Privacy

Three things, and only three:

• A push subscription, only if you turn alerts on. When you enable alerts, your browser issues a subscription: a unique endpoint address plus two encryption keys. We store those so we can send you a notification. We never see your email, phone number, or device name, and we cannot trace the subscription back to you.
• Ordinary server logs. Like any web server, ours records requests — including your IP address, the page requested, and your browser’s user-agent string. These exist to debug faults and detect abuse.
• Aggregate traffic measurement, via Google Analytics. Which pages are opened, roughly where in the world from, which site sent you, and how far down a page you scrolled or which outgoing link you followed. Google sets cookies in your browser to recognise a returning visit, and receives your IP address in the process. We use it to see which earthquakes people actually read about and whether the explanations get read at all; we never attach any of it to a push subscription, and there is no account to attach it to in the first place.

• No accounts, sign-ups, names, or email addresses.
• No analytics beyond aggregate traffic. Nothing is recorded per person, and nothing identifies you by name.
• No cookies other than Google Analytics' own, and an administrator session cookie issued solely to whoever operates the service.
• No advertising, and no data sold or shared with advertisers.
• No location access. The site never asks for your position, and the map is centred on the earthquake, never on you.

Your light or dark theme preference is kept in your browser’s local storage. It never leaves your device and is never sent to the server.

• Your browser’s push service — Google, Mozilla, Microsoft, or Apple, depending on your browser. Web Push works by handing the notification to them for delivery; there is no way around this. The contents are encrypted with keys only your browser holds, so the push service can see that a message was delivered but not what it said.
• Google — Analytics runs on their infrastructure, so they receive your IP address and the pages you opened, and may use that data under their own terms. Blocking the script, or any tracker blocker, stops this entirely and the site works exactly the same without it.
• Esri — map tiles load directly from Esri’s servers, so they receive your IP address and which part of the map you looked at. This happens on any page showing a map.
• Our hosting provider — which necessarily processes requests in order to serve the site at all.

Fonts are served from our own domain rather than a font provider, so no request leaves your browser for them.

To delete your push subscription: open the site and turn alerts off. The record is deleted from our database immediately, as part of the same action. You can also revoke notification permission in your browser’s site settings — we detect a dead subscription on the next send and delete it automatically.

Subscriptions that fail repeatedly are pruned without being asked. Server logs are retained only as long as our hosting provider keeps them.

For anything else, write to hello@quakewire.com.

The service is not directed at children and does not knowingly collect data from them. There is little to collect in any case: enabling alerts requires no identity of any kind.

If this policy changes in a way that affects what is collected, the date at the top of this page changes with it. There is no mailing list to notify you through, because we do not have your address.