Privacy Policy
Last updated: May 2026
What we collect
LocalMatal is designed to collect as little data as possible.
- Photos — uploaded images are processed server-side before storage. EXIF metadata (including GPS coordinates embedded in the file) is stripped before the image is saved.
- Location — when you submit a place, you provide approximate coordinates. We store a fuzzed version (offset by at least 100 metres in a random direction). Your precise location is never written to our database.
- IP address — your IP is hashed (SHA-256 with a rotating daily salt) for rate-limiting purposes. The raw IP is never stored. The hash cannot be reversed to identify you.
- Submission text — place name, contributor name, and your description are stored as submitted after moderation approval.
What we do not collect
- No accounts or sign-ups. No passwords.
- No tracking cookies. No advertising identifiers.
- No email addresses (unless you contact us directly).
- No analytics beyond aggregate Cloudflare Web Analytics, which is cookieless and privacy-preserving.
Image handling
Photos are stored on Cloudflare R2 object storage. EXIF metadata — including any embedded GPS, camera model, or timestamp data — is stripped server-side before storage. Uploaded originals are not retained after processing.
Content moderation
Submitted photos are automatically scanned for faces and explicit content using Cloudflare Workers AI. Submissions that pass automated checks are reviewed by the site maintainer before publication. Rejected submissions and their associated images are permanently deleted.
Right to be forgotten
If you would like a published submission removed, email hello@localmatal.com with the URL of the place entry. We will tombstone the entry within 14 days, removing photo, name, and description from public display while preserving chain topology.
Third-party services
- Cloudflare — infrastructure provider (Pages, Workers, D1, R2, KV, Workers AI). Subject to Cloudflare's privacy policy.
- Resend — used for internal maintainer notifications only. No contributor emails are sent via Resend.
- OpenStreetMap — map tiles are loaded directly from OpenStreetMap tile servers when the map component is displayed. Subject to OSMF's privacy policy.
- Cloudflare Turnstile — used for bot protection on the submission form. Cookieless challenge. Subject to Cloudflare's privacy policy.
Contact
Questions or takedown requests: hello@localmatal.com