Privacy Policy

Browsing the site. You can read every gold rush, figure, region and map entry without an account and without giving us anything. Our hosting provider processes your IP address and request details to serve pages and guard against abuse.

If you create an account. Your email address, and your name if you provide one or if it comes from the Google or Facebook account you signed in with. We also store your membership tier and, if you subscribe, an identifier linking you to your Stripe customer record. We never receive or store your Google or Facebook password.

If you subscribe to the newsletter. Your email address, which surface you submitted it from, and whether you have confirmed it. Your address is only treated as subscribed once you confirm it.

If you buy a membership. Payment is handled entirely by Stripe on Stripe's own hosted checkout. Your card number never reaches our servers and we never store it. We receive back only what we need to give you access: a customer and subscription identifier, the plan, its status, and the current billing period.

What we don't collect. We don't sell or rent personal information, we don't run advertising or advertising trackers, and we don't build profiles of visitors across other websites.

The site sets cookies only when you sign in. Those cookies keep you signed in and are strictly necessary — the site cannot offer an account area without them. If you never sign in, browsing sets no cookies at all.

We use no advertising, profiling or cross-site tracking cookies. Where analytics are enabled they are cookieless, and the Google Tag Manager container described below sets no cookies of its own — which is why you aren't asked to accept a cookie banner.

If we ever publish a tag through that container that does set cookies — Google Analytics, for example — we will update this page and ask for your consent before it runs.

Where analytics are enabled, the site uses Plausible Analytics, which is cookieless and does not collect or store personal data. It reports aggregate figures — page views, referrers, broad country and device type — and cannot identify you or follow you to other sites.

Every page also loads Google Tag Manager, a container Google operates that lets us manage measurement tags without changing the site's code. Loading it discloses your IP address, browser and the page you are on to Google. The container itself sets no cookies and collects nothing further on its own.

What the container does beyond that depends on the tags published inside it. Any tag that would profile you, follow you across other sites, or set a cookie is a material change to this policy: we will list it here and, where consent is required, ask for it before the tag runs.

The site relies on the following providers. Each processes data only to deliver its part of the service.

Photographs and portraits shown on the site are served from our own domain, so viewing them tells no one but our host that you did.

Some historical documents in the archive still load from the institutions that hold them, such as Wikimedia Commons, the Library of Congress, the Internet Archive and the National Park Service. Requesting those files discloses your IP address to those institutions.

We use your information to run your account and give you the access you've paid for, to send the newsletter if you asked for it, to keep the site working and secure, and to understand in aggregate which entries people find useful.

Where the UK or EU GDPR applies, we rely on performance of a contract for account and membership data, your consent for the newsletter (withdrawable at any time), and our legitimate interest in a secure, functioning site for security, aggregate analytics and the tag container that loads them. Should we publish a tag that requires consent, we will collect it separately rather than rely on that legitimate interest.

Account and membership records are kept while your account exists, and for a period afterwards where we must — Stripe retains transaction records to meet financial and tax obligations. Newsletter addresses are kept until you unsubscribe. Unconfirmed newsletter addresses are not treated as subscriptions. Aggregate analytics contain no personal data and are kept indefinitely.

You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or ask us to stop using it. You can unsubscribe from the newsletter at any time. To do any of these, contact us at TODO: contact email address.

If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, to the Office of the Information and Privacy Commissioner for BC. If you are in the UK or EU, you may complain to your national data protection authority. If you are a California resident, you have the right to know what is collected and to request deletion; we do not sell personal information.

We are based in Canada and our providers operate internationally, so your information may be stored or processed outside your country, including in the United States and the European Union. Those countries' privacy laws may differ from your own.

The site is intended for a general audience and is not directed at children under 13. We don't knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

Traffic is encrypted in transit. Accounts are protected by our authentication provider, and card details are handled solely by Stripe. Access to the archive is checked on the server, and archive files are served through links that expire. No system is perfectly secure, but we take reasonable measures to protect your information.

If this policy changes in a way that materially affects you, we will update the date at the top of this page and, where appropriate, tell you directly.

Questions about this policy, or about the information we hold, can be sent to TODO: contact email address. The person responsible for this site is Kristian Sullivan, British Columbia, Canada.