Visitor map
Country totals only
Like every web server, Shtory.ie receives a network address long enough to return the requested page. For a qualifying page request, the active country collector briefly checks that address against a country database held locally, then discards the address from the map system and writes only the UTC calendar day and two-letter country code to a dedicated collector log. The public map dataset contains only country totals. It does not contain an IP address, IP prefix, IP hash, user agent, referrer, page path or exact event time.
Country totals normally update within about a minute, and a country can appear after its first qualifying request. This threshold of one offers no anti-correlation buffer and does not guarantee anonymity. The map counts page requests, not people. On a quiet site, someone who already knows when you visited may therefore be able to infer the country of that visit from a new dot or counter change. Dots use fixed country centres; they are not measured locations. VPNs, proxies and undetected automated requests can make a total inaccurate.
Signal Room
Coarse request signals, not visitor profiles
The Signal Room is a separate request observatory intended to explain broad traffic, protocol, performance and defensive-security patterns on this server. During a request, Nginx may use the network address transiently and a country database held locally to derive a country code. Before an observatory event is written, every other value is reduced to a fixed category: a UTC minute bucket, route family, allowlisted method, broad client class, probe-shaped signal, bounded response timing and size measurements, HTTP and TLS generation, and response status.
The sanitised observatory event contains no IP address or prefix, stable IP hash, request or session identifier, raw URL or query,
referrer, user-agent string, cookie, request body or exact event time. Its categories describe requests and heuristics, not confirmed
people, devices or attackers. Requests carrying Sec-GPC: 1 or DNT: 1, the one-request mirror endpoint and the
separately operated BlueMap application are excluded from the observatory log.
Sanitised event records are designed to be kept for no more than 48 hours, excluded from ordinary backups and reduced to fixed public totals and time-series aggregates. The observatory configuration must not be activated until that rotation control is installed. Published aggregates may be retained to show longer trends because they contain only fixed categories and totals. The public feed does not produce cross-dimensional request profiles that would connect a country, route, client class and security signal together.
The optional request mirror returns only the coarse categories calculated for that single mirror request, plus the time at which its
disposable response was generated. Its response is marked no-store, has no analytics or security access log, creates no
stable identifier and is not added to the public aggregates.
Minecraft record
Public game history, coarsened before publication
The Minecraft page can publish a player's public game name, fixed display colour, broad 15-minute attendance intervals, cumulative game statistics and completed advancements from this public server. A separate activity view reduces recorded block interactions to 128-by-128-block cells inside the Minecraft world and delays them by at least 24 hours. It is an in-game activity-density map, not an Earth map and not a record of a player's physical location.
The public snapshot does not contain a network address, Mojang UUID, chat, command, inventory, operator status, raw login line or exact movement trail. Private identifiers are used only on the server to associate Minecraft's own files before the result is reduced. Per-player heat layers are off by default. The page states the actual retained coverage instead of implying that it knows activity from before the available records.
A player may ask for their name to be hidden, replaced with an alias, or removed from future public snapshots by contacting Edward Dunne at eddied96@gmail.com.
Live location
Visible only when somebody chooses to share
The Live Location page is separate from the visitor map. It uses browser geolocation only after a person explicitly confirms that they want to share, presses Start and grants their browser permission. Each person chooses a short expiry and either approximate or exact mode. Approximate is the default and rounds the published position; exact mode displays an additional warning before it can start.
While sharing is active, the public map feed contains the person's chosen display name and colour, their current rounded or exact point, the selected precision, when that point was updated and when it will expire. It does not publish their temporary control key, network address, device information, raw GPS accuracy, altitude, heading or speed. The service keeps at most one current point for each consenting person. After its short freshness window the point remains visible but is explicitly labelled last known. Pause, Stop, expiry or a machine reboot removes it, and no route history is stored. A separate Home summary publishes the chosen name and area label plus timing state, but no coordinates, precision or map geometry.
A public exact point can still be copied or recorded by somebody else while it is visible. Server-side deletion cannot erase a copy made outside Shtory.ie. Browser tracking may also pause when a phone locks or the page is in the background, so the map is a best-effort live display rather than proof of identity, presence or safety.
After consent, the server accepts the public name and area label the person entered, assigns a colour, and creates a temporary control key for that one session. The controller keeps the key only in the same tab's session storage: it is never placed in a link, query string or permanent browser storage. Reloading that tab can recover the controls; hiding, refreshing or leaving the page does not silently Pause. Closing the tab loses its local key, while the last point remains until expiry unless Pause or Stop was used first. Stop removes the server session and clears the key from the tab. Location sharing is based on explicit consent, which they can withdraw instantly with Pause or Stop, or by contacting eddied96@gmail.com.
