Draft 0.2 · 27 September 2026
This page is written in English. The Spanish, French and German versions are translations; until our lawyer has reviewed them, the English text is the one that counts.
This page covers the map, the account pages our server shows you, and the e-mails we send. It says what we collect, what we keep, what we show, and how to have it deleted. Every fact on it is taken from the code that does it.
This site is run by its founder, who decides what happens to the data on this page.
Write to us about anything on this page. A person reads every message.
Every request to this site passes through Cloudflare, our host and network. Like any web server, it sees your IP address and what your browser says about itself.
If a request fails on our side, our server writes the error to a log — not your IP address, not the web address you asked for, not your cookies. We keep that log for 30 days.
To suggest your city, we read Cloudflare's guess of where your connection is. We use it for that answer and don't store it.
The site also sends us small usage events. They say:
They carry no cookie and no identifier. But we keep each one with the network data of section 4 — among it the first part of your IP address — and delete them within about 90 days. So for up to 90 days we hold, for each network, a trail of what was opened and answered from it.
When a post or a picture has been on your screen for a second, the site tells us which one, and we count it — once in 30 days for each network address and browser. That is not kept with your network data: to tell repeats apart we keep only a one-way code made with a secret key, for at most 31 days. The count itself says nothing about you. Only the person who posted ever sees it, and only once we turn counts on for their city.
When your yes counts, it also lights that activity's public line “someone saw this”, which for a while shows how long ago it was last seen. It never shows who answered.
On your device the site keeps: a random number, so one phone isn't counted as many (until you clear the site's data); today's answers, for 48 hours; and a few settings, like whether location worked. The random number travels with your answers; we store only a one-way code of it, kept with the answer.
Why we may do this: our legitimate interest in running a fast, honest site. For the city guess: our legitimate interest in showing you your city first.
When you answer, post, grab a seat at an offer, ask for a city, report something, rate an offer or link a business — and with the usage events — we keep:
After 90 days we delete the address parts and the browser code. The country stays.
Why: our legitimate interest in keeping the map honest — to spot and undo floods and fake answers.
We ask for your location only when you tap something that needs it, and your phone asks you first. If you said yes before, the map uses your location on your phone — to show what's near and to ask about the spot you're standing in. That alone sends nothing to us.
Your location reaches us, with the time, when you answer whether something is happening, say it is still there, or grab a seat at an offer. If you hold a seat, also when you post or send a picture of the day (section 7). Your phone sends the reading it has, with how precise it was. Only the answer buttons on a place's own page refuse to send a reading less precise than 500 m; everywhere else the reading goes as it is, however blurry.
We use it to check you are really there: inside the place's area plus 75 m, and up to 50 m more when the reading is blurry — never more, however blurry. An answer from farther away is kept, with its point, but not counted. A still-there, a grab, a post or a picture of the day from farther away is refused, and its point is not kept.
What we keep:
We never publish the point of an answer or a grab, and we never sell your location. Our e-mails never give your position; one kind names a place where you answered (section 12).
Tapping the map to drop a pin for a new spot sends that pin — never your location — to find the name of the street or square. We keep nothing of it but a counter of requests from your network, for two days, to stop floods.
Why: your consent — you allow location on your phone, and you tap to send it.
Sign-in is only through Google. We ask Google for your e-mail address and nothing more. Google sends us its number for your account, your address, and whether Google has verified it. We only accept an address Google has verified.
We keep your address, Google's number, when you linked them, and when your address was verified. Nothing else from Google, and no Google password or token. If you change your address at Google, we keep the old one until you tell us.
Your account also holds your handle, if you set one, and whether you want the weekly e-mail.
The cookies:
sid, goa, moa and mpick go only to our server's own address (api.habitsofthecity.com). hc_role belongs to our whole domain, so your browser also sends it when it loads our pictures; only the map reads it.
Signing out ends the session on our side and clears both cookies.
If your address already belongs to an older account that didn't use Google, sign-in is refused. Write to [email protected] and we will sort it out by hand.
Why: to give you the service you signed in for (a contract).
A seat lets you map a city for us. We keep your e-mail address with the city of your seat. If we withdraw a seat, we e-mail you the reason.
What a post makes public: the activity, your words, the place and its neighbourhood, and your pictures with their credit. Your current handle, the half hour you posted and the place's point rounded to about 11 m are public too — in the map's live data, on the place's card and in the Live feed — for at least a day, and then until the site is next rebuilt. That can take up to about a week in a quiet city: we rebuild at night once a city has five new posts, or once the last rebuild is a week old. After that the post no longer carries your handle or the half hour; your handle stays only as the credit on your pictures.
A new spot you create is a small circle around your pin. Everything we publish shows its centre rounded to about 11 m.
The map may also draw your pin as a small dot on the place's line, rounded to about 11 m, for as long as the activity is on the map. Your pin starts where your phone says you are standing. If you don't want the dot to show where you stood, move the pin before you send.
Posting sends your pin and your phone's reading. We use the reading once, to check you are within 135 m of your pin (a little more when the reading is blurry), then drop it and keep only how precise it was. We keep the pin on our server to about a metre and publish it only rounded to about 11 m — and unless you moved it, your pin is your phone's reading.
