Privacy Policy

Waystone is a heritage-mapping service operated by Matt Bramhall, a sole trader based in the United Kingdom. This policy explains what personal data Waystone collects when you use the website, web app and mobile apps, why, and the choices and rights you have over it. We have kept it short and free of legalese. If anything is unclear, email mattbramhall.business@gmail.com.

Data we collect

We collect only what we need to run the service and make it better:

Account details. If you create an account, we receive your email address, and where you choose to share it your name, from Apple or Google when you sign in. We never see or store your Apple or Google password.

Places you save. Pins, notes and places you choose to keep are stored against your account so they are there when you return.

Narration requests. When you tap a place to read its story, or ask for AI Research on a name on an old map, the place (its name and location) and your request are sent to our servers, and on to our AI provider, to write the narration. If you are not signed in, a random identifier for your browser (see What the app keeps on your device) is used to apply fair-use limits to narrations.

Feedback you send. When you send a note through Share Feedback, we receive your note, the page you were on, a random identifier for your browser, and your account if you are signed in. If you leave Add technical details ticked, the note also carries details of how the app was running:

• your browser and operating system;
• your graphics card and what it supports;
• processor cores, memory and screen size, and your connection type;
• how smoothly the map was running, and any slow moments;
• any errors the page ran into;
• where the map was (to about a kilometre) and which layers you had on.

These details contain no name or email. They help us find problems that only happen on some devices. Untick the box and your note is sent on its own.

Update emails. If you sign up for update emails, we pass your email address to Kit (kit.com), the service that sends them, which holds it for that purpose only. Kit first sends you an email asking you to confirm; you are not on the list until you do. Every update email has a link to stop them, or email mattbramhall.business@gmail.com and we will remove you. Waystone itself does not keep your address.

Usage statistics. Unless you switch them off, the web app records how it is used, so we can see which features help people and where the app is slow or breaks. This includes:

• when the app is opened;
• which features and places are opened;
• how long narrations take;
• errors and crash reports;
• the app's version and the address of the page.

These records are linked to a random identifier for your browser, and to your account when you are signed in. We use them only to run and improve Waystone. We never use them to advertise to you or sell them to anyone. You can switch them off at any time (see Your choices). A place's own address in the web app (explore.waystone-ai.org/place/…) is part of the web app and records the same statistics, on a phone too.

Visits to our website. The pages of waystone-ai.org count visits with a random number made fresh for each page view, so two visits cannot be linked to each other and nothing is stored on your device. They record which page was viewed, the width of the window, which links, buttons and map windows were used, and the name of the website that sent you there, if any. Automated browsers are not counted.

The LiDAR viewer shown inside our website, and inside other sites that include it, records no usage statistics and keeps no identifier on your device. It may remember one display setting: whether its compass is locked to north.

Technical data. Like any website, our servers and our hosting provider process your device's IP address and basic request details in order to deliver pages, maps and data to you and to protect the service from abuse.

What the app keeps on your device

Waystone does not set cookies for tracking or advertising. The web app uses your browser's own storage, which stays on your device, for:

• a random identifier for your browser, used to apply fair-use limits to narrations and, if usage statistics are on, to count usage;
• your sign-in session, if you sign in;
• your settings and preferences, such as layers, map controls and which introductions you have seen;
• any features you map, any projects you save and any figures you add to a report with the Tools card, until you clear them or take them off the list. They leave your device only as a file you choose to save.

Everything except the usage-statistics use is needed for the app to work as you have asked it to. You can clear this storage at any time in your browser's settings (it is listed as site data). This signs you out and resets your settings.

Your choices

• Usage statistics: turn them off in the web app under About → Your data → Share usage statistics, or, on a place's page on a phone, under About this place → Your data → Share usage statistics. It is one setting for both, in that browser. While they are off, nothing about how you use Waystone is sent from that browser. Your choice is remembered in that browser.
• Technical details with feedback: untick Add technical details on any note to send the note on its own. If usage statistics are off, the box starts unticked.
• Your account: you can ask us to delete it and its data at any time (see Your rights).

Data we don't collect

We keep this deliberately small:

• Your live location stays on your device. The map uses it to centre the view. It is not sent to us or stored unless you save a pin there.
• No advertising cookies or trackers. We don't use advertising cookies or advertising trackers, we don't build advertising profiles, and we don't use your device's details to recognise you across other sites.
• We never sell, rent or trade your personal data.
• No card numbers. We don't take payment for the beta, so we never hold card numbers.

