Privacy Policy

Last updated: June 14, 2026

What we collect

Accounts contain an email address, username, password hash or Google account identifier, saved preferences, and the contributions you choose to make. Basic server logs may include IP addresses, request paths, browser details, and timestamps for security and reliability.

Photos and location

Uploaded photos are screened for people before storage. GPS metadata may be read to suggest a listing location, but all metadata is stripped when the image is re-encoded. The resulting coordinates are stored with the listing, not inside the published image.

How information is used

We use account data to authenticate you, operate moderation and trust features, personalize results, prevent abuse, and deliver password-reset messages. We do not sell personal data.

Retention and control

Unattached uploads are removed after 24 hours. Password-reset tokens expire after one hour. From account settings you can export your data or delete your account. Deletion removes reviews and saved spots and anonymizes account credentials. Listings and photos may remain as community records without your email or former public identity.

Service providers

Production deployments may use Vercel for the website, Railway for the API and database, Cloudflare R2 or compatible object storage for photos, Resend for email, Google for optional sign-in, and an error-monitoring provider. Each provider processes only the data needed for its role.

Contact and changes

Privacy requests can be sent through the project maintainers. Material changes will update the date above. See the Terms of Service for service rules.