Privacy policy
What we collect, why we need it, and the choices you have over your information.
Central Synaptic Intelligence Systems · British Columbia, Canada · Version 2026-10-v3 · Updated October 19, 2026
1. Who is responsible for your information
Central Synaptic Intelligence Systems is established in British Columbia, Canada and operates this service. Contact Michael Rybaltowicz at BrainandBodyai@Gmail.com for privacy, access, correction, export or deletion requests. If your organization operates a separate deployment, its designated privacy administrator may also be responsible for customer records. British Columbia’s Personal Information Protection Act and other applicable Canadian privacy laws may apply to our handling of personal information; requirements depend on the activity and deployment.
2. What the service collects
We process your name, email, internal password hash or Google identity, account memberships and roles. We also process site boundaries, submitted turbine pinpoints, location source, reported accuracy and capture time, operational telemetry, notes, advisory records, and security/audit events. Internal passwords are stored as salted password hashes. Google sign-in requests basic identity scopes (openid, email and profile); it does not request access to your Gmail or Drive.
3. Phone location is your choice
Your browser asks for location permission only after you select “Use my phone location”. Your device may combine GNSS/GPS, Wi-Fi and cellular positioning; the app cannot verify which signal produced the fix. The location is previewed before you confirm saving it. We do not request continuous background location tracking. You can decline or revoke browser permission and enter known coordinates manually. After saving, the pinpoint and its provenance become account records; revoking permission does not delete previously saved records.
4. Why information is used and who can access it
Information supports authentication, account authorization, site mapping, operational analysis, recordkeeping, troubleshooting and service security. Access depends on membership and role in the relevant account. Account owners and administrators can manage permitted members and see account operational/audit records. Google identity information is used for authentication, account matching and related security; it is not sold or used for unrelated advertising or profiling.
5. Cookies, local storage and optional analytics
Essential cookies keep your session and protect requests against forgery. The session and CSRF cookies last up to 30 days unless cleared earlier; temporary Google OAuth cookies, including the signed legal-acceptance confirmation, last up to 10 minutes. A pending Google access-request cookie lasts up to 30 minutes. Production session records support revocation. Only hashes of one-time verification/reset tokens are stored; verification links expire after 24 hours and password-reset links after 30 minutes. Your browser stores your optional analytics preference locally until you change it or clear browser storage. Vercel Analytics loads only after you choose Allow analytics; declining does not prevent core account features. Change the choice from “Privacy choices” in the footer. Network and security logs may still be created to operate the service.
6. Maps, weather, Google and other service providers
Google authentication, Vercel hosting infrastructure, Supabase PostgreSQL storage when configured, optional Vercel Analytics, Google Maps (when configured), MapLibre delivery and Esri imagery may receive requests from your browser. Map providers can receive your IP address and the map area being viewed. Weather requests can transmit site coordinates to Open-Meteo through the server. When configured, Resend processes your email address and requested account-verification/password-reset messages to deliver essential account emails. Providers may process information outside Canada under their own policies and contractual terms. We do not sell personal information. Information may also be disclosed to authorized customer administrators, necessary service providers, or where required by law or to protect rights and security.
7. Retention, export and deletion requests
Retention depends on service needs, customer agreements and applicable legal, audit and safety obligations. The account privacy tool exports the current profile/account/membership snapshot and recent audit context; it is not a complete export of every telemetry or location record. Contact us for additional records. A deletion or deactivation submission creates a pending request for administrator review; it does not immediately erase an account or revoke access. Some audit, operational, contractual or legally required records may be retained. We assess requests and explain applicable limits rather than promising automatic deletion.
8. Your choices, safeguards and complaints
You can request access to and correction of your personal information, ask about processing or transfers, withdraw optional consent, and request export, deletion or deactivation subject to applicable law. Contact Michael Rybaltowicz at BrainandBodyai@Gmail.com; do not email passwords, secret keys or sensitive operational datasets. We use signed sessions, account authorization, request protection and audit records, but cannot guarantee perfect security. If privacy concerns are not resolved, you may contact the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).
9. Changes to this policy
This policy identifies the practices implemented in the current software version. Material changes will be reflected in the published policy and, where required, communicated or presented for renewed consent. Policy version: 2026-10-v3.