HLTW?
Report

Privacy policy

Last updated: 4 July 2026

This page explains how How Long's The Wait? ("we", "us") handles personal data. It is written to satisfy the UK GDPR, EU GDPR and the UK Data Protection Act 2018. If any part is unclear, contact us — see below.

1. Who we are (data controller)

The platform is operated by MRDN Studio, United Kingdom. For any privacy question or to exercise your rights, email privacy@howlongsthewait.com.

2. What we collect

  • Account: the email address or phone number you sign in with, and a display name you choose.
  • Reports you submit: category, status, note, approximate coordinates, timestamp, and any photo you attach.
  • Interactions: confirmations, disputes, comments, flags.
  • Device signals: IP address and user-agent (server logs, kept up to 30 days for abuse prevention).
  • Analytics (optional): anonymous event counts, only if you accept the cookie banner.

3. Lawful bases

  • Contract — creating and running your account.
  • Legitimate interests — publishing community safety reports, moderating abuse, keeping the service secure. We've balanced this against your rights.
  • Consent — optional analytics and precise device location when you tap "Use my location".
  • Legal obligation — responding to lawful requests from authorities.

4. What's public and what isn't

Reports are public by design — that's the point of the platform. Your display name and a short opaque author reference appear next to everything you post. Your email address, phone number and precise GPS are never shown publicly. Photo metadata (EXIF, including embedded GPS) is stripped before storage. Coordinates are stored fuzzed to roughly 500 m before being published on the map.

5. How long we keep it

  • Reports: auto-archived after 72 hours of inactivity; kept for statistical purposes but removed from the live map.
  • Photos and video clips: auto-deleted 24–48 hours after upload.
  • Account: until you delete it. Deletion requests actioned within 30 days.
  • Server logs: up to 30 days.

6. Who we share with (processors)

  • Supabase — database, authentication and file storage.
  • Cloudflare — application hosting and DDoS protection.
  • Google Maps Platform — map tiles and place search. Google may log IP + request metadata under its own privacy policy.
  • Resend — sending transactional emails (magic links).

We do not sell your data. We do not run third-party advertising trackers.

7. International transfers

Where a processor operates outside the UK/EEA, transfers rely on Standard Contractual Clauses or a UK/EU adequacy decision.

8. Your rights

Under UK/EU GDPR you can request:

  • Access to a copy of your personal data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten")
  • Restriction or objection to processing
  • Data portability
  • To withdraw consent (analytics / location) at any time

Email privacy@howlongsthewait.com. You can also complain to the UK ICO (ico.org.uk) or your local EU supervisory authority.

9. Children

The service is not intended for anyone under 16. Please don't create an account if you are under 16.

10. Email alerts

If you sign up for our optional email alerts ("Watch this area"), we process a small amount of extra data specifically for that service.

  • What we store: your email address, the countries you asked to watch, the exact consent wording you agreed to (and when), and a send log recording which alert emails we've sent you.
  • Why: to send you the alerts you asked for. Lawful basis: your consent (UK/EU GDPR Art. 6(1)(a)), which you can withdraw at any time.
  • How long: unconfirmed signups are automatically deleted after 7 days. Send-log entries are automatically deleted after 12 months. Confirmed watches are kept until you unsubscribe.
  • Sharing: we never share or sell this data. Alert emails are delivered via our email processor (Resend — see §6).
  • One-click unsubscribe and full erasure: every alert email carries a one-click unsubscribe link (both in the email body and as an RFC 8058 header so your mail client's native unsubscribe button works). After unsubscribing, the confirmation page offers a one-click "Remove all my data" option that deletes every alert signup and send-log record for your email address.
  • Data requests: use the contact form to request access, rectification, erasure, restriction, objection, or portability for your alerts data. Postal: How Long's The Wait?, Nicholas House, River Front, EN1 3TF, United Kingdom.

11. Changes

We'll update this page and change the "Last updated" date when material changes happen.