Privacy

Who is responsible

The World Radar is a personal, non-commercial project operated from Spain. Its operator is the data controller for everything described here and can be reached at [email protected]. That address reaches a person, and it is the right one for any request under this policy.

If you never sign in

This is how most people use the site, and it asks nothing of you. There is no account, no profile and nothing that follows you between visits. Three things still happen, and all three are worth stating:

• The server keeps access logs. Each request records an IP address, the time, the URL asked for, the response status, your browser’s user-agent string and the page you arrived from. They exist to keep the site running and to defend it — rate limiting, abuse, diagnosing a fault — and they are deleted after 14 days. Because the map is a single page whose state lives inside it, those logs do not record which theaters, events or briefings you opened.
• Your browser remembers how you like to read. Three values are kept in local storage, never sent to the server and never seen by us:
  • app:theme — Dark or light.
  • app:density — Your reading profile: Novice, Explorer or Analyst.
  • app:clock — Whether event times are shown in your zone or in UTC.
  Clearing site data in your browser removes them.
• Your browser fetches the map from other people’s servers. The imagery, the terrain and the labels are not ours to host, so your browser asks for them directly and those servers see your IP address. They are named below.

The legal basis for the logs is our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). Nothing on this path profiles you, and no decision about you is made automatically.

If you create an account

An account is optional and unlocks nothing: the map, the reading profiles, the briefings and the probability readings are the same with or without one. It exists so there is a way back in later. The legal basis is the agreement between us — you asked for an account, and this is what providing it takes (Article 6(1)(b) GDPR).

What is stored

• Your email address, lowercased. It is the account.
• Your display name, only if you signed in with Google and Google supplied one. It is shown on your account page and nowhere else.
• An identifier from Google (the sub claim), if you use Google sign-in, so that the same Google account is recognised next time.
• Timestamps: when the account was created, when it was last changed, and when the address was verified.
• Sessions: for each browser you are signed in on, a hash of the session token, its expiry, and the user-agent string that browser sent.
• Sign-in links: a hash of each link mailed to your address, with the times. It is what enforces the limit of three links per address per quarter hour.

What is not stored

• No password. There are none to store: you sign in with a one-time link or with Google.
• No reading history. The site does not record which theaters, events or briefings you open, how long you stay, or where you zoom.
• No “last seen”. The pages that render the map read the database through a role that has no permission to write, so looking at the map cannot leave a mark on your account even by accident.
• No IP address attached to your account. The access logs above are not joined to it.

The sign-in link and the session token exist in readable form only in your mailbox and in your browser. What this server keeps is a SHA-256 digest, which cannot be turned back into a working key — so a copy of the database is not a way into anyone’s account.

Signing in with Google

Google sign-in is one of two ways in and it is never required. If you use it, this is exactly what is requested and what happens to it.

• openid — A stable identifier for your Google account (the "sub" claim).
• email — Your email address and whether Google has verified it.
• profile — Your display name. Nothing else in the profile is read, and the picture is never fetched.

Those three are the whole request. The World Radar does not ask for and cannot read Gmail, Drive, Contacts, Calendar, Photos or any other Google service. It does not request offline access and holds no refresh token, so it cannot act on your behalf at Google after you have signed in.

The data received is used for one purpose: to create your account and recognise you when you come back. It is not used for advertising, not used to build a profile, not sold, not shared with anyone, and not read by a human. If Google reports that it has not verified the address, the sign-in is refused — an unverified address would let someone claim an account that belongs to another person.

You can revoke this app’s access at any time from your Google account permissions. That disconnects Google from your account here; it does not delete the account itself, which you can do on your account page.

Cookies

Two, both strictly necessary, both created only when you sign in. A visitor who never signs in is never given a cookie by this site, which is why there is no consent banner: strictly necessary cookies do not need one, and there are no others to ask about.

• app_session

  Keeps you signed in. It holds a random token; the account it belongs to is looked up on the server.

  30 days, or until you sign out. · HttpOnly · Secure · SameSite=Lax
• app_session_oauth

  Carries the one-request proof (state, PKCE verifier and nonce) that the answer coming back from Google is the one this browser asked for.

