Privacy Policy

The Privacy Officer for Urban Design Index is the Founder and Operator.

Privacy questions, access requests, correction requests, deletion requests and complaints may be sent to:

Account information

You may browse the public archive without an account. An account is required to submit entries, comment, like content or manage contributions.

When you create or use an account, we may collect:

• your email address;
• your optional display name;
• an internal user identifier;
• your account role and permissions;
• authentication and session information;
• the date your account was created;
• records of your acceptance of our Terms and licensing conditions; and
• information provided through Google when you choose Google sign-in.

Passwords are handled by our authentication provider. Urban Design Index does not see your Google password.

User submissions

When you submit an entry, we collect:

• uploaded photos;
• the map location you select;
• the location label associated with the entry;
• titles, descriptions, notes and tags;
• designer, manufacturer and product information;
• links associated with the submission;
• your selected display and licensing preferences;
• your internal user identifier;
• submission and editing timestamps; and
• an edit history showing changes made to shared records.

Submissions are intended for public display.

Photos are stored in original, display and thumbnail versions. Embedded image metadata, including EXIF location information, is removed before the image is uploaded to storage.

Anonymous submissions

All uploads require an account.

When you select "Post Anonymously," your display name and account identity are hidden from the public-facing entry. Urban Design Index privately retains the connection between the submission and your account for accountability, moderation, licence documentation, dispute resolution and legal compliance.

Anonymous submissions may only be published under the CC0 1.0 Universal Public Domain Dedication.

Comments, likes and other interactions

When you comment on or like content, we collect:

• the comment or interaction;
• the related submission;
• your internal user identifier;
• the display name associated with the comment, where applicable; and
• the date and time of the interaction.

Comments and associated display names are public unless removed.

Communications and reports

When you contact us, we may collect your name, email address, message and any documents or evidence you provide.

This includes:

• general inquiries;
• privacy requests;
• copyright complaints;
• requests to correct designer, manufacturer or product information;
• reports of inappropriate content;
• security reports; and
• administrative or account-support communications.

Visitor analytics

To understand how the archive is used, page visits may send an analytics event to our own server.

We may record:

• the page or URL path visited;
• the relevant entry identifier;
• a randomly generated session identifier;
• a randomly generated visitor identifier;
• the referring website's domain;
• device class, such as mobile, tablet or desktop;
• country and city information provided by our edge network;
• the date and time of the visit; and
• an internal user identifier for signed-in administrators, used to exclude internal activity from public analytics.

The visitor and session identifiers are not intentionally connected to your name, email address or account.

We do not store your IP address in our analytics database. Infrastructure and service providers may process IP addresses as part of normal internet communications, security and service delivery.

We use personal information to:

• create and secure accounts;
• authenticate users;
• publish and manage submissions;
• apply the contributor's selected Creative Commons licence;
• display attribution when selected;
• privately associate anonymous submissions with the responsible account;
• provide commenting, liking and editing features;
• create thumbnails and other image formats;
• operate maps and location-search functions;
• maintain edit histories;
• moderate content and investigate abuse;
• respond to copyright, privacy, correction and security reports;
• provide account support;
• understand aggregate use of the website;
• prevent fraud, misuse and security threats;
• maintain backups and operational records;
• enforce our Terms of Use;
• establish, exercise or defend legal claims; and
• comply with legal requirements.

We limit collection, use and disclosure to purposes that a reasonable person would consider appropriate in the circumstances.

The following information may be publicly accessible:

• published photos;
• submission locations;
• titles, notes, descriptions and tags;
• comments;
• designer, manufacturer and product information;
• external links added to submissions;
• the selected Creative Commons licence; and
• the contributor's display name when the contributor chooses public attribution.

Your email address, authentication credentials and internal account identifier are not displayed publicly.

Because public material may be copied, indexed, archived or redistributed by other people and services, removing information from Urban Design Index may not remove copies that were previously obtained by others.

Published images are made available under the Creative Commons licence or public-domain dedication selected during upload.

Creative Commons licences and CC0 are intended to be permanent and irrevocable once applied. Deleting an account or removing an image from Urban Design Index does not revoke rights already granted to people who obtained the image under the selected licence.

When an eligible removal request is completed, Urban Design Index will stop actively displaying and distributing the image through the archive. Copies previously received by others may continue to be used under the licence that applied when they received the image.

We may retain limited records documenting the uploader, licence selection and date of acceptance where reasonably necessary to establish the licensing history, resolve disputes or meet legal obligations.

We use service providers to host, secure and operate the website. These providers may process information only as needed to provide their services, comply with law and protect their systems.

Current providers include:

• Lovable Cloud and Supabase infrastructure for databases, authentication, server functions and file storage;
• Cloudflare for website hosting, delivery, security and coarse geographic information;
• Google for optional Google OAuth sign-in;
• OpenStreetMap Nominatim for place searches and reverse geocoding; and
• MapTiler and OpenStreetMap tile services for map imagery.

Search terms and coordinates entered into map tools may be sent to the applicable mapping provider. Your browser also sends normal network information, including an IP address, when requesting maps, files or website content.

We remain responsible for personal information under our control that is processed by service providers.

We do not sell personal information.

We do not currently use advertising networks, advertising cookies or disclose personal information to advertisers.

Urban Design Index may display advertising, sponsored content or paid placements in the future. Displaying an advertisement does not necessarily require personal information to be disclosed to the advertiser.