How we use it

We use your data for three things, and nothing else:

• To provide the service: signing you in, writing narrations, keeping your saved places, and sending the update emails you sign up for.
• To keep it working and secure: finding and fixing faults and slowness, preventing abuse, and protecting the service.
• To improve it: understanding what is useful, and reading the feedback you send.

We do not use your data for advertising or for automated decisions that affect you.

Under the UK GDPR, our lawful bases are:

• the performance of our agreement with you, for your account, saved places and narrations;
• our legitimate interests in running a safe, working service and improving it, for technical data, usage statistics (which you can switch off) and feedback;
• your consent, for the technical details you choose to add to a note, and for update emails.

Who we share it with

To run Waystone we rely on a small number of trusted providers who process data on our behalf:

• Cloudflare: hosting, content delivery, our servers, and storage of the data above.
• Apple and Google: sign-in. When you choose to log in, they pass us your email. Your account with them is governed by their own privacy policies.
• Kit: sends the update emails to people who have signed up and confirmed.
• Anthropic: the Claude AI model that writes the narrations. The place and your request are sent to Anthropic to write the text. It is not used to train their models.
• Place lookups: to gather sources for a place's summary, our servers send searches made from the place's name and location to Perplexity and to Google Places. They contain nothing you type and nothing about you, and they come from our servers, so those services do not see your IP address.

Maps and pictures. Most maps and data reach you through our own servers, so map providers such as MapTiler and Esri (satellite imagery) never see your IP address. Some content loads straight from its source, which then receives your IP address in the ordinary way any website does when it sends your browser a file:

• some historic Ordnance Survey maps come from the National Library of Scotland's map service, hosted by Amazon Web Services;
• pictures in some place cards come from Wikipedia and Wikimedia Commons;
• when you search round a site in England, Scotland, Wales or Northern Ireland with the Tools card's Site step, your browser asks that nation's list of designated heritage (Historic England's National Heritage List, a service hosted by Esri; Historic Environment Scotland's designations; Cadw's, on the Welsh Government's DataMapWales; the Historic Environment Division's, hosted by Esri) for the map squares round the site. It sends the rectangle of map squares, as loading the map does; your site boundary and the rest of your mapping stay on your device;
• the Geology layer, the ground probe's geology, a cross-section's rock strip and a report's geology section come straight from the British Geological Survey's map service: your browser sends it the map squares it draws, the point you pin, the line of a cross-section or a grid of points over a site;
• the Victorian map page's "This place through time" and a report's list of historic maps ask the National Library of Scotland's map index for the place in the middle of the map or the box round a site;
• when you open a name on the Victorian map with Read the words, the card asks the Archaeology Data Service's catalogue (at the University of York) for records in a small box round that name;
• some pages of our website load their animation scripts from jsDelivr, a public code-delivery service, which receives your IP address and browser details when your browser fetches them;
• the fonts on our website and on the web app's place pages come from Google Fonts, which receives your IP address and browser details when your browser fetches them;
• our website's near-me finder sends the postcode you type to postcodes.io to find where it is.

Some providers are based outside the UK. Where data is transferred internationally, it is protected by appropriate safeguards, such as the UK's International Data Transfer Agreement or equivalent standard contractual clauses.

How long we keep it

We keep personal data only as long as it is useful for the purpose it was collected:

• Account details and saved places: kept while your account is active. If you delete your account, they are deleted within 30 days.
• Narration requests: may be kept briefly to operate and debug the service, then deleted or anonymised.
• Usage statistics: detailed records are deleted after 30 days. We may keep counts that cannot identify anyone.
• Update emails: Kit holds your address until you unsubscribe.
• Feedback notes, and any technical details sent with them: kept for 24 months so we can follow up problems over time, then deleted. You can ask us to delete yours sooner.

You can ask us to delete your account and its data at any time by emailing mattbramhall.business@gmail.com.

Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• correct anything that is wrong or incomplete;
• have your data erased (the "right to be forgotten");
• restrict or object to how we use it, including usage statistics, which you can also switch off yourself;
• receive your data in a portable, machine-readable form;
• withdraw consent at any time, where we rely on it.

To exercise any of these, email mattbramhall.business@gmail.com and we will respond within one month.

You also have the right to complain to the UK's Information Commissioner's Office (ico.org.uk), though we hope you would contact us first so we can put it right.

Contact

Waystone is operated by Matt Bramhall, a sole trader in the United Kingdom, who is the data controller for the purposes of the UK GDPR. For any question about this policy or your data, write to mattbramhall.business@gmail.com.