Privacy policy

Who we are

Epicentric is a map of the places around a spot you choose, minus the brands you never want to see. Gozunga LLC runs Epicentric at epicentric.app. In this policy, "we" and "us" mean Gozunga LLC.

Epicentric only works if it knows roughly where you are looking. We take that seriously. We collect what the app needs to work, we tell you exactly what that is below, and we don't sell it or use it for ads.

If you have a question about this policy or your information, email support@gozunga.com or write to Gozunga LLC, 230 S Phillips Ave, Suite 203, Sioux Falls, SD 57104.

The short version

• You can use Epicentric without an account. Without one, your epicenter and settings stay on your device.
• Your device shares its location with Epicentric only after you allow it. We read one position at a time while the app is open. We never track you in the background.
• We use your location to find places near you. We don't keep a history of where you have been, except the check-ins you choose to make.
• We don't sell your personal information. We don't share it for targeted advertising. Epicentric has no ads. We count page views with analytics we host ourselves, which sets no cookies and doesn't follow you to other sites.
• You can ask us to show you, correct, or delete your information at any time.

What we collect and why

We collect the following information. Each item says why we need it.

• Account details. If you create an account, we store your @handle, your password, and your email address if you give one. We store a password only as a salted scrypt hash, never as the password itself. Email is optional for password accounts. We use these details to sign you in and to recover or verify your account.
• Google sign-in. If you sign in with Google, Google shares with us a stable account ID, your email address and whether Google has verified it, your name, and your profile photo. We use them only for your Epicentric account and profile. We keep the account ID, the email address, and whether it's verified, and we use them to sign you in and link Google to your account. We also keep the web address of your Google profile photo and, unless you turn it off in Settings, a small copy of the photo that we show as your profile picture. We don't store your name. We never receive your Google password, your contacts, or anything else from your Google account. If you created your account with Google, we keep your Google account ID with your account until it's deleted, even if you unlink Google.
• Profile details. If you fill them in under Edit profile, we store a display name, a bio, a location, and one website link. Each is optional, and you can change or clear it at any time. The location is text you type, such as a town. We never fill it from your GPS, your epicenter, or your check-ins. We don't fill the display name from Google either. Your profile also shows the month and year you joined, taken from when you created your account.
• Your epicenter. The spot you choose to search around is saved on your device. When you search, the app sends that point and your radius to our servers to look up nearby places. Our servers use the point to answer the request and don't store it.
• Your device location. See How we handle location.
• Searches. When you type an address or place, we send the text to our own address search server to find matches. Epicentric doesn't save your searches, apart from the recent places described next. Our address search server may keep short-lived logs of its own. If you pick a result while signed in, we save it to your recent places so it shows up on your other devices. You can remove recent places in the app.
• Settings and lists. If you have an account, we store your settings so they follow you: your radius, whether to show only open places, your home screen shortcuts, the brands and places you hide or like, your saved lists, and your favorite places.
• Check-ins. When you check in at a place, we store the place, the time, your local day and time zone, who can see it, and the GPS reading your device gave at that moment. We store the reading and its accuracy only to confirm that you were really at the place, which keeps Mayor titles fair.
• Ratings, reviews, and reports. We store the ratings and reviews you write, the places you report as missing or closed, and any note you add to a report.
• People you follow. We store who you follow, who follows you, follow requests, and which other people's lists you follow.
• Account status. We store whether your account is Public or Private, whether we have verified it, and any Mayor titles you hold. Right now an Epicentric admin marks accounts verified by hand. If we verify your account, we may store a phone number you give us for that purpose. We don't send verification emails or text messages.
• Technical information. Like any website, our servers see your IP address when your device connects. It passes through Cloudflare and our web server, and Epicentric doesn't store it. If you search before you choose an epicenter, we may use an approximate city-level location from your IP address to show nearby results first. We look that up on our own servers or read it from Cloudflare. We don't store it.
• Page views. We count the pages you view in the app, as described in Analytics.

How we handle location

Location is the heart of Epicentric, so here is exactly what happens to it.