  10 minutes, and it is cleared as soon as Google answers. · HttpOnly · Secure · SameSite=Lax · scoped to the Google sign-in route

What your browser fetches from elsewhere

The map is assembled in your browser from sources we do not host. Those servers necessarily see your IP address, your user-agent and which tile you asked for. We send them nothing else: no identifier, no account, no referrer — this site withholds the referring page on every cross-origin request.

• OpenFreeMap

  Serves the vector base map and the fonts its labels are set in.

  Every time the map draws, with or without an account.
• NASA EOSDIS GIBS

  Serves the night-lights satellite imagery the map is built on.

  Every time the map draws, with or without an account.
• Amazon Web Services (Open Data)

  Serves the elevation tiles that give the map its relief.

  Every time the map draws, with or without an account.
• X (Twitter)

  Serves an embedded post or video when an event cites one as its source.

  Only after you open that event and ask for the embed. Never on arrival.
• Telegram

  Serves an embedded post when an event cites one as its source.

  Only after you open that event and ask for the embed. Never on arrival.

The last two are different in kind: nothing is fetched from X or Telegram until you open an event that cites one of them and ask for the embed. Until you do, your browser has not spoken to them.

Who else handles data for us

These are processors: they act on our instructions, under contract, to run the service.

• Cloudflare

  Runs the network edge: DNS, the public TLS certificate and the CDN. Every request to this site passes through it.

  Always.
• AlphaVPS

  Hosts the virtual server the site runs on, in Germany.

  Always.
• Resend

  Delivers the sign-in email. It handles your address and the message itself.

  Only when you ask for a sign-in link.
• Google

  Identifies you if you choose to sign in with Google: a redirect to Google and then an exchange between Google and this server.

  Only if you press "Continue with Google". Never otherwise.

The server itself is a virtual machine in Germany, and the database on it is the only place account data lives. It is not copied anywhere else, and no third party is given access to it.

Where data goes

Hosting is inside the European Economic Area. Some of the services above are based outside it and may process data — chiefly an IP address, and in Resend’s case the sign-in message — in other countries, including the United States. Each relies on the transfer safeguards it publishes, which for these providers are the European Commission’s standard contractual clauses and, where they are certified, the EU–US Data Privacy Framework. Their own policies are linked above.

How long anything is kept

• Server access logs (IP address, time, the URL asked for, status, user-agent, referrer)

  Rotated daily and deleted after 14 days.

• Your account: address, sign-in methods, display name if Google supplied one

  Until you delete it. Deletion is immediate and permanent.

• Sessions (a hash of the session token, its expiry, and the user-agent that opened it)

  30 days, or until you sign out — "Sign out everywhere" ends all of them at once.

• Sign-in links (a hash, the address they were sent to, and the times)

  The link itself dies in 15 minutes or on first use. The record that one was sent is what enforces the three-per-quarter-hour limit, and it goes with your account when you delete it.

Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Two of those you can exercise yourself, immediately, without asking anyone:

• Your account page shows everything held about you. There is no hidden record behind it — what that page displays is what exists.
• “Delete account” is immediate and permanent. It removes the account, every sign-in method attached to it, every session, and the record of every sign-in link mailed to your address. Nothing is retained afterwards, because there is nothing else about you to retain.

For anything else, write to [email protected]. If you think your data has been handled wrongly you can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, or to the authority where you live.

Security

Traffic is encrypted end to end, at the network edge and again between the edge and this server. Sign-in links and session tokens are stored only as SHA-256 digests. A sign-in link works once and expires in fifteen minutes, and asking for a new one kills the old. The pages that render the map connect to the database with an account that cannot write to it. The editorial tools that publish content are not reachable from the internet at all.

None of that makes a system impossible to breach, and anyone who claims otherwise about theirs is selling something. If you find a weakness here, [email protected] is the address to tell us about it.

Children

This site is not directed at children. You must be at least 14 — the age of digital consent in Spain — to create an account, or older if the country you live in sets a higher age. The map itself asks nothing of anyone, but it reports armed conflict and is not written for children.

Changes

If this policy changes, the date at the top changes with it. A change that materially affects people with an account will be stated on this page before it takes effect. The terms of service are the other half of this document and change the same way.