Privacy Policy

What we collect and store

• Community reports. If you submit a report we store what you enter — category, description, and the latitude/longitude you placed on the map — plus a hashed version of your IP address used only for rate limiting and abuse prevention. We do not store your raw IP with the report, and we do not ask for a name or email.
• Geocode query cache. Place names extracted from news headlines are sent to a geocoding service (see below) and the resulting coordinates are cached server-side indefinitely — coordinates don't change. These cached queries may incidentally contain street or landmark names from article text, not data about you.
• Standard server logs. Our hosting provider keeps routine request logs (IP, user agent, path) for security and operations, retained per the provider's defaults.

What stays on your device

Saved areas, dashboard preferences and UI state are stored in your browser's localStorage and are never sent to our servers unless you explicitly create a shareable dashboard link. Clearing your browser storage deletes them.

No accounts (yet)

CityAlert currently has no sign-up, no email collection, and no advertising trackers. When saved-area alerts and accounts ship, they will necessarily involve more personal information — including email addresses and the home addresses or locations you ask us to watch, which are sensitive. This policy will be updated and highlighted before any such collection begins, and consent will be collected at sign-up in line with PIPEDA and CASL.

Third-party processors

• Nominatim / OpenStreetMap — text you type into place search, and place names extracted from headlines, are sent to nominatim.openstreetmap.org to resolve coordinates. OSMF's own policies apply to that service.
• Railway — application hosting, located in the US West region. Data we store (reports, caches) is processed in the United States; this is permitted under PIPEDA but means it may be subject to US legal process.
• Public feed providers — we fetch public RSS/API data from the sources listed on Sources; those requests contain no personal information about you.

Your rights — access, correction, deletion

Under PIPEDA you may request access to personal information we hold about you, ask for corrections, or ask for deletion (for example, a community report you submitted or one that concerns you). Email [email protected] with the subject "Privacy request". We respond within 30 days. If you are unsatisfied you may complain to the Office of the Privacy Commissioner of Canada.

Retention & security

Community reports are kept while they're relevant to the map's historical record; geocode cache entries are kept indefinitely (they contain coordinates, not personal data). We apply reasonable technical measures — hashed rate-limit identifiers, access-controlled hosting — appropriate to the low sensitivity of what we currently store.

Changes & contact

We will update this policy before shipping any feature that collects new personal information (accounts, watch zones, alert delivery). Material changes will be noted on this page with a new "last updated" date. Questions or requests: [email protected] · Contact page.