Privacy policy

1. Who this policy covers

OpsiClear LLC maintains ColmapView, an open source web viewer for COLMAP reconstructions and related media. This policy describes the ColmapView website, the public Spatial Hub catalog and share-link service, and the configured Google Drive and Hugging Face integrations. Account features may be disabled in some deployments. Other operators' deployments and the external services you use have their own policies.

Contact us about privacy at info@opsiclear.com.

2. Local and remote files

When you select local files, the viewer reads the reconstruction, image files, masks, Gaussian splats, configuration files, or archives needed for the features you use. It parses, transforms, and renders that data in your browser. Selecting local files does not upload their contents to a ColmapView application server.

Loading a URL or manifest makes requests to the file hosts and any image or mask hosts referenced by that dataset. Requests can expose your IP address and connection information to those hosts. The dataset's source URL, paths, filenames, and file contents are used in the browser to discover and load supported data.

Camera metadata conversion and COLMAP export run in your browser. A remote camera import can also request source directory listings and referenced photographs or masks from their hosts to resolve the dataset's file paths.

If you open a viewer link that includes a dataset URL in its query string, your browser sends that full viewer URL to the website host when requesting the page. The host may therefore receive and log the dataset URL, including a Drive file ID or access-related link parameters. This is distinct from uploading dataset contents. To avoid putting a private source URL in that page request, open the viewer first and paste the source into Load URL instead of sharing or opening a URL-bearing viewer link.

Local export saves files through your browser. Sharing a viewer URL can include a dataset URL and encoded viewer settings. Treat links, filenames, and saved configurations as potentially sensitive; anyone receiving a link can read what the link itself contains.

3. Google Drive access

Public Drive ZIP and TAR archive links, including compressed TAR, can be loaded without connecting your Google account where the Drive integration is configured. For a private archive, you choose to sign in, authorize drive.file, and select the file through Google Picker or Drive's Open with menu. This permission applies to files you select or open with ColmapView or files the app creates; it is not broad access to every file in your Drive. The account must already be allowed to download the file. Pasting an arbitrary private link does not itself grant access. ColmapView retrieves the selected archive's metadata and content; the loader does not modify source files.

The separate Add to Google Drive action requests drive.install alongside drive.file to add ColmapView to Drive's Open with menu. Ordinary file sign-in does not request installation. When you open an archive from Drive, Google sends its file ID, any resource key and an account identifier in the viewer URL. The website host may receive that URL. ColmapView uses the identifier only as an untrusted sign-in hint; Google enforces file access. It removes raw launch state from the address bar. The selected file's sharing URL remains in the viewer link; account identifiers and tokens are not added to shared links.

Google Picker runs Google's file-selection interface in your browser. ColmapView supplies its app configuration and current Google token to Picker so you can choose an archive. After selection, the app uses the chosen file ID and, when required, its resource key to download through Google's Drive API. Cancelling the picker does not start a dataset load.

Loading and publication share a Google connection with the drive.file permission. Connecting never starts an upload; publication is a separate action. The publisher reads your Drive permission ID and keeps it in tab memory to bind retries to the same account. It uploads a new dataset ZIP with a random publication marker in its app-private metadata (appProperties), then verifies size, checksum, marker and sharing permissions. The marker stays with the file in Drive. Only if you select link sharing does it allow anyone with the link to read the uploaded file. ColmapView does not request drive.readonly or full-Drive read/write access.

Google supplies short-lived access tokens directly to your browser through its sign-in popup. ColmapView keeps them in tab memory and sends them only to Google APIs and Picker. It does not send them to our Worker, store a Google account record, request a refresh token or use a server-side Google client secret. Reconnect after reload or expiry. Passwords are entered with Google, never with ColmapView.

Google Limited Use: Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use this information for the visible viewing and publishing features you request. We do not sell it, use it for advertising or credit decisions, or use it to train generalized AI models. Transfers occur to provide features you explicitly request, including publication to another provider as described below, or where required for security or applicable law. Maintainers do not routinely receive or read your Drive file contents.

