PrivacyLast updated
Almost nothing, and there is no database for it to go into. This page describes the code deployed right now, not an intention. Where something does leave your browser, it is named.
There is no sign-up, no login and no password. Browsing the map is not tied to any identity.
No database, no key-value store, and nothing this site serves writes a file. There is nowhere for the server to put anything about you.
Boards, layouts, themes, pins and watchlists are saved in your own browser. They are never uploaded.
Vercel Web Analytics counts page views. No Google Analytics, no ad pixel, no session recording.
Who is responsibleUK
Provenance is built and run by one person in the United Kingdom, publishing as 011-sam-110. Under UK GDPR that person is the controller for whatever personal data this site processes, which the rest of this page sets out and which is very close to none.
That is a handle rather than a legal name, and it is worth being straight about what that does and does not mean. It is the account that authored every commit in the repository below, so the work is attributable and the person is reachable. If you have a formal reason to know who they are, such as a data-protection request or a legal notice, open an issue asking and you will be told. Nothing here is anonymous. It is pseudonymous, which is not the same thing.
The whole application is open source under the AGPL-3.0, so every claim on this page can be checked rather than trusted. If a sentence here does not match the code, the code is the truth and the sentence is a bug. Read the source.
Contact. There is no support address published for this project. The route that exists is an issue on the repository. That tracker is public, so do not put anything private in it.
StorageServer side
This is the strongest thing on the page, so it is the one worth checking. The app has ten runtime dependencies and not one of them is a database client. There is no key-value store, no object store and no cloud storage account. Nothing this site serves writes a file.
That last sentence used to say “the application code writes no files”, and it stopped being exactly true in August 2026, so it has been narrowed rather than left to rot. The repository now contains a camera-review tool that does write files: it records which cameras a person looked at before their pictures were allowed onto the map. It runs on a laptop, against a local development server, and it is not deployed here at all. You can check that. /admin is a 404 on this deployment, and so is every request that tool makes. A test in the repository fails the build if a new route is added under it without that guard. Two files in the whole tree can write to disk, both belong to that tool, and a second test fails if a third appears.
No route reads a cookie or a session. There is nothing in the code that could.
Exactly one route reads your IP address, and it is worth naming rather than burying. The feedback endpoint takes the forwarded address, hashes it, and uses the hash to count how many submissions have come from one place in the last hour. The address itself is not written down, not logged and not sent on, and neither the address nor the hash is attached to what you wrote. The hash lives in ordinary server memory and disappears when that instance recycles.
The hash is salted with a random value generated when the server instance starts. That matters, because a plain hash of an address would not protect it: there are only about four billion possible addresses, so anyone could hash all of them and look yours up. The salt makes that impossible. It never leaves memory, it is not in the source code, and it dies with the instance that made it.
Be clear about what it is for. It stops the same person submitting fifty times. It is a counter, and it is the only thing in this application that touches your address at all.
Some routes hold what you typed in ordinary server memory for a few minutes so a repeated request does not hit an upstream service twice. That is listed below. It also lives in RAM on one serverless instance and is gone when the instance recycles.
StorageYour browser
The console remembers how you set it up. It does that in your browser, under 30 keys prefixed tn. in local storage, plus one IndexedDB database and one service-worker cache. Almost none of it is ever sent to us, and the table says which parts are the exception.
| What | Where | Does it leave your browser? |
|---|---|---|
| Console layout, boards, presets, saved monitor profiles | Local storage | No |
| Theme, skin, language, view mode, which map layers are on | Local storage | No |
| Watchlists, dropped pins, tracked aircraft, market alerts | Local storage | No |
| A display name, if you type one into settings | Local storage | No. There is no account for it to belong to |
| Locations you add as assets to watch, with a name and a radius | Local storage | No |
| Which headlines you have already been shown, and sparkline history | Local storage | No |
| How many times you have visited and how long the tab has been visible, used to decide whether to show the feedback prompt | Local storage | No. The decision is made in your browser |
| Your coordinates, if you press “near me” and allow the browser prompt | Local storage | Only to find nearby cameras, see the next section |
| A Telegram bot token or a Discord webhook, if you set one up | Local storage, in plain text | Only when you send an alert, see the next section |
| Camera frames your browser has already loaded, for the day strip | IndexedDB tn.camslot.history, capped at 8 MB | No |
| The shell, the manifest and two icons, so the app opens offline | Service worker cache tn-v1-shell | No. API responses and anything cross-origin are never cached |
Clearing site data in your browser deletes all of it. There is no copy anywhere else, so there is nothing to ask us to delete. Note that a bot token or webhook you paste in is stored in plain text, like any other browser setting, so treat a shared computer accordingly.
The server35 API routes
Most of the API takes no input from you at all: it fetches public feeds on a schedule and hands them to the map. These are the routes that receive something you supplied.
| When you | What reaches us | Where it goes next | Kept? |
|---|---|---|---|
| Search for a place | The text you type, and your map centre if the search is biased to it | Photon, the open geocoder at photon.komoot.io | In memory for 5 minutes, then dropped |
| Ask for cameras near you | The coordinates your browser hands over | Nowhere. The nearest cameras are worked out on our server from data already loaded | No |
| Open a camera still or a live stream | The camera id | We fetch the image or the video from the operator and pass it back to you | No |
| Look up a domain or an IP in the recon widgets | The domain or IP you typed | Cloudflare DNS, crt.sh, rdap.org and the registry it redirects to, RIPEstat, Shodan InternetDB | Cached against that target for 5 minutes |
| Upload a photo to the location tool | The image | A third-party AI gateway, which is the next section | No |
| Ask for a news summary | The article link | The publisher’s own site, then the same AI gateway | The summary is cached in memory against that link |
| Send a Telegram or Discord alert | Your own bot token or webhook URL, and the message text | api.telegram.org or discord.com | No. It is used for that one request and dropped |
| Answer the feedback prompt | Your answers, and your IP address in the request, which is hashed for rate limiting only | A private Telegram chat belonging to the person who builds this | Not by us. The hash is held in memory for an hour |
With the single exception of the feedback endpoint described above, none of these routes reads your IP address, your cookies or your user agent, because the code contains no way to. Every request we make on your behalf goes out with a fixed user agent naming this project, not yours.
