Privacy Policy

The operator of the Service (“we,” “us,” or “our”) establishes this Privacy Policy concerning the handling of user information in Tabithread (the “Service”).

1. Information We Collect

We collect the following information when providing the Service:

  • Your email address and password. Passwords are stored in hashed form, and we cannot retrieve the original password.
  • Profile information provided by Google when you sign in with a Google account
  • Travel records you create, including text, photographs, and any location data you choose to attach
  • Session cookies used for authentication and a session-hint cookie used to determine whether you are signed in
  • First-party local storage used to record how you arrived at the Service, landing pages, optional initiative or post identifiers, and first-observed and last non-direct acquisition information
  • Usage information such as the date and type of feature, API, CLI, or MCP tool use; client type and version; success or failure; map and geocoding counts; and the type and size of stored media
  • Anonymous events for public travel-journal views and successful map displays or the first map interaction, including the journal identifier, observation time, and delivery method
  • The reply email address and message entered in the contact form

2. How We Use Information

We use the information we collect for the following purposes:

  • Providing, maintaining, and improving the Service
  • Authenticating users and managing signed-in sessions
  • Displaying and distributing travel journals that users choose to publish
  • Understanding feature use, storage consumption, operating cost, and failures
  • Analyzing how acquisition sources and initiatives relate to registration and initial use
  • Using actual API, CLI, and MCP usage to decide compatibility and maintenance periods when those interfaces change
  • Responding to inquiries and sending important notices
  • Preventing automated submissions and other misuse of the contact form

3. Storage of Photographs and Other Media

  • Photographs and other media uploaded by users are stored in Cloudflare R2.

4. Analytics

  • We use Cloudflare Web Analytics to understand use of the Service. Cloudflare Web Analytics does not use cookies and measures traffic in a way that does not identify individuals.
  • We also use identifiers issued by the Service itself to measure activity after a visitor arrives, views of public travel journals, and successful map displays or the first interaction with an embedded map. We do not link anonymous map events to an authenticated user, and we do not collect views, plays, or reactions that occur inside social-media services.
  • Acquisition data in local storage is retained for no more than 30 days and is no longer used after it has been associated with registration or has expired. Unidentifiable traffic is not inferred and linked to an individual.
  • Visit and acquisition details stored on our servers are deleted by daily processing after 31 days have elapsed from arrival and moved into daily and initiative-level statistics that do not contain user IDs or the data linking those IDs to the records. For a registered user whose acquisition source was recorded, we keep only the pseudonymous linkage needed to aggregate first use through day 28 after registration. Once daily processing reaches day 28, we move the available result into statistics without the user ID or linkage and delete that linkage even if part of the measurement period is missing. We do not use names, email addresses, or other directly identifying information as initiative, post, video, or similar analytics identifiers.

5. Third-Party Disclosure and Service Providers

  • We do not provide personal information to third parties without your consent, except where required by law.
  • We may entrust handling of information to cloud-service providers such as AWS and Cloudflare to the extent necessary to provide the Service.
  • We use Cloudflare Turnstile to prevent automated submissions and other misuse of the contact form. See Cloudflare's Turnstile Privacy Addendum for information about its data practices.

6. Information Made Public

  • A travel journal becomes public only when its owner chooses to publish it. Anyone with the URL can then read it, and it may appear in the public list and search results. The owner chooses whether to publish each record.
  • Photographs and other uploaded media can be retrieved without authentication by anyone who knows the public URL used to display them. The Service does not expose a list of another user's media, but unpublishing a travel journal or removing media from an article does not necessarily invalidate a previously shared media URL or copies already retrieved or cached by a browser or content-delivery network. Deleting the media itself removes the stored object.

7. Data Deletion

  • When a user deletes their account, we delete the account and the travel records registered through it.
  • If usage analytics contains a link to a user, we remove that link when the account is deleted. We may retain finalized statistics after removing their association with a user ID to operate and improve the Service.

8. Changes to This Privacy Policy

  • We may change this Policy when necessary. A revised Policy takes effect when it is displayed through the Service.

Established: July 5, 2026

Last revised: July 24, 2026