Privacy

What we store

An account needs an email address and a password. The password is stored as a hash, so nobody reads it back, an administrator included. Everything after that is optional. Username, display name, bio, home base, van details, photos, captions, trips, spot reviews and check-ins are stored because you typed or uploaded them.

We also count the bytes your photos occupy. The free quota is 250 MB per account and a counter has to come from somewhere.

Photos and where they were taken

Phones and cameras usually write GPS coordinates into the image file. Natrix reads latitude and longitude once, during upload, and stores the pair in the database next to the photo row. Those two numbers are what places the photo on your map. A photo that carries no coordinates stays unplaced until you drag a pin onto the map yourself.

The file we hand back carries none of that. Every upload is re-encoded into three WebP copies, 320, 960 and 1600 pixels wide, and the re-encode drops every metadata block: EXIF, XMP and IPTC alike. The file you uploaded is never written to disk. Download a photo from Natrix and you get pixels with the rotation already applied, and nothing else.

Every photo starts private. It reaches friends or the public only after you change its visibility yourself, one photo at a time.

Friends map and check-ins

Location sharing is off when you register and stays off until you switch it on in settings. With it on, the friends whose requests you accepted see the position of your last manual check-in and when you made it. The app never reads your device location on its own, nothing runs in the background, and switching the setting off drops you from the friends map on the next request.

A friendship is mutual and either side can end it. Ending it stops the sharing in both directions.

Cookies and sessions

One cookie, set when you sign in, holding a session token. It is marked HttpOnly, so page scripts cannot read it, and it is scoped to natrix.live. A session lasts 30 days and is renewed at most once a day while you keep using the app. Signing out deletes it.

No analytics cookie, no tracking pixel, no advertising network. Nothing here follows you to other sites, so there is no consent banner to click away.

Where the data sits

A single server in Germany runs all of it: the web app, the PostgreSQL database and the photo files. Photos live on the local disk of that machine under /var/lib/natrix-live/uploads, outside the web root. nginx releases a file only after the app has checked that the request is allowed to see it. There is no object storage, no CDN and no copy at a third party.

A nightly database dump is written to /var/backups/natrix-live on the same machine and a dump older than seven days is deleted. Off-site backup does not exist yet, which is a statement of fact rather than reassurance.

Requests that leave the server

Map tiles are fetched by your browser straight from OpenFreeMap, so OpenFreeMap receives your IP address and the tiles you look at. Address searches go to Nominatim at the OpenStreetMap Foundation and are sent from our server, not from your browser, so your IP address stays here. A van page can embed YouTube videos, loaded from youtube-nocookie.com only once you press play.

Deleting your account

Settings has a delete button. It removes your rows from the database and deletes the photo directories that belong to you, reviews and check-ins included. Deletion is immediate and there is no undo.

For a copy of your data, write to the contact address in the imprint and we will export it by hand. Self-service export is not built yet.

Legal basis and your rights

Account data is processed to perform the contract you enter by registering, article 6 paragraph 1 letter b GDPR. Photo coordinates, public visibility and the friends map rest on your consent, article 6 paragraph 1 letter a, and you withdraw that consent by changing the setting or deleting the item.

You can ask for access, correction, deletion, a portable copy, and you can object to processing. Write to the address in the imprint. If the answer does not satisfy you, the data protection authority of your federal state accepts complaints.