4. Hugging Face access

Public Hugging Face dataset links can be opened without signing in. Private access requests openid profile read-repos; builds with publishing enabled also request contribute-repos at sign-in to create and write repositories created by the app. Read-only connections cannot publish. Hugging Face enforces your repository and organization permissions.

Publishing uses the granted repository permission and connected username to create a dataset under your account; connecting never starts a publication. Access tokens stay in tab memory and are sent only to Hugging Face APIs. The username is kept in tab memory for repository operations and appears in repository URLs you publish or share. ColmapView does not keep a server-side account record or refresh token. Other profile fields, such as name, avatar and email, are not retained. Reconnect after reload or expiry. Passwords are entered with Hugging Face.

Hugging Face sign-in uses a short-lived authorization code in its browser callback URL, which hosting infrastructure can receive. The signing-in tab exchanges it directly with Hugging Face using PKCE; the verifier stays in tab memory. ColmapView uses no server-side OAuth client secret. Access tokens are not included in shared links.

S3-compatible buckets

Bucket access keys, secrets and temporary session tokens stay in tab memory and sign requests directly to your configured bucket. ColmapView does not send them to its Worker or persist them in browser storage. The connection form supports password-manager autofill; saving credentials in that manager is your choice and is governed by its settings and policy. Bucket files transfer directly between your browser and the bucket. Use credentials restricted to the bucket and access you need.

5. Publishing and sharing data

Publication is a separate action you start after choosing a destination and reviewing its options. It transfers a representation of the current reconstruction, referenced photos or matched video frames, available masks and splat files, viewer settings, and any chosen preview or dataset metadata to that provider. Original images can retain embedded metadata, including EXIF, capture details, or location information. Review your source files before publishing. For video-backed views, the manifest selects the image frame saved for each camera pose. Playback and seeking keep that selection unchanged; source recordings remain at their original host.

The Hugging Face publisher creates a new dataset repository that is public by default. You can choose Private before uploading. The dataset includes a card containing the repository name as its title, description, and any license you select. Specifying a license is optional for both public and private uploads. Public files and previews can be accessed or copied by others, including while uploading. Private viewer links require a Hugging Face connection with repository access and do not contain authorization tokens.

The current Google Drive publisher creates a dataset ZIP and, by default, shares it with anyone with the link after upload verification. Choose Private to keep the ZIP private. A viewer link to a private file does not grant access; recipients need provider permission and must authorize that ZIP for ColmapView through Google Picker or Drive's Open with menu unless it is already available to the app.

Spatial Hub links. Where the Hub is enabled (on colmapview.opsiclear.com and colmapview.github.io), every completed upload also sends Spatial Hub, a service OpsiClear LLC runs on Cloudflare: the viewer and dataset link; a title (the Hugging Face repository name, Drive file name or bucket folder name); for Hugging Face uploads, the description and any license you chose; a 600 × 315 JPEG preview prepared in your browser; asset counts and format; whether the data is public; and a random delete key, stored only as a hash. The Hub stores cards until deletion. Public datasets get a short readable link; private or unconfirmed datasets get an unguessable link. Anyone with a Hub link can see the title, description, preview and dataset link, even when the dataset needs permission. Dataset files and provider credentials are not stored in public Hub cards. Request card removal at info@opsiclear.com with the Hub link.

A dataset initially loaded from Google Drive may be uploaded to Hugging Face if you explicitly publish it there. Similarly, files read from Hugging Face or another source may be included in a Drive publication you request. Dataset files go directly from your browser to the selected provider and are subject to that provider's terms and privacy policy. ColmapView does not automatically publish a loaded dataset.

Share on Hub. This separate, optional action submits a loaded public dataset or completed public upload for public discovery. After your confirmation, the Hub stores the dataset and viewer link, supplied title, description, optional license, preview, asset metadata, creation time and ownership hashes. Verified listings appear in the public catalog; other submissions remain pending for operator review until approved or removed. Verification can read bounded anonymous Hugging Face metadata and model headers or an existing curated manifest; other sources require manual review. It does not send provider credentials or copy dataset files into Hub storage. Request removal with the listing link or submission ID.

