Privacy

Wild Watcher is a map of publicly available nature cameras. There are no accounts, no advertising, and no third-party trackers. This page describes exactly what the software does, and it is written to match the code rather than to cover us.

What we do not collect

• No name, email address or account: there is nothing to sign up for.
• No advertising or analytics cookies, and no third-party tracking scripts.
• No precise location. We never ask for the browser geolocation permission.
• No IP address in anything Wild Watcher itself stores, not in the database, not in the product analytics, not in a log file of ours. Our hosting and database providers see and log connection addresses, as every web host does; that is described below.

What we do collect

We record anonymous product events so we can tell which cameras people find interesting and which are letting them down: a camera was viewed, the random button was pressed, a search term was entered, a filter was used, a camera failed to load.

When you leave a camera we record how many seconds it was on screen while the page was visible, how you reached it (the random button, auto-roll, choosing it yourself, or a link), and whether the visit ended there. If you use auto-roll we record that it was started, paused, resumed, stopped or moved on, and why: for example that a stream did not start. None of this says anything about what was on screen; it is about whether the camera was worth sending you to.

If you follow a link to support one of the organisations behind a camera, we record that it was followed, which organisation it was, and which camera you were watching. That is how we can show an organisation how many people Wild Watcher sent them. The link goes to their own site, and what happens there is covered by their privacy policy, not ours. We take no fee and add no tracking of our own.

On a seasonal page, such as our Fat Bear Week guide, we also record that the page was opened and which of its links you followed (to the event’s official site, to a camera operator, to a donation page, to one of the cameras or to the map) and whether you used its share button. The same goes for the short line about it on the homepage, including closing it. That is how we can tell whether the page sent people where it meant to. Links to other organisations open their own sites, which see only that you came from Wild Watcher, never which page.

When you press the random button or use auto-roll, your browser also sends the list of cameras it has shown you in this tab, so that we do not send you straight back to one you have just seen. That list is used to choose the next camera and is not stored.

Each event may carry a session id: a random string generated in your browser and held in sessionStorage. It exists only so we can tell “one person pressed random ten times” apart from “ten people pressed it once”. It is not linked to any identity and is never shared. Your copy is destroyed when you close the tab; the copy attached to those events is erased from our database after 30 days, after which nothing connects one recorded action to another.

Search terms are recorded as text, so please do not type anything personal into the search box. It is a search box for places and animals.

When a visit begins we also record three coarse facts about it, worked out on our server from the request your browser was already making. No script runs in your browser to collect them, and nothing is stored on your device:

• Where you arrived from: the hostname of the referring site only, such as reddit.com or google. Never the page address or anything after it, because that is where search terms and personal identifiers tend to live.
• Country: a two-letter code, so we know whether to look for more cameras in places people are actually visiting from. Our hosting provider works this out from the connection; we read the country and never the address itself.
• Mobile or desktop: two buckets, nothing finer. It tells us where to spend design effort. It is not a device fingerprint.

Together these cannot identify you: they describe a visit, not a person, and there is no identifier tying one visit to another beyond the session id that dies with the tab.

IP addresses

To stop one client overwhelming the service, requests are rate limited. Your address is combined with a random secret that is created when the server starts, never written down and never shared, then hashed; only part of that hash is kept, in memory, for a few minutes. The secret is what makes this meaningful: an unsalted hash of an address can be reversed by anyone willing to try every address, and this one cannot be. The address itself is never written to disk, never logged by us and never stored in our database.

The companies that run the servers do see it. Our site is hosted on Vercel and our database is Neon, and both keep their own connection and security logs under their own privacy policies, as every hosting and database provider does. No website can honestly claim otherwise. Both process data in the United States.

When something breaks

When the site throws an error, a report goes to Sentry so that we find out rather than waiting for someone to tell us. An unmonitored site fails quietly, and this one has a job running every three hours that nobody would notice stopping.

Nothing runs in your browser. Only our server reports errors, so no Sentry code is loaded on the page and nothing is put on your device. You can check this yourself: the page still loads no third-party scripts at all.

A report says what broke and where: the error, the place in our code it came from, and the path of the page or endpoint. Before it is sent we remove your IP address, everything after the ? in the address, which is where search terms live, the contents of the request, any cookies, and every header except the two or three that describe the format. What is left describes a fault in our software rather than a person.

The code that does the removing is src/lib/observability/scrub.ts, and it is covered by tests, because a promise like this one is worth exactly as much as the thing enforcing it.

Data stored in your browser

• Saved cameras are kept in localStorage on your device. They never reach our servers. Clearing your browser data removes them.
• Session id in sessionStorage, described above.
• Cameras shown in this tab, your mute choice and your auto-roll timing, in sessionStorage. They go when the tab closes. Only the list of cameras ever leaves your browser, as described above.

None of these is a tracking cookie, and none follows you to any other site. This is why you are not being shown a cookie banner.

Third parties you interact with

Wild Watcher does not host any video. When you watch a camera, you are connecting directly to whoever operates it, and their privacy policy applies to that connection:

• YouTube for most live cameras. We use the youtube-nocookie player, which is Google’s own privacy-enhanced mode. Be clear about what that does and does not mean: it stops the player using your viewing for ad personalisation, and it avoids the advertising cookies the ordinary player sets. It does not make the connection invisible. Google still receives your IP address, your browser details and which video was requested, and may store data on your device once playback begins. Their privacy policy governs all of that, not ours.
• The camera operator’s own website for cameras shown in their viewer, such as the National Park Service.
• Pictures on camera cards and animal pages. A card shows either the operator’s own preview, served by YouTube or the National Park Service, or a public-domain photograph served by Wikimedia Commons (upload.wikimedia.org), which also serves the photograph of each animal on the animal pages. Your browser fetches these images directly, so those services see the connection and which image was requested. We ask your browser not to tell them which page you were on.
• OpenFreeMap serves the map tiles, which are built from OpenStreetMap data. Your browser fetches them directly, so OpenFreeMap sees the connection and roughly which part of the world you are looking at.
• Open-Meteo provides weather. We request it from our server using a coordinate rounded to about 11 km, so no precise position is sent, and never anything about you.

How long we keep things

• Session ids are erased from recorded events after 30 days. That is long enough to answer “was that the same visit?” and short enough that nothing older can be joined up at all.
• Events themselves are deleted after one year. A year is the shortest window that lets us compare a season against the same season: these are wildlife cameras, and a bear cam in July is not a bear cam in January.
• Camera health checks are kept for 90 days in full and then reduced to a daily uptime summary per camera, which we keep. None of this is about people; it is about cameras.
• Viewing summaries (for each camera and each hour of its local day, how many visits arrived and how long they stayed) are counted from the events before those are deleted, and kept. They contain no session id and nothing about any individual visit.
• Error reports are kept for 90 days by Sentry, then deleted. A fault nobody has fixed in three months is not going to be fixed by keeping the report longer.

These are enforced by a job that runs every three hours, not by us remembering. Logs held by our hosting and database providers are on their retention schedules, not ours.

Children

There is nothing here that is unsuitable for children, and there is nothing to sign up for, so we do not knowingly collect personal information from anyone of any age, including children. We do not direct the site at children specifically, and we do not ask anyone their age, because asking would mean collecting something we would rather not have.

One thing worth knowing as a parent: most cameras play in YouTube’s own player. Once playback starts, Google’s terms and privacy practices apply to that connection, and they are not ours to make promises about.

Changes and contact

If this policy changes materially, the date at the top changes with it. Questions about privacy, or about anything on this page, can go to support@wildwatcher.earth.