Privacy Policy
Terrazed is a terrain tool, not an advertising business. There is no tracking, no analytics pixel, no advertising network, and nothing is sold or shared for marketing. This page describes the small amount of data there is and what happens to it.
Who is responsible
Terrazed, operator of terrazed.io, is the data controller. Contact: privacy@terrazed.io.
What is stored
| Data | Why | Kept for |
|---|---|---|
| Email address | To identify your account, confirm it, and send account and billing email | Until you delete your account |
| Password | To sign you in. Stored only as a scrypt hash, which we cannot read | Until you delete your account |
| Saved projects | Terrain settings you chose to save | Until you delete them or your account |
| Purchase status | To know what your plan includes. Card details never reach us | Until you delete your account |
| Provider API keys you add | To fetch elevation on your behalf. Encrypted (AES-256-GCM) and never sent back to the browser | Until you remove them |
| IP address | Rate limiting and daily quotas, so that signing out is not a way around them | Counters reset daily; server logs are short-lived |
There are no cookies for tracking. The single cookie set is your sign-in session, which is required for the service to work and disappears when you sign out.
Who else sees it
- Stripe: payment processing. Stripe handles your card details directly; we receive only a customer reference and whether the purchase succeeded.
- Resend: sends account email such as address confirmation. Receives your email address.
- Hosting provider: runs the server and database.
Nothing is sold, rented, or shared for advertising. We disclose data otherwise only where the law requires it.
Third-party services you use through Terrazed
When you import real-world terrain, imagery or map features, Terrazed makes requests to outside services, listed on the data sources page. Those requests are made by our server on your behalf, so your IP address is not exposed to them. They do receive the geographic area you asked for. Those services have their own privacy policies.
Your rights
You can ask for a copy of your data, correct it, delete it, or object to how it is used. The quickest route for deletion is your account settings; otherwise email privacy@terrazed.io and we will respond within 30 days.
Deleting your account removes your email, password hash, projects and stored provider keys. Backups are kept on a rolling basis and are overwritten within 90 days, so a deleted account can persist in a backup for up to that long before it ages out.
If you are in the UK or EU, you also have the right to complain to your data protection authority.
Security
Traffic is encrypted in transit. Passwords are stored as scrypt hashes, and provider API keys are encrypted at rest. No system is perfectly secure, but the amount of data held here is deliberately small, which is the most reliable protection there is.
Changes
If this policy changes materially, account holders will be told by email or in the app before it takes effect.