Slipcurve›Privacy notice
Privacy notice
This website collects nothing. The software keeps your project on your own computer and sends nothing to us. When you switch networking on it calls the data providers named below, and this page says what each one receives.
Who is accountable
The operator of this site and the software is Slip Curve LTD. Questions, access requests and complaints about personal information go to info@slipcurve.com. You may also complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, to the Office of the Information and Privacy Commissioner.
This website
There is no form, no sign-up, no analytics, no cookie and no request to any host other than this one. That sentence is measured on every page load by the site's own gate, from the browser's response list and cookie jar, not read off the markup. Whatever the hosting provider records at the connection level is governed by that provider's own policy and is not used by the operator.
The software
Slipcurve runs in your browser from files on your computer or from a site you host. Your project lives in the browser's storage on that machine and in the files you save. Nothing is sent to the operator: there is no account with us, no licence server, no telemetry, no crash report and no usage data.
The personal information a project can hold is narrow and nameable: the accounts you create (name, optional email, role, sign-in times), the people and companies in your directory, the author of each drawing markup and who accepted or rejected it, photographs with their embedded capture time and, where the camera recorded one, a coordinate, and field records that name crew. All of it stays with you. Your organisation is the one responsible for it under PIPEDA, British Columbia's PIPA or the statute that applies to you, including any duty to report a breach. The software helps where it can: an injury record marked as a privacy concern case prints "Privacy Case" in place of the name on the OSHA 300 log, and before you share a markup list the software tells you which people it names.
What is sent when networking is on
Networking is off when the software is opened from disk and is switched on in Settings. With it on, pages call the providers below directly from your browser. Every web request carries your device's address; a page served from a website also identifies that website. No request carries a person's name or a record from your project.
| Purpose | Provider | What it receives |
|---|---|---|
| Weather | Open-Meteo — forecast | the project site coordinate and the date range |
| Weather | Open-Meteo — historical (ERA5) | the project site coordinate and the date range |
| Weather | ECCC / MSC GeoMet — OGC API features | the project site coordinate and the date range |
| Geocoding | Nominatim — geocoding (OpenStreetMap) | the address text you type, or a coordinate to name |
| Road routing | Valhalla (FOSSGIS) — road route | the coordinates of the stops being routed |
| Road routing | Valhalla (FOSSGIS) — road distance/time matrix | the coordinates of the stops being routed |
| Road routing | OSRM demo server — road route | the coordinates of the stops being routed |
| Elevation | NRCan CDEM — elevation profile (Canada) | the coordinates being profiled |
| Elevation | Open-Elevation — point elevation (global) | the coordinates being profiled |
| Public holidays | Nager.Holidays — public holidays | the country code and the year |
| Exchange rates and statistics | Bank of Canada Valet — FX | currency codes, or the statistical series requested |
| Exchange rates and statistics | Frankfurter — blended reference FX | currency codes, or the statistical series requested |
| Exchange rates and statistics | Statistics Canada WDS — vector data | currency codes, or the statistical series requested |
| Map features | Overpass API — OpenStreetMap features | the bounding box of the map view |
| Basemap tiles | OpenStreetMap — raster basemap tiles | the tile coordinates of the map view |
| Country and hazard risk | UCDP Georeferenced Event Dataset — organised violence | the country and the date range |
| Country and hazard risk | ACLED — political violence and protest events | the country and the date range |
| Country and hazard risk | GDACS — disaster alerts (floods, cyclones, wildfires, volcanoes, droughts, earthquakes) | the country and the date range |
| Country and hazard risk | ReliefWeb — disasters and emergencies by country | the country and the date range |
| Development indicators | World Bank — development and governance indicators | the country code |
| Country and hazard risk | USGS — earthquake catalogue | the country and the date range |
| Country and hazard risk | U.S. Department of State — travel advisories | the country and the date range |
| Country and hazard risk | UK Foreign, Commonwealth & Development Office — travel advice | the country and the date range |
| Country and hazard risk | Global Affairs Canada — travel advice and advisories | the country and the date range |
| Country and hazard risk | GDELT — global news mentions | the country and the date range |
| Exchange rates and statistics | ExchangeRate-API open endpoint — daily rates, 150+ currencies | currency codes, or the statistical series requested |
Each provider's own terms govern its use of what it receives; the link in each row is its published policy. Where a provider's free tier is for non-commercial use, the software refuses it by name until a paid key is set.
Safeguards
Account passwords are never stored: what is stored is a PBKDF2-HMAC-SHA256 derivation at 310,000 iterations over a random per-user salt, compared in constant time. Each account's workspace is stored under its own key. The software sets no cookie and takes no device position. There is no encryption at rest: accounts separate people, they do not encrypt the records, and anyone with access to the browser profile can read every workspace on it. Protect the computer accordingly.
Security concerns go to the address above. The site publishes a security.txt file naming it.
Your data, your file
Save Data exports the whole workspace as one file you keep. Wipe removes every saved record from the browser. Removing the software is deleting its folder and the browser's storage for it. The operator holds no copy, so there is nothing for the operator to retain, return or erase.
Changes
When the software's behaviour changes in a way this notice describes, the notice changes with it in the same release.