Privacy,
plainly.

Earth Sandwich is a non-commercial hobby project run by Laurent Georges, based in Switzerland, who is the data controller for everything on this page. For any privacy question or request, write to [email protected]. Swiss data-protection law (the Federal Act on Data Protection) applies, and so does the EU's GDPR for visitors in the EU.

1. § 2.1
   Browsing any page. Like every website, our server and Cloudflare (which sits in front of it) see your IP address, browser type and the pages you request. We use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. Your language choice is remembered in your own browser's storage, never sent to us.
2. § 2.2
   Using the map. If you press "sandwich me", your browser asks for your location and uses it on your device only to draw your antipode. We never receive it. Map tiles come from OpenFreeMap, which sees your IP address and which part of the world you are looking at.
3. § 2.3
   Starting or joining an attempt. Your browser gets a random anonymous identifier and keeps it in its own storage, so you can close the page and come back to your sandwich later. We delete identifiers after 30 days (Article V), and clearing this site's data in your browser drops yours sooner. To keep bots out, Cloudflare Turnstile runs a check before the identifier is issued. The attempt code links the two participants' identifiers. Your browser also keeps a random key for your seat, which lets your personal link move the seat to another of your devices; we store only a one-way hash of it. While the lobby is open, the two phones exchange live distance and countdown messages through Supabase Realtime.
4. § 2.4
   Taking your photo. We store the photo, your position at the moment of capture with its accuracy radius, the capture time, and your device clock's offset from UTC (for example UTC+2), which helps a moderator spot a position moved by a VPN. For a photo chosen from your gallery, we keep only four fields from its metadata: GPS latitude, longitude, date and time. No camera model, no device identifiers, nothing else. Your browser also keeps a random withdrawal key for your slice (§ 6.2); we store only a one-way hash of it. Your photo may show your face, other people or your surroundings. Frame it as you would for anything you might later publish.
5. § 2.5
   Publication. If a moderator approves a sandwich, the public board shows: both positions rounded to about 1 km, capture times truncated to the minute, the tier and distances, and re-encoded copies of the two photos and the souvenir card with all metadata removed.

We do not collect names, email addresses or phone numbers, and we don't want them. Please don't put them in your photos.

1. § 3.1
   Verifying and publishing sandwiches. Positions, times and photos are the evidence for Sandwich Law. Without them there is nothing to verify. We process them because you asked us to run your attempt (GDPR Art. 6(1)(b)).
2. § 3.2
   Keeping the site running and bot-free. Server logs, analytics counts and the Turnstile check serve our legitimate interest in a working, abuse-resistant site (GDPR Art. 6(1)(f)).
3. § 3.3
   Never. We do not sell data, show ads, build profiles or use your photos to train anything.

Some of these providers process data outside your country, including in the United States, under their own standard data-protection terms.

An automated clean-up runs every night. Lobby messages are temporary and are cleared by Supabase within days.

1. § 6.1
   What you can ask for. A copy of your data, correction, deletion, restriction, or taking a published sandwich down. Either participant can have a sandwich removed without the other's agreement (Sandwich Law § 8.3).
2. § 6.2
   Withdrawing yourself. The sandwich page has a Withdraw my slice button. It deletes your photo and position immediately, takes the pair off the board, and closes the attempt. The browser that took your photo keeps a private withdrawal key, so reopening the sandwich link in that browser brings the button back, even after the sandwich is published.
3. § 6.3
   Everything else, or from another device. Email [email protected] with your sandwich code (it looks like BREAD-7F3K2Q) and which side you were. We have no accounts, so the code is the only way we can find your data. Keep it if you might want to ask later. We answer within 30 days, usually much faster.
4. § 6.4
   Complaints. If you think we have mishandled your data, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to your national data-protection authority. We'd appreciate hearing from you first.

1. § 7.1
   Only the two participants and the moderators can see an attempt. The database enforces this row by row. Original photos sit in a private storage bucket.
2. § 7.2
   What goes public is built separately. Published photos are re-encoded copies, so no metadata can survive. Published positions are rounded by the database itself, not by the page displaying them.
3. § 7.3
   Abuse limits. Bot checks, rate limits and attempt codes that can't practically be guessed protect both the evidence and the moderators.
4. § 7.4
   If something goes wrong. If we ever discover a breach affecting your data, we'll post it here, notify the relevant authority where the law requires, and fix the cause.

1. § 8.1
   Under 16? Browse the map all you like. Before submitting photos, get a parent or guardian to agree to it (and ideally to hold the other slice).
2. § 8.2
   Changes. If this notice changes, the date at the top changes too. We will never apply a looser rule to data collected under a stricter one.