What this site knows about you.

This site is run by Lucas Weinmann, in São Paulo, Brazil, as a personal project. Under the Lei Geral de Proteção de Dados I am the controller of the data described here. Write to lucaspiccoliw@gmail.com about anything on this page.

Browsing the catalogue and the map needs no account and stores nothing about you beyond the server logs described further down.

If you make an account, the site stores your email address, your password, a username, a display name, and — if you fill them in — a short biography and an avatar. The password is stored as a hash, which means the site cannot read it and neither can I.

After that it stores what you do here: the works you mark as visited, the date you give for each visit, any note you write, any photograph you upload, and which collections you have completed.

Your profile is public. Anyone who opens it — signed in or not — sees your display name, your username, your biography, your avatar, the works you have visited, your notes, your photographs and the collections you have finished. The same material appears on building pages and in the feed.

Your email address is never shown to anyone and never appears on a page. Your password is shown to nobody, including me.

You can change your display name, username, biography and avatar at any time in settings. A visit can be edited or deleted from the building it belongs to.

Before a photograph leaves your phone or computer it is re-encoded in your browser, and that discards its EXIF data. The location where the picture was taken, the camera, the serial number and the timestamp never reach the site at all.

Photographs are stored at public web addresses. That means anyone holding the link to one can open it without an account, in the same way an image on any public page can be linked to. Deleting a photograph removes the file itself, not only its place on the page.

Your profile photograph takes the same route. It is cut to a square and re-encoded in your browser before it is uploaded, it sits at a public address like the others, and removing it in settings deletes the file.

One cookie, and it exists to keep you signed in. There is no advertising, no third-party pixel, and nothing that follows you to another site.

The site counts the pages people open, so that I know whether anyone is reading it and which works they look at. It is written and run by me, on this domain. No outside company is involved and nothing about you is sent anywhere else.

What is recorded for each page opened: the page itself, the site you followed a link from, the country your connection appears to be in, and rough facts about the browser — mobile or desktop, Chrome or Safari, iOS or Windows. No account is attached to any of it, so a page you open while signed in is no different from one you open as a stranger.

Your IP address is never written down. It is used for a moment, mixed with a secret that is generated at random each day, to produce a short code that lets the count tell one person from two. The secret is deleted after two days, and once it is gone those codes cannot be reversed, recalculated or matched against another day’s by anyone — including me, and including anyone who obtained a copy of the database. That is the whole reason it is built this way: there is no cookie to refuse and no profile to build, because after two days the material to build one no longer exists.

Counts are kept for twelve months and then deleted.

The site never emails you. There is no newsletter, no notification and no password reset. Your address is there to identify your account and to let me reach you if something about it needs a person.

Map tiles are served by OpenStreetMap. When a map loads, your browser asks their servers for the tiles directly, which means OpenStreetMap sees your IP address as any website you visit does. Nothing about your account goes with that request.

Three companies, each doing one job. Vercel hosts the site and keeps ordinary server logs, which include IP addresses and the pages requested. Supabase holds the database and the photographs. Resend sends one kind of email: an alert to me when somebody reports a photograph — never anything to you.

All three run outside Brazil, mostly in the United States, so storing your data here means it is transferred abroad. None of them is permitted to use it for anything but running this site.

A photograph, a visit note or a profile can all be reported. The site keeps a record of each one: the reason given, who reported it, whose it was, what was decided, and — for a note or a profile — a copy of the words complained about, so that the record still says what was actually said after the words have been changed or cleared. That record outlives the thing it is about, so that a repeated problem can be recognised. Reports are visible only to me.

A report is deleted twelve months after it is decided. One that is still waiting on me is kept until it is dealt with, however long that takes — an unanswered report is work outstanding rather than a record.

Finishing a collection lets you download a card, and that card has your display name printed on it. It is yours to keep or to post wherever you like; once it leaves the site, where it goes is out of my hands and out of yours.

Brazilian law gives you the right to know what is held about you, to correct it, to delete it, and to receive a copy. Correcting and deleting both work here and now, in settings.

Deleting your account removes it along with everything attached to it — your visits, your notes, your photographs and your completed collections. It is immediate and it cannot be undone. Nothing is kept back except the moderation records described above, with your name removed from them.

A copy of everything is a download away, in settings: your account, every visit with its date and note, the addresses of your photographs, and the collections you have finished, as one file. What it leaves out is listed inside it.

For anything this page does not answer, email lucaspiccoliw@gmail.com.

If what the site does changes, this page changes with it and the date at the top moves. Since the site does not email you, there is nowhere to send a notice — checking the date is the way to know.

The other half of the arrangement is on the terms of use.