V1 collects only what is needed to run the map, sync your saves and review corrections.

You can browse without an account. Hereabouts does not run advertising profiles or sell personal information.

When you browse

Cloudflare, Supabase and the map tile providers receive ordinary technical request data needed to deliver the service. Cloudflare Turnstile processes technical challenge data when you request an email sign-in link so Hereabouts can limit automated abuse. Browser location is requested only when you press “Location”; it is used in your browser to sort activities and is not submitted with a correction report.

When you sign in or save

You can request a one-time email sign-in link or use Google. Google provides your email address and basic profile to Supabase when you choose Google sign-in. Hereabouts stores your Supabase user ID, each saved activity slug and the time it was saved. Saved activities are protected by row-level security so the public and other users cannot read them. Save, Calendar and Share require sign-in; browsing, searching, filtering, official links and directions do not.

When you report a correction

We store the activity, report category, your explanation, an optional evidence link and an optional contact email. Cloudflare supplies the connection address to the correction intake so it can enforce a basic abuse limit. Supabase retains only a salted one-way fingerprint for that purpose; the report does not store your raw IP address, user agent or request headers.

Access and deletion

Correction records are private to authorised reviewers. You can remove individual saves from the activity page, sign out, or permanently delete your sign-in account from the account menu. Account deletion also removes your saved activities. To remove a correction report that included your email, use the contact route and provide enough information to identify the record.