Privacy Policy & Terms of Service

Privacy Policy

International Parks ("we", "us", or "our") operates the website at internationalparks.org. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Information We Collect

When you create an account, we collect the following information:

• Email address (used for account authentication and communication)
• Username (publicly displayed with your reviews and comments)

When you use our platform, we may also collect:

• Park reviews and ratings you submit
• Comments you post on park pages
• Wishlist and saved park data
• Profile preferences and settings
• Tag votes and feature votes
• Visit and performance measurements, described under "Analytics" below (collected whether or not you have an account)

How We Store Your Data

Your account data and user-generated content are stored securely using Supabase, a managed PostgreSQL database platform with encryption at rest and in transit. We take reasonable measures to protect your information from unauthorized access, alteration, or destruction.

Cookies

We only use cookies the site needs to work: three that keep you signed in, and one short-lived cookie that remembers which page to return you to while you sign in. If you are not signed in and have not started signing in, we set no cookies at all. We do not use analytics, advertising or third-party tracking cookies, and we never sell or share cookie data.

• sb-access-token: httpOnly authentication cookie containing your session token. Cannot be read by JavaScript on the page. Expires after 24 hours (30 days if "Remember Me" is selected).
• sb-refresh-token: httpOnly cookie used to renew your session without logging in again. Expires after 7 days (90 days with "Remember Me").
• sb-user-id: Your account's internal user ID, readable by the site's own JavaScript so the page can tell you are signed in. Same expiry as sb-refresh-token, since your session can be renewed for that long. It contains no email address or password.
• auth_return_url: httpOnly cookie holding the page you were on (for example a park page) when you started signing in with Google, a login link or a new account, so you land back there afterwards. It holds only that page address, is set only when you start one of those sign-ins from a page other than the home page, and expires after 10 minutes (Google) or 1 hour (emailed links), or as soon as sign-in finishes.

The three sign-in cookies are set only when you log in and are cleared when you log out. All four are strictly necessary for the service and are exempt from cookie-consent requirements under GDPR and the ePrivacy Directive, which is why we do not show a cookie banner. The site's administrator's own browser also carries an ip_internal marker, set when the admin dashboard opens, so that the administrator's visits are left out of the visit counts. It is never set for anyone else.

Separately from cookies, your browser's local and session storage keep a few things on your device: your analytics choice (if you make one), your recent park and nearby-park searches, an unsent review draft, and small caches that make search faster. They stay on your device and are never sent to our servers. Clearing your browser's site data removes them.

Analytics (No Cookie, No Third Party)

A small first-party script on our own site reports each page you view, and how quickly it loaded, to our own server. No third-party analytics service is involved and nothing is stored on your device to do it. For each page view we keep:

• the page address you visited and the time
• your browser's user-agent string (the browser, version and operating system it reports) and whether it looks like an automated client
• a visitor identifier. If you are not signed in, this is a one-way hash of your IP address and user agent combined with a secret key. We do not store your raw IP address, and the hash cannot be turned back into one without that key. If you are signed in, the identifier is your account's email address, so those page views are linked to your account.

Page-load measurements (such as how long the largest image took to appear) are stored with the page address, user agent, device type, browser and the same hashed identifier. If you use the "Have you been here?" prompt on a park page, your score is stored with your account email, or the hashed identifier if you are not signed in, so that each visitor can answer once per park.

We use this to count how many people read the site, see which pages they use, find slow pages, and keep automated traffic out of those numbers. To do that, an automated nightly process looks at activity patterns per identifier (for example, being active for most hours of a day) and marks identifiers that behave like bots so they are left out of our counts. This data is only visible to the site operator. It is never sold, shared, or used for advertising.

Page views and page-load measurements are kept for 13 months, then deleted automatically by a nightly process. Records linked to your account email are deleted sooner, along with your account, on request (see "Account Deletion" below). Daily totals with no visitor identifier (such as how fast pages loaded each day, and daily Google Search click counts) are kept longer. So are the bot marks described above (a hashed identifier, the rule it matched and the date), so that the same automated client stays excluded, and your "Have you been here?" scores, which are ratings you chose to give rather than measurements.

