Effective: October 31, 2026
Privacy Policy
IrriDex is a community map and irrigation equipment directory operated by Tristan Long. This notice describes information the application processes, why it does so, how it is shared, and the choices available to you.
1. Who operates IrriDex?
Platform: IrriDex
Data controller: Tristan Long
Location: United States
Privacy and GDPR inquiries: gdpr@sccpsteve.com
For questions about your personal data or to exercise privacy rights, email gdpr@sccpsteve.com. You may also submit a privacy request through Send Feedback. Avoid including passwords or sensitive identifying documents in the initial message.
2. Information processed
- Accounts: username, password hash, account status and permissions, registration/application answers, security-question recovery records, account timestamps and saved preferences. Passwords are stored as hashes rather than plain text.
- Map contributions: submitted sprinkler/system locations, coordinates, notes, photos, equipment models, visibility settings, authorship and editing history. A map point can identify a private residence or a precise location.
- Forums: public discussion titles, posts, authorship, replies, followed discussions, and reports submitted to forum moderators. Forum discussions are publicly readable. IrriDex displays aggregate discussion view counts and net upvote/downvote scores. Signed-in members may vote on posts and have their first visit to a discussion recorded to avoid repeat counting. Anonymous views are counted once per browser session without recording a persistent guest identifier or IP address in the forum view database. Voting records and member-specific view receipts are included in personal data exports and removed during account erasure. Posts may include voluntarily shared photos or links in later releases.
- Profiles and community: public profile information, avatars, gallery images, saved-loot records, messages, notifications, and feedback or moderation requests. Site administrators may have tools to review user messages for site administration and safety.
- Technical and security records: session identifiers, masked or hashed IP-related abuse-prevention identifiers, error reports, activity timestamps, server access logs, and security/moderation audit events. Server and hosting logs may process IP addresses.
- Device preferences: your selected appearance, intro preference and timezone; optional browser storage for map settings, UI sounds, catalog cache and dismissed update notices. Offline draft storage may also be used when you explicitly queue a submission while disconnected.
3. Purposes and legal bases (EU/UK users)
| Purpose | Likely legal basis |
|---|---|
| Provide approved accounts, user features and user-submitted map entries | Contract or steps requested before account approval (GDPR Art. 6(1)(b)), where applicable |
| Protect accounts, limit abuse, investigate incidents and moderate contributions | Legitimate interests in service safety (Art. 6(1)(f)), subject to balancing and applicable law; legal obligation where genuinely applicable |
| Show public profiles and publicly marked map submissions | Providing requested publication features and/or legitimate interests; members control visibility where offered |
| Save optional browser preferences | Your opt-in choice for non-essential device storage, and consent where required by cookie law |
| Respond to requests and maintain legally necessary records | Legitimate interests or legal obligation, as applicable |
These are the processing categories reflected in the application. The operator must complete and document a lawful-basis assessment for actual use, including any processing of children's data, before claiming EU/UK compliance.
4. Public disclosure and recipients
Content marked Public may be visible to anyone, potentially including search engines and people outside your country. Records marked Private or Trusted Users Only are intended to have restricted visibility according to the site's access controls. Moderators and administrators can access information needed to run, secure and moderate the service.
Hosting services such as DreamHost process site traffic and infrastructure data. When you access maps, third-party imagery/tile providers may receive requests containing your IP address, browser details, and the tile or map area requested; depending on the layer selected this may involve Esri, OpenStreetMap-related services, local government imagery providers, or other sources identified in map credits. CDN providers used for mapping software may also process network requests. Each service has its own practices.
5. International processing
The application is hosted or administered in the United States and may be accessed globally. Public submissions may be viewed from other countries. Where EU/UK law applies, international transfers of non-public personal data require an appropriate legal transfer mechanism and an assessment of the recipients and safeguards. The operator must verify those arrangements with hosting and other service providers.
6. Retention and account deletion
IrriDex uses the following retention periods for the application data that the controller manages. A valid legal obligation, unresolved security investigation, or legal claim may require a limited exception. In that case, only the information needed for that purpose will be retained, access will be restricted, and it will be deleted when the exception no longer applies.
