Privacy Policy

Last updated: [DATE] · Soyutech Ltd, ICO Registration No. [INSERT]

1. Who we are

Exhalo is operated by Soyutech Ltd, a company registered in England and Wales and registered with the UK Information Commissioner's Office (ICO). ICO registration number: [INSERT]. Contact: privacy@soyutech.com

2. What data we collect

We collect no data that identifies you. There is no account, no login, no name, no email address, no device identifier, and no tracking cookie of any kind. When you press the exhale button, the only information processed is:

• Your IP address — used transiently (see section 3 below) and never stored
• A derived approximate city name and country (see section 4)
• The approximate hour the signal was received (rounded to the nearest hour)

3. What we do with your IP address

Your IP address is used solely to determine approximately which city you are in — accurate to roughly a 25-mile radius. The IP address itself is never written to our database, never logged to a file, and never transmitted beyond the geolocation lookup. It exists briefly in server memory during processing and is discarded immediately after. We store only a temporary, salted hash of the IP in memory (not the database) to prevent the same connection from being counted twice within a 5-minute window. That hash expires automatically and is never persisted.

4. What is stored in our database

Each exhale session creates one anonymised row containing:

• Timestamp — rounded to the nearest hour (e.g. 14:00, not 14:23:07)
• Country — ISO country code (e.g. "GB")
• City name — only cities with a population above 100,000 are recorded; smaller towns are replaced with the country centroid to prevent village-level identification
• Coordinates — latitude and longitude rounded to 1 decimal place (~11km precision)

No click count within a session is stored. How many times you press the button is known only to your browser and is cleared when you leave or the session expires.

5. CAPTCHA

We use Cloudflare Turnstile in invisible mode to prevent automated bot submissions. Turnstile is privacy-preserving: it does not set tracking cookies, does not build a profile of you, and does not track you across the web. See Cloudflare's privacy policy for their data practices.

6. Heatmap data

The map shown on Exhalo displays aggregated signals only. No individual exhale event is ever visible. A city must have received at least 10 exhale events within a 24-hour window before it appears on the heatmap at all. Coordinates on the map are city centroids rounded to 1 decimal place — not a precise location.

7. Third parties

We use the following infrastructure providers:

• Cloudflare — infrastructure, CDN, and Turnstile CAPTCHA
• ip-api.com / MaxMind GeoLite2 — city-level geolocation lookup only (IP not stored by us beyond the transient lookup)
• Supabase — anonymised database storage (PostgreSQL)

We use no advertising networks, no social media tracking pixels, no Google Analytics, no Meta Pixel, and no third-party analytics scripts of any kind.

8. Your rights

Because we hold no personal data about you, there is nothing to delete, access, correct, or port. You cannot be identified in our database. If you believe we hold information that relates to you, contact us at privacy@soyutech.com and we will investigate.

9. Cookies

Exhalo sets no cookies. A cookie banner is not displayed because there is nothing to consent to.

10. Data retention

All exhale event rows are automatically deleted after 90 days. No archive is kept.

11. Contact

Soyutech Ltd
Email: privacy@soyutech.com