You can stop being measured at any time, wherever you live. If your browser sends a GPC signal we exclude you automatically. Otherwise, choose "Don't count my visits" below. This stops page views and page-load measurements from that browser. The choice is saved in that browser's local storage, so it applies per browser and is lost if you clear its site data.

How We Use Your Information

We use your information to:

• Provide and maintain your account
• Display your reviews, ratings, and comments on the platform
• Improve our website and user experience through aggregated analytics
• Communicate with you about your account when necessary

Data Sharing

We do not sell, trade, or rent your personal information to third parties. We do not engage in any form of data brokering. Your data may be shared only in the following limited circumstances:

• Public content: Reviews, ratings, comments, and your username are publicly visible on the platform as part of its community features.
• Service providers: We use Vercel to host the website, Supabase for the database and for sign-in emails, and EmailJS to deliver what you send through the Suggest a Park forms (park suggestions, feature requests and issue reports, with your account email) and the DMCA form. These providers process data on our behalf and are bound by their own privacy policies and data processing agreements.
• Services your browser contacts directly: Some features load data straight from another service, which then sees your IP address and browser details under its own privacy policy:
  • Maps load their background tiles from OpenStreetMap's tile servers, which learn which area of the map you are viewing.
  • Searching for a place or address in a nearby-parks search sends the text you typed to Photon, a geocoding service run by Komoot, to find its location.
  • If you choose "Continue with Google", Google handles that sign-in and shares your email address with us.
  None of these is used for advertising, and nothing is sent to them unless you use that feature.
• Legal requirements: We may disclose information if required by law or in response to a valid legal request.

Account Deletion

You may request deletion of your account and associated data at any time by emailing internationalparksbusiness@gmail.com. There is no delete or download button on the site yet, so account deletion and copies of your data are handled by email. Send the request from the email address you sign in with and include your username; we reply to that address to confirm before deleting anything. Upon receiving your request, we will delete your account and personal data within 30 days. Note that publicly posted reviews and comments may be anonymized rather than deleted to preserve the integrity of community content.

Some changes you can make yourself, signed in, from your profile: change your username, make your profile private, and delete individual reviews (My Reviews) or wishlist entries (Wishlist).

Children's Privacy

Our service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the site after changes constitutes acceptance of the revised policy.

GDPR & Your Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and similar data protection laws. This section describes those rights and how we comply with our obligations.

Legal Basis for Processing

We process your personal data only when we have a lawful basis to do so. The legal bases we rely on include:

• Contract: Processing necessary to provide the service you requested when you created an account (e.g., storing your profile, displaying your reviews and comments, maintaining your wishlist).
• Consent: When you voluntarily create an account and submit content to the platform, you consent to the processing described in this policy. You may withdraw consent at any time (see "Withdrawal of Consent" below).
• Legitimate interest: Processing necessary for our legitimate interests, such as maintaining site security, preventing abuse, and improving the platform (including the cookieless analytics described above, which you can opt out of at any time), provided these interests do not override your fundamental rights.

Data Retention

We retain your personal data for as long as your account is active and as needed to provide you with our services. Specifically:

• Account data (email, username, settings): Retained for the lifetime of your account. Deleted within 30 days of an account deletion request.
• User-generated content (reviews, comments, ratings): Retained for the lifetime of your account. Upon deletion, content is anonymized (author attribution removed) rather than deleted, to preserve community data integrity.
• Authentication cookies: Expire after 24 hours (30 days with "Remember Me"; the refresh cookie and sb-user-id after 7 or 90 days) and are cleared on logout.
• Analytics and performance records (page address, time, user agent, hashed or account identifier): Deleted automatically 13 months after they are recorded. Records keyed to your account email are deleted sooner, with your account, on request. Daily totals with no visitor identifier are kept longer.
• Server logs: Request logs with IP addresses are retained by our hosting provider (Vercel) for up to 30 days and then automatically purged.

Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data. You can also update your username and profile settings directly through your account.
• Right to erasure: You may request that we delete your personal data. See "Account Deletion" above for details on how this is handled.
• Right to restrict processing: You may request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format (JSON), and have the right to transmit that data to another service.
• Right to object: You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, please email internationalparksbusiness@gmail.com from the address you sign in with. We will respond to your request within 30 days. If the request comes from a different address, we may ask you to confirm it from your account email before acting on it.

International Data Transfers

Our database is hosted by Supabase on infrastructure located in the United States. If you are accessing our service from the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the United States. We rely on the following safeguards for these transfers:

• EU-US Data Privacy Framework: Our infrastructure providers participate in the EU-US Data Privacy Framework, which has been recognized by the European Commission as providing an adequate level of data protection.
• Standard Contractual Clauses: Where the Data Privacy Framework does not apply, our service providers use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure appropriate safeguards for international transfers.

Withdrawal of Consent

Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time. You can do this by:

• Deleting your account by contacting us (see "Account Deletion" above)
• Emailing internationalparksbusiness@gmail.com with your request

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Supervisory Authority

If you are located in the EEA or UK and believe that our processing of your personal data violates data protection laws, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU data protection authorities can be found on the European Data Protection Board website. We encourage you to contact us first so we can try to resolve your concern directly.

Data Protection Contact

International Parks is a small, independently operated website and is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any data protection inquiries, requests, or concerns, please contact us at internationalparksbusiness@gmail.com. We aim to respond to all data protection requests within 30 days.

Terms of Service

By accessing or using internationalparks.org, you agree to be bound by these Terms of Service. If you do not agree to these terms, please do not use the site.

User Accounts

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You must provide accurate information when creating an account and keep your account information up to date.

User-Generated Content

By submitting reviews, ratings, comments, or other content to the platform, you:

• Grant International Parks a non-exclusive, royalty-free, worldwide license to display, distribute, and use your content on the platform.
• Affirm that your content is your own original work or that you have the right to submit it.
• Agree that your content does not violate any third-party rights, including copyright, trademark, or privacy rights.

Content Guidelines

All user-generated content must adhere to the following guidelines. You may not post content that:

• Is abusive, harassing, threatening, or discriminatory
• Contains spam, advertising, or promotional material
• Is intentionally false or misleading
• Contains malware, viruses, or harmful code
• Violates any applicable laws or regulations
• Infringes on the intellectual property rights of others

Right to Remove Content

We reserve the right to remove, edit, or disable any user-generated content at our sole discretion, without notice, for any reason, including but not limited to content that violates these Terms of Service or our content guidelines. We may also suspend or terminate accounts that repeatedly violate these terms.

Intellectual Property

The International Parks website, including its design, logos, original content, and software, is the property of International Parks and is protected by applicable intellectual property laws. You may not reproduce, distribute, or create derivative works from our content without explicit written permission.

Disclaimer of Warranties

The site and all content are provided "as is" and "as available" without warranties of any kind, either express or implied. We do not guarantee the accuracy, completeness, or reliability of any park information, ratings, reviews, or other content on the platform. Trail conditions, park access, and safety information may change without notice. Always verify details with official park authorities before visiting.

Limitation of Liability

To the fullest extent permitted by law, International Parks and its operators shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of or inability to use the site. This includes, but is not limited to, damages for loss of data, loss of profits, or personal injury resulting from reliance on information provided on the platform. Our total liability for any claim shall not exceed the amount you have paid to use the service, if any.

Governing Law

These Terms of Service shall be governed by and construed in accordance with the laws of the United States. Any disputes arising under these terms shall be resolved in accordance with applicable law.

Changes to These Terms

We reserve the right to modify these Terms of Service at any time. Changes will be posted on this page with an updated revision date. Your continued use of the site following any changes constitutes acceptance of the new terms.

Contact Us

If you have any questions about this Privacy Policy or Terms of Service, or if you wish to exercise your rights regarding your personal data, please contact us at internationalparksbusiness@gmail.com.