• Your browser or phone asks before Epicentric can read your location. If you say no, the app still works. You search for an address or landmark instead.
• If you allow it, the app reads one position when you tap the locate button or choose your current location as your epicenter. While your epicenter follows you, the app reads one new position when you return to the app, at most about every 45 seconds. Epicentric never watches your position continuously and can't read it when the app is closed.
• To show what is right where you are standing, the app sends your current position to our servers. Our servers look up named places close to you on OpenStreetMap data. We run our own copy of that data. If ours is unavailable, our servers send the same lookup to a public OpenStreetMap server, such as overpass-api.de. That lookup comes from our servers. It carries no name, account, or IP address of yours.
• To list places around your epicenter, our servers ask for a map area rounded to a coarse grid, not your exact point.
• We don't keep a history of your positions. The one exception is check-ins: when you check in, we keep the GPS reading from that moment with the check-in until you ask us to delete it or delete your account. Other people never see your GPS reading. They see only the place you checked in at, and only if your settings allow it.
• You can turn off location for Epicentric at any time in your browser or device settings. See Your rights and choices.

What other people can see

Some of what you do in Epicentric is social. Here is who sees what.

• Your @handle is public. Anyone who knows it can find your profile, though profiles are shown only to signed-in people.
• Your profile photo, if you have one, shows next to your @handle wherever the handle appears, including to people who don't follow you and on Private accounts. It's a 256-pixel copy of your Google photo that we make once and serve from our own servers, so people who see it never contact Google. Each time you sign in with Google, we fetch the photo again from Google's image servers so it stays current. Turn off Use your Google photo in Settings to delete the copy and show your initial instead. Unlinking Google or deleting your account deletes it too.
• Your display name, bio, location, website link, and the month you joined show on your profile to signed-in people. On a Private account, only people you approve see them. Text appears exactly as you typed it, and the website link is the only link. When you tap the link, you leave Epicentric for that site.
• You choose who sees each check-in as you make it: Public or Followers. Each check-in starts as Followers, which shows only to your followers.
• A Public account shows its Public check-ins, Mayor titles, public lists, and who it follows to signed-in people. Public check-ins from a Public account also appear on a place's timeline, which anyone can see.
• A Private account shows its activity, lists, followers, and following only to people you approve. Everyone can still see your @handle, your profile photo, and how many people you follow and how many follow you.
• Activity appears about 10 minutes after it happens, so nobody sees in real time that you are at a place.
• Ratings and reviews are public. They appear with your @handle on the place, even if your account is Private.
• To hold a Mayor title, your account must be Public and verified. Only Public check-ins count toward it, so Followers check-ins never do. The title shows your @handle on the place.
• Your email address, any phone number we store for verification, your password, GPS readings, epicenter, searches, and hidden brands stay private.

We don't sell your information

We don't sell, rent, or trade your personal information. We don't share it for targeted or cross-context behavioral advertising. Epicentric shows no ads and has no advertising trackers. Our own analytics, described in Analytics, isn't shared with anyone.

Services we rely on

A few outside services help run Epicentric. Each one gets only what it needs to do its job.

• Cloudflare protects the site and delivers it to you. Your traffic, including your IP address, passes through Cloudflare.
• Google provides Google sign-in, if you use it. Google also serves the fonts the app uses, so Google sees your IP address when you load Epicentric.
• OpenFreeMap serves the map images. Your device asks OpenFreeMap for the part of the map you are looking at, so OpenFreeMap sees your IP address and the map area on screen.
• Public OpenStreetMap servers, such as overpass-api.de, answer place lookups only when our own copy is unavailable, as described in How we handle location.
• Google Maps opens only when you tap Navigate on a place. It receives that place's location from your device, and Google's own privacy policy applies there.

Our address search, routing, and OpenStreetMap servers, our IP location database, and our databases run on servers we operate.

Analytics

We use Umami, a privacy-focused analytics tool that we host ourselves, to count page views in the app at epicentric.app. Your device loads it from stats.app.gozunga.com, a server we run. Umami sets no cookies and doesn't track you across other sites.

When you view a page, Umami records:

• the page you viewed, without the part of its address after a ? or a #
• the site that sent you there, if any
• your browser, operating system, device type, screen size, and language
• your approximate location, such as your country, region, and city, worked out from your IP address

Umami uses your IP address to work out that approximate location and the identifier described below, but it doesn't store the IP address in its records.

