Last updated: 2026-07-09 · consent version 2026-07-01
Club 49 Prospecting (“Club 49”) respects your privacy. This policy explains what we collect and why.
Signing up asks for one thing: an email address. That, and an ID for the account itself, is all we take. Alongside it your account row keeps a handful of housekeeping values the app runs on — whether you are a member or an admin, whether the account is approved, any expansion packs you have unlocked, referral credits, and the date you joined. None of those describe you.
Everything else is optional and entirely yours to add or leave blank: a display handle, an avatar, and your saved preferences. We never ask for your real name, home address, phone number, date of birth, or payment details, because the app has no use for them and there is nothing to charge you for. Your email is never shown to other members.
All of it lives in Supabase, our database host, which stores it on our behalf and does not use it for anything of its own.
Finds, photos, journal entries, chat messages, encrypted direct messages, crew posts, job listings, and saved map pins are stored so the app can sync them across your devices. Encrypted DMs are ciphertext in our database; decryption happens in your browser. Chat reactions are stored with your account (one per member per message) so you can change or remove yours; other members only ever see the emoji counts, never who reacted.
We use your browser’s localStorage for guest-pass timing, UI preferences, feature settings and progress (your chosen views, text size, the getting-started checklist, daily-brief timing, active-use timing), offline map tile caches, and saved spots when you are not signed in. All of it stays on your device; you can clear it by clearing site data for club49.app.
When a signed-in member shares a spot or an invite, the link includes that member’s random account code (a UUID) so that a friend who joins through it is credited to them. The code reveals nothing about the member, no name, no email, no location. If you open such a link, the code is kept in your browser’s local storage only until you join (so the inviter gets their credit) or until you clear site data; it is not used to track you.
Our progressive web app installs a service worker that caches the app shell and optionally map tiles you save for offline use. Cached tiles stay on your device until you clear site data or we ship an update.
The club airwaves (push-to-talk) ride your internet connection between members and are covered by the sections above: voice bursts are stored briefly in Supabase and auto-delete within 24 hours. The frequency tuner and your saved “my set” are pure reference and live only in your browser’s local storage; nothing about what you tune or save is sent anywhere. The Listen in the app feature is off until you turn it on and agree once. When you play a public stream, your device connects directly to that stream’s server, which can see your IP address, exactly as if you had clicked a link to it; Club 49 does not proxy the audio, embeds no third-party player, script, cookie or tracker, and stores nothing about your listening. You choose the source, you must have the right to hear it, and you agree to listen only and to follow that source’s own terms. The external receivers we link to (WebSDR, KiwiSDR, LiveATC, OpenMHz, Broadcastify, the National Weather Service) are independent services with their own privacy policies.
The map loads public data from U.S. government sources (USGS, BLM, USDA, NOAA, etc.) and uses Supabase for auth and member features. Cloudflare hosts the site. Optional integrations include USAJOBS (federal job listings) and Giphy (chat GIF search). We do not sell your personal information.
Some features look things up for you as you use them: the address or town you type into the home-base box is sent to OpenStreetMap’s Nominatim service to turn it into map coordinates; the dig-day planner and the daily brief send the coordinates of your home base or current map view (never your name, email, or account) to Open-Meteo for a weather forecast; river flows come from USGS water services; and the gold price comes from a third-party market feed that receives no personal data. Map tiles and imagery are fetched from their hosts (USGS, USDA, Esri, and others), which, like any website you load content from, receive standard web requests, your IP address and the tile areas requested, with no Club 49 account information attached.
The cross-layer finder includes an optional land-status check, and we ask you once before the first time it runs. When you use it, your browser asks the Bureau of Land Management’s public map service about the coordinates of each site you are checking, and BLM returns the managing agency. That is all that is shared: no name, email, account or device location. Club 49 does not proxy the request, does not see it, and keeps no record of what you looked up. BLM is a federal agency, so anything on their side is covered by the Department of the Interior privacy policy rather than ours. You can change this setting at any time in the finder.