| Information | Retention period or deletion rule |
|---|---|
| Active accounts, profiles and associated contributions | While the account is active and the information is needed for the service. On an eligible, verified erasure request, the account and associated personal data are removed from the live application without undue delay, ordinarily within 30 days of receiving the request, unless a lawful exception applies. |
| Forum discussions and replies | Public while the discussion remains available. If a member requests an eligible account erasure, their authored forum messages are removed from public display and the author reference is cleared, while other members’ independent replies may remain. Moderator-hidden forum content can remain restricted pending review. |
| Feedback, suggestions, bug reports and privacy correspondence | 180 days after the report or request is closed, unless a longer period is necessary for an unresolved dispute, security investigation, or legal requirement. |
| Application security and moderation audit logs | 12 months from the recorded event, except specific records preserved for an active investigation, a legal claim, or a legal obligation. Routine appearance and timezone changes are not security audit events. |
| Backups created and controlled by the IrriDex operator | Normally no more than 14 days in a rolling backup cycle. When a verified erasure request is fulfilled, existing operator-controlled backups containing the data are deleted, and a fresh backup is created only after the live data has been erased. |
| Personal data export packages | Encrypted packages expire exactly 72 hours after creation and cannot be downloaded afterward. A scheduled purge deletes expired files; a package can also be revoked early. |
| DreamHost-managed recovery backups | Retained and replaced according to DreamHost's own systems, which the operator cannot directly erase. Their exact maximum retention period is not known; see the explanation below. |
DreamHost-managed backup generations
DreamHost labels available website-file restore points as Most Recent (approximately 1 hour to 1 day old), Mid-Range (1 day to 2 weeks old), and Oldest (2 weeks old or more). These labels describe the age of the available restore points, not a guaranteed deletion deadline. DreamHost generally describes website-file backup availability as about two weeks, without a guarantee. The oldest category has no stated maximum age. Database files stored among the website's files may also be present in these file backups.
What happens when you request erasure
After verifying and assessing an eligible erasure request, we remove the affected account and associated personal data from the live site, delete backups we personally control, and then create a new clean backup. We cannot promise immediate erasure from DreamHost-managed recovery backups. Any remaining copies there are not used for ordinary site operations and are held only for disaster recovery until DreamHost replaces or retires them. If such a backup must be restored, previously completed erasures must be reapplied before the restored site is made available to users. We will explain any applicable exception or backup limitation in our response to your request.
IrriDex does not treat older backup copies as permission to revive deleted accounts or previously erased personal information. Contact gdpr@sccpsteve.com for questions about a particular erasure request.
7. Cookies and browser storage
IrriDex uses an authentication session cookie, security/registration-abuse prevention storage and explicitly requested appearance/timezone settings. The IRRIDEX_CONSENT_V1 cookie records your privacy selection for up to 180 days. Optional browser storage can remember map view, layers, interface preferences and update acknowledgements. Optional storage is disabled until you choose to allow it. The current application does not intentionally set advertising or third-party analytics cookies. See Cookie Preferences for a detailed inventory and to change your selection.
Security record cleanup: Failed-login fingerprints are routinely deleted after the 24-hour monitoring window; expired automatic IP login bans are deleted at the next scheduled cleanup. Closed feedback and resolved privacy requests are ordinarily removed after 180 days, and audit events after 12 months, except records placed on a documented retention hold for lawful reasons. The privacy cleanup runs hourly on the configured DreamHost schedule; failures may delay deletion.
8. Security
IrriDex uses access roles, hashed passwords, browser-session security controls, rate limiting, and audit logs for certain security and moderation actions. No online service can promise absolute security. Please do not submit passwords or confidential records in public map notes or feedback.
9. Your privacy rights
Depending on your location and applicable law, you may request access to your personal data, correction, deletion, restriction, a portable copy, and information about processing. You may also object to processing based on legitimate interests and withdraw any consent for optional browser storage at any time. Some requests can be limited by legal obligations or other people's rights.
Signed-in members can use Your privacy rights to submit and track requests. Staff manually review corrections, objections, restrictions and other rights. Guest and former members may contact the controller at gdpr@sccpsteve.com or via Send Feedback, using a subject such as “Privacy request — access,” “Privacy request — delete,” or “Privacy request — objection.” We may need to verify account ownership before releasing or deleting records. Do not provide identity documents unless requested through a secure method. For applicable EU/UK requests, the normal response window is one month, subject to permitted extensions. You may complain to your local data protection authority (or the UK Information Commissioner's Office) about unresolved concerns.
10. Children and sensitive data
IrriDex is not designed to collect children's sensitive information. Do not add precise details about a child or share sensitive personal information in map records or profiles. Applicable parental consent, age-appropriate design, and lawful-basis requirements may vary by jurisdiction and must be reviewed if minors can use the service.
11. Automated decisions
The application uses automated security/rate-limit checks, but account applications, account bans and contribution removals require human moderator decisions. Automatic IP-based security restrictions may temporarily block repeated failed sign-in attempts for 72 hours, with manual review available via the privacy contact. If any automated process has a significant effect on you, contact us for an explanation and review.
12. Contact and updates
IrriDex’s data controller is Tristan Long. Send privacy questions, complaints and data rights requests to gdpr@sccpsteve.com, or use the public privacy request form. Material revisions to this notice will be posted here with an updated date. Where an EU or UK representative is legally required, their contact details will be published after the representative has been appointed.