in email sent to your address. Analytics, if you accepted it, is separate from your account; use the preference above to stop it and erase its cookies from this browser.

For anything else, write to [email protected]. If you think your data has been handled wrongly you can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, or to the authority where you live.

Security

Traffic is encrypted end to end, at the network edge and again between the edge and this server. Sign-in links, codes and session tokens are stored only as SHA-256 digests. A sign-in email works once and expires in fifteen minutes, and asking for a new one kills the old; its code works only in the browser that asked for it, and five wrong codes spend it. The pages that render the map connect to the database with an account that cannot write to it. The editorial tools that publish content are not reachable from the internet at all.

None of that makes a system impossible to breach, and anyone who claims otherwise about theirs is selling something. If you find a weakness here, [email protected] is the address to tell us about it.

Children

This site is not directed at children. You must be at least 14 — the age of digital consent in Spain — to create an account, or older if the country you live in sets a higher age. The map itself asks nothing of anyone, but it reports armed conflict and is not written for children.

Changes

If this policy changes, the date at the top changes with it. A change that materially affects people with an account will be stated on this page before it takes effect. The terms of service are the other half of this document and change the same way.