ViaCache privacy policy
Who operates ViaCache
ViaCache is an outdoor-discovery and private-quest service from NSF Labs. This draft uses NSF Labs LLC, Florida, United States, as identified on the NSF Labs website; the operator’s exact legal identity is subject to owner confirmation. It covers viacache.com and the ViaCache Android, iPhone, and iPad apps. Public reference datasets also have their own source notices and attribution.
Information we process
- Accounts: email address, display name, profile information, password hashes for email sign-in, and sign-in/session records. If you choose Apple, Google, or Facebook sign-in, the provider supplies identity details such as an account identifier, name, email, and profile image where available. We do not receive your provider password.
- Your activity and content: saved places, journals, cache submissions, descriptions, questions, answers or answer checks, photos, reports, reviews, quest settings, participation, progress, timestamps, and find-verification results.
- Device and service information: network addresses, browser/device information, request information, errors, and security/rate-limit records needed to deliver and protect the service. Network and hosting providers also process connection metadata.
- Local storage: browser settings and guest saves/journals, session cookies, and phone preferences. Mobile credentials are stored in platform-protected storage; signed-in account records are stored on our servers.
Location and maps
You can scout a chosen map area without using your current location. “Near me,” on-site find recording, and field placement use foreground location with device permission. Search coordinates go to our service. Find submissions include coordinates, accuracy, and timing so we can check proximity and freshness; stored activity can identify the cache or checkpoint visited, the time, and the verification result. Published cache and quest-checkpoint coordinates are part of the content you choose to share.
The pilot does not run continuous background location tracking. Turning off location may prevent location-dependent features. Google Maps receives map and search requests and associated technical information; opening directions sends the chosen destination to Google Maps. Air-quality lookups send our server the requested coordinates; the server rounds them to one decimal place before querying AirNow. A map area may describe a planned trip rather than your current location.
Photos, documents, and optional AI
Photo uploads are processed on our server, resized and re-encoded without embedded EXIF metadata before storage. Sanitized images are sent to Cloudflare Workers AI for content screening and may be reviewed by authorized moderators. Approved photos may become public with an approved cache listing. Do not upload sensitive documents, faces or identifying details without appropriate permission.
Quest documents are uploaded for parsing into questions and settings. When you request AI-assisted drafting, submitted source text and drafting settings are sent to our Cloudflare AI service to generate proposed questions. Saved quests retain the content you choose to keep. AI output requires review; the feature is not a confidential document vault. The raw-document and service-log retention schedule remains an owner-review item.
How we use information
We use information to operate accounts, display maps and discoveries, run quests, verify field activity, deliver account emails, moderate content, prevent abuse, respond to support requests, and maintain backups and service reliability. The current implementation does not include advertising SDKs or a data-broker sales feature. This statement does not mean that third-party maps, sign-in, hosting, or payment providers collect no information.
Who receives information
- Other users: approved public listings and their shared content are visible publicly. Private quests and participant information are available according to invitation and role permissions. People with access can copy information; keep invitation links private.
- Infrastructure: our primary hosting, DigitalOcean standby/backup server, and Cloudflare networking, storage, email and AI services process data for the relevant functions. Data may be processed in the United States and other locations used by these providers.
- Sign-in, maps and air quality: Apple, Google, Facebook and AirNow receive information relevant to the features you use. Their own policies govern their independent services.
- Payments, when enabled: optional native tips use Apple or Google Play. Website support opens Buy Me a Coffee. The provider handles payment details and receipts. The app receives transaction status and product information; ViaCache does not ask for or store your full card number. Store/payment-provider records may remain even if a ViaCache account is deleted.
- Support and legal needs: authorized operators may access information to resolve requests, investigate abuse, or respond to applicable legal requirements.
Storage, retention and security
We use HTTPS, access controls, protected credentials, and encrypted database backups. No system can guarantee absolute security. Signing out or uninstalling the app does not delete server-side account data. Current browser and native sessions have limited lifetimes; account and content records can remain until removed.
Nightly encrypted snapshots are copied to an off-site server. The off-site job retains the newest 30 snapshots; additional administrator recovery copies may last longer. A deletion may not immediately disappear from existing backups. Exact account, content, logging, recovery-copy and deletion-retention periods must be finalized before adoption of this policy; this draft does not promise a deletion deadline that is not implemented.
Your choices and requests
You can change location permissions in device settings, sign out, edit supported profile/content fields, and clear browser-local data. To request access, correction, export, or deletion of account information, contact [email protected] and identify the request and account email. Do not send a password, payment card number, or private key. Identity verification may be needed. The pilot does not yet have a complete self-service account deletion/export workflow; owner review and implementation are required before public-store launch. Applicable privacy rights and response requirements depend on your location and circumstances.
Children and family activities
Family-friendly destinations or age-tailored quest questions are not a completed child-account or parental-consent system. Owner review required: decide the minimum account age, guardian participation rules, and child-data handling before a public release or school use. Do not treat this draft as confirmation that ViaCache is approved for independent use by children.
Changes and external services
A final policy should display its effective date and explain how material changes will be communicated. Links to other sites open services with their own policies. This draft may change as the pilot, store payments, and privacy controls are completed.
Contact
NSF Labs · [email protected]
Subject: ViaCache privacy