Privacy Policy

Information you provide

If you use our contact form, we collect the information you submit: your name, email address, subject, request type, and message. Phone number and address are optional. We keep the request so our team can review it and respond, including keeping replies in the same conversation.

If you have an account, we process the username, name, email address, and account credentials needed to manage it. Passwords are stored as password hashes, not as readable passwords.

Information collected for security and site features

When you sign in or attempt to access a protected area, security logs may record the login identifier, IP address, browser user-agent, requested route, time, and outcome. The contact form also uses a verification challenge to prevent abuse; the challenge is associated with a protected, hashed network identifier and expires after a short period.

The site stores your theme preference and may cache map place lookups in your browser's local storage. If you use a dinosaur location map, a place-name query may be sent to Photon at photon.komoot.io to find a location. That service receives the query and standard connection information such as your IP address; its own privacy terms apply to its processing.

When you sign in, an essential authentication cookie is used to keep your session secure. You can manage or clear browser storage and cookies through your browser settings, though clearing the authentication cookie will sign you out and disabling storage may affect site features.

Optional analytics

If you accept optional analytics in the cookie prompt, we derive a persistent, 64-character pseudonymous visitor identifier from your IP address using a one-way keyed HMAC. We do not store the raw IP address in the analytics database. A first-party cookie stores this identifier, and a separate temporary cookie stores a random session identifier. We record page paths (not query strings), content identifiers where relevant, time spent on a visible page, maximum scroll depth, and whether mouse, touch, or scrolling interactions occurred, solely to differentiate bots from human users. We also record selected site actions, such as searches being submitted and dinosaur information tabs being selected.

These identifiers are not linked to account details or browser user-agent strings. With your consent, our server also sends the request IP address to ipwho.is to look up approximate city, country, ISP, and ASN information, along with any network-risk fields included in its free response. The provider receives the IP address for the lookup. Analytics records, including the pseudonymous identifier, search phrases, and available lookup results, expire after 180 days. We exclude known bots, configured trusted administrative IP addresses, and authenticated administrator traffic where identified. Search phrases are stored in our first-party analytics database and are not sent to Google Analytics. You can decline or change your choice at any time using the Privacy settings link in the site footer; declining stops future collection and clears the analytics cookies.

How we use information

• To operate and maintain the website and account features.
• To review contact requests and communicate with you about them.
• To authenticate accounts, protect the site, and investigate abuse or technical issues.
• To remember site preferences and provide requested map features.
• To meet legal obligations and protect our rights where necessary.

Sharing and service providers

We do not sell personal information. Information may be processed by providers that help us host the site, store its data, or deliver email replies, and may be disclosed when needed to comply with law, protect users, or secure the service. These providers process information for the relevant service. Photon receives location-search requests as described above when you use that feature. ipwho.is receives request IP addresses for the optional analytics lookup described above.

Retention and security

We keep information for as long as reasonably needed for the purposes described here, such as handling a conversation, maintaining an account, or protecting the service. Retention can depend on operational and legal requirements. We use safeguards intended to protect information, but no online service or storage system can be guaranteed completely secure.

Your choices and requests

You can ask us to access, correct, or delete personal information you have provided, subject to applicable requirements and any information we need to retain for legitimate purposes. You may also choose not to provide optional contact details. To make a request, use our contact form or email Show support email.

Children's privacy

If you believe a child has provided personal information through the site and would like us to review or remove it, please contact us using the form or support email above.

Changes to this policy

We may update this policy as our site or practices change. The latest version and its update date will be posted on this page.