Privacy Notice

1. Scope and operator

World100K is an independently developed and self-funded hobby project operated from the European Union. This notice explains how the independent operator of World100K handles information when people visit or interact with the project.

For the processing described in this notice, the independent operator of World100K acts as the data controller.

World100K is a general-audience project and is not specifically directed to children. It does not request a user's age as a condition of browsing the public map. Eligibility for accounts and interactive features is explained in the Terms of Service.

2. Information World100K handles

Account and authentication information

World100K may process:

• a random account identifier and account status;
• an Account Key lookup value and a verifier derived from the secret part of the key;
• passkey credential identifiers, public keys, counters, supported transports, backup state, and usage timestamps;
• authentication challenges, session identifiers, session-token hashes, expiry information, and authentication method; and
• account restrictions and security-event information.

World100K does not require an email address, telephone number, payment details, password, or real name to create an account. The secret part of an Account Key is not stored in readable form. Passkey private keys and device biometrics remain with the user's authenticator and are not received by World100K.

Profile and public Submission information

World100K may process and publicly display information people choose to submit, including:

• avatar or display names and appearance choices;
• home-tile and tile-entry information;
• images, country or flag selections, website links, and radio-station selections;
• comments, chat messages, and related display information; and
• submission dates, update dates, status, and moderation information.

Public Submissions can be viewed by anyone. Do not treat a public Submission as private storage.

If a Submission depicts another person, including a person under 18, the uploader is required by the Terms of Service to have the appropriate permission. World100K does not verify family relationships, guardianship, or permissions before publication.

Technical, security, and activity information

World100K may process:

• IP addresses and shortened network ranges;
• random device identifiers;
• account, upload, comment, chat, and authentication-attempt records;
• tile views and other feature interactions;
• timestamps, result codes, rate-limit information, and security-event details;
• image or text hashes used to detect repeated material; and
• image and text moderation results.

This information is used to operate the project, count legitimate activity, prevent manipulation, enforce limits, investigate errors, and protect accounts and services.

3. Why information is used

World100K handles information where it is reasonably necessary to:

• provide features a user requests and administer accounts;
• publish and technically present Submissions;
• authenticate users and maintain secure sessions;
• prevent spam, fraud, automated misuse, repeated submissions, and security attacks;
• moderate images and text and enforce the Terms of Service;
• count visits and understand aggregate use of the project;
• diagnose faults, maintain the service, and improve reliability; and
• comply with applicable legal obligations or protect legal rights.

Depending on the circumstances, these purposes rely on providing the requested service, the operator's legitimate interests in running and protecting World100K, compliance with legal obligations, or another lawful basis available under applicable data-protection law.

World100K does not sell personal information and does not use it for targeted advertising.

4. Cookies and browser storage

World100K uses limited first-party cookies and local browser storage for operation, security, and user-requested settings:

• Device cookie: stores a signed random device identifier used for anti-abuse limits, tile interactions, comments, and chat. It may remain for up to one year.
• Authentication cookie: stores an opaque session token after sign-in. It normally remains for up to 60 days unless the session is revoked, expires, or the user signs out.
• Mutation-security cookie: stores a signed session and anti-forgery value used to protect state-changing requests. It remains for up to 24 hours.
• Local preferences: display names, avatar position, map or minimap settings, movement settings, audio preferences, and similar choices may remain in the browser's local storage until changed or cleared through the browser.
• Cloudflare Turnstile: when an anti-bot challenge is required, Cloudflare may process technical information needed to provide and verify that challenge.

World100K also uses Vercel Web Analytics for aggregate page and visitor statistics. According to Vercel, this analytics service does not use cookies, does not associate page views with an IP address available to World100K, and resets its visitor-identification hash after 24 hours. It may process page URL, referrer, approximate location, browser, operating system, and device type for aggregate reporting.

World100K does not currently use advertising cookies or cross-site behavioural tracking.

5. Service providers and external services

Information may be processed by providers used to operate World100K:

• Vercel provides website hosting, serverless infrastructure, technical logs, and cookieless aggregate Web Analytics.
• Neon provides database infrastructure.
• Cloudflare provides image storage through R2 and anti-bot verification through Turnstile.
• Sightengine may receive submitted images or text for automated moderation.

When someone opens a user-provided website or plays a third-party radio stream, that external service receives the ordinary connection information sent by the person's browser. Those services operate under their own privacy terms.

Information may also be disclosed when reasonably necessary to comply with applicable law, a valid legal process, or an urgent need to protect the security or rights of the project or others.

6. International processing

Some service providers operate internationally and may process information outside the European Economic Area. Where data-protection law requires safeguards for an international transfer, World100K relies on the safeguards made available by the relevant provider, such as approved contractual protections or another lawful transfer mechanism.

Public Submissions are available worldwide by their nature.

7. Automated moderation

Automated systems may check images and text for prohibited or unsafe material, detect repeated or abusive activity, apply rate limits, or reject a submission. Automated moderation may produce false positives or fail to detect prohibited material. World100K does not use automated processing to make decisions that produce legal or similarly significant effects about an individual.

8. Retention

World100K keeps information only for as long as reasonably needed for the purposes described in this notice, including operating public features, securing accounts, preventing abuse, maintaining technical records, resolving disputes, and complying with law.

In general:

• public Submissions may remain available while they form part of World100K, unless removed by the operator or where removal is legally required;
• account and authentication information may remain while an account exists and for a reasonable period needed for security, backup, and dispute handling;
• expired sessions, short-lived challenges, IP-address records, attempt logs, and other security information are retained only for the period reasonably needed for their operational or security purpose;
• moderation caches and non-identifying aggregate counts may be retained to prevent repeat abuse and maintain the project; and
• information stored only in a user's browser remains until it expires or the user clears it.

Service providers may keep limited backup, security, and technical records according to their own documented retention cycles. Retention practices will be reviewed as World100K develops.

9. Individual rights

Depending on applicable law and the circumstances, individuals may have rights to request access to, correction of, deletion of, or restriction of personal data, to object to certain processing, and to receive certain information in a portable form. Individuals may also lodge a complaint with the data-protection authority responsible for their place of residence or the operator.

These rights are not absolute. For example, some information may need to be retained for security, legal compliance, freedom of expression, the rights of others, or the establishment or defence of legal claims. World100K may request information reasonably necessary to verify that a request concerns the person making it.

10. Security

World100K uses technical and organisational safeguards intended to protect information, including hashed or opaque credentials, secure cookies, access controls, rate limits, and moderation measures. No internet service or storage system can guarantee absolute security.

11. Changes to this notice

This notice may be revised as World100K, its providers, or its data handling changes. The current version will be posted on the Privacy page.

12. Privacy contact

Privacy correspondence may be sent to project@world100k.com.