Privacy policy

Last updated: 8 October 2026

You can plan without an account. Saved missions start private, and you choose what to publish. This page explains the information used to provide Straight Line Planner.

Who is responsible and how to contact us

Straight Line Planner is operated by Leo Frössling, who is responsible for the personal data processed through this website. For privacy questions, access requests or account deletion, email straightlineplanner@gmail.com. Do not send passwords or sign-in links. We may ask you to verify ownership before acting on an account request.

Accounts and Google sign-in

If you create an account with email, Supabase handles your email address, password authentication, account identifier and sign-in sessions. Account confirmation and password recovery emails are delivered through Resend. Passwords are not stored in mission drafts.

If you choose Continue with Google, Google provides your email address, a Google account identifier and basic profile information, which can include your name and profile picture. Supabase stores the account and identity information needed to authenticate you and link it to your missions. We use this information to sign you in and maintain your account. We do not request access to Gmail messages, Google Drive files, contacts or calendars, or use Google profile information for advertising.

Google handles your Google password; the planner does not receive it. You can remove the connection through your Google Account connections. Removing that connection does not itself delete your planner account or saved missions. Contact us if you want those deleted.

Missions, checkpoints and sharing

When you explicitly save a mission, Supabase stores it under your account identifier. This includes its name, endpoint coordinates, corridor settings, endpoint labels, checkpoints, notes and review decisions. Saved missions are private by default. Authorized service administration may access stored data when needed to operate the service or handle a support request.

A coordinate link includes the mission endpoints in the URL. If you enable public sharing, anyone can view the mission and the checkpoints you select for sharing, including their notes and review status. Other checkpoints stay private. Shared links can be forwarded, and published missions can also be discovered through the public data API; the link is not a confidential access credential. Recipients may download or copy published information. Unpublishing removes access through the public page but cannot remove copies held by other people. Avoid including sensitive personal information in public missions.

Browser storage and location

Obstacle-analysis progress, route coordinates and map findings are cached in this browser to resume long missions. Recent results are reused for up to 30 minutes. Older stored results remain until replaced or cleared. “Remove local plan copies” also clears this analysis recovery data.

Draft recovery and preferences are stored in your browser, with separate recovery drafts for anonymous planning and signed-in accounts. Temporary planning copies may use browser session storage. Authentication uses cookies and session credentials to keep you signed in. These are separate from analytics, which does not use cookies.

Local drafts remain on that browser until you clear the site's storage or they are replaced. Sign-out does not erase every local draft. The temporary draft used during sign-in is eligible for automatic restoration for up to 24 hours; this is not a promise that its stored data is automatically erased after 24 hours. Clear site data through your browser settings on a shared device, or choose “Remove local plan copies” in More actions to remove planner drafts and undo history while keeping your sign-in. Neither action removes previously downloaded files or copies on another device.

Location is requested only when you use a location feature and permit access in your browser. The site displays your position while active and does not record a background journey. Using your position as a mission endpoint makes that coordinate part of the plan, which can be stored, analysed, exported or shared like other mission coordinates. Map requests may reveal the area you are viewing to map providers. You can stop location tracking in the planner or revoke the browser permission.

Maps, search and terrain services

Providing maps and analysis involves sending the relevant map area, search text or mission coordinates to our servers and data providers. Place search uses Geoapify; obstacle analysis uses OpenStreetMap data through Overpass; terrain uses AWS-hosted terrain tiles; map layers use Esri, OpenStreetMap and OpenTopoMap. Direct browser requests expose your IP address and ordinary request information to the provider. Requests made through our server still send the geographic information needed for the feature. We do not deliberately send your account identity or private checkpoint notes to these providers.

See Data sources and licenses for the services used. Requests to the website and its providers may appear in operational logs, including IP addresses, timestamps, URLs and browser information, for delivery, security and diagnosis. URLs can contain coordinates when you open coordinate links. Search, map and analysis results may be cached temporarily to reduce repeated requests.

Website analytics

We use Vercel Web Analytics for aggregate statistics about visits to fixed public pages, including the planner, introduction, guide, Help, Data sources and this privacy page. We remove URL query parameters and fragments, exclude authentication and shared mission page views, and do not send account identities, mission names or checkpoint details as analytics events. The analytics service may collect the page path, referrer, time, approximate region and browser or device information. It uses a temporary request-derived visitor identifier instead of analytics cookies; Vercel says that identifier is discarded after 24 hours.

Details are available in Vercel's analytics privacy documentation. Cookie-free analytics does not mean that hosting, authentication or map providers receive no request data.

Why we use information and who receives it

We process account and mission information to provide the service you request, on the basis of performing our agreement with you. Our legitimate interests in operating, securing and improving the service support necessary operational processing and aggregate usage measurement. Optional Google sign-in and browser location require the permissions you grant. Where applicable law requires consent, you can withdraw it; withdrawal does not undo processing already carried out.

Vercel hosts the website and analytics, Supabase provides authentication and database storage, and Resend delivers account emails. Google processes Google sign-in, and the map services described above process feature requests. We do not sell your personal data. Information may also be disclosed when necessary to comply with law or protect the service. Optional donation links take you to Buy Me a Coffee, where its privacy terms apply; the planner does not collect your payment-card details.

The mission database is hosted in Supabase's Stockholm region. Providers operate internationally, so processing may involve countries outside Sweden and the European Economic Area. Their data-protection terms describe applicable transfer safeguards. See Supabase's privacy policy, Vercel's privacy policy, Resend's privacy policy and Google's privacy policy.

Retention, deletion and your choices

We keep your account and saved missions while needed to provide your account, until you delete the missions or request account deletion. You can delete saved missions from My missions, turn off public sharing, export a plan, or clear local browser storage yourself. Account deletion is currently handled by contacting us. Copies in provider backups and operational logs may remain until the provider's retention period expires; information required for legal obligations or resolving a dispute may be retained for that purpose.

Depending on applicable law, you may request access to, correction or deletion of your personal data, a portable copy, restriction of processing, or object to processing based on legitimate interests. Contact us using the email above. You can also complain to your local data-protection authority; in Sweden this is IMY.

Changes to this policy

We will update this page when the service's data handling changes and revise the date above. Material changes affecting existing account data will be communicated where required. For practical sharing and storage guidance, see Help.