The Steam Report

Short version: signed out, we keep nothing about you. If you sign in so your starred spots follow you to other devices, we keep your email address and your stars. No ads, no analytics, no newsletter, and nothing is sold.

This is our notice under South Africa's Protection of Personal Information Act (POPIA).

Who is responsible

The responsible party is The Steam Report ([OWNER LEGAL NAME: to be filled in by the owner]).

Information Officer: [NAME: to be filled in by the owner], hello@sauna.capetown.

If you are not signed in

You're not signed in, so we keep nothing about you. The regions you pick, and whether you hide quiet spots, are saved in your own browser (local storage on this device), not on our server. Clear your browser data and they are gone.

If you sign in

Starring a spot needs an account. There's no password: we email you a 6-digit code. We keep:

• your email address;
• the spots you starred;
• a session cookie, so you stay signed in on that device;
• a scrambled (hashed) copy of your login code, which works for 10 minutes and is wiped by our nightly clean-up soon after;
• short-lived counters that stop people abusing the sign-in form. They include your IP address, and the nightly clean-up removes them, so they stay for up to 2 days at most.

In your browser we also keep a small cache so the page fills in at once: your initial letter and your starred spots, with no email address. Signing out or deleting your account clears it.

If you ask for a code but never sign in, no account is created. We still hold your email address next to the hashed code, and a short-lived counter with your IP address (the same abuse limits as above), until the nightly clean-up removes them (up to 2 days at most), and we send the address to Resend to deliver the code.

Our own logs hold only short status lines we write ourselves, and a technical error report if something breaks. We don't put email addresses, codes or IP addresses in them, and we have switched off the per-request logging that would record visitors' IP addresses. Apart from the counters above, we don't store IP addresses.

Why

So your stars follow you to any device, and to keep the sign-in form safe. You consent by asking for a code. We use this data for nothing else.

Where it is stored, and who handles it

• Cloudflare hosts the site and stores the database (Cloudflare D1, in its EU jurisdiction), and runs the network that serves the pages. To do that it necessarily processes every visitor's IP address, as it does for any website it serves. We don't keep those addresses.
• Cloudflare Turnstile checks that you are a person when you ask for a code.
• Resend (United States) sends the code email. Your email address goes to them for that.

That means your information is stored and processed outside South Africa. We send it only to the services above, to run the board.

How long

Until you delete your account. Accounts nobody has used for 24 months are deleted automatically. A nightly clean-up also wipes expired login codes and old counters, so those stay for up to 2 days at most.

Your rights

You can ask to see what we hold, correct it, or have it deleted, and you can object to us using it. To delete everything now, use "Delete my account" in the app: we erase your email and starred spots from our server straight away. Or email hello@sauna.capetown and we'll do it for you.

Complaints

If you think we've handled your information badly, tell us first and we'll try to put it right. You can also complain to the Information Regulator (South Africa): inforegulator.org.za. The POPIA complaint forms are at inforegulator.org.za/popia-forms, and complaints can be emailed to POPIAComplaints@inforegulator.org.za.