If you choose to answer the “how are you liking the app” invitation, we store what you submit: the star rating, your comments and suggestions, whether you were signed in, roughly how long you had used the app, and a coarse browser description (for fixing device-specific problems). Reviews are deliberately anonymous, they carry no email and no account identifier, and only the admin can read them.
AI assistant: when you use the AI map analysis (or an expedition briefing), your question plus the current on-screen context (map location, and the honey holes and layers in view) and a short summary of your own find journal are sent to our AI service, hosted on Cloudflare, which relays them to a third-party AI model provider to generate a reply. We send no account identifier, each chat starts fresh, and the conversation is not stored on our servers or pooled with other members. The provider processes the request under its own terms only to return the answer. Do not enter personal or sensitive information into the assistant.
Every location layer on the Club 49 map is drawn from records that government agencies already publish and that are public by law: U.S. Geological Survey mineral, terrain and place-name databases (works of the federal government are public domain under 17 U.S.C. § 105, and federal records are available under the Freedom of Information Act); Bureau of Land Management mining-claim records (recorded with the BLM under the Federal Land Policy and Management Act and published as public land records); California oil, gas and geothermal well records published by CalGEM (California Department of Conservation) as public records under California law, including the California Public Records Act; wildfire, flood, water and terrain data from NIFC, FEMA, USGS water services and the USGS 3D Elevation Program; and community-mapped places from OpenStreetMap under its open database license. We do not create, buy, or publish private databases about people or property; the map shows what the public record already says, and markers link back to the underlying government record so anyone can verify the source.
A marker is a public data point, never permission to enter land. Historic mines, wells, springs, swimming holes and similar features can sit on or near private property, and the app repeatedly directs members to check the land-ownership layer, posted signs, claims, and the law before visiting anything. Nothing on the map grants access anywhere.
If a mapped item relates to your property and you would like it reviewed, whether or not you are a member, email [email protected] with the location. We review such requests promptly, can suppress an item from display while we review, and honor lawful removal requests.
Messages sent through “Contact the admin” are stored so we can reply. Rate limits apply to reduce spam.
Club 49 is not directed at children under 13. We do not knowingly collect data from children.
Photos you upload may contain embedded location (EXIF) data. Strip it first if you do not want to share where a photo was taken. You are responsible for what you choose to post; do not reveal a spot you mean to keep private.
Device GPS: the locate button and the “Near me now” list use your device’s location on your device only, to place the blue dot and sort nearby sites. Your GPS position is never sent to our servers, never stored, and never shared with other members. Your browser asks your permission before any location is read, and the feature simply does not run if you decline.
You can sign out, edit or delete content you control, and request a copy or deletion of your account data by emailing [email protected]. California residents may exercise CCPA rights (access, deletion, and to know what we collect); we do not sell personal information.
We keep account and member content while your account is active. On deletion we remove your profile and the content you control, except where we must retain limited records to comply with law or prevent abuse.
All traffic is served over HTTPS. Member data is protected by database row-level security, so you can only read and write your own records. Direct messages are end-to-end encrypted: the private key stays in your browser and we store only ciphertext. Service credentials (API keys) are held server-side and are never shipped to your browser. No security is perfect, but we follow these practices to reduce risk.
We do not use advertising or cross-site tracking cookies, and we do not sell or share your personal information for advertising. The app uses your browser’s local storage only to make the app work (preferences, guest-pass timing, offline tiles, saved spots). If we add analytics, we will use a privacy-respecting service that does not track you across other websites, and we will note it here.
Club 49 is operated in the United States and your data is processed and stored there. If you use the app from outside the U.S., you consent to that processing. Residents of the EU, UK, and similar regions may request access, correction, deletion, or a portable copy of their data using the contact below; we honor those requests.
We review this policy as the app grows and may update it. When it materially changes we update the version above and ask members to re-accept it in the app before continuing, so you always know what you agreed to.