WhereCare Privacy Policy

Who operates WhereCare

WhereCare is operated by an individual in the United States, not by a registered company. For questions about who runs the service, contact jon@etherlabs.app. Privacy, access, correction, and deletion requests should go to privacy@etherlabs.app, and everything else to support@etherlabs.app.

Information you provide

• Account information: email address, username, password hash, verification status, role, and account history.
• Identity-change history: previous usernames and the old/new email addresses, status, and dates associated with an email-change request. Confirmation tokens are stored only as one-way hashes.
• Verified badge requests: the review basis, statement, optional public supporting link, decision notes, expiration, and revocation history you or an administrator provides.
• Community content: venue details and coordinates, facility reports, room-specific caregiver notes, votes, reviews, edit suggestions, report reasons, and moderation records.
• Photos: uploaded facility images and captions. Uploads are sanitised before storage and reviewed by moderators.
• Support messages: information you choose to send by email, including screenshots or device details.

Passwords are hashed with Argon2id and are not stored in plain text. Public contributions may display your username. Email addresses are not displayed publicly.

Location information

If you choose “Use my location,” the browser supplies your device location so WhereCare can center the map, sort nearby places, prefill a place submission, or run Travel Mode while the PWA remains open. Travel Mode watches location only after you start it and stops when you stop it or the app closes; WhereCare does not perform background location tracking. Device coordinates are used to request nearby map results. Along Route also sends WhereCare narrow search areas derived from the active route so matching places can be found. These trip searches are not attached to your account, and WhereCare application logs omit their query details. Coordinates for a place are stored only when you intentionally submit that place. Map providers receive normal request information, such as IP address, referrer, and the map area being viewed, under their own policies.

Device storage and cookies

• A secure, HTTP-only, same-site session cookie keeps signed-in accounts active for up to 30 days unless the user signs out or the session is revoked.
• The Account screen shows each active session's creation, last-seen, and expiration times and lets you revoke other sessions. WhereCare does not create a device fingerprint or store a browser/device label for this feature.
• Local storage remembers theme, device-only favorites, Travel Mode amenity/distance settings, and whether an install prompt was dismissed.
• IndexedDB stores places and areas a user intentionally saves for offline use.
• Cache Storage holds the PWA shell and recent venue responses so supported pages can reopen with limited connectivity.

Browser settings can clear this device data. Blocking the session cookie prevents account sign-in. Offline map tiles are not guaranteed.

Service providers

• Cloudflare provides the public network edge and may process IP addresses and request metadata.
• Google Maps and Places provide the production map, place lookup, and route previews.
• OpenStreetMap is used only when Google Maps is unavailable or not configured. In that fallback it supplies map tiles, and address searches send your typed query and an approximate location, or the coordinates of a dropped pin, to Nominatim.
• Resend processes account verification, email-change confirmation/security notices, and password-reset email delivery.
• OpenDrive stores encrypted database backups; backup files are encrypted before leaving the WhereCare host.

New photo uploads are stored by WhereCare. Some older venue records may still display a photo from a legacy external URL; opening that venue can send your IP address, referrer, and normal browser request information to that image host.

These providers may process information in other countries under their own terms and privacy policies.

Anonymous usage counts

WhereCare keeps simple daily totals: how many times each place was opened, and how many visits arrived through a printed QR code or partner link. A count is only a number for a day. It is not linked to an account, session, IP address, device, or location, and WhereCare cannot tell who or where you were. These totals may be shared as aggregate figures, for example with a business, venue, or community partner to show how many families found a place through WhereCare. Individual visits, searches, and device locations are never recorded, shared, or sold.

Operations, security, and moderation

WhereCare records limited operational facts such as request method, route, status, duration, and a request identifier. Application logs deliberately omit query strings, request bodies, email addresses, usernames, session tokens, and precise coordinates. Network infrastructure may separately process IP addresses for delivery and abuse prevention. When the web app crashes, it sends WhereCare only the error category, a general error class, app version, and build time. It does not send the error message, stack, page URL, current route, search text, coordinates, account identifier, or session cookie, and no third-party error-tracking service receives the report. Signed-in users can review their own submitted-place, vote, review, and photo history. Admins can review account and contribution history to enforce the Terms and Community Rules.

Retention and deletion

Sessions expire after 30 days. Verification and email-change links expire after 24 hours and password-reset links after one hour. Verified account badges expire on the date chosen during review; the current choices are 90 days, one year, or two years. Expired sessions and authentication tokens are removed daily. Expired Verified badges and pending email-change requests are processed by the same daily job. An account that remains unverified for 90 days may be removed as abandoned only if it has no contribution, report, moderation, or pending deletion-request activity. A pending Verified badge or email-change request also prevents abandoned-account removal. Completed email-change history is retained with the account and is included in an account export. Previous usernames remain unavailable while the account exists to prevent impersonation. Community contributions and audit records are retained while needed to operate the map, preserve voting history, prevent abuse, and explain moderation actions. Encrypted database backups are retained for up to 14 days in normal operation.

Signed-in users can download an account-data export and submit or cancel an account deletion request from Account. Account-deletion instructions are also available without signing in. Deletion requires the current password and review by the Master Admin. Completion revokes account access and removes the account email, username, password, entitlements, username/email-change history, and identifying account-audit details. Some public contributions are retained under a non-identifying deleted-user label to preserve map, voting, and moderation integrity. Backup copies expire on their normal schedule.

Children and sensitive content

WhereCare is designed for caregivers and is not directed to children under 13. Do not post personal information about children, staff, or families, and do not upload images showing a child or any person’s face. Contact WhereCare promptly if a child has submitted personal data or if sensitive content appears in the app.

Changes and contact

Material changes will be posted here with a new effective date. Privacy, access, correction, and deletion requests can be sent to privacy@etherlabs.app. Support is currently operator-run and is not staffed continuously.