Cancellation or failure may leave a created repository, committed files, a partial upload, or a completed private Drive file on the provider. Closing a publish dialog does not cancel the job. Provider-side copies must be reviewed and removed through that provider; deleting a viewer link or disconnecting an account does not delete them. Other people's downloads cannot be recalled.

6. Browser storage and connection retention

Loaded datasets, archives, decoded images, thumbnails, camera recordings, and publication progress are kept as working data and caches in the current browser session. In video mode, the viewer can prefetch the next and previous recordings within a bounded three-recording cache. The viewer does not create a persistent IndexedDB database for dataset contents. Browsers and remote hosts may still cache downloaded responses according to their own behavior.

Large archive downloads, cached camera recordings, decompressed gzip TAR contents, and photo-package exports can use temporary browser-managed disk storage on your device. The viewer removes downloaded and decompressed archive files when the archive closes. Recordings outside the current playback window are evicted after their player releases them; closing video mode or its detail, or changing datasets, clears the window. Completed export packages remain for at least 24 hours so a browser download can finish; later archive processing removes expired exports where browser lock support permits safe cleanup. Failed or cancelled exports are removed, and files left by a reload or crash are cleaned during later archive processing. Clearing this site's browser data also removes these files. This storage does not send dataset contents to a ColmapView server.

Where supported, Save ZIP to file asks you to choose a file on your device and writes the export directly there, without a browser-managed copy. The writer replaces an existing file only after the complete package validates and its final save succeeds. Cancelling or failing before that final save preserves an existing file; a newly chosen filename can remain empty. Clearing site data does not remove files saved this way.

The app saves viewer preferences, theme, named configuration profiles, and last-seen version information in local storage so they can survive reloads. A session-storage record of an unfinished automatic URL load may contain the dataset URL; it is normally removed when the attempt finishes and can remain after a tab crash to prevent repeated failing loads. Browser history and bookmarks may also retain viewer or dataset URLs.

Provider access tokens, the Hugging Face username and bucket credentials are kept only in the current tab's memory. ColmapView creates no account-session cookie, server credential record or cross-device user profile. It does not persist credentials in local storage, session storage or an app-managed credential vault.

Earlier connection service. An earlier release on October 19, 2026 offered encrypted saved connections on the custom host for up to 30 days, using a signed session cookie. Its records included provider identifiers, scopes, expiry and access or refresh tokens, explicitly remembered bucket credentials, and temporary sign-in transactions that could contain viewer return URLs. This revision retires that service and removes its stored records as part of deployment. Legacy auth endpoints disable restoration and expire the old cookie when contacted.

Disconnect clears this tab's connection; reloading or closing the tab also ends it. Other open tabs and already issued tokens or signed URLs may remain usable until their own expiry. Disconnect does not revoke the provider grant or erase displayed data, preferences, exports or provider-side publications. Revoke provider access through that provider's account settings when needed.

Data uploaded to Google Drive or Hugging Face stays with that provider under its retention rules until you remove it there. If you contact OpsiClear LLC, we receive the contact details and information you voluntarily send and use them to respond and handle the request. Please send only the information needed; ask us by email to remove information you have supplied.

7. Website hosting and external services

ColmapView is hosted on GitHub Pages and Cloudflare Pages. These hosting and infrastructure services process connection information such as IP address, request time, browser information, and requested website resources to deliver and protect the website. Their handling is described in the GitHub privacy statement and Cloudflare privacy policy.

