Rumbleback is a static page. It has no server, no account and no database. The only data that leaves your browser are requests to USGS (earthquake data), OpenFreeMap (map tiles) and GitHub Pages (this site). Your pin is kept in your browser's local storage and is never sent anywhere. docs/PRIVACY.md lists every request.

If you find a way to make the page run someone else's script, read local data it should not, or send a pin off the device, please report it privately through GitHub's "Report a vulnerability" on the Security tab instead of a public issue. Expect a first answer within a week.