Data & Privacy
Prepared 17 September 2026. This notice describes current handling and distinguishes planned retention changes.
The proposed storage-pressure policy is described below. It has not been activated in production, so uploaded and retrieved files may remain stored. Keep your own copies of important data and reports.
What the service retains
| Category | Purpose and current retention |
|---|---|
| Account information | Username, email, supplied profile details, password hashes, verification status, and account settings support authentication. Records remain until removed through an account-management process. |
| Authentication and security records | Session records, hashed verification/reset tokens, login attempts, and audit events support access control and security. Authentication audit records use hashed identifiers for IP/user-agent information; server access logs may separately contain IP addresses and request details. No fixed deletion deadline is promised here. |
| Uploaded and retrieved datasets | Files used for requested analyses are stored on the VPS. The storage-pressure cleanup policy below is planned, not currently enforced. |
| User-specific outputs | Run configuration, intermediate files, generated maps, tables, logs, and other outputs can be retained in user-specific storage. These may include information derived from submitted data. |
| Reports and derived summaries | HTML reports, supporting assets, and workflow-generated summaries or knowledge records may be retained. Reports can contain sensitive locations or other input-derived information. |
| Operational backups | Backups may contain account records or retained content. Removal from live storage does not imply immediate removal from every backup. |
Processing and service providers
Website Q&A update, October 15, 2026: Ask GeoDataAI sends your questions and recent conversation history through our server to Google Gemini to generate answers. Do not submit credentials or sensitive information. API keys stay on the server and are never sent to your browser. This support chat cannot access your account, files, or analysis jobs.
The platform runs on a Hostinger VPS. Account emails are sent through Hostinger SMTP. Local Ollama provides the configured local model service. Retrieval contacts external data providers. Other enabled integrations may contact external AI or data services depending on the workflow and configuration; this notice does not promise that every workflow stays entirely on the VPS.
Your responsibilities and controls
Upload only material you are permitted to process. Do not upload passwords, access keys, or confidential, regulated, or sensitive personal information. Keep your own copies of important datasets and reports. Use self-service password reset to secure your account.
For data-handling questions or a deletion request, email geodataai@geodataai.net. A self-service account/data deletion interface is not currently provided. Do not include passwords or unnecessary sensitive files in a request.
Account separation and cookies
The application uses authenticated user identifiers and per-user storage directories. Session and CSRF cookies support sign-in and request validation. These controls do not constitute a guarantee that all risks are eliminated. User-distribution analytics based on IP geolocation are not currently implemented.
Planned storage-pressure cleanup
The cleanup policy below has passed initial disposable-data tests but is not connected to production upload, retrieval or task-completion events. It does not currently guarantee deletion after one day.
The planned policy checks available space at upload/retrieval admission and task completion, rather than scanning all datasets every five minutes. When available space on the dataset filesystem is below 80 GB, idle datasets may be removed if their combined size exceeds 300 MB, or if an uploaded dataset has been stored for more than 24 hours. Small retrieved datasets will not be removed solely because they are older than 24 hours under this rule. Thresholds use decimal units: 1 GB = 1,000,000,000 bytes and 1 MB = 1,000,000 bytes.
Active uploads, analyses and downloads must be protected. Required companion files will be handled with their dataset. Cleanup is intended to stop when free space reaches 80 GB; it must not expand into unrelated storage if insufficient eligible data is available. HTML reports and their supporting assets, account records, application files, and reference spectral libraries are excluded from this raw-data cleanup.
Age will use a recorded server arrival or transfer-completion time. For historical data whose arrival time cannot be established reliably, the time will be marked unknown and will not be invented from file modification time. Such data will require review before age-based cleanup. Dataset deletion can make old download links unavailable; retained reports are not substitutes for the original data. Keep local copies of anything you need.
Planned deletion audit records
Restricted administrator records will document the username and user ID, dataset name and ID, upload or retrieval source, arrival time when known, time stored, deletion time, data size, companion-file list, reason, free space before and after, and whether deletion succeeded, was skipped, partially completed or failed. These records will be stored separately from raw datasets and will not be removed by the dataset cleanup rule. They will not contain passwords, access tokens or file contents. A fixed audit-record retention deadline is not currently promised.
Planned IP-based regional statistics
New account-linked IP/location analytics, automatic 30-day raw-IP expiry, and a public user-distribution map have not been deployed. Existing security records and server access logs are described above and are not covered by an unimplemented 30-day expiry promise.
The proposed feature will record the validated client IP at account creation and successful login, with approximate country/region, lookup time and source. IP forwarding will be accepted only through the trusted reverse proxy. A local GeoIP database is preferred so individual IP addresses need not be sent to a third-party geolocation API. Access to account-linked IP records will be restricted to authorized administrators.
The proposed raw-IP retention period is up to 30 days in the new analytics store, subject to deployment and verification of the expiry mechanism. Account-linked country/region may be retained separately for statistics while the account exists. IP geolocation is approximate: VPNs, proxies, mobile networks and shared connections can indicate a different region. It does not establish a person's home address, nationality or physical presence.
Planned public distribution map
The proposed map will count each verified account once using its latest known country and display only aggregated country-level counts. Country-center markers will represent countries, not individual IP locations. Countries with fewer than five eligible users will be suppressed, and unknown locations will not be plotted. The public website must not receive usernames, email addresses, raw IP addresses, user IDs, individual login records or precise user coordinates. Any published summary will be generated from a restricted aggregate-only data source.
This page will be updated when these features are enabled and their safeguards verified. Planned features should not be interpreted as current enforcement or a guarantee of anonymity.
Policy clarification updated October 13, 2026.