Spatial Hub runs on Cloudflare Workers and stores share-link metadata and compact JPEG previews in Cloudflare D1. Curated catalog files and thumbnails are static assets. The former R2 bucket has been deleted. A verified database export is retained separately as a migration backup. It stores no provider tokens or bucket keys. Automatic Worker invocation logging is disabled; application logs do not include authorization codes, tokens or bucket secrets. Hosting infrastructure still processes connection information. To slow guessing of Hub links, the Hub counts misses per network using a keyed hash of the IP address (for IPv6, its /64 network), and removes that state at most an hour after the last miss or link creation.

Current ColmapView viewer versions include no analytics scripts, analytics cookies or app account-session cookie; see older versions below. These policy pages load no third-party scripts or fonts. Account controls, sign-in, remote datasets, external links and publication contact the relevant services, which may use their own cookies and process account or connection information. See Google's privacy policy and Hugging Face's privacy policy.

Font downloads. ColmapView's interface downloads IBM Plex Sans and JetBrains Mono from this website's own assets; the Hub and policy pages use the locally hosted IBM Plex Sans. These interface fonts do not use Google Fonts, Adobe Fonts or a font CDN. Font requests expose ordinary connection information to the website host, as other website resources do. Your browser may cache the font files. Their IBM Plex and JetBrains Mono copyright notices and SIL Open Font License 1.1 are distributed with the website. External interfaces you choose to open, such as Google's sign-in and file picker, may load their own resources under their provider's policy.

Opening Share on Hub loads Cloudflare Turnstile to protect public submissions. Cloudflare processes connection and browser information for this check. On submission, the Hub sends the one-use response and client IP to Cloudflare for validation; it does not store the response. Feed request limits use a keyed network hash. See the Cloudflare privacy policy and Turnstile Privacy Addendum.

Older versions on GitHub Pages: most released versions remain available at their own addresses on colmapview.github.io, such as /v0.15.4/, so existing links keep working. Before October 24, 2026, v0.15.4 and earlier loaded Google Analytics (Google tag G-7K5H83SEMY) automatically. Those versions sent page addresses, including dataset URL queries, referrers, browser/device and connection information to Google and set _ga and _ga_7K5H83SEMY cookies. Maintainers could see the resulting reports. The hosted archive pages now remove those analytics scripts and the older Google Fonts links; original release tags are unchanged. Cached pages, downloaded copies and other deployments may still contain the original integrations. Reload to obtain an updated hosted page, use colmapview.github.io/latest/, or block analytics in your browser. Clear this site's data to remove cookies set by an earlier visit. Google's handling of past measurements is described in How Google uses information from partner sites.

The website restricts outgoing referrers to the site's origin so query strings and dataset paths are not sent as referrers. Requests to the dataset provider necessarily include the resource you ask it to retrieve. Tokens are limited to the relevant provider requests, and production Google and Hugging Face API connections use HTTPS. Your device, browser extensions, source hosts, and copies you share also affect the privacy of your data.

Public Hub catalog analytics. With your consent, the hosted catalog browse and scene metadata pages on colmapview.opsiclear.com and colmapview.github.io use Google Analytics (measurement ID G-7K5H83SEMY) to measure visits, sessions, returning visits, engagement and Hub actions so we can improve the catalog. Consent is the basis for this optional processing. Until you select Allow analytics, no Google analytics script or measurement request is loaded. Declining does not restrict the catalog. Analytics settings stays available in the public catalog footer. Withdrawing consent disables measurement, removes this integration's analytics cookies and reloads the page to discard the tag. It does not erase measurements already sent; contact us about applicable deletion or other rights.

The browser stores your choice, its time, the consent revision and which browser privacy signals were present for up to 180 days. Earlier cookieless allowances and allowances limited to the retired catalog path do not authorize the current cookie scope; we ask again. Retired-path analytics cookies are removed. An existing refusal remains respected. Do Not Track and Global Privacy Control keep analytics off by default without opening a consent prompt. You can explicitly allow this Hub's analytics in Analytics settings while a signal is present; that choice applies only to analytics, not advertising or cross-site profiling. A newly detected signal withdraws an earlier allowance that did not cover it. Removing the signal alone does not restore that allowance.

