Epitavia · Steckler Lab

Privacy

Last updated November 4, 2026

The short version

Who we are

Epitavia is a nature atlas run by Steckler Lab. When this page says "we", it means Steckler Lab. Questions about privacy go to privacy@stecklerlab.com.

Your account and email

To make an account we ask for an email address, a display name, and a password. We store the email and name, plus a salted hash of the password. A sign-in cookie keeps you signed in for up to 30 days. It's marked HTTP-only so page scripts can't read it.

We use your email to:

These emails are sent through Cloudflare's email service. We don't send marketing email.

To slow down abuse, we keep counters of sign-in, sign-up, and email requests, keyed to a scrambled (hashed) form of your network address or email. Each counter stops counting after its window, a day at most. The hashed counter records themselves are kept in our database.

Locations, observations, photos, and recordings

Field notes, photos, and condition reports you submit are stored so stewards can review them. If you add a place, its name, type, location, description, and access notes become public once it is published, without your name. Reports you file on a place are seen only by moderators. Accepted notes become part of the public atlas. A sound recording you make in the guide stays on your account and is not published that way.

Your device's location is only read when you tap a button that asks for it, such as "Use my current location". For each note you pick how the location is handled:

Stewards review notes so they don't reveal sensitive wildlife locations.

Saved places, hike plans, and completed walks are tied to your account and are not public. If you create an invite link for a walk plan, anyone with that link can see that plan, including its meeting point and route. If you submit without an account, a random ID and your submission receipts are kept in your browser's local storage so you can check on them later.

If you use "locate me" or let the guide use your location, your precise position is sent with your guide questions and kept with that guide session so it can give nearby answers. There is no blur option on that path, so don't use it if you don't want your position stored.

The microphone is only used while you're actively using voice input or making a recording. Voice input may use your browser's built-in speech recognition, which your browser's maker runs under their own privacy terms.

AI features

AI features need a signed-in account with a confirmed email. We send your question to an AI model through OpenRouter, along with the place context needed to answer it. OpenRouter passes it on to the company that runs the model.

We keep a record of your AI conversations and runs, including the model used, so we can show your history, enforce usage limits, and investigate problems. We count AI requests per account per day to enforce the limits.

AI answers can be wrong. Check anything important, especially about safety, weather, or wildlife.

Paid plan and payments

Paid plans are not on sale, and we do not charge you today. If a paid plan is offered later and you subscribe, payment is handled by Stripe. You enter your card details on Stripe's own pages, and they never reach our servers.

From Stripe we keep:

That's what we would need to turn the paid plan on or off. Once paid plans are on sale, you would manage or cancel the subscription, or fix a failed payment, through Stripe's customer portal, linked from My Atlas ("Manage billing").

Service providers

How long we keep things, and deleting them

To delete your account, email privacy@stecklerlab.com from the address on the account. We'll delete:

Notes already accepted into the public atlas can be removed, or kept without your name, whichever you prefer. If a place's name, location, or access notes were already shared on terms compatible with the OpenStreetMap ODbL, people who received that copy can keep using it. Backup copies are kept only for a limited time. You can also ask us for a copy of your data, or to correct it.

Children

Epitavia isn't aimed at children under 13, and we don't knowingly create accounts for them.

Changes and contact

If we change how we handle data, we'll update this page and the date at the top.

Contact:

See also: Terms, the rules for using Epitavia.