Privacy

What this project does

Earth Evidence Lab is an independent practice project maintained by Yatish Grandhe. You can read public Earth-data records without an account. This notice describes how the implemented features handle information; it is not a claim of NASA affiliation.

Accounts and Google sign-in

Email-and-password accounts use Supabase Auth. If you choose Google sign-in, the app requests only openid, email, and profile access. Google provides basic identity information, which can include your account identifier, email address, name, and profile image, to Supabase for authentication. The app uses the provider-issued user ID and email to associate your saved work with your account. It does not request Gmail, Drive, Calendar, or Contacts access.

Supabase manages hosted passwords, provider identity records, and login sessions. The app uses HTTP-only session and sign-in verification cookies. Google account passwords are entered with Google, not this app. Signing out ends this app’s session; it does not delete your Google account or saved app data.

Saved work and publication

Private analysis jobs, investigation titles and notes, and expedition plans are stored in the project’s Supabase PostgreSQL database with account ownership checks. The scientific worker processes requested analyses. Maintainer administration and infrastructure access are separate from the app’s ordinary user access.

Publishing a report deliberately creates a public result snapshot. Anyone with its link can read or download it, and public examples may be listed in the app. Revoking a publication stops it being served by the app; it cannot retrieve copies other people already downloaded. Consider what a report reveals before publishing.

Your browser fieldbook and sharing

Saved places, fieldbook collections, notes, evidence clips, and recent places use local storage in this browser. They do not automatically sync to your account or another device. If browser storage is blocked, this fieldbook can be temporary. Clearing site data removes browser-local work and preferences, so export anything you want to keep first.

A research-pack download includes local annotations only when you explicitly choose to include them. A desk share URL contains validated public place IDs and view settings, not fieldbook notes or clips. Files, copied links, and copied assistant briefs leave the app only through the sharing or download actions you choose. Recipients may retain copies.

Optional research assistant

When the assistant uses an AI model, the server sends your question, bounded conversation history, and selected public page context to Anthropic (Claude) or, as a backup, Mistral directly or through Vercel AI Gateway. Context can include the selected place, variable, years, and catalog filters. Read-only tools can send relevant public records and documented methods to the model. The assistant does not automatically read account details or private investigation and fieldbook notes. Anything personal that you type into a question is still part of that submitted text.

The app keeps the conversation in page memory and does not save its transcript to the project database. Clear the conversation or reload to remove that in-memory history. This does not erase information already sent to a provider or exported by you. Provider processing follows the applicable Anthropic, Mistral and Vercel terms. Keep personal information out of your questions. This project does not promise a fixed provider retention period.

Weather, climate, and map services

Weather and climate views send the selected place’s coordinates and requested variables from the server to Open-Meteo. These are the coordinates of the place you are viewing; the app does not request your device’s GPS location. NASA POWER requests similarly use the selected public location. Source responses may be cached to avoid repeated retrieval.

Map views load tiles from OpenFreeMap or Esri. Your browser’s tile requests reveal ordinary connection information, including an IP address and the requested map area, to the tile service. These map references are separate from your private notes and account records.

Hosting, security, and preferences

Vercel hosts the application; Supabase supplies authentication and the database. Hosting and authentication services process requests and operational logs, which may include IP addresses, request paths, timestamps, and error information. The application records bounded error labels and abuse-limit counters. Assistant abuse limits use a hashed IP bucket; sign-in limits use a hashed email bucket. Hashing these values is not a guarantee of anonymity.

Cookies and browser storage also remember interface preferences such as the sidebar state. Do not put passwords, access tokens, or sensitive personal information in questions, notes intended for export, or public issue reports. Operational logs, service backups, and provider records are not governed by a fixed deletion schedule promised by this app.

Access, correction, and deletion requests

You can sign out, remove saved investigations through the available controls, revoke published reports, and clear browser site data for local fieldbook content. Account-wide access, correction, or deletion requests currently require contacting the maintainer; there is no automatic account-deletion control. Ownership must be verified before private account information is released or changed. A request does not itself confirm that data or provider backups have been deleted.

To start a privacy request, contact the maintainer through the project repository and ask for a private follow-up channel. GitHub issues are public: do not include your password, tokens, full email address, or private work in an issue. This notice will be updated when the project’s data handling changes.