After opt-in, first-party cookies named cvh_ga and cvh_ga_7K5H83SEMY distinguish browsers and sessions. They are restricted to /hub on the Hub host you visit (colmapview.opsiclear.com or colmapview.github.io), expire no later than the 180-day choice and do not renew automatically on visits. Your browser may attach these cookies to other requests under the Hub path, including service and legacy management pages. Those pages do not initialize analytics, and the Hub application does not read or save the cookie identifiers in its records. The consent choice stays in browser local storage, separately for each host. Google receives cookie identifiers, IP address and browser/device information, public catalog page paths and permitted interaction events. These include search use without the search text, filter names, dataset opens with public curated dataset IDs, metadata opens, shuffle, pagination and theme controls. We exclude query strings, URL fragments, full referrer URLs, form text, dataset files, provider credentials and account identifiers. A bounded referral category such as Google, GitHub or Hugging Face may be derived locally to understand traffic sources.

Advertising storage, advertising user-data use and personalization remain denied; Google signals and automatic enhanced measurement remain off. Only the stated analytics is allowed. OpsiClear LLC can view the reports. The consent revision accompanies measurements so the applicable consent interface can be identified. Google Analytics event data is configured for 2 months and user-level data for 14 months, with the user retention period reset by new activity; aggregate reports may remain longer. Consent withdrawal stops future collection without changing those existing retention settings. Share-link, management, API, local-development, viewer and policy pages do not initialize analytics. Google's processing is described in its privacy policy and information about partner sites.

Google LLC is listed as an active participant in the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework as checked on October 25, 2026. Covered transfers rely on the applicable framework; Google's data processing terms describe processing and additional transfer safeguards. Framework status and applicable transfer arrangements require ongoing review.

The external providers described here may process information outside your country, including in the United States. Their linked privacy policies describe their processing locations and transfer safeguards. The ColmapView interface font files themselves require no third-party font service.

8. Your controls and removal options

• End app access: use Disconnect in the account control or Sign out in the publisher to clear this tab's provider connection. Disconnect the bucket separately. Reloading or closing the tab also ends the local session. The retired saved-connection service no longer restores connections.
• Hub analytics: use Analytics settings in the public catalog footer to allow or decline measurement. Declining after an allowance withdraws consent. This does not affect access to the Hub or viewer.
• Revoke provider authorization: remove ColmapView in Google Account connections or Hugging Face connected applications. This is separate from the app's local Disconnect control.
• Clear this browser: use Reset settings on the dataset-loading page to remove saved viewer preferences, or clear this site's data in your browser to remove local and session storage, cookies, and cached responses. To remove the Google Analytics cookies that older versions set, clear the site data for colmapview.github.io. Clear browser history, bookmarks, and downloaded exports separately if needed.
• Remove published copies: change sharing or delete the uploaded file in Google Drive; use your Hugging Face repository's settings to change access or delete the repository. Check for files or repositories left by interrupted publication.
• Delete a Hub link: email info@opsiclear.com with the Hub link to request removal. If you saved a private delete link from an earlier upload, open it and choose Delete permanently. The dataset stays where it is; social networks may keep previews they already fetched.
• Ask for help: email info@opsiclear.com with a privacy or deletion request. We can help with information you sent to us; we do not have a central copy of your locally processed dataset and cannot erase other users' downloads or provider-managed backups.

Depending on applicable law, you may have rights to access, correct, delete, receive a copy of, restrict or object to our processing of personal information, and to complain to a relevant data-protection authority. Contact us to exercise the rights that apply to you. You can withdraw optional analytics consent without affecting the lawfulness of earlier processing.

9. Contact and policy changes

OpsiClear LLC is responsible for this policy. Contact info@opsiclear.com for questions about access, privacy, or data handling. Public GitHub issues are suitable for general bugs, but do not post private files, account details, tokens, or private dataset URLs there.

We update this page when data practices change and show the effective date above. Changes to the use of Google user data will be disclosed and, where required, separately consented to before that new use begins.