Privacy Policy

Data collected

When you submit a measurement, we record: the measured value (in Bq/m³), the test type and duration, and — if you provide them — the building level, dwelling type, an approximate neighborhood, and a comment. No account is created, no email address is requested, and no name is collected.

The address you type to locate your measurement is used only for geocoding: it is never stored. Only the resulting coordinates — already jittered, see below — are retained.

Published position

The position published on the map is jittered exactly once, at submission time, and frozen forever after — it is never recomputed and cannot be reversed from the published data.

The jitter radius adapts to the local density of already-published measurements, but always stays between roughly 100 meters and 1000 meters: an isolated point in a rural area never resolves to a specific address.

Navigation geolocation: if you allow it, your browser shares your position with this page to center the map on your neighborhood and, in the submission form, to propose where the pin goes when that position is accurate enough. The position stays in your browser — it is never sent to our servers, recorded, or logged. If you then choose to submit a measurement, only the jittered coordinate described above is transmitted, never the exact position your device computed. Declining disables no feature: the pin can just as well be placed by hand or through an address search.

Rate limiting

To limit abuse, the system identifies the source of a submission by an HMAC of the IP address — never the raw IP address itself — combined with a salt that automatically rotates every day. Old salts are kept for only 48 hours before being deleted. The limit applied is 3 submissions per 15-minute window for a given derived identity.

Rate-limit records (the HMAC result, not the IP address) are purged after 24 hours. No permanent record ties a submission back to an IP address.

Edit link

After you submit, a secret link containing a cryptographically random 256-bit token lets you later add a post-mitigation reading or delete your submission. Only a hash of this token is stored on our servers — the token itself is shown to you exactly once, on the confirmation screen.

If you lose this link, your submission can no longer be edited or deleted by you: there is no account recovery, by design.

Public access

The public map never exposes the true (unjittered) coordinates of a submission, nor the hash of your edit token. Only the already-jittered coordinates and the measurement fields are publicly accessible.

Retention

• Rate-limit identifiers: at most 24 hours (the rotating salt itself: 48 hours).
• Address entered for geocoding: never retained.
• Published measurement and jittered position: retained until you delete them via your edit link, or you request deletion via the contact below.

Right to erasure

You can permanently delete your own submission at any time via your secret edit link. If you have lost this link, you can request deletion by contacting us below — but without the token or any other identifying information, we may not be able to locate the specific submission. We therefore cannot guarantee a manual deletion path when the token is lost.

Privacy Officer