Privacy notice

Dharma Rocks is built to collect as little personal data as possible. This notice explains what we hold, why, the lawful basis for it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

Who we are

The data controller for Dharma Rocks is Sīlavāpi Cheesley, based in the United Kingdom. If you have any questions about this notice or your data, contact hello@dharma-rocks.com.

What we collect, why, and our lawful basis

• Your email address - to create your account, sign you in, and email you about your submissions and account (for example, when a moderator publishes or declines something you shared). Lawful basis: contract (providing the service you asked for).
• A display name, and an optional short bio - pseudonymous by default. You never have to give your real name. Lawful basis: contract.
• Content you submit - stories, photos, painted-rock registrations, sightings, and chapters. This is published only after a moderator approves it. Approximate locations are rounded before they are stored, so an exact address is never kept. Lawful basis: contract.
• Reports you make about other people’s content, and moderation decisions. Lawful basis: our legitimate interests in keeping the community safe and respectful.
• Technical logs - our hosting providers process standard request information (such as IP address) to run the service securely and prevent abuse. Lawful basis: legitimate interests.

We do not use advertising trackers, and we never sell or share your data for marketing.

Your content is public

Once approved, the stories, photos, rocks and chapters you share are public: anyone can view them on the site, and they are also available through our read-only public API. Only your pseudonymous display name and approximate locations are shown there - never your email, and never a precise location.

Photographs

When you upload a photo, we strip its embedded metadata (including any GPS coordinates and camera details) before it is stored, so hidden location data is not published.

Cookies

We use a single essential cookie to keep you signed in. It is strictly necessary for the service, so it does not require a consent banner. We set no analytics or advertising cookies.

How you sign in

Sign-in is by email “magic link” only: we email you a secure one-time link. There is no password to store, and no third-party identity provider (such as Google or Facebook) is involved. The sign-in email itself is handled by our processors, Supabase and Resend, listed below.

Maps

Our maps use OpenStreetMap. When a map loads, your browser requests map images directly from OpenStreetMap’s servers, which means your IP address is shared with OpenStreetMap for that purpose. See the OpenStreetMap Foundation privacy policy. When a chapter organiser uses “detect coordinates”, the lookup is made by our server (not your browser) and the result is rounded to an approximate area.

Who processes your data for us

We use a small number of trusted providers as data processors under contract:

• Supabase - database, authentication, and file storage.
• Vercel - website hosting and delivery.
• Resend - sending the sign-in links and the notification emails described above.

Some of these providers may process data outside the UK. Where they do, the transfer is covered by appropriate safeguards (such as UK adequacy regulations or the UK International Data Transfer Agreement).

How long we keep it

We keep your account and content until you ask us to delete them (or you delete them yourself). Submissions that are declined are removed after a short review period. Reports and moderation records are kept for as long as needed to keep the community safe. Technical logs are retained only for a limited time by our providers.

Children

Dharma Rocks is not directed at children. You must be at least 16 years old to create an account. Anyone is welcome to enjoy painting and finding rocks offline.

Your rights

Under UK data protection law you have the right to:

• access a copy of your data;
• have inaccurate data corrected;
• have your data erased, including your whole account;
• restrict or object to how we process your data;
• data portability;
• withdraw consent where we rely on it.

You can exercise the main rights yourself, straight away, from your account page:

• Download your data - a JSON copy of everything we hold about you.
• Close your account (anonymise) - we remove your name and email but keep the rocks, stories and photos you shared, so others can still find and follow them. Your content then shows as “Former member”.
• Delete your account - we permanently erase your account and everything you shared, including any rocks you registered (so people who find them later can no longer track their journey).

You can also contact hello@dharma-rocks.com and we will action your request, normally within one month.

Complaints

We hope to resolve any concern directly, so please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this notice

If we make significant changes to how we handle your data, we will update this page and its review date above.