Privacy Policy

DeepMap (deepmap.cc) is operated by Rafael Silva in Portugal, under the DeepMap name, as controller of personal data processed through the platform. For privacy questions or to exercise your rights, contact contact@deepmap.cc.

We process your email, stable account identifier (UUID), authentication method, creation/access dates and the session/security data needed for registration, email confirmation, sign-in and password recovery or changes. Email/password authentication is managed by Supabase Auth; we do not display your password on your profile or make it available to other users.

If you choose Google OAuth, we receive the basic data authorised in that process, such as name, email, picture and provider identifiers. We do not request access to your Google inbox or files. Google also processes the data needed for its own authentication service.

Profiles include a username, display name, biography, avatar, visibility and membership information. An initial username may be generated. We also retain information needed to manage username changes and temporary reservations. An avatar can be a platform preset, a Google picture or a custom image stored in Supabase Storage.

New profiles are public by default; you can change visibility in settings. Public profiles display the name, username, biography, avatar and membership information. Making a profile private restricts its details but does not hide all identity: the username, active avatar and private-profile status remain accessible. A permanent profile link and a custom-avatar address may contain the UUID. Custom avatars are served through public URLs; profile privacy does not make the file itself private.

The platform does not publicly display your authentication email. Do not put your email, sensitive information or other people’s data in public fields. Content you publish yourself may disclose personal information.

We store proposals for new markers and corrections, the associated game and marker, game coordinates, text, image/video references, notes, status and dates. Submitted coordinates refer to the video-game map, not your physical location. Images can be flagged through the correction workflow.

We store authorship by UUID, submission versions, moderation decisions, notes and the identity of participants, editing/approval records, permission grants/removals and suspensions, including reasons and any expiry. We store account notifications and their read status.

Pending submissions and internal history are accessible to their author or authorised staff according to permissions. Approved content may become public and show its creator’s username even if their profile is private. An incorporated correction and minimal public identity do not become private when profile visibility changes.

For accounts completing the new registration step, we keep the user UUID, the Terms and Privacy Policy versions and the database timestamp of acceptance. We do not collect IP or browser details for this record. Older accounts are not recorded as having accepted without evidence.

Performance of the requested service: creating/authenticating accounts, managing profiles and preferences, receiving/processing contributions and presenting related notifications. Authentication data is necessary for account features; without it you can still browse the available public areas.

Legitimate interests: protecting accounts and the platform, preventing abuse, reviewing content, maintaining coherent maps and necessary authorship, decision and security records, answering enquiries and understanding service use. We balance these interests against your rights, particularly for children. Truly anonymous statistics are not personal data; any personal data needed to produce them requires a legal basis and compliance with applicable tracking rules.

Legal obligations: responding to requests and retaining or disclosing data where an applicable law or lawful order requires it. Consent is used only where legally needed for a specific processing activity, not as a blanket basis for accounts. Accepting the Terms or reading this policy does not amount to consent to every processing activity.

Supabase provides authentication, the database and storage for custom avatars. Vercel hosts/delivers the site and provides Web Analytics. Google is involved when you choose its sign-in or when its resources, such as pictures or videos, are loaded. Confirmation and recovery emails are triggered through Supabase Auth and delivered by the email service configured for that purpose.

Providers and their subprocessors receive data needed for their role under the applicable terms. Authorised staff may access data needed for support, administration and moderation. We may disclose data to authorities when legally required. Public-content recipients include platform visitors. Cloudflare R2 is not used for storage or uploads at this stage.

DeepMap integrates Vercel Web Analytics for usage statistics, such as pages visited, referral sources, approximate country and browser/device characteristics. According to Vercel’s documentation, its default setup provides aggregated statistics, does not use third-party cookies and does not keep a permanent visitor identifier; its technical visit identification is short-lived.

We do not configure custom events containing email or UUID. Before sending page addresses to Web Analytics, we replace dynamic path segments with route placeholders and remove query parameters and fragments. Unknown paths are grouped under a generic placeholder. The absence of third-party cookies does not mean no data is processed or guarantee absolute anonymity for every technical request.

