Privacy Policy

Information we collect

• Account information: email address, display name, password hash, verification state, preferences, and security settings.
• Contributions: observations, ratings, review or tip text, photos, submissions, reports, and the associated private account or guest identifier.
• Security and operations: session and trusted-device records, hashed tokens, shortened keyed hashes derived from network signals, timestamps, rate-limit events, moderation history, and scrubbed error diagnostics.
• Local browser information: signed-out saved places, display preferences, and activity filters. Activity age filtering is performed locally; exact age is not sent to or stored by our server.

How we use information

• Provide accounts, maps, discovery, saved places, contributions, moderation, and support.
• Authenticate users, prevent abuse, enforce limits, investigate incidents, and protect the service.
• Operate and improve the service using aggregate cookieless analytics and scrubbed diagnostics when configured.
• Comply with law, respond to valid requests, and establish or defend legal claims.

Legal bases and consent

Where applicable, we process information to provide the requested service, for legitimate operational and security purposes, to comply with law, and with consent when required. You may withdraw consent for future processing where consent is the basis.

Cookies and local storage

We use essential cookies for sign-in, security, locale, and control of guest contributions. Trusted-device use is optional. Signed-out saved places and preferences use browser storage. Plausible is configured without cookies or cross-site advertising tracking. We will obtain legally required consent before adding non-essential tracking.

Service providers and international processing

Providers may include Vercel for hosting and firewall services, Supabase for PostgreSQL, Cloudflare R2 for images, Mapbox for maps and requested geocoding, transactional email providers, Plausible for aggregate analytics, and Sentry for scrubbed diagnostics. Information may be processed in Canada, the United States, and other locations where providers operate. We use appropriate contractual and technical safeguards.

Public content and third-party data

Approved contributions may be public and associated with a display name. Ratings can be public immediately while free text and photos await moderation. Place data generally describes locations rather than your account, but we treat it as personal information where applicable. We do not sell personal information and do not share it for cross-context behavioural advertising.

Retention

Account information is kept while an account is active and then deleted or de-identified, subject to backups, security, disputes, and law. Guest sessions expire after one year; sign-in challenges after ten minutes; trusted-device records after 30 days; administrator verification after 12 hours; and transactional-email audit events after 90 days. Cleanup jobs remove expired records. Copyright and moderation records may be retained to document decisions and compliance.

Your rights

Depending on where you live, you may request access, correction, portability, deletion, withdrawal of consent, or information about processing and cross-border providers. Email showmethirdplaces@halfwoods.com with the subject “Privacy request,” preferably from your account email. We may verify identity proportionately and will respond within applicable legal periods. You may complain to your privacy regulator.

Security

Safeguards include HTTPS, hashed passwords and tokens, encrypted administrator MFA secrets, session revocation, atomic rate limits, firewall controls, restricted photo quarantine, content moderation, backups, dependency scanning, and scrubbed monitoring. No system is perfectly secure.

Children

The service is not directed to children under 14. We do not ask for birth dates or proof of age and do not knowingly create child profiles. A parent or legal guardian may contribute using their own account or browser identity. Contact us if you believe a child supplied personal information.

Privacy officer, changes, and contact

The Privacy Officer for 17988117 CANADA CORP. can be reached at showmethirdplaces@halfwoods.com. Material changes will use a new version and additional notice or consent where required.