Privacy at Earth Right Now
Earth Right Now is designed to work without requiring an account. Favorites, recent places, recent windows and interface preferences are stored in your browser unless a feature clearly says otherwise.
ERN links to or embeds third-party camera and travel sources. When you open or play a third-party source, that provider may receive normal web request information and applies its own privacy policy.
The current camera-review draft and Earth Signal preview tools run locally in your browser and do not submit their form contents to ERN. They are readiness tools, not active upload services.
Soft-launch analytics
During ERN’s controlled soft launch, ERN uses a small first-party analytics service to learn whether the Live Discovery Engine is useful. It records aggregate page visits, a coarse device class, coarse country/region supplied by Cloudflare, referrer hostname where available, ERN place/source identifiers that are opened, privacy-filtered search terms and zero-result searches, and clicks on verified travel/affiliate actions. This is used for product reliability, discovery-gap planning and business learning—not advertising profiles or paid ranking.
ERN does not store raw IP addresses, precise visitor coordinates, My Earth favorites or recent-history data, contact details, booking references, payment details, transaction values or commission amounts in analytics. Search terms are normalized and aggregated rather than kept as per-visitor event logs; terms that look like an email address, URL or phone number are dropped from stored search text. ERN uses a random first-party browser identifier only to estimate new versus returning use; it is not shared for cross-site tracking. Analytics is not sent when the browser signals Do Not Track or Global Privacy Control. Aggregate analytics data is retained for no more than 90 days under the current soft-launch policy.
Future generative ERN Guide
ERN is preparing an optional generative Guide, but it is not active yet. Before activation, the Guide must use a secure server-side endpoint so model credentials are never exposed in the browser. The server must rebuild trusted place and source context from ERN's own catalog rather than treating visitor text as source truth.
If the generative Guide is activated later, the intended privacy boundary is: visitor prompts are used only to answer that request; raw prompts and raw model responses are not retained in operational logs; ERN does not build advertising or behavioral profiles from Guide conversations; rate limiting must use a server-derived keyed identifier rather than storing raw network identifiers; and the deterministic Guide remains available when generative processing is unavailable or declined.
The final model/provider-specific data-handling terms must be reviewed and this notice updated if needed before activation. Until then, the public ERN Guide remains deterministic.
Future camera and place submissions
ERN is preparing an optional camera/place submission workflow for businesses and organizations, but submission transport is not active yet. If activated, a submitted record will be treated as untrusted intake for human review, never as automatic publication or source approval.
Unapproved submission records will be retained for no more than 30 days for review and then deleted. If a submission is approved into ERN's public catalog, only the source/place metadata needed to operate and attribute that catalog entry may remain as normal catalog data. Submission consent does not grant ERN permission beyond the rights actually verified during review.
Until a secure HTTPS review endpoint is configured and the transport readiness checks pass, the public form remains local/preparatory and does not transmit submission contents to ERN.
Future Earth Signals
ERN is preparing an optional Earth Signals contribution feature, but public contribution is not active yet. If activated, Earth Signals will let visitors share short-lived structured observations about what a place feels like right now. Free-text submissions are not part of the current design.
Location sharing will be optional. Public signal display will be limited to place-level location rather than precise coordinates. Media metadata must be stripped before storage or publication. Visitors will be able to report signals that appear wrong, misleading, unsafe, spammy or privacy-sensitive.
Earth Signals are designed to be temporary. Public structured signal records will expire automatically after 45 minutes and the backend retention process must delete expired records. Activation also requires a secure HTTPS endpoint, durable storage, server-side rate limits using pseudonymous subjects, moderation, reporting, expiry cleanup, secret isolation, observability and cost controls. Until those production safeguards are verified, Earth Signals remain read-only.
Future temporary Now Moment photos
ERN is preparing an optional still-photo Now Moment feature for short-lived, place-based visitor media. Photo uploads are not active yet. The first activation, if it occurs, will accept still images only; video remains disabled.
Before storage, the visitor-side client will re-encode and resize the image where supported, and the server will reject media that still contains common EXIF, XMP, GPS or other disallowed metadata. The first version will not accept captions, comments or other free text, and public records will not contain precise contributor coordinates. A canonical ERN place is required.
Every submitted photo will enter a private moderation queue first. It will not be shown publicly until a human review approves it. Reported photos will be hidden immediately pending review. Approved public photos will be labeled as temporary visitor media and not independently verified; they will never upgrade a camera source to LIVE or change ERN source health.
Now Moment photo records and their private stored media are designed to expire after 45 minutes. Automatic cleanup must delete both the metadata record and stored object after expiry. The service also has per-visitor rate limits, a hard retained-media ceiling, private object storage, server-side secrets and a separate public activation switch. Until production deployment, live health verification and explicit activation are complete, photo upload stays off.
ERN does not sell your personal information. Advertising tracking, paid advertising profiles, accounts, payments and other separately gated data-collecting services remain inactive unless explicitly reviewed and approved.
Last updated: 2 October 2026.