Google avatars and external images may be requested directly by your browser when displaying content, including when opening a map popup. YouTube/Vimeo players are loaded only after you click the video button; the placeholder does not request an external thumbnail. Those third parties may receive your IP, browser and request information and apply their own cookies or technologies under their rules. YouTube embeds use its privacy-enhanced domain and Vimeo embeds request Do Not Track mode; neither starts automatically. Opening external content does not itself constitute consent to unnecessary tracking.

We use cookies needed for authentication, session continuity and secure completion of sign-in/recovery flows. They can persist between visits and be renewed; the current library’s default cookie lifetime is up to 400 days, subject to browser rules. This is not the token validity period or a promise of account access for that duration. Signing out removes the applicable session data.

Your language preference is stored in browser localStorage without an application-defined automatic expiry, until you change it or clear local data. We do not configure sessionStorage for preferences. You can manage cookies and storage in your browser; blocking necessary storage may prevent authentication. The third-party technologies described above also follow their providers’ terms.

CNPD ↗

Account/profile data: while the account exists and the data is needed for the service, subject to erasure requests and retention obligations. Deletion is currently handled on request, not by an automatic button or a scheduled inactivity period.

Published contributions: while useful to map content and lawfully retained; they may outlast the account. Submissions, versions, audit and moderation: while needed for content integrity, abuse prevention, review of decisions and legal claims, with personal data limited to what is necessary. These records have no single automatic expiry period.

Notifications: while needed for account information and service management; limiting the displayed items does not delete older ones. Technical data and backups: according to providers’ operational cycles and the time needed to investigate incidents or meet legal duties. Enquiries: while resolving the request and, where necessary, to evidence the response or defend rights. We do not promise technical deletion deadlines the system cannot guarantee; you can ask about retention relevant to your case.

To request deletion, write to contact@deepmap.cc, preferably from the account email. If you no longer have access, explain the situation so we can verify identity proportionately. Do not send your password. Making a profile private or signing out does not delete the account.

Deleting the authentication account and profile does not automatically delete published markers, submissions, versions or audit records. Public attribution may stop resolving to a profile, but the historical UUID and other elements may remain in internal records where retention is justified. Retaining a historical identifier does not amount to complete anonymisation.

We separately assess personal data within content, avatars, notifications and related records, removing or unlinking eligible data and explaining any legal exceptions. Preserving contributions is not a blanket reason to refuse erasure. External copies already made by third parties may be outside our control.

You can request access, rectification, erasure, restriction, objection to processing based on legitimate interests and portability where applicable. Where processing depends on consent, you can withdraw it without affecting earlier lawful processing. Rights have legal conditions and exceptions; we will explain the decision in your case.

Send requests to contact@deepmap.cc. We normally respond within one month and will tell you within that period if a justified legal extension is needed. Additional identification is requested only where necessary and proportionate. You can complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or the competent authority in your country.

International providers may process data outside the European Economic Area, including for support and subprocessing, even where primary hosting is in a European region. We do not claim all data stays in the EU. Transfers subject to the GDPR must have an applicable safeguard, such as an adequacy decision or European Commission standard contractual clauses, with additional measures where necessary. Contact us for information about relevant safeguards.

We use appropriate technical and organisational measures, including access controls and separation between public information and authorised operations. Security also depends on providers and careful handling of credentials; absolute security cannot be guaranteed.

DeepMap is not specifically directed at children and does not collect dates of birth or automatically verify age. If you are a minor, involve your legal representative where the law requires permission to use the service.

Where processing relies on consent for information-society services offered directly to children, the applicable legal consent age applies: in Portugal, 13 under Article 16 of Law 58/2019; below that threshold, the legal representative must be involved. This specific rule does not replace contractual-capacity rules or requirements in the country of residence. Contact us if you believe a child’s data is being processed improperly.

The date on this page identifies the current version. We will communicate material changes in a way appropriate to their importance, through the platform or direct contact where required, before starting new processing that requires additional information or consent. New upload/storage services will receive a separate review before being made available.