CSVF2 PRIVACY POLICY

What the program sends, and when

• Your account (new in version 5). When you sign up, the program (or the account page) sends your email address, a password and your callsign. The website stores the email, a salted one-way hash of the password (never the password itself), and the callsign, and emails you a confirmation link. When you log in it sends the email or callsign and the password; the program then keeps a login token on your computer and sends it with later requests, which is how the website knows which account is asking. You can delete the account yourself from the account page or by emailing support@ke9gdp.com.
• Your licence, once, for review (new in version 5). To be approved you upload your licence as a PDF, PNG or JPEG, exactly as issued. It is stored privately on the website's disk, never published and never shown to anyone but the site owner, who checks it by hand. It is deleted when the account is approved or rejected (a rejected account can upload a new one). The account then only keeps that it was approved, and when.
• Your callsign on the users list. When your program first runs with an approved account it asks the website to list your account's callsign. The website takes the callsign from the account, not from the request, so a callsign can only be listed by the account approved for it. The program version is sent with it. Nothing is sent until you have accepted this policy.
• The time. The website records the time it received the callsign.
• Update checks. The program asks the website which version is newest (a plain web request that carries no callsign and no personal data), and when you agree to an update it downloads it from the website.
• Notifications. The program asks the website for the notifications the site owner has posted (a plain web request that carries no callsign and no personal data) and shows them on its Notifications tab. It does this when it starts and now and then while it is open, and on the tab's Refresh button.
• Feedback, only when you send it. The Feedback button opens a form. Nothing is sent until you press Send. What is sent is the kind (bug, idea or other), the message you wrote, the program version and, only if you fill them in or tick the box, a contact address you typed and your callsign. The site owner reads it on a private admin page. It is not published.
• Feedback conversation (new in version 4). When you send feedback, the program also makes a random 32-character code (it is not derived from anything about you) and keeps it on your computer. The website stores only a one-way hash of it, together with your message. Only when you open the Feedback tab or press Check for replies, the program sends that code to the website and receives the messages of that one conversation (yours and the site owner's), which it shows as plain text. A message you type in the Feedback tab is sent with the code. Nothing is checked in the background, and only for conversations your own program started. The site owner reads and answers them on a private admin page; they are not published.

Public by design

Your approved callsign and the time it was first seen are stored in a database that is public: the CSVF2 users page lists the 10 most recent, and anyone can download the whole list from that page. Amateur callsigns are public records already, but this list says that you ran this program.

Your location, over the radio, and the map

• Over the radio, not to this website. To transmit, the program requires you to enter a location (receiving needs none), and the data callsign frame at the start and end of each of your transmissions carries your neighbourhood next to your callsign, as a grid square (Maidenhead locator) of 8 characters (a cell about 0.5 x 0.7 km; you can choose 6 or 4 characters, about 5 x 7 km or 100 x 150 km). Only that cell is ever sent or kept, never exact coordinates. Anyone who can receive your radio signal can read it, and any CSVF2 program that hears it shows it on its Map tab. The program does not send it to ke9gdp.com. The format is in the protocol specification.
• You cannot switch it off in the program window (from version 3.5): no location, no transmitting, and the window always uses the New callsign mechanics. You choose how coarse it is (Precision on the Settings tab: neighbourhood, district or region). The server scripts (radio_server_*.py) are not affected and keep their own location switch.
• On your computer. Your own location (the 8-character cell) and the callsigns, cells and times of stations your program heard are kept in csvf2_user.json next to the program, so the Map tab can show them (up to 300; delete the file to forget them). The Use this computer's location button asks Windows' own location service, on your computer only, and keeps just the cell.
• Map pictures. The Map tab draws a street map from tiles downloaded from tile.openstreetmap.org, only while the Map tab is open and Show map tiles is ticked. Each request tells that server your internet address and which tiles (so, which part of the world and at what zoom) you are looking at, under the OpenStreetMap Foundation's own policy, not this one. Tiles are cached in a map_cache folder next to the program. With the box unticked no tile is requested and the map is a plain grid.

What is not sent

The program does not send this website any transmitted or received messages, files, audio, settings, location, operating system, device or hardware information, and no list of what you transmit or receive. (Your name and address are on your licence, which is why it is deleted once reviewed.) The program does not run in the background when it is closed.

Things you should know

• A broadcast location is public. Radio is heard by everyone in range and may be recorded or relayed; a grid square in a callsign frame can be read, kept and shared by anyone who receives it, and cannot be taken back. If that is not acceptable, enter a coarser precision (or do not transmit): a location is required to transmit. Amateur callsigns are public records already, but a location next to one is something you are choosing to add.
• Like any web request, the website sees the internet address the request came from. It is used only to limit how fast one address can send callsigns; it is kept in memory for that and is not put in the database or the public list.
• Callsigns are not verified. Anyone could send someone else's callsign, so being on the list does not prove who ran the program.
• You have to accept this policy to use the program (once; the program remembers) and then log in with an approved account. If you do not accept, it closes and sends nothing. An approved account keeps working without the internet for 14 days after the website last confirmed it.
• The website sees the internet address each request comes from and uses it to rate-limit sign-ups, logins and other writes; it is kept in memory for that.
• To have feedback you sent (with its conversation), your account, or a callsign removed from the website, delete the account on the account page or email support@ke9gdp.com with the callsign or what you wrote.
• If this policy changes in a way that matters, new program versions will ask you to accept it again.