Umami groups your page views with an anonymous identifier. It makes the identifier from a one-way hash of your IP address and browser details, mixed with a value that changes at least once a month. After each change, you get a new identifier, so Umami doesn't link your visits from one period to the next.

Umami never receives your precise location or your map position. All it learns about where you are is the approximate location from your IP address described above. The parts of the address it drops are where the app keeps the map position and any shared place. It doesn't receive your check-ins or your account details either, and we don't tell it who you are. We use it only to understand how people use Epicentric. We don't share or sell what it records.

When we may disclose information

We share personal information outside the cases above only in these situations:

• To follow the law, when a valid legal process such as a subpoena or court order requires it. When the law allows, we tell you first, unless doing so would put someone at risk.
• To protect people, when we believe in good faith that disclosure is needed to prevent harm to someone or to stop fraud or abuse of Epicentric.
• If Epicentric or Gozunga is sold or merged, the new owner may receive your information. Your information stays covered by this policy, and we'll notify you in the app before your information is handled under a different privacy policy.
• When you ask us to.

How long we keep information

• Account information, settings, lists, favorites, follows, and recent places stay until you remove them in the app or we delete your account.
• Check-ins, including their GPS readings, and ratings, reviews, and reports stay until you ask us to delete them or we delete your account.
• A sign-in works for 30 days, or until you sign out. When you sign out, we delete its record. A sign-in that simply expires leaves a record of a hash of its token and its dates, which stays until we delete your account.
• Records used during a Google sign-in stop working after 10 minutes. A Google sign-up waiting for you to pick a @handle stops working after 30 minutes, and it holds your Google account ID and email. We delete expired records the next time someone starts a Google sign-in or sign-up, so they can stay a while longer.
• If you created your account with Google, your Google account ID stays with your account until we delete it, even if you unlink Google.
• Epicentric doesn't store your IP address. Our abuse limits count requests per account, or for all signed-out visitors together, and keep those counts only in memory, for up to an hour.
• Analytics records stay in Umami until we delete them. They aren't linked to your account.
• Our servers keep short-lived error logs to fix bugs. Each of our services keeps only a few small log files and overwrites the oldest. These logs don't record the pages you visit or the places you search for, though rarely an error message includes part of the request that caused it.
• When we delete your account, we remove your information from our live systems within 30 days. Deleted data may remain in backups for up to 30 days before they're overwritten.

How we protect your information

We protect your information with measures that fit how sensitive it is. They include:

• Encryption in transit. Your connection to Epicentric always uses HTTPS. Some traffic between our own servers isn't encrypted yet, and we're adding encryption to it.
• Passwords stored only as salted scrypt hashes.
• Sign-in cookies that scripts can't read, sent only over HTTPS. We store only a hash of each sign-in token.
• Limits on how fast anyone can look up @handles, start a Google sign-in, read activity, or check in, so no one can scrape accounts.
• Access to personal information limited to the few people at Gozunga who run Epicentric.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires. If you find a security problem, email support@gozunga.com.

Your rights and choices

Wherever you live, you can:

• See your information. Most of it is in the app. For a full copy, email support@gozunga.com.
• Correct your information. Change your settings, lists, ratings, and reviews in the app, or email us to fix anything else.
• Delete your information. You can remove favorites, follows, recent places, and the lists you made in the app. Check-ins, ratings, reviews, and reports can't be removed in the app yet, so email support@gozunga.com and we'll delete them. To delete your whole account, email us from the email on your account, or tell us your @handle. If your account has no email address, we'll ask you to prove it's yours with a short step in the app while you're signed in. We delete your account and its information within 30 days.
• Turn off location. In your browser or phone settings, remove Epicentric's location permission. Epicentric then stops reading your location. You can still search for an epicenter by address.
• Go Private. In the app, make your account Private.
• Use Epicentric without an account. Your settings then stay on your device. Clear your browser's site data to remove them.

We answer requests within 30 days. We won't treat you differently for using any of these rights.

