What we collect, and what we do not

1. What we collect, and only when you give it

Reading the map or the alerts feed needs no account and collects nothing about you personally.

When you create an account, Supabase — the service that handles sign-in — stores your email address and, if you signed in with Google, the name and profile picture Google shares. We never see your password; it is hashed by Supabase.

• A sighting you post: the animal, how urgent it looks, the words you write, the map coordinates you pin, the time, and a photo if you add one.
• The display name you choose. It can be a nickname — it does not have to be your real name, and your email is never shown to anyone.
• A contact detail, only if you type one into the optional contact field.
• Which account posted each sighting, so contributions are attributable.

2. What is public

Everything in a sighting is public: the title, description, urgency, map pin, photo, display name, and any contact detail you added. That is the point — it is a noticeboard for neighbours.

Your email address is never public. Only your chosen display name appears.

3. Location

The site asks your browser for your location so it can drop a pin and sort sightings by distance. Your browser will ask you first, and saying no still leaves the site fully usable — you can place the pin by hand.

Your own position is used in your browser to sort and centre things, and is not stored. What is stored is the pin you place on a sighting, which marks where the animal is, not where you are. Move the pin before posting if those are the same place and you would rather they were not.

4. What your browser keeps

A few things stay on your device and are never sent anywhere except when you post:

• A draft of the report you are writing, so a closed tab or a sign-in detour does not lose it.
• Reports written while offline, queued until you have a connection.
• Your chosen display name, so you do not retype it.
• A sign-in cookie, so you stay signed in.
• The offline copy of the app, so it opens without a connection.

5. What we do not do

• No advertising, and no advertising trackers.
• No selling or renting of your information, to anyone, ever.
• No third-party analytics following you around the web.
• No email from us beyond what sign-in itself requires, such as a confirmation link.

6. Who else is involved

Running the site means a few companies handle data on our behalf:

• Supabase — the database holding sightings, and the sign-in system holding accounts.
• Vercel — hosting; its servers process requests and keep short-lived operational logs.
• OpenStreetMap — supplies the map tiles. Your browser requests tiles from them directly when you view a map.
• Google — only if you choose to sign in with Google.

7. How long things are kept

Sightings stay up as a record of what happened, including after they are marked safe. They are not deleted by their author, because a sighting others are relying on should not vanish mid-rescue.

Account details are kept until the account is closed.

8. Children

stray.my is not aimed at children. If you are under the age at which you can agree to this yourself where you live, please ask a parent or guardian before creating an account.

9. Your choices, and how to ask

You can ask for a copy of what is held about you, ask for it to be corrected, or ask for your account to be closed. Depending on where you live you may have further rights under local data protection law — in Malaysia, the Personal Data Protection Act.

Write to add a contact email address here. stray.my is operated by add the operating person or company here.

Closing an account does not remove sightings already posted, for the reason given above. Ask and the display name on them can be detached from your account. See also the terms of use.