Privacy Policy

This Privacy Policy describes how Dan Pacheco (“we,” “us,” or “our”) collects, uses, and protects information when you use Maps & Cards (the Scroll Map Builder) at this website (the “Service”).

Effective date: July 21, 2026

1. Two ways to use the Service

Your privacy experience depends on how you use the Service:

• Guest Mode — we do not store your guest stories on our servers. Drafts stay in your browser. You use Guest Mode at your own risk and are responsible for any content you create or export.
• Full editor — when a site password is enabled and you use it, stories you save are stored on this hosted instance so they can be edited and viewed here. Example stories on the home page are also stored on the server.

2. Information we collect

Guest Mode

• Browser storage: the builder may save drafts locally in your browser (for example, localStorage under keys such as playground-*). This data stays on your device and is not uploaded to our story database.
• Technical logs: basic server logs (such as IP address, browser type, and timestamps) may be recorded by the hosting provider for security and troubleshooting
• Cookies: see Section 4 below

We do not collect guest account profiles or store guest drafts in our online database.

Full editor / saved stories

• Story data: map story configuration (locations, card HTML, annotations, basemap settings, and related metadata) that you save with the full editor
• Session data: an authentication cookie when a site password is used (see Section 4)
• Technical data: basic server logs for security and troubleshooting

3. How we use information

We use information only to:

• Operate the builder, story viewing, and save features
• Keep password-protected editing sessions secure and functional
• Display example or saved stories to visitors of this instance
• Maintain security, enforce acceptable use, and troubleshoot errors
• Operate hosting and database infrastructure for this instance

We do not sell personal information. We do not use your information for advertising or to build marketing profiles of students or guests.

4. Cookies and similar technologies

We use cookies and similar technologies as needed to run the Service.

Service cookies (first-party)

• Editor password session (mc_auth) — when a site password is set, this cookie keeps you signed in to the full builder and story write API after you enter the password. It is typically HttpOnly and SameSite=Lax.

Guest Mode does not require a sign-in cookie. Guest drafts use browser storage, not this cookie.

What we do not use cookies for

• Advertising or targeted marketing
• Selling personal information or sharing it with data brokers
• Social media tracking pixels
• Building marketing profiles of students or guests

The site operator may optionally enable Google Analytics 4 by setting a measurement ID on the server. When enabled, Google may collect usage data (such as pages viewed and approximate location derived from IP) under Google’s Privacy Policy. When that ID is not set, no Google Analytics script is loaded.

Browser storage (not cookies)

The builder may use local storage to remember guest drafts and editor preferences. That storage is controlled by your browser. You can clear it through your browser settings. Clearing it deletes your guest drafts on that device.

Your choices

If you block or delete cookies, password-protected full editor access may not stay signed in. Guest Mode and viewing example stories should still work.

5. Where data is stored

• Your device only (Guest Mode): browser local storage for drafts
• This hosted instance (full editor / examples): story data in a PostgreSQL database and/or on-disk story folders, depending on how the instance is deployed
• Your device (exports): ZIP downloads you choose to save
• Third-party map providers: when a story displays a map, your browser requests map tiles/styles from providers such as OpenFreeMap, Carto, or Esri. Those requests are subject to those providers’ own policies

6. Sharing and access

Guest drafts are visible only in the browser where they were created; other visitors to the site cannot see them.

Stories saved with the full editor, and seeded example stories, may be viewable by anyone who can access this website.

We may disclose information if required by law or to protect the Service, our users, or others.

We use infrastructure providers (such as hosting and database services, for example on Render) to operate the Service. They process data on our behalf to provide hosting, not for their own marketing.

7. Retention and deletion

Guest browser data remains on your device until you clear it or delete the draft in Guest Mode.

Server-saved stories are retained while this instance is running and until an authorized editor deletes them. Contact us if you need help removing content you saved with the full editor on this hosted instance.

8. Education and student privacy

The Service may be used in educational settings. Schools may have additional obligations under laws such as FERPA or COPPA. Where a school directs student use of the Service, classroom and institutional policies also apply.

If you are under 13, you may use the Service only with appropriate parental or school consent as required by law.

9. Security

We use reasonable technical measures to protect data, including optional password protection for the full editor and secure cookies in production. No online service can guarantee absolute security. Guest Mode data on your device is only as secure as your device and browser.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be reflected on this page.

11. Contact

Privacy questions should be directed to Dan Pacheco via danpacheco.com.

Template notice: Have qualified legal counsel review this policy before production use.