Privacy Policy

CaveFinder (cavefinder.app) is operated by Buzzy LLC, a New Mexico limited liability company. This Privacy Policy describes how we collect, use, and protect your information when you use our terrain analysis service.

1. Information We Collect

Account Data

When you create an account, we collect:

• Email address: used for account authentication, password resets, and service notifications
• Display name: shown in the application interface
• Password: stored only as a salted, computationally expensive hash (scrypt, via Werkzeug); we never store or have access to your plaintext password. When you choose a password we check it against known leaked passwords through Have I Been Pwned, sending only the first five characters of its hash, never the password itself
• Passkeys, if you add one: we store only the public key your device creates, never anything that could sign in as you

Accounts are run by CaveFinder’s own sign-in service at id.cavefinder.app, operated by Buzzy LLC like the rest of CaveFinder.

Usage Data

When you use CaveFinder, we automatically collect:

• IP address: used for rate limiting and abuse prevention
• Browser session ID: a random identifier for analytics
• Search locations: the geographic bounding boxes you analyze (latitude/longitude coordinates defining the area)
• Analysis parameters: data source selections, filter settings, and feature usage
• Timestamps: when actions occur

Field Notes

The marks you put on candidate spots (Cave, Not, ?) and any note text you add are saved to our server with the scan they belong to. Only you can see them, they are included in your own exports, we do not use them for anything else, and they are kept until you delete them or your account.

Payment Data

Payment processing is handled entirely by Stripe. We never receive, process, or store your credit card number, bank account details, or other payment instrument data. We store only your Stripe customer ID to link your account to your subscription.

2. How We Use Your Data

• Provide the service: process your terrain analysis requests and deliver results
• Enforce subscription tier limits: track usage against your plan allowances
• Prevent abuse: rate limiting, fraud detection, and enforcing acceptable use
• Improve detection accuracy: we analyze aggregate usage patterns (such as which data sources and regions are most popular) to improve the service. We never use individual location data to train or improve our proprietary analysis methods.
• Communicate with you: service announcements, security notices, and responses to support requests

3. Cookies

CaveFinder uses a minimal number of cookies, all essential to the operation of the service:

Cookies are set with the HttpOnly flag where they are not intended to be read by JavaScript, and the Secure flag in production (transmitted only over HTTPS). We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You can withdraw consent for non-essential analytics at any time from the cookie preferences link in the footer. Your cookie choice is also kept in your browser’s local storage so the notice does not reappear.

4. Third-Party Service Providers

We share data with the following third-party processors only as necessary to operate the service:

