Privacy policy
The short version: we collect what the site needs to work, we don't sell it, we don't run advertising or analytics trackers, and you can download or delete everything at any time.
What we collect
When you create an account
- Username and email address. The email confirms you are real, and is how we send password resets.
- A password hash, never the password itself. If you sign in with Google we store no password at all.
- Optional profile details you choose to add: display name, bio, location and a photo.
When you sign in with Google
Google tells us your email address, name and a stable account identifier. We store those. We never see your Google password, and we ask Google for nothing beyond your basic profile.
What you post
Scores, written reviews, photos, places you add, who you follow, and reviews you mark helpful. All of this is public and shown next to your username. Treat anything you post here as published.
Technical information
- Your IP address is used to count requests so one person cannot flood the site. Those counters expire within the hour and are not linked to your account.
- Server logs record account events such as sign-ups, confirmations and password resets, along with the username involved.
- Photo metadata is removed. Every uploaded image is re-encoded, which strips EXIF data including any GPS coordinates your camera recorded. We never see where the photo was taken.
Cookies
We use two cookies, both strictly necessary:
- Session cookie — keeps you signed in and protects forms against cross-site request forgery.
- "Keep me signed in" — only set if you tick that box.
Your light or dark mode preference is kept in your browser's local storage and never sent to us.
We run no advertising and no analytics trackers, so there is nothing here to consent to and no cookie banner. If that ever changes, this page changes first and you will be asked.
Who else sees your data
We don't sell or rent your data. It reaches these services only because the site needs them to work:
| Service | What it receives | When |
|---|---|---|
| Cloudflare | Your IP address and request details | Every visit — it sits in front of the site |
| OpenStreetMap | Your IP address, and the map area you are looking at | Only on pages showing a map |
| Nominatim (OpenStreetMap) | The address you type | Only when you search for an address while adding a place |
| jsDelivr and unpkg | Your IP address | Every visit — they serve our styling and map code |
| Handled entirely by Google | Only if you use "Continue with Google" | |
| Our email provider | Your email address and the message | Confirmations and password resets |
We may also disclose data where the law requires it, or to protect the site and its users from abuse.
How long we keep it
- Your account and posts — until you delete them.
- Rate-limit counters — an hour at most.
- Server logs — rotated regularly, kept weeks not years.
- Deleted content — removed immediately, including photo files. Backups may hold a copy for a short period before they rotate out.
Places you added stay on the map after you delete your account, because they belong to everyone using the site. Your name comes off them.
Your rights
Wherever you live, you can do all of this yourself, immediately:
- See it — your profile shows everything you have posted.
- Correct it — edit your profile and any review, any time.
- Take it with you — download a copy from your settings page as a JSON file.
- Delete it — settings has a delete button that removes your account, reviews, photos and follows.
If you are in the UK, EU, or a US state with its own privacy law, those laws also give you the right to object to processing, to complain to your data protection authority, and to ask us to act on your behalf. Email [email protected] and we will respond within 30 days. We do not sell personal information, so there is nothing to opt out of.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored or logged in the clear. Uploaded files are re-encoded before they are stored, so a malicious file cannot survive the trip. No system is perfect, and we will tell you promptly if something happens that affects your data.
Children
This site is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
Changes
If this policy changes we will update the date at the top, and tell you directly if the change is significant.
Contact
Privacy questions: [email protected], or use the contact form.