Membership privacy
Your discoveries stay yours.
Where It Was is operated by Oliver Brinicombe-Scarr. Contact hello@whereitwas.com or write to 20 Moorside Road, Winchester, Hampshire, SO23 7RX, United Kingdom.
We use your email address to create and authenticate your account and provide the private service you request. We store your optional display name, saved Place and World references, collections, self-reported visits and achievements. A visit is your own record, rather than verified attendance. Challenges are inactive. Creating an account does not subscribe you to the newsletter.
Supabase provides authentication and database storage in Oregon, United States. Vercel hosts the website and account endpoints. Brevo sends your one-time sign-in codes and any newsletter messages you request from hello@whereitwas.com. Brevo is set to track individual opens and clicks only with consent, and we mark every recipient as not consenting; Brevo may still keep delivery logs and aggregate deliverability statistics. These providers may process connection and delivery information outside the United Kingdom. Their published processing terms describe available international-transfer safeguards: Supabase, Vercel and Brevo. Contact us for details about your data.
A necessary Secure, HttpOnly browser cookie identifies your account session. Provider credentials are encrypted on the server. Session records expire within 30 days and are eligible for removal by the maintenance job after expiry. Signing out ends the current device’s session. This essential account storage is separate from optional analytics consent.
Your current profile, saves, collections and visits remain until you remove them or delete your account. Changes to visits and collections can remain in private history for up to 90 days before they become eligible for cleanup. Achievements record the first qualifying self-reported activity and remain until account deletion. Security rate-limit records use keyed hashes and become eligible for deletion after 24 hours.
Use the account centre to update your display name, export account data or delete your account. Deletion removes your profile, sessions, saved references, visits, collections, private history and achievements. Newsletter consent is separate: you choose whether to unsubscribe when deleting your account. Read newsletter privacy for its records and retention.
For access, correction, deletion, restriction, portability or a privacy concern, contact hello@whereitwas.com. We may need to verify that the address or account belongs to you; never send us your password or sign-in code. You can also complain to the UK Information Commissioner’s Office. See site privacy and analytics for browsing without an account.