Privacy

The short version

You can use the map, browse cities, and read every report without an account and without telling us who you are. An account exists only to save preferences and alert rules. Reports you post are public by design — that's the point of the site.

What's collected

If you never sign up

• An approximate location from your IP address. Our host tells us roughly which city a request came from, and the map opens there. It isn't stored, and it's city-level at best.
• A precise location, only if you tap for it. The browser asks first, and the answer stays in your own browser's storage. It isn't sent to us unless you save it as a home area on your account.
• An anonymous voting id. Confirming or flagging a report sets a cookie holding a random identifier, stored here only as a hash, so one browser can't stack votes on one report. It isn't linked to anything else.
• Rate-limiting data. Posting is throttled using the request's network address. It's used at the moment of the request and not retained as a record of your activity.

If you make an account

• Email address — to identify the account and, later, to send alerts if you turn them on.
• Password — never stored. What's kept is a scrypt hash, which can't be reversed into your password.
• An optional handle, shown on reports you choose to attribute.
• Preferences — a home area (label and coordinates), search radius, and default filters.
• Alert rules and their matches — what you're watching for, and which reports matched. History is kept 7 days on the free plan.
• Sessions — signing in stores a hash of your session token, never the token itself, alongside its expiry.

When you post a report

Everything in a report is public: store, address, city, coordinates, product, stock level, price, notes, and your photo. Please don't put anything in the notes you wouldn't want public.

Photos have their metadata stripped on our server before storage. Phone cameras embed GPS coordinates, timestamps, and device identifiers in image files; those are removed from the copy we keep, so the stored image doesn't carry your home address home with it. The photo itself is then public at an unguessable URL.

Who else sees it

• Our host and database provider process the data to run the site.
• OpenStreetMap serves the map tiles and turns typed addresses into coordinates, which means your IP address and any address you type into the report form reach them.

Nothing here is sold, and nothing is shared with anyone else except where the law requires it.

What's kept in your browser

A cookie remembers which filters you last used — category, product, store type, time window and sort order — so the site opens where you left it. It holds nothing identifying: only choices you made from dropdowns here.

Beyond that and the sign-in and voting cookies described above, this site uses local storage — which never leaves your device — for your theme choice, whether you've dismissed the banners, your last known location, and your cookie choice.

Your choices

• Delete your account. This isn't self-serve yet — ask and we'll remove the account along with its preferences, alert rules, and alert history.
• Reports outlive the account that posted them, since other people have confirmed and relied on them. Ask us and we'll remove a specific report you posted.
• Edit or clear your preferences any time from your account page.
• Location is always opt-in. Declining it costs you distance sorting and nothing else.
• Clearing your browser data removes the voting id, your stored location, and your cookie choice.

Children

This site isn't directed at children under 13, and accounts aren't knowingly created for them.

Changes

If this policy changes in a way that affects what's collected, the date at the top changes with it.

Contact

A contact address for privacy and removal requests is being finalised, and will be published here before alerts or ads go live.