A1000

Privacy Policy

Last updated: 12 May 2026

A1000 (“we”, “us”) runs the website you’re looking at, where hand-numbered notebooks travel between strangers and their journeys appear on a shared map. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is the data controller

The controller of your personal data is Annie Wagstaff, The Bow Quarter, London E3 2UQ, United Kingdom. To get in touch about anything in this policy, email a1000littlenotes@yahoo.com.

2. What we collect

  • Account data — your email address, a chosen display name, and (if you sign in with Google) your Google profile name and avatar URL.
  • Approximate scan location — when you scan a book’s QR code and grant location permission, your browser sends your coordinates to us. We immediately offset them by a random 200–400m and discard the originals. Only the fuzzed point is stored. We never store your exact location.
  • City and country — derived from the fuzzed coordinates via OpenStreetMap’s public reverse-geocoding service.
  • Content you post — notes, photos and chat messages you choose to share.
  • Technical data — standard server logs (IP address, user-agent, timestamps) kept briefly by our hosting provider for security.

We do not use advertising cookies, third-party analytics, or behavioural trackers. The only cookie we set is a functional one that keeps you signed in.

3. Why we use it (legal basis)

  • Consent (Art. 6(1)(a) GDPR) — for accessing your location and for sending you scan-alert emails.
  • Contract (Art. 6(1)(b)) — to provide your account and the service.
  • Legitimate interest (Art. 6(1)(f)) — to keep the site secure and functioning.

4. Who processes your data

  • Lovable Cloud — our hosting and database provider (storage, auth, file storage, server functions).
  • Google — only if you choose “Sign in with Google”.
  • OpenStreetMap (Nominatim) — receives a fuzzed coordinate to return a city/country name. No personal identifiers are sent.

5. How long we keep it

We keep your data for as long as your account is active. You can delete your account at any time from your account page; this removes your profile, notes, chat messages and follow-list. Scan circles are anonymised (the user link is removed) so the public map history of each book remains intact, but nothing connects them to you.

6. Your rights

You have the right to:

  • access a copy of your data,
  • correct anything that’s wrong,
  • delete your account and personal data,
  • withdraw consent (e.g. turn off location, unsubscribe from alerts),
  • object to processing or request restriction,
  • lodge a complaint with your national data-protection authority.

To exercise any of these, email a1000littlenotes@yahoo.com.

7. International transfers

Our processors may store data outside the EU/UK. Where this happens, transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard.

8. Children

A1000 is not intended for children under 16.

9. Changes

If we materially change this policy we’ll update the date above and, where required, notify you by email.