Privacy
This page covers the website at unprotectedseth.com, the live map at where.unprotectedseth.com, and the Unprotected Seth app for iPhone. All three are run by one person, Seth Reiber. There are no accounts, no advertising, no analytics services, no cookies, and nothing is sold or shared with anyone for money or advertising. The one person whose location is published is Seth, by choice.
The short version
| What | Why | Kept for |
|---|---|---|
| A hash of your address when you add a song or set a heart | To limit how many one visitor can send in an hour | One hour |
| A random install id from the app, hashed before it is written | So a like, a wave or a song counts once | With the like, wave or song |
| The country, and sometimes the city, a wave came from, as reported by the network | To show where waves come from | Up to the newest 50,000 waves |
| Your push token, only if you turn HOWL alerts on | To deliver the alerts | Until you turn them off |
| A server log line per request, with a daily keyed hash in place of your address | To keep the server running and debug it | Rotated as space requires |
Nothing on this list is linked to a name, an email address, a phone or an account, and none of it can be, because none of those are ever asked for.
What the website keeps
The website is a static page served by Cloudflare Pages. It sets no cookies. It reads the live map's public data to show where the car is and whether a stream is on. Fonts are served from this site itself, not from Google. The HOWL page at /howl remembers a random id and your hearts in your browser's local storage, on your device only, so that a heart counts once; clearing site data removes them.
What the live map keeps
The map publishes one person's position: the car's. Anything within two kilometres of home is shown as Home, on the house's own pin, so the street never appears. When you add a song to the jukebox or set a heart on a note, the server keeps a hash of your IP address for an hour to limit how many one visitor can send. The address itself is never stored. Songs and hearts are anonymous; nothing records who added one.
The server writes one line per request to a log for debugging. Since 24 October 2026 that line carries a short hash keyed by the calendar day instead of your address, so it cannot be reversed and cannot follow anyone from one day to the next. Lines written before that date held the address and were rewritten the same way on 24 October 2026.
What the app keeps
- A random install id is created on your phone the first time it is needed. It goes with a like, a wave, or a song pick so each counts once. The server hashes it before writing anything to disk, and nothing links it to a person, a phone, or an account.
- A wave keeps the country, and sometimes the city, that the request arrived from, as reported by the network. No coordinates from your phone are ever read; the app does not ask for your location.
- If you turn on HOWL alerts, your phone's push token is kept so alerts can be delivered, and nothing else. Turning alerts off removes it.
- Your likes, flooded pages, chosen settings, and the list of songs and waves you sent stay on your phone.
Who else sees a request
Some requests go to other companies because of how the pages are built. Each of them sees your IP address the way any web request does, and each applies its own privacy policy:
- Cloudflare hosts the website and carries the live map's traffic to the server at home. It keeps the ordinary logs of a network provider under its privacy policy. The Leaflet map library also loads from Cloudflare's cdnjs.
- The U.S. Geological Survey serves the map tiles your browser draws, from The National Map, under the USGS privacy policy.
- YouTube plays the films, the trailer and the live stream in its embedded player. The site and the app use the privacy-enhanced embed, which sets no cookies until you press play. The app and the HOWL page use YouTube's embedded player, and the server reads the channel's public feed. By watching you agree to the YouTube Terms of Service, and Google describes what it collects in the Google Privacy Policy. Cover images for episodes load from YouTube's image servers.
- Spotify is connected to one account, Seth's, which is how the now playing row and the jukebox work. Your search in the jukebox is sent to Spotify by the server, under that account, so Spotify does not see your address for the search itself. Album art is loaded by your browser or phone from Spotify's image servers, which do. Opening a song hands you to Spotify or Apple Music under their policies.
- OpenStreetMap's Nominatim turns the car's own coordinates into a place name. It only ever receives the car's position, never yours.
- Apple delivers HOWL alerts through its push service when you turn them on.
- The store opens Stripe and the merch shop in Safari. A purchase is between you and them, and no part of it passes through the app or the live map.
- Venmo handles contributions to the story, from the website only. Venmo shows the sender's name to the recipient the way any payment does, under Venmo's privacy policy; nothing about a contribution reaches this site or the app.
Children
The site and the app are not directed at children under 13, and no personal information is knowingly collected from anyone, of any age. There is nothing to sign up for.
Your rights
If you live in California, the European Union, the United Kingdom or anywhere else with a privacy law, you have rights to know what is held about you and to have it deleted. Here that is simple, because nothing held is linked to you. Nothing is sold, shared for advertising, or used for profiling, so there is nothing to opt out of. For visitors in the EU and UK, the little that is processed rests on legitimate interest: keeping a small site running and abuse-free.
To have anything removed, write to seth@unprotectedseth.com and say which (a song, a wave, a push token) and roughly when; there is no account to look up, so the time is what finds it. You will get an answer from a person.
Security and changes
Everything travels over HTTPS. The server is a single machine run by one person, kept up to date and reachable only through Cloudflare. This page may change as the site does; the date at the top says when. The terms of use cover everything else.
The Bureau is fiction
The Bureau of Anomalous Fauna, HOWL, its contracts, and its alert tiers are part of a story told along a real drive. The Bureau is not a government agency. HOWL alerts are notifications about the car and the stream dressed in that story. They are not real emergency alerts.
Questions
Write to seth@unprotectedseth.com.