A picture of the day is sent with your location. We keep that point for 12 months, like an answer's.
Once sent, a post stays on the map: there is no delete button. Write to [email protected] to have one taken down.
Each Monday, once we turn counts on for your city, we may e-mail you roughly how many people saw your posts that week — a rough number and a city, never a date or a place. Switch it off in You → Settings. How many people saw your posts is shown to you alone.
People in your pictures: we rely on the vetting that comes with a seat; on taking no pictures at all of children playing, of swimming or of sunbathing; on the promise you tick when you post; and on hiding a picture of the day as soon as someone reports it.
When you upload a picture we strip its hidden data — place, camera, time — and never keep the original file. We keep resized copies and two fingerprints. The fingerprints stop the same picture being posted again; we keep them even after the picture is removed.
A lasting picture of a place. When you post one, you tick this promise:
I took this picture, it shows the place, no identifiable person or child is its subject, and it may be shown here under CC BY 4.0, irrevocably — credited to my handle if I have set one on my account, otherwise to “a visitor”.
A picture of the day. When you post one, you tick this:
Shown on the map for about a day, then removed; it may appear, credited to you, in visitors' recaps and share images, and shared copies persist.
Its files are deleted 7 days after its day ends, unless a report about it is still open.
Pictures are served from a public address on Cloudflare R2, at photos.habitsofthecity.com. Anyone can open or save a picture while it is shown. After removal, copies can linger in browser and network caches for up to a year.
A place shows at most ten pictures. When an eleventh arrives, the oldest leaves the place, but its files and its address stay.
The credit is your handle, if you set one; otherwise “a visitor”. The handle's own words, in You → Settings:
Shown as the credit under pictures you post from now on — as @handle, linking to instagram.com/handle. It is a claim you type here, not a verified account. Pictures already published keep the credit they were granted.
Stop crediting me (You → Settings) turns every credit of yours into “a visitor”, on published pictures too.
The first report on a picture of the day hides it at once; the first on a post less than a day old takes it off the Live feed. Either way, we then decide.
Signed in, the You tab shows your days, read from your own answers over the last 90 days.
Signed out, today's answers stay on your phone for 48 hours. When you sign in on that phone, its yeses are attached to your account — the phone proves they are its own with its random number and the answers' codes. We keep that link as long as the answer.
The share image is made on your phone. It carries no time, and it leaves your phone only when you share it.
A grab — a seat you claim at a business's offer — keeps your account, your location at that moment (section 5) and the seat's code. The business sees its offer, never who you are.
Businesses sign in through Google Business Profile. Google shows us your business accounts and locations: names, titles, addresses and whether they are verified. We keep the location you choose — its id and title, the id of the business account it belongs to, and when Google confirmed it is verified — and your e-mail address as the contact. We don't keep the addresses or Google's access token, and we never change your listing.
If you tell us whether an offer was as promised, we keep your yes or no with your grab, and so with your account. An answer given on the map also keeps the network data of section 4.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Asking for a city keeps your account and the name you typed, and we e-mail you when that city is on the map.
A report is anonymous. We keep its words and the network data of section 4 — even when you are signed in, we don't store your account with it.
Our e-mails are plain text: no images, no tracking pixels, no tracked links. We send them only about things you did or asked for: what became of something you posted or offered; when a city you asked for is on the map; when we withdraw a seat or take something of yours down, and why; if you hold a seat, the weekly e-mail; and, now and then, a question about a place where you answered.
The question about a place. If you were signed in when you answered or posted at or near a place in the last three months, we may e-mail you to ask whether what others report there matches what you saw. The e-mail names the place (or, for a spot not yet on the map, the city) and says why you got it; it never says where you stood. We ask at most once a week and stop after two asks you leave unanswered; your yes or no is kept with your account. It has no switch or unsubscribe link yet.
They go out through Resend, with data kept in the EU (Ireland). Reply to any of them and a person reads it.
We keep a copy of each e-mail about something you sent us — your address and the words we sent — for 12 months after it is delivered.
The weekly e-mail can be switched off in You → Settings. It has no one-click unsubscribe link yet.
The words we send to a language model. To draft the Spanish, French and German text of a post, and a caption for sharing it, we send Anthropic's model the post's words, the place, the city and the handle of the person who posted. Never an e-mail address or a location. We run it from our own computer, through our Claude subscription.
Our review desk. Only we can open it, behind Cloudflare's sign-in. It shows a post's words, pictures and place, the e-mail address of the person who sent it, and the country and network part of section 4. The addresses of seat holders are listed there with their cities. Every action on the desk is written to a log that cannot be edited.
Outside the EU: Cloudflare, Google, Resend and Anthropic are US companies. We rely on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
You can ask to see, correct or delete what we hold about you, to limit or object to how we use it, and to take a copy with you. Write to [email protected].
You can also complain to the Spanish Data Protection Agency (AEPD), aepd.es.
This site is not for anyone under 16. If you are younger, don't sign in or post.
When we change this page, we change the date at the top. If a change matters, we say so on the map and e-mail everyone with an account before it applies.
Sign in to post — so we can let you know what your posts turned into.