§ 1. Data Controller
1. The Data Controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is the individual creator and owner of the Silent Atlas online platform, operating the site for non-commercial educational and community purposes (hereinafter referred to as the "Controller").
2. For privacy matters, data subject rights inquiries, and notices, you may contact the Controller directly via email at: [email protected].
§ 2. General Principles and Data Minimization
1. The Controller processes data in full accordance with GDPR principles, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
2. The Platform is built on Privacy by Design and Privacy by Default:
- Browsing and using all creative features is anonymous;
- No registration, account creation, real names, phone numbers, or residential addresses are collected.
§ 3. Creative Tools and 100% Photo Privacy (Local-Only Processing)
1. Users can freely access our digital utilities: Travel Board (Keepsake Board Generator), Quick Stories (Story Generator), and Magnet Studio.
2. Client-Side Processing Technology: All photos, travel memories, and image files uploaded into these tools are read and manipulated solely within the local memory of the User's device and web browser (client-side processing) using IndexedDB / LocalStorage.
3. Zero Server Transmission: Images are never transmitted to the Controller's servers or any third-party cloud. The Controller cannot view, copy, or retain user photographs.
4. Generated images (JPG, PNG) and video files (MP4) are compiled locally on the User's hardware and saved to their device exclusively upon their direct command.
§ 4. Community Module: "Atlas of Reviews"
1. In the Atlas of Reviews module, Users may voluntarily share ratings, reviews, and travel tips regarding visited countries and regions.
2. Processed Data Scope: optional author handle / nickname (e.g., first name, handle, or "Anonymous"), reviewed country and city, category scores, text review or comment, and timestamp of publication.
3. Legal Basis for Processing:
- Art. 6(1)(a) GDPR (Consent): Publishing a review in the public community feed occurs at the direct request of the User via clicking the submit button;
- Art. 6(1)(f) GDPR (Legitimate Interest): Community moderation, anti-spam defense, filtering unlawful content, and compiling aggregated, anonymous statistical leaderboards.
4. Right to Erasure / Rectification: Any author may request removal or correction of their published review at any time by contacting: [email protected] with specific reference to their submission.
5. Automated Language Processing & Machine Translations: To ensure global accessibility and seamless understanding across international travelers, review texts may be subjected to automated machine translation and automated anti-spam/moderation scans (using secured cloud API interfaces). This processing applies solely to publicly submitted review text and involves no transmission of private personal identifiers.
§ 5. Email Communications & Breach Reporting
1. When contacting the Controller via email ([email protected]) or submitting an inappropriate content flag ("🚩 Report"), the sender's email address and message contents are processed.
2. Legal Basis: Art. 6(1)(f) GDPR – legitimate interest in handling user inquiries, providing technical support, and fulfilling obligations under the EU Digital Services Act (DSA).
3. Correspondence data is stored only as long as necessary to address the request and safeguard against potential legal claims.
§ 6. Security, Server Logs, and Global Infrastructure (Cloudflare)
1. The Platform operates over the enterprise-grade global edge network of Cloudflare, Inc. (including Cloudflare Pages, Workers, CDN, and DNS security).
2. All web connections are encrypted end-to-end via modern SSL/TLS (HTTPS).
3. During visits, Cloudflare edge servers automatically log standard technical telemetry (server logs): visitor IP address, timestamp, browser/OS version, and requested URI.
4. These technical logs are not tied to identified individuals and are utilized strictly for platform reliability, mitigation of cyber threats (DDoS attacks, malicious bots), and global CDN acceleration (Art. 6(1)(f) GDPR).
§ 7. Cookies, Google Consent Mode v2, Google Signals, and Analytics
1. The Platform uses browser storage (LocalStorage, IndexedDB, Service Worker) for core operational features.
2. Google Analytics 4 & Google Consent Mode v2: The site utilizes Google Analytics 4 provided by Google Ireland Limited, adhering strictly to Google Consent Mode v2. Analytics and advertising tags are blocked by default (denied) and only execute after voluntary user consent via the cookie banner.
3. Google Signals: With affirmative consent, Google Signals may compile aggregated, non-personally identifiable demographic benchmarks (approximate age brackets, general interest categories) for users logged into Google Accounts with personalized ads enabled. Users can adjust or revoke ad personalization at: https://myadcenter.google.com.
4. Consent Management & Revocation: Users retain the right to update or withdraw their cookie consent at any time by clicking the floating "Cookies" icon or the "Cookie settings" footer link.
§ 8. Outbound Third-Party Links
1. The Platform provides vetted links to external services:
- Partner Print Facility: When ordering physical collector posters is activated, transactions are fulfilled directly by an independent print partner acting as a distinct data controller;
- Buy Me a Coffee: External platform for voluntary creator support, processing payments under their respective privacy framework;
- Official Social Media: Links to Silent Atlas profiles on YouTube and Facebook.
§ 9. Your Rights Under GDPR
Under European privacy law, every individual has the right to:
- Access (Art. 15 GDPR): Confirm whether personal data is processed and receive copies;
- Rectification (Art. 16 GDPR): Correct inaccurate personal data;
- Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request prompt removal of published reviews or email logs;
- Restriction of Processing (Art. 18 GDPR): Request suspension of data processing;
- Objection (Art. 21 GDPR): Object to processing based on legitimate interests;
- Consent Revocation: Withdraw cookie or publication consent at any time;
- Lodge a Complaint: File a formal grievance with the competent supervisory authority (e.g., Polish PUODO or your local European Data Protection Authority).
To exercise any of these rights, simply email: [email protected].
§ 10. Privacy Policy Updates
1. The Controller may update this Privacy Policy to reflect technological refinements or statutory changes.
2. The current version is always available free of charge at https://silentatlas.app/en/privacy (and in Polish at https://silentatlas.app/polityka-prywatnosci).
3. This policy becomes effective upon publication.