• Stripe (stripe.com): payment processing. See Stripe's Privacy Policy.
• Hetzner (hetzner.com): hosts our servers, where your account, saved results and usage data are stored.
• Resend (resend.com): sends our account emails (sign-up verification, password resets, security notices), so it receives your email address and the message.
• OpenTopography (opentopography.org), Microsoft Planetary Computer (planetarycomputer.microsoft.com) and NASA Earthdata (earthdata.nasa.gov): global elevation data downloads (SRTM, NASADEM, ALOS and Copernicus, the last also from Amazon Web Services). Our servers send the geographic coordinates of the area you scan to retrieve terrain data.
• USGS (usgs.gov): digital elevation model data from the 3D Elevation Program. Your requested geographic coordinates are sent to retrieve terrain data. USGS National Map tiles (shaded relief, hydrography, watershed outlines, coverage outlines and NAIP colour-infrared air photos) are also requested by your browser directly from USGS, so it receives your IP address and the map area you are viewing.
• IGN (France), Natural Resources Canada and ARSO (Slovenia): when the Hillshade or Slope layer is on and the map shows France, Canada or Slovenia, those shading tiles are requested by your browser directly from that agency, so it receives your IP address and the map area you are viewing.
• Other government map layers: when you switch on the USDA Forest Service land layer, the Forest Service roads and trails layer (clicking one of its lines also sends that map position to the Forest Service through our server) or the Natural Resources Canada coverage outline, those tiles are requested by your browser directly from that agency, so it receives your IP address and the map area you are viewing.
• USDA soils layer (sdmdataaccess.nrcs.usda.gov): the soil map tiles are requested by your browser directly from the USDA, so it receives your IP address and the map area you are viewing. Clicking for soil details is answered through our server.
• Place search: what you type into the search box is sent from our servers to Photon (photon.komoot.io) and OpenStreetMap Nominatim to find the place. Your IP address is not passed on.
• National elevation services: ARSO (Slovenia), Natural Resources Canada, IGN (France) and LINZ (New Zealand). When you scan in those countries, your requested geographic coordinates are sent to retrieve terrain data.
• Cloudflare (cloudflare.com): CDN, DDoS protection, and SSL/TLS, plus the bot check on the sign-up and password-reset forms (Turnstile) and a few code libraries your browser loads from cdnjs.cloudflare.com. See Cloudflare's Privacy Policy.
• Google Fonts (fonts.googleapis.com): our home page loads its typeface from Google, so Google receives your IP address when you open it. The map app and our other pages do not.
• Links you choose to follow: buttons such as directions in Google Maps or a record on its source site open that site only when you click them.
• OpenStreetMap / Overpass API (openstreetmap.org and overpass-api.de, and its public mirror overpass.kumi.systems when the main server is unavailable or refuses the request): public cave location data, mapped roads and tracks, and the OpenStreetMap map style. The coordinates of the area you scan are sent from our servers to query publicly available cave data and to check each result for a nearby road or track. Your IP address is not passed on. When you use the OpenStreetMap map style, its tiles are requested by your browser directly from OpenStreetMap, so it receives your IP address and the map area you are viewing.
• MRLC / National Land Cover Database (mrlc.gov, run by the USGS): land cover. When you scan in the United States, the coordinates of the area you scan are sent from our servers to MRLC to look up the land cover there (for example developed land or open water). Your IP address is not passed on.
• Esri (esri.com): satellite, aerial and topographic map imagery, including the historical imagery used to compare two maps. These map tiles are requested by your browser directly from Esri, so Esri receives your IP address and the map area you are viewing, for as long as the map is on screen. See Esri's Privacy Statement.
• Historical air photo archives: when you compare maps using an older air photo or orthophoto from a government or public archive (for example state and county GIS offices in the US, national and regional mapping agencies in Europe, Japan's Geospatial Information Authority or New Zealand's Ministry for the Environment), our server requests those tiles from that archive, so it receives the map area you are viewing but not your IP address. Each photo is credited to its source on the map.
• Wikidata (wikidata.org): public cave records. When we do not already hold the answer, the coordinates of the map area you are looking at are sent from our servers to Wikidata to look up publicly available cave data. Cave records that came from Wikidata also link back to it; those links are only followed if you click them.
• Macrostrat (macrostrat.org): bedrock geology. When you click a point on the map, your browser sends the coordinates of the point you clicked directly to Macrostrat to look up the rock unit there, so Macrostrat receives your IP address and that clicked location. When the geology layer is switched on, its map tiles are also requested by your browser directly from Macrostrat, which then receives your IP address and the map area you are viewing.
• OpenTopoMap (opentopomap.org): topographic contour map tiles. When you use this map style, the tiles are requested by your browser directly from OpenTopoMap, so it receives your IP address and the map area you are viewing.
• Bureau of Land Management (blm.gov): public land boundaries and the township and section survey grid. When the BLM layer, the township and section grid or the BLM roads and trails layer is switched on, its map tiles are requested by your browser directly from the BLM, so it receives your IP address and the map area you are viewing, and our servers send the BLM the edges of the map area on screen to count the public land in view.
• Amazon Web Services (amazonaws.com): the free global terrain data that shapes the 3D view is hosted on Amazon's servers. When you open the 3D view without a completed scan, your browser requests those terrain tiles directly, so Amazon receives your IP address and the map area you are viewing.

5. Data Retention

• Analytics data (usage events, session logs): retained for 90 days, then deleted
• Analysis results (search areas, candidate lists, saved results and field notes): kept in your account so you can return to them, and deleted when you delete your account. Temporary working copies and uploaded overlays expire within 24 hours.
• Items you share into a project: items you share into a project belong to that project and stay after you leave it or delete your account. Only the project leader can remove them.
• Account data (email, display name, hashed password): retained until you request account deletion
• Payment records (Stripe customer ID, subscription status): retained as long as your account is active or as required for billing/legal purposes

6. Your Rights

Depending on your jurisdiction (including under the GDPR and CCPA), you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate personal data
• Deletion: request deletion of your account and associated data. You can delete your account directly within the application, or contact us. Items you shared into a project stay with that project (see Data Retention).
• Data portability: request your data in a structured, machine-readable format
• Opt-out of analytics: contact us to opt out of non-essential usage data collection
• Do Not Sell (CCPA): we do not sell your personal information to third parties

To exercise any of these rights, contact us at help@cavefinder.app or use the account deletion feature within the application. We will respond within 30 days.

7. Data Security

We protect your data through:

• Passwords stored using a salted, computationally expensive hash (scrypt, via Werkzeug), never in plaintext
• HTTPS encryption for all data in transit (enforced via HSTS in production)
• HttpOnly and Secure cookie flags to prevent client-side access
• Rate limiting to prevent brute-force attacks
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)

8. Children's Privacy

CaveFinder is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at help@cavefinder.app and we will promptly delete it.

9. International Data Transfers

CaveFinder is operated from the United States. If you access the service from outside the US, your data will be transferred to and processed in the United States. By using the service, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The Effective Date at the top of this page shows when it was last updated.