BETA SERVICE POLICY
Privacy Notice
Beta draft · last updated September 4, 2026
1. Who controls the data
Data controller/operator: [OWNER TO PROVIDE LEGAL NAME, ADDRESS AND JURISDICTION]. Privacy contact: [OWNER TO PROVIDE PRIVACY EMAIL]. This notice describes the planned beta processing and must be reviewed against the final deployment region and vendors.
2. Data we collect
We process account identifiers, verified email and display name; profile, avatar, bio, home region, visibility settings and selected social links; lists, quests, private Item inventory, image tags, proof provenance, comments, ratings, follows and moderation history; subscription status and provider references; and technical security logs. Everyday Feedback cases are private. We store your message, follow-up correspondence, an account link if you sign in, and an optional reply email for manual staff review. When email dispatch is configured, saving queues a minimal staff notification and, only if you explicitly select it, a receipt to your chosen email. Emails contain a reference and protected case/inbox link, never private case content or the secret code. Provider acceptance does not prove inbox delivery, and no response time is guaranteed. Already accepted email cannot be recalled after case deletion. Only with your consent do we attach a route template without page identifiers or query/share tokens, browser family, screen size and UI language; attachments are not accepted. Separately, purpose-specific security hashes help prevent abuse and recognize submission retries; raw IP addresses are not stored in cases. The scheduled privacy processor clears those hashes once they are at least 30 days old. Messages and staff notes remain until the case is deleted or the owning account is erased; ordinary account cancellation does not erase them. Account exports include your case details and visible replies, excluding internal staff notes and secret codes, and expire after seven days. Case deletion also removes its copy from stored exports, although a copy you already downloaded remains yours. The anonymous secret code is kept in this tab’s sessionStorage and sent only in a private header, never in a URL; the server stores only its hash. Keep a copy privately: anyone holding it can read, reply to or delete the case, and you need it to return without an account.
3. Location and proof visibility
Nearby search can use your device location when you grant browser permission. A check-in sends precise coordinates and accuracy with a short-lived challenge for one-time, low-assurance quest verification. Original quest proof, private Item images, storage keys, checksums and crop provenance remain private and use authenticated, short-lived access. A collectible proof is owner-only by default; if you explicitly make it public, viewers receive only its safety-scanned, metadata-stripped derivative. Publication never exposes raw coordinates or private source bytes.
4. Public and searchable content
Your profile, home location, social accounts and quests follow your visibility choices. An approved collectible instead shows the contributor @handle and links to a contributor page because that public attribution is accepted at submission. A private-profile contributor page shows only the handle and public contribution history; after ordinary cancellation it also shows an account-canceled notice. People discovery exposes only coarse proximity bands, never an exact distance derived from a private home coordinate.
5. Translation and AI
When you request another language, eligible text is sent to the configured translation model. Results are stored by source revision, target language and model version so unchanged content is not translated again. List-generation prompts can be processed by the configured AI model and grounded against place results.
6. Service providers
The beta is designed to use AWS for hosting, identity, storage, scanning, databases, email and AI; Google Maps Platform for maps and place search; and Stripe or another configured provider for payment. Google processing is described in the Google Privacy Policy and map use is subject to the Google Maps Platform Terms . Final vendor/subprocessor list: [OWNER TO CONFIRM].
7. Retention and security
Private media uses restricted storage and time-limited access. Sessions use encrypted Secure, HttpOnly cookies; browser storage does not hold Cognito access, ID or refresh tokens. Retention periods for inactive accounts, proof files, logs, translations and moderation records: [OWNER TO SET BEFORE LAUNCH]. First-party visitor statistics use a random local browser identifier that rotates after Taipei midnight. The server classifies the browser family and estimates the IP country locally; it stores only coarse categories and hourly counts, not raw IPs, user agents, account identities, page URLs or referrers. IP countries are approximate and may reflect a VPN. Matching and deduplication records are kept for the current and previous Taipei day; aggregates are kept for 180 days. Do Not Track and Global Privacy Control are respected. Blocked storage or requests are excluded; statistics estimate browsers, not people. Public discovery, trip previews and successful trip saves also contribute anonymous stage counts. The browser reads a referrer only to classify the first daily source as search, another website or direct/unknown; only this category is retained and sent, never the referrer URL or search query. Each stage is counted once per browser per Taipei day and is not linked to an account. Stages are estimates, not ordered conversion rates.
8. Your choices and rights
You can change public/searchable fields, unfollow people, withdraw publications and correct profile data. You may separately cancel the account, which preserves approved licensed contributions, or invoke an applicable personal-data deletion right. Authenticated active or canceled accounts can create a portable JSON export, available only to that account through a non-cacheable response for seven days. Contact [OWNER TO PROVIDE PRIVACY EMAIL] for correction, objection, withdrawal questions or other applicable rights.
9. Account deletion
Authenticated active or canceled users can request statutory deletion by entering an account-specific confirmation. This is separate from ordinary cancellation. Public/search visibility, including retained collectible contributions, is frozen immediately. A seven-day cooling-off period allows withdrawal before erasure begins; afterward private media and identity access are removed, contributed collectible media is deleted, credited handles and consent timestamps are anonymized, and profile data is erased. Restricted audit records may be retained where required, but are not public.
No proof evidence is made public by publishing a visit.Public projections contain minimized completion metadata only.