Privacy

Impossible Atlas is a live performance tool. A performer starts a short, temporary performance and hands you a link so you can choose a point on a map. This page explains what happens with that choice, and separately what we keep about performers who bought a licence.

If someone handed you a map (spectators)

You do not have an account and we do not ask for your name or e-mail address. The app never asks for your device's location and does not use GPS, your camera, microphone, contacts or photos. There is no advertising, no analytics and no third-party tracking script on the page you were handed.

What the app does send. The point you place by hand is sent to the performance server once it has been still for a few seconds, so the performer's screen can follow along — not while your finger is moving, but before anything is final. When you place a pin, that place is also looked up so your phone can show its name, address and photos, which means our server asks Google's geocoding and places services about it. If you type in the search box, the text you submit is sent the same way. The performance ends with one final point, which is the one the performer is shown.

What is stored about it. The performance row holds the chosen position, the place identifier if there was one, and what the server worked out from it (address, city, country, a nearby landmark), plus the times things happened. It also holds a random identifier for the page you were given and a hash of the capability your browser was issued, which is what stops a second device from taking over the performance. There is no account, no name, and nothing that identifies your phone.

How long. A performance expires automatically, 60 minutes after it starts by default. Once it has expired, every part of the app refuses it, and the row itself — with the position and everything derived from it — is deleted by a cleanup job that runs on a schedule (daily, plus whenever a new performance is created, at most once every 15 minutes). So an expired performance is unusable at once and physically gone within about a day. We keep no history of chosen locations.

IP addresses, devices and logs

We do not store IP addresses. To stop one phone or one network from flooding the service, the server keeps a counter whose key is a shortened one-way hash of the address; the address itself is never written down, and those counters are deleted within an hour.

We store no user-agent string, no device model and no fingerprint of any kind. For a performer's own devices we store one coarse word for the device that controls performances — “iPhone”, “Android phone” and six others — shown only on the screen that offers to move control, and never used to decide anything.

Server logs contain no IP address, no user-agent, no coordinates and no place names. Identifiers appear only shortened or hashed, and error reports carry the type of error without its message. Logs live with our hosting provider under their retention, not in a store of our own.

If you bought a licence

Your account. The e-mail address you sign in with and your password are held by our authentication provider. You choose that address at activation, and it does not have to be the one you bought with.

Your purchase. We keep the licence itself: the product, its status, how many performances it has run and how many are left, and the packs bought for it. The purchase e-mail address is kept only until the licence is activated (or the pack applied) and is then deleted by the database. Licence and pack records are business records and are not deleted automatically.

The shop and the bookkeeping are separate. Payments run through our shop, and card details never reach this service. Deleting the purchase address from this app does not delete the order in the shop or the invoice in our accounting — those are records we are required to keep, and they have their own retention.

Performance history. One row per charged performance, holding the licence, the performance identifier and the time, and no location at all. It is what answers “why is my balance lower than I expected” and is deleted after 90 days. Deleting it does not touch the financial records above.

Links and codes. Activation links are stored only as a hash and work for 30 days; pack links the same, for 90 days. One-time codes for switching device, resetting a password or confirming an address are stored only as a keyed hash, work for 10 minutes, and are deleted a day after they expire. The table that holds them contains no address.

Operational timing. We record a small set of timing events — a performance was claimed, a pin arrived, a notification was shown — to see whether the product works. They carry a performance identifier, an event name and a number of milliseconds. No coordinates, no place, no spectator identity. They are deleted after 30 days. There is no third-party analytics anywhere in the app.

Withdrawal requests. If you ask to withdraw from a purchase, we keep what you submitted — the order reference, the e-mail address to reply to, anything you wrote, and the time — because it is the record of a legal request. It is not deleted automatically.

There is no self-service account deletion yet. Write to us and we will do it; the licence ends with the account rather than being freed for someone else.

Who else is involved

Google Maps. The map itself is Google Maps, loaded by your browser, so Google sees the map traffic directly, including the photos of a place you opened. Our server also asks Google to turn coordinates into an address, to describe a tapped place, to find places nearby and to look up text you searched for. If the performer has turned it on, their own phone opens Google Maps on the final point when it freezes, so Google also receives that point from the performer's phone. Your use of the map is subject to Google's own terms and privacy policy, linked from the map. We are independent of Google.

Our database and hosting provider store and serve everything described above on our behalf. Our e-mail provider sends the activation links, codes and purchase confirmations, and therefore sees the recipient address and the content of those messages. Our shop handles purchases and sends us signed notifications of them.

Notifications. A performer's result notification travels through the push service belonging to their browser or phone. The content is encrypted end to end, so the push service can see that a message was delivered but not what it said.

Asking us something

Write to info@webtovenaars.nl with any question about your data, or to ask for a copy or deletion of it.