Privacy

Settings

Data and privacy

Marchstone runs in your browser. Your areas, marks and positions stay on your phone and are never sent to me: there are no accounts, forms, analytics, ads or third-party scripts. Two things do reach other servers: the page itself, from the host, and the map, from Esri or OpenStreetMap.

Who is responsible

Kuba, kuba@tinkered.app. Marchstone is a private, non-commercial hobby project.

What the host records

The site is hosted by Cloudflare. Like any web host, Cloudflare processes your IP address, the time of the request, the page requested and your browser details to deliver the site and protect it from attacks. If a connection to the site fails, your browser may also send Cloudflare a short error report.

I can see a sample of these requests, including IP addresses, in the Cloudflare dashboard. I use it only to keep the site working and secure (legitimate interest, Art. 6(1)(f) GDPR). Cloudflare keeps these records for up to 7 days (security events: 24 hours) and then deletes them.

Cloudflare, Inc. is based in the United States and processes this data on my behalf under its data processing addendum. Transfers rely on the EU–US Data Privacy Framework, with standard contractual clauses as a fallback. Cloudflare's privacy policy.

The map

To draw the map, your browser asks for the squares of ground in view: satellite imagery from Esri, or the street map from the OpenStreetMap Foundation when you switch to it. The provider receives your IP address and which squares you asked for, which is often roughly where you are standing. The OpenStreetMap request also carries this site's address, because its usage policy asks for it; Esri gets no referrer.

The map loads only when a map screen opens, or on a wide screen, beside your saved areas. Save the map for offline use, or work on a saved area with no signal, and no tile requests are made. I receive none of this data. The legal basis is legitimate interest in showing you the map the app is built around (Art. 6(1)(f) GDPR).

Each provider handles the requests as its own controller, under its own policy: Esri (Environmental Systems Research Institute, Inc., United States, certified under the EU–US Data Privacy Framework) and OpenStreetMap Foundation (United Kingdom, which the European Commission recognizes as providing adequate protection).

If you email me

Mail to kuba@tinkered.app is forwarded by Cloudflare Email Routing to my Gmail inbox (Google). I use your address and message only to reply (legitimate interest, Art. 6(1)(f) GDPR) and keep the conversation while it may still be useful for follow-up. Ask me to delete it at any time and I will. Google LLC, like Cloudflare, is certified under the EU–US Data Privacy Framework.

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing, or object to processing, by writing to kuba@tinkered.app. You can also complain to your data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO).

The hosting records are not tied to names and expire within 7 days. To check whether any of them concern you, send your IP address and the time of your visit within that period.

What the app stores in your browser

These items stay on your device and are not sent to me.

fb.fields
localStorage. Your areas and the marks on them. Kept until you delete them.
fb.settings
localStorage. Border width, position quality, screen, sound, theme and language. Kept until you clear this site's data.
fb.gaugeSeen, fb.browserSeen
localStorage. A note that the gauge explanation and the browser warning were shown, so neither appears twice. Kept until you clear this site's data.
marchstone-v + version
Browser cache and service worker. The app's own files, so it opens with no signal. Replaced with each new version.
fb-tiles-v1
Browser cache. Map imagery you viewed or saved, up to 6,000 squares, oldest dropped first. Kept until you use Clear saved map tiles in Settings.
Network error reporting policy (Cloudflare)
Browser network setting. Tells the browser where to send a report if a connection to the site fails. Kept for 7 days.

Remove them at any time in your browser's site settings, or by uninstalling the app. Back up your areas first: they exist nowhere else.

No analytics, advertising or profiling.

Last updated: 27 September 2026