Privacy
Applies to www.solarsystemregistry.org. Last updated 2026-07-25.
The short version. The registry itself is free and needs no account. We count how many distinct people visit, and — only if you volunteer it — we store an email address. We never store your IP address: it is converted one-way into a pseudonym the moment it arrives, and the original is discarded. We run no advertising, no third-party trackers, and we sell nothing.
What is processed, and why
- A visit count, per pseudonymous visitor. When you load the site, our counting endpoint derives a one-way cryptographic hash (HMAC-SHA256) of your IP address using a secret key held only on the server, keeps the first 16 characters, and stores that — never the address itself, which is never written to a database and never written to a log. The pseudonym cannot be reversed into an IP address without the secret key. Purpose: to know how many distinct people the registry reaches, and to know when to show the invitation below.
- A coarse country code (two letters, e.g. "FR") derived from the same request. No city, no precise location, no device fingerprint, no user agent, no referrer.
- A short-lived abuse counter. To stop a script from stuffing the address list or guessing the administrator's password, we keep a counter of recent attempts against the same one-way pseudonym, with the time its window opened. It holds no content — just a number and a timestamp — and it resets by itself.
- Your position — in your browser only. The simulation marks where you are on the Earth (an orange mark, and your heading when you move faster than 2 knots) and stands Stargazing there. If you have already allowed this site to use your device's location, that is used; otherwise your browser asks GeoJS (get.geojs.io) to locate your IP address, approximately — city level at best. The result stays in your browser: it is never sent to us, never stored, never put in a link. The ✕ next to it on the Earth's card turns it off on that device.
- An email address — only if you type one. After about ten visits we show a dismissible invitation to create an account. Providing an address is entirely optional; "continue without an account" always works, and the registry is never withheld. Purpose: to keep you informed about the project and to understand how many visitors would support it.
What is deliberately NOT done
- No IP address is stored or logged, anywhere.
- No cookies are set for tracking. The site uses your browser's local storage for your own settings (and, if our counting endpoint is unavailable, for a purely local visit count that never leaves your device).
- No advertising, no analytics broker, no data sale or sharing, no profiling, no automated decision-making.
- If you use the optional AI assistant, it runs against your own provider key from your own browser; we never see your key or your prompts.
An honest limitation
Because the visit count must recognise a returning visitor across days, the secret key used for the pseudonym is stable rather than rotated daily. That is a deliberate trade-off: a daily-rotating key would make "your tenth visit" uncountable. The stored value remains a one-way pseudonym, and it is the only identifier we hold.
Retention
Visit counters are kept while the project runs and are aggregate by nature. An email address is kept until you ask us to delete it.
Your rights (GDPR)
You may ask for access to, correction of, or deletion of the data associated with you, and you may object to this processing. Because we hold no IP address, the practical handle is your email address if you gave one. Write to contact@cosmicfootprint.org and we will act on it. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).
Who else is involved
The site itself is hosted on Vercel, whose infrastructure handles page requests under its own policies; our code stores no IP address anywhere. The visitor-counting endpoint is a Cloudflare Worker, described on this page for when it is deployed — today no counting endpoint is live, so no counting data leaves your browser (the visit tally falls back to the purely local, per-device counter noted above). Once deployed, Cloudflare will act as our processor for the counting data, its database will be created in western Europe, and Cloudflare's own request logging will be turned off, because it would otherwise retain request metadata — including your IP address — for several days, which would contradict what this page says above.
To place the orange mark when your device's location is not allowed, your browser sends one request to GeoJS (get.geojs.io), which answers with an approximate position for your IP address from GeoLite2 data created by MaxMind. GeoJS states that it keeps no access logs. This request goes from your browser to GeoJS directly; nothing about it reaches us.
Legal basis and controller
Counting distinct visitors rests on our legitimate interest in knowing the reach of a free public-interest project, using the most privacy-preserving method we could implement (a one-way pseudonym, no IP retention). Storing an email address rests on your consent, which you give by ticking the box on the invitation and may withdraw at any time. The project is run by Adrien Normier; contact as above.
Changes
This notice is versioned with the site. Material changes will be reflected here with a new date.