Movement arcade
Recorded locally, published only by choice
Opening the Movement page does not start location access or send an activity to this server. A walk, run or cycle begins only after the person presses Record and grants browser permission. During recording, the raw fixes, timestamps and accuracy values stay in that browser's IndexedDB so the draft can survive a reload. Before any publication attempt, pressing Keep private deletes the local draft and sends nothing. If an earlier upload received an uncertain response, Keep private first withdraws the possible public copy and clears the raw draft only after that withdrawal is confirmed. Phones may reduce or stop browser GPS work while locked or backgrounded, so this remains a best-effort recorder rather than a safety or competition timing system.
After Finish, the person can independently choose whether to publish named statistics, a named route, or an anonymous heatmap contribution. Only that explicit choice creates an upload credential and sends the completed draft. The server recomputes the activity in memory, rejects bad fixes and implausible jumps, removes exactly the first and last 200 travelled metres, and never stores the raw points. A public route or heat contribution is accepted only when at least 400 metres remain after those cuts, which normally means recording roughly 800 metres or more. Leaving and later returning near the start can expose that later part of a loop; end trimming cannot make every route anonymous.
Published routes are simplified to 10 metres, quantised and have no per-point times or accuracy. The route and recent-activity feeds do include the exact completion timestamp. Heat contributions use a 25-metre base grid and may be coarsened further when a public response is large. They can be anonymous, but cell totals for passes, time and distance can still be revealing when only a few people have contributed. Anonymous means no public name; it is not a guarantee that somebody with outside knowledge cannot infer who made a contribution.
The Movement API receives no cookie, user-agent, referrer or forwarded network-address header, and its access logs are off. Nginx still uses the connecting address transiently in memory to enforce abuse limits, without passing that address into the Movement service or database. Public activities remain until deleted. After a successful upload, that browser keeps a separate deletion credential for the publication; losing the browser data also loses that local delete control. A removal can still be requested from Edward Dunne at eddied96@gmail.com. Consumed upload-session hashes are retained for idempotent retries and pruned after about 48 hours.
Photographs
Processed copies, deliberate captions
Gallery photographs are selected and written about by Edward. Original uploads remain in a private, ignored local folder. Before a public copy is approved, Shtory Desk corrects its orientation and re-encodes it without EXIF, GPS, XMP or IPTC metadata. A story may still include a deliberately broad place such as Galway when that context is useful.
People, number plates and identifiable locations are reviewed before publication. If a photograph or caption concerns you and you want a correction or removal, contact eddied96@gmail.com.
No identity layer
No map cookie or fingerprint
The country-level visitor map does not set cookies, request browser location, fingerprint a device or attempt to count unique people. The separate Live Location controller requests browser location only after a person explicitly consents and starts sharing. A theme preference may be kept in the browser's local storage so the light or dark choice survives a return visit; that preference is not used by the map and is not sent as an analytics identifier.
The homepage stopwatch also stores its current state and last recorded time in that browser's local storage so a timer can survive a reload. That stopwatch record stays on the device, is never sent to Shtory.ie and can be removed by clearing this site's browser data. If local storage is unavailable, the stopwatch works only for the current tab.
Exclusions
Privacy signals come first
Requests carrying Sec-GPC: 1 or DNT: 1 are excluded from the map collector. Known crawler,
command-line client, uptime-monitor and asset requests are also excluded on a best-effort basis. Bot detection
cannot be perfect, which is why the public page describes requests rather than people.
Operations
Security logs are separate
New dedicated web-server security logs may contain network addresses and are kept separately from the visitor map, normally for about seven days, except when a specific record is needed to investigate an active security incident. Older inherited Nginx logs created before this separation are not reused for map totals and are aging out under their previous rotation rather than being repurposed.
Those restricted defensive logs are also separate from the Signal Room. They are not a source for public observatory events, and the observatory schema contains no stable request identifier that could be used to join its records back to the security log.
Basis and choices
Why this processing happens
Edward Dunne relies on legitimate interests for the limited country-level aggregation and coarse Signal Room processing: understanding the broad reach and operation of this personal site while minimising what is retained. Security logging supports the separate interest in keeping the server reliable and safe.
Live Location processing relies on the participating person's specific consent. Nothing is shared merely by opening the page: the person must explicitly consent, grant browser permission, choose a precision and duration, and press Start. They may withdraw that consent at any time with Pause or Stop, which removes their current public point.
Movement publication also relies on specific consent given after an activity has finished. Recording alone is private to that browser. The person chooses each public output separately and may use the saved deletion control or contact Edward to withdraw that publication later.
The collector treats Sec-GPC: 1 or DNT: 1 as an objection and excludes that request. You may also object by
contacting the controller and privacy contact, Edward Dunne, at eddied96@gmail.com.
Country-event intake is active.
The map contains no visitor identifier, cookie or profile, but its near-live timing creates the limited country-level inference risk
described above.
You may also contact Ireland's Data Protection Commission.