What Commonmile keeps, and what it does not.

The Journey Planner

Nothing you type into the planner is stored. The numbers travel in the page address, the answer comes back, and nothing is written to the database.

Crews

A crew holds what you put in it: a crew name, walkers’ nicknames, the journey and settings, and each walk (who, which day, the distance or steps). All of that is encrypted (AES-256-GCM) with a key made from the crew’s link and a server key. The database keeps only a fingerprint (SHA-256) of the link, plus each walk’s date, so the site can find a crew and sort its walks. We cannot recover a lost link.

The link’s code is never part of a page address the server receives. A crew link looks like garfieldunited.org/c#…, and browsers never send the part after the #. The page that link opens hands the code to the site once, inside a form, and the site then keeps the crew open in your browser with a private cookie for 60 days (“Close the crew on this device” removes it). So the code is not in the web server’s access log or the site’s error log.

Use nicknames or first names only, never children’s names. No locations, GPS tracks, photos or contact details are asked for or kept. Delete a walk or the whole crew at any time from the crew page. Crews not opened for 400 days are deleted automatically.

Logs, cookies and backups

The web server keeps a standard access log (address, time, page, browser) for security and troubleshooting. To limit abuse, the site keeps daily counters keyed by a salted hash of your address; they are deleted within three days. Forms set a security-token cookie that stops other sites from posting into yours, and opening a crew sets the crew cookie described above; there are no tracking or advertising cookies and no outside scripts, fonts or images.

This site’s own nightly database copies are kept for 14 days. Each deploy of a new version also makes a database copy, kept on the server for up to 14 days; WeldonPC keeps a copy of those with the site’s records on its own storage. WeldonPC also backs up the whole server four times a week to a separate backup server, where the 14 most recent copies (about three and a half weeks) are kept. So a deleted walk or crew can stay in a backup until those copies roll off (about six weeks for the server copies). Every one of these copies holds crew data only in its encrypted form, and none holds a crew’s link.

No email is collected, nothing is sold, and no one else receives your data. Questions: weldonpc.com/contact.