Before introducing advertising technology or data practices that materially change how personal information is collected, used or disclosed, we will update this Policy and provide notice or obtain consent where required.

Urban Design Index does not currently use third-party advertising cookies.

The website uses browser storage for functions including:

• maintaining authentication sessions;
• storing a randomly generated visitor identifier;
• storing a temporary analytics session identifier; and
• identifying internal administrator traffic.

Clearing browser storage may sign you out, reset analytics identifiers or affect site functionality.

The website handles two different types of geographic information.

Submission locations

Contributors select locations associated with objects and precedents in the built environment. Submission locations are intended to be public and normally describe the photographed object rather than the contributor.

Contributors should avoid placing a submission pin at a private residence or another sensitive location unless that location is genuinely necessary and lawful to publish.

Visitor geography

Our infrastructure may derive an approximate country and city from a visitor's IP address. This information is used for aggregate analytics, security and service delivery.

Urban Design Index does not use this information to determine a visitor's precise address or movements.

Urban Design Index and its service providers use infrastructure that may process or store information outside Ontario or outside Canada, including in the United States and the European Union.

Information processed in another jurisdiction may be accessible to courts, law-enforcement agencies or government authorities under the laws of that jurisdiction.

We use service providers that we consider reasonably appropriate for the nature of the information and services involved.

We may use or disclose personal information when reasonably necessary to:

• comply with a subpoena, court order, warrant or other valid legal requirement;
• respond to an authorized regulatory or law-enforcement request;
• investigate copyright, privacy, fraud, security or abuse complaints;
• protect the rights, safety or property of users, Urban Design Index or others;
• enforce our Terms of Use;
• collect or respond to a debt or legal claim; or
• complete a business transaction as permitted by law.

We will not publicly disclose the identity behind an anonymous submission merely because someone requests it. Account information will only be disclosed where permitted or required by law or where reasonably necessary with appropriate authority to address a legal matter.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy.

Our general retention practices are:

• Account information is retained while the account is active.
• Published submissions are retained until removed by the contributor, an administrator or through a valid request.
• Raw analytics records are retained for up to 12 months and may then be deleted or converted into aggregate statistics.
• Comments and likes are retained until removed or until the related account or submission is deleted.
• Edit histories, abuse reports and moderation records are retained for as long as reasonably necessary to maintain the integrity of the archive and resolve disputes.
• Copyright, privacy and legal correspondence may be retained for the period reasonably necessary to investigate the matter and establish, exercise or defend legal rights.
• Records of Creative Commons selections may be retained after account or submission deletion where needed to document the licensing history.
• Records of privacy breaches are retained for at least 24 months after we determine that the breach occurred.
• Information may remain temporarily in provider backups and system logs until overwritten under the provider's normal retention schedule.

Where possible, information that is no longer required is deleted, anonymized or converted into aggregate form.

You may request deletion of your account by contacting the Privacy Officer.

Subject to legal, licensing, security and technical limitations, account deletion will ordinarily remove:

• your profile;
• your active authentication account;
• submissions you uploaded;
• stored photos associated with those submissions;
• comments and likes associated with the account; and
• other information that is no longer reasonably necessary.

We may retain limited information where necessary to:

• document an irrevocable licence;
• prevent fraud or repeat abuse;
• comply with law;
• respond to a legal claim;
• maintain a breach or security record; or
• preserve anonymized and aggregate analytics.

Deleting your account does not revoke Creative Commons rights previously granted to the public.

Subject to applicable legal exceptions, you may:

• request access to personal information we hold about you;
• ask how your information has been used or disclosed;
• request correction of inaccurate personal information;
• update most submission and account information through the website;
• request removal of a submission;
• request deletion of your account;
• withdraw consent for optional processing; and
• make a complaint about our privacy practices.

We may need to verify your identity before responding to a request.

Access may be limited where disclosure would reveal another person's personal information, confidential commercial information, legally privileged information or information that cannot legally be disclosed.

We will respond within a reasonable period and explain any refusal where required.

Urban Design Index uses administrative, technical and organizational safeguards appropriate to the nature of the information under our control.

Measures include:

• managed authentication;
• password hashing by the authentication provider;
• row-level database security;
• private file storage;
• short-lived signed image links;
• restricted administrative actions;
• role verification;
• limited administrator access;
• image metadata removal; and
• logging and investigation of relevant administrative activity.

No safeguard can eliminate every risk. Users should use a strong, unique password and protect access to their email and Google accounts.

We investigate suspected loss, unauthorized access, use or disclosure of personal information.

We maintain a record of every identified breach of security safeguards involving personal information under our control.

Where a breach creates a real risk of significant harm, we will notify affected individuals and report the breach to the appropriate privacy regulator as required by law.

Urban Design Index is not directed at children under 16, and we do not knowingly collect personal information from children under 16.

A person under 16 must not create an account or submit content without the involvement and consent of a parent or legal guardian.

Please contact the Privacy Officer if you believe a child has provided personal information contrary to this Policy.

We may update this Policy as the website, service providers or legal requirements change.

The "Last updated" date will identify the most recent revision. Material changes will be communicated in a manner appropriate to the change.

Where a new use or disclosure requires additional consent, continued use of the website alone will not replace any consent that is legally required.

Please direct privacy questions, requests and complaints to:

Please describe the issue and include enough information for us to identify the relevant account, submission or interaction.

We will investigate privacy complaints and respond within a reasonable period. You may also contact the Office of the Privacy Commissioner of Canada regarding concerns that cannot be resolved directly with us.