Privacy

• Account email and display name; optional country focus and language preference.
• For location managers and service providers: the business contact details and optional bio you enter. For authority claims: the official email you provide.
• Forum threads and replies; corrections and suggested authorities; location photos you upload for your listings.
• OnLoc records you create: projects, permit applications, location notes, document packs, holds, recce reports (including photos and audio), shortlists and viewer feedback.
• If you add your own AI key: the key is stored encrypted and never shown back in full; we keep a usage log without prompt or response content.
• Page-view events keyed by a hash that rotates every UTC day. The IP address is used only to build that hash and is not stored.

• Supabase — database, file storage and sign-in email delivery. Region: AWS eu-west-1 (Ireland).
• Netlify — application hosting.
• Cloudflare Turnstile — bot checks on public forms.
• OpenStreetMap tiles and Nominatim — map tiles and city-level geocoding only; we do not send street addresses to Nominatim.
• AI providers you choose — only when you add your own key, and only for the feature you run.
• We do not use advertising or third-party analytics trackers.

We only use strictly necessary and functional cookies and checks — never for tracking:

• Supabase session cookies — keep you signed in.
• NEXT_LOCALE — stores the language preference you save on Your account (functional; sameSite=lax; lasts one year).
• Cloudflare Turnstile — a browser check on public forms to block bots; it is not used for advertising or analytics tracking.

OnLoc records are private by default. Staff cannot read private OnLoc rows (enforced in the database). Sharing is opt-in per record and feeds anonymous aggregates once a minimum sample exists. Contact names, contact notes and private notes are never shared at any share level.

Exact addresses are never shown on public location pages. Map pins use approximate public coordinates, not the property.

You can correct your display name and preferences on Your account.

You can download a JSON copy of your records (profile, OnLoc data, posts, listings and signed file links valid for 24 hours) from Your account. Downloads are limited to once every ten minutes.

You can delete your account from Your account by typing your email. Private records and uploaded files are removed; public posts you wrote stay on the site without your name. The last remaining admin account cannot be deleted.

Open Your account

Privacy requests: contact details will be published here once our email service is live. These pages are governed by the laws of England and Wales. You must be at least 16 to create an account.