Privacy policy

What this preview uses

You can browse research without an account after entering the tester invite. If you create an account, the service processes your email, authentication information, display name, profile, saves, journals, posts, selected photos, relationships and moderation reports to provide those features.

Account saves and journals are private. Posts require a Public or Approved followers audience. Post comments and attachments inherit that audience; place comments are public. Sharing selected journal photos does not share the rest of the journal.

Hosting and service providers

Vercel hosts the website and processes web requests for delivery and security. Supabase provides account authentication, PostgreSQL and private photo storage. The selected Supabase project is hosted in Ireland (eu-west-1). These providers process information needed to operate their services; see Vercel’s privacy notice and Supabase’s privacy policy.

Why we process information

We process account details and content to provide the account, journal and sharing features you request, on the basis of providing the service under its terms (GDPR Article 6(1)(b)). Security checks, moderation and handling support requests serve our legitimate interests in protecting the service and its community (Article 6(1)(f)). You can contact us to object to processing based on legitimate interests.

Optional aggregate analytics helps us understand which public pages are used. It excludes account content and uses no permanent visitor identifiers. We do not sell personal data, use advertising profiles or make automated decisions that produce legal or similarly significant effects.

Cookies and device storage

Authentication uses essential session cookies named deep-delver-auth-token (sometimes split into numbered parts) when accounts are configured. Guest saves and your appearance preference use browser local storage. Session storage remembers whether you are using account mode, to avoid treating an expired account session as a guest. Unfinished editor text and photos use account-scoped IndexedDB on your device. Failed requests and expired sessions retain these drafts for the same account. Explicit sign-out clears device-local account drafts and private query caches; guest saves and appearance preferences remain.

Browser storage persists until you remove it, sign out where applicable, or clear site data; session storage is scoped to the browser tab. Clear site data on shared devices after use. This app does not install advertising cookies, GA4, marketing pixels or session replay.

Optional analytics

Analytics is disabled in this build. An optional Plausible integration is included for a later configured public HTTPS deployment.

When enabled, we send only page counts for Map, Materials, About, Privacy and Terms, plus a “Signup submitted” event after the server accepts the Create profile form. The event does not establish email confirmation, a new account or email delivery. Opening or reloading the thank-you page does not record a conversion.

Events contain a fixed public path and site domain. They exclude query strings, map bounds, coordinates, referrers, names, account identifiers, form text, photos, private routes and viewed locality identifiers. No analytics cookies or permanent browser identifiers are created by this integration. Browser Do Not Track and Global Privacy Control disable events. Plausible receives the network address and browser information needed to process the request; see Plausible’s data policy.

Other network requests

Viewing the map requests visible tiles from Kartverket, which receives your network address and the requested tile area. Read Kartverket’s privacy information. Opening an external evidence or credit link sends a request to that provider.

Optional Sentry error reporting is disabled without configuration. Configured reports exclude credentials, private content, photos and precise GPS. Replay is disabled.

Retention and your choices

Account content remains in the configured service until it is removed through supported controls or the operator handles a request. Public content may be read or copied by other people. Removing follower approval cannot recall copies already made.

Contact the operator above to request access, correction, deletion, or to raise an objection or another privacy request. Account-wide deletion currently requires the operator’s help. You may also contact Datatilsynet about privacy concerns.

Tester invitation

During the private web test, the shared invite password unlocks the preview. A signed essential cookie named deepdelver-invite remembers access in this browser for up to seven days. It is separate from account sign-in and does not identify an account. Changing the invitation settings revokes existing invite access. The welcome page does not load the map, account service or analytics.