US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, or another US state with a privacy law, you have the rights that law gives you. They include the right to know what personal information we collect, use, and disclose, and the right to access, correct, delete, and get a portable copy of it.

Under the California Consumer Privacy Act as amended by the CPRA, we collect these categories of personal information: identifiers such as your @handle, email, IP address, and the profile photo Google shares if you sign in with Google, which you can turn off, as well as your name, which Google shares and we don't keep, internet activity within Epicentric, including the pages you view, which our own analytics counts, precise geolocation from check-ins and place lookups, and the content you post. The sections above give the sources, purposes, and the service providers that receive each one.

We don't sell or share personal information, as those laws define "sell" and "share", and we haven't in the past 12 months. Because we don't, there is nothing to opt out of, and a Global Privacy Control signal changes nothing for you here.

Some of what we hold counts as sensitive personal information under the CPRA: your precise geolocation, and your @handle together with your password, which sign you in. We use precise geolocation only to provide the features you ask for, and your @handle and password only to sign you in. We don't use any of it to infer anything about you.

To make a request, email support@gozunga.com. You can also ask someone to make it for you, and we may confirm their authority with you. If we deny your request, you can appeal by replying to our answer. If we deny the appeal, you can contact your state attorney general.

If you are in the European Economic Area or the UK

Gozunga LLC is the controller of your personal information. We rely on these legal bases:

• Contract, to provide your account, settings, check-ins, and the other features you use.
• Consent, to read your device location. You give it through your device's permission prompt and can withdraw it in your settings at any time.
• Legitimate interests, to keep Epicentric secure and free of abuse and to show nearby results from an approximate IP location before you choose an epicenter.
• Legitimate interests, to count page views with our own analytics so we can understand how people use Epicentric. Analytics sets no cookies and doesn't know who you are.
• Legal obligation, when the law requires us to keep or disclose information.

You have the right to access, correct, delete, restrict, and object to our use of your information, and to get a portable copy. To use them, email us. We answer within 30 days, or we'll tell you if we need more time as the law allows. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. You also have the right to complain to your local data protection authority, or in the UK to the Information Commissioner's Office. We would like the chance to help first.

We are based in the United States, and we handle your information in the United States. When you use Epicentric from outside the US, your information goes to the US so we can provide the service you asked for. US privacy law may differ from yours, but this policy and its protections apply wherever we handle your information.

Children

Epicentric isn't for children under 13, and we don't knowingly collect personal information from them. If your country sets a higher age for using online services without a parent's consent, you must be that age to make an account. If you believe a child under 13 has given us personal information, email support@gozunga.com. We will delete the account and its information.

Cookies and device storage

Epicentric uses only the cookies it needs to sign you in. It uses no advertising or analytics cookies, and our analytics sets none. All three cookies are HttpOnly, Secure, and SameSite=Lax.

The app also stores these items in your browser's local storage. They never leave your device unless you are signed in and the item syncs to your account.

The page address holds the map view you are looking at, after #map=, so a reload keeps your place on the map. Your browser doesn't send that part of the address to our servers or to our analytics. A link you share to a place carries the place and its coordinates.

Clear your browser's site data for epicentric.app to remove all of them.

Google user data

Epicentric's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We ask Google for the openid, email, and profile scopes. They share your Google account ID, your email address and whether Google verified it, your name, and your profile photo. We use that information only for your Epicentric account and profile. We keep the account ID, the email address, and whether it's verified, to sign you in and link Google to your account. We keep the web address of your profile photo and a 256-pixel copy of it, which is your profile picture in Epicentric until you turn it off in Settings. Turning it off or unlinking Google deletes the copy. We don't store your name. We don't use any of it for ads, we don't sell it, and we don't use it to train AI models. People at Gozunga don't read it unless you ask us to, it's needed for security or abuse, or the law requires it. You can unlink Google in the app's Settings, or remove Epicentric's access in your Google account.

Changes to this policy

If we change this policy, we post the new version here and update the effective date. If a change matters, such as a new use of your location, we tell you in the app before it takes effect.

Contact us

Email support@gozunga.com, or write to Gozunga LLC, 230 S Phillips Ave, Suite 203, Sioux Falls, SD 57104.