Photo geolocationRead this one
The photo location tool estimates where a picture was taken. To do that it sends the image from our server to an AI gateway, which passes it to a vision model. That is the whole point of the feature, and there is no version of it that keeps your image on one machine.
Checked against production on 18 August 2026: uploads take the vision-AI gateway path. The alternative backend, a self-hosted geo-embedding model, is not enabled there.
We do not store the image. What the gateway and the model provider behind it do with it is governed by those services, not by this code, and we cannot make a promise on their behalf.
So do not upload a photo you would not be willing to hand to a third party. Photos carry faces, number plates, and often a GPS location in their metadata.
The feedback promptFour questions
After you have used the console for a while, it may ask you four things: what you do, what you find useful here, a rating out of ten, and an email address. Only the email is optional. Leaving it blank sends the rest normally.
What you write is relayed straight to a private Telegram chat belonging to the person who builds this. Nothing is written to a database, because there is not one. If you give an email it goes in that same message, it is read as you being open to a short call, and it is not added to a mailing list.
Whether you get asked is decided in your browser, not on a server. The console keeps a count of your visits and how long the tab has actually been visible, in local storage, and asks once you pass one of those marks. Answering or closing the box records a permanent no, so you are never asked twice.
The request that carries your answers also carries your IP address, as every web request does. That endpoint hashes it to rate-limit abuse, described above. The hash is not put in the message and does not travel with what you wrote.
Third partiesDirect from your browser
A few things load straight from other people’s servers. Those servers see your IP address and roughly what you are looking at, because your browser connects to them and not to us. We cannot see or change that.
basemaps.cartocdn.com serves the default map tiles and the label fonts every map style uses. That includes the globe on the front page, so CARTO sees you whether or not you open the console.
elevation-tiles-prod.s3.amazonaws.com serves terrain elevation tiles. That source is registered on every map, not only when 3D relief is switched on.
server.arcgisonline.com serves the satellite basemap and one aerial image on a satellite’s detail card. tile.opentopomap.org serves the topographic basemap. Both load only if you pick them.
www.youtube.com is embedded wherever a stream is a YouTube one. Those embeds are Google’s and can set Google’s cookies. Some autoplay as soon as the widget is on your board.
Most camera imagery does not work this way. Road-camera stills, their HLS video and the Windy webcams are all fetched by our server and passed on to you, so the road authority or camera operator sees this deployment and not you. That was a deliberate choice.
Two camera paths are the exception, and the difference is worth stating rather than glossing. A camera whose stream is a YouTube one is an embed, so your browser connects to Google directly and we cannot stand in front of it. The same is true of a custom stream URL you type into the news widget yourself: it plays from whatever host you gave it.
Typefaces are self-hosted. They are downloaded at build time and served from this domain, so your browser never contacts Google Fonts.
CookiesAnalytics
Provenance sets no cookies. Not for sessions, not for preferences, not for analytics. The code writes none, and production responses carry no Set-Cookie header. The one exception is not ours: the YouTube embed described above.
The site does load Vercel Web Analytics, served from this domain, which reports page views to Vercel, our host. It is the only analytics here. A search of the repository finds no Google Analytics, no gtag, no Meta pixel, no PostHog, no Plausible, no session recorder and no fingerprinting library.
What Vercel collects, and for how long, is Vercel’s to describe rather than ours. We have not audited their end. What we can tell you is what this application asks for, which is a count of page views, and that nothing in this code sends them anything else. Vercel’s privacy policy.
LogsOurs and the host’s
One log statement exists across all 35 API route files. It records that a named public data feed threw an error, and the name comes from our own list of feeds rather than from anything you sent. Nothing you type is logged anywhere.
Vercel keeps its own request logs underneath the application, as any web host does, and those will include your IP address and user agent. That happens below this code, we do not add to it, and we have not audited how long it is held. If that matters to you, treat it the way you would treat any hosted website.
Your rightsUK GDPR
Under UK GDPR you can ask for a copy of your personal data, ask for it to be corrected or erased, object to it being processed, and complain to a regulator.
The honest version here is that this application holds no record of you to hand over, correct or delete. There is no account, no database and no server-side profile. Most of the data about your use of the site is in your own browser, and you can erase it yourself by clearing site data.
Three things sit outside that, and they are the only places anything of yours can persist. Two are handled by Vercel as our host: Web Analytics, and platform request logs. The third is a feedback answer, if you chose to send one, which is sitting as a message in a private Telegram chat. That one is the only place a name or an email you gave us can be. Ask and it will be deleted.
If you think any of this is wrong, say so in an issue and it will be checked against the code. If you want to complain to a regulator, the UK’s is the Information Commissioner’s Office.
Changes
This describes the code as deployed on 18 August 2026. When the behaviour changes this page is supposed to change with it, and if it has not then that is a bug worth reporting. Both histories live in the same public repository, so the two can be read against each other.
Features that are designed but not shipped are deliberately absent. Describing something the software does not do yet would make this page wrong in the direction that matters least to us and most to you.