Privacy
Effective
This page lists what No Stairs Please collects, why, where it is kept and which services process it. The site shows no ads, and we do not sell personal information.
What we collect
You can browse the map and list without an account. The site collects the items below only when you use the feature that needs them.
- Account
- Your email address, a hash of your password and your name if you gave one. We never store the password itself. We also keep whether your email is verified and when the account was created.
- Google sign-in
- If you sign in with Google, Google sends your name, email address, verification status and profile picture link. We keep your Google account ID and the sign-in tokens Google returns, with the access and refresh tokens encrypted. The site asks Google only for your basic profile and email address.
- Sessions
- Each sign-in creates a session record with the IP address and browser of that device and the time the session ends.
- Sign-in limits
- The sign-in service counts recent requests from each IP address to slow down password guessing.
- Email links
- Verification and password reset links carry a token that expires after one hour.
- Favorites
- The IDs of the venues you save to your account.
- Hidden venues
- The IDs of the venues you hide while signed in, and when you hid them.
- Reveals
- Which venues you revealed and when. Reveals made on the website without an account count against your network, using a keyed hash of your network address (the full IPv4 address, or the first half of an IPv6 address), not the address itself. Reveals made in ChatGPT before signing in count against a keyed hash of the anonymous ChatGPT subject identifier sent by OpenAI.
- Connected apps
- If you connect ChatGPT or another MCP client to your account, we keep the client name and ID, granted scopes, SHA-256 hashes of the OAuth access and refresh tokens, and when the connection was created and last used.
- Purchases
- Your Stripe customer ID, each checkout, and for each payment the pass, amount, dates, access period, Stripe payment IDs, receipt link and payment status. You enter card details on Stripe’s checkout page. They do not reach our servers.
- Email to us
- If you write to team@nostairsplease.com, we keep your message so we can answer it.
Why we use it
- To create your account, sign you in and keep you signed in.
- To send verification and password reset emails. The site sends no newsletters or marketing email.
- To save your favorites and hidden venues so they follow you to other browsers.
- To count reveals and hold each one open for 7 days.
- To sell All Access, confirm payments, show your purchases and receipts, and pause access when a payment is reversed or disputed.
- To protect sign-in from abuse.
- To count page views and measure load times across all visitors.
Where it is kept
Account, session, favorite, hidden venue, reveal and purchase records are kept in a Cloudflare D1 database that only the site’s server code reads. Stripe keeps payment and card details. Your browser keeps your display settings, listed under cookies and storage.
Other services
These services process data for the site. Each one receives your IP address and browser details with its requests and handles them under its own privacy policy.
- Cloudflare
- Hosts the site, runs its server code and database, and sends the verification and password reset emails. Cloudflare Web Analytics counts page views and load times without cookies. Cloudflare also asks browsers to report network errors to it.
- Stripe
- Runs the All Access checkout page and processes payments. Stripe receives your email address, account ID, your name if your account has one and the card details you enter.
- Signs you in when you choose Continue with Google. Google Fonts serves the site’s typefaces on every page.
- Esri
- Serves the satellite imagery on maps, so it receives the map area you view.
- OpenFreeMap
- Serves the street maps, labels and map fonts, made from OpenStreetMap data, so it receives the map area you view.
- FOSSGIS
- When you use Draw a route, or fill in both Near and To, the FOSSGIS routing server (routing.openstreetmap.de) receives the stops or the two places and returns the road route.
- unpkg
- Delivers the MapLibre map library when a map loads.
- Venue websites
- Venue photos load from the websites that host them.
Links to venue sites, social posts and Google Maps open those services under their own policies.
ChatGPT and MCP
When you use No Stairs Please inside ChatGPT or another Model Context Protocol (MCP) client, the tool arguments you send and the venue records returned pass through that client under its own privacy policy.
- Before you sign in, OpenAI sends an anonymous subject identifier (
openai/subject) with ChatGPT tool requests. We hash that identifier with our server secret to count your 4 free ChatGPT venue reveals and to keep those venues open after you connect your account. - When you connect your No Stairs Please account via OAuth 2.1, you approve the connection on our consent page. We store only SHA-256 hashes of the issued access and refresh tokens in D1.
- You can view and disconnect any connected app at any time from the Connected apps section of your account page, which revokes its tokens immediately.
Keeping and deleting data
We keep account records while your account exists. Reveal records are kept so that reveals do not refill.
The site has no delete button. To delete your account, email team@nostairsplease.com from the address on the account. Write to the same address to ask what your account holds or to correct your name or email. You can reset your password from the account page.
Stripe keeps its own payment records under its own policy.
Children
The site is not meant for children under 13, and we do not knowingly collect their information.
Changes and contact
When this policy changes, the effective date at the top changes with it. Send questions to team@nostairsplease.com.