Privacy

What we collect

Exploring needs no account. You can press the button, read, and keep one find a day without telling us who you are.

If you sign in, we hold your email address, and an email address is personal data. Sign-in is by a link or code sent to that address, or through Google, which shares the address and name on your Google account.

Your profile holds the handle you choose, a display name and bio if you add them, and an avatar if Google provides one. Your handle is public: it appears on your Shelf and as the credit on finds you suggest.

What you do while signed in is tied to your account: keeps, suggestions, votes, Expedition entries, rescue proposals, reports, and the notifications they produce. When you first sign in, the keeps and device id saved on your device are sent to us once so they can join your account.

The newsletter form stores the email address you give it and where on the site you gave it.

Requests to Elsewhere are rate limited by network address so one device cannot flood the site.

What your device stores

Elsewhere keeps a small record in your browser so the site works without an account: a random device id, your keeps (the id of each find and the day you kept it), which prompts you dismissed and when, and counters for the install prompt (visits, button presses, the last visit, and when you said not now).

For the length of a tab session it also keeps the list of finds you have just seen, so the next press does not repeat one, and a marker for the sign-in method while a sign-in is in progress. A flag remembers that this device has signed in before, so the sign-in sheet can say "Sign in" instead of "Make an account".

When Elsewhere is installed as an app, a service worker caches the app shell (scripts, fonts, icons), the explore page, the offline page, the manifest, and public catalogue responses such as the current Expedition and the Top Picks, for a short time. It never caches account pages, account responses, or pages from other sites.

Clearing site data in your browser removes all of this. Signing in and merging clears everything except the device id.

Email

Sign-in email always comes through: it is how a link or code reaches you.

Two optional emails are tied to an account: the Monday Field Report, which says where your finds traveled that week, and One year ago today, which shows what you kept on this day a year ago. Both can be turned off in Settings.

The newsletter is separate and does not need an account. Every issue carries an unsubscribe link.

Sign-in and account email is sent through Resend. The newsletter is sent through Buttondown.

Analytics and cookies

Elsewhere counts events, not people. An event is a name such as press_start, resource_view, keep, share, or sign_in_completed, with details about the find (its id, domain, kind, topic, and whether it was framed) or the method used. No email address, name, handle, or free text goes into an event.

Events go to Vercel Analytics in production and nowhere in development.

The only cookies are the session cookies set when you sign in. They are marked httpOnly and same-site, so scripts cannot read them and other sites cannot send them. There are no advertising cookies and no cross-site tracking.

Who runs it

Elsewhere is built and run by Jack DeManche (Genuine Jack).

The site runs on Vercel. The database and sign-in run on Supabase. Email is sent through Resend, the newsletter through Buttondown, and rate limits are kept in Upstash. Each of these holds the data it needs for its part under its own terms.

Your choices

You can sign out at any time. The two optional emails are switches in Settings. The newsletter unsubscribe link is in every issue.

You can ask us to delete your account and what it holds, or to remove the credit from a find you suggested, by email. We confirm what was removed.

Clearing site data in your browser removes everything Elsewhere stored on the device.

Questions about your data go to hello@exploreelsewhere.xyz.