Privacy Policy

The short version

Outflock stores your email address (for sign-in) and the addresses you choose to save. We do not sell your data, serve you ads, or share your information with third parties for marketing. You can delete your account and all associated data at any time from the Saved addresses page.

What we collect

Account data: When you sign in, we store your email address in our database (Supabase). This is the only piece of information that identifies you.

Saved searches: When you click Save on a result, we store the address text, latitude, longitude, formatted address, camera count, and search radius. We only store what you explicitly choose to save. We do not log every address you search.

Session cookies: We use a secure, HTTP-only cookie to keep you signed in across visits. It contains a session token, not any personal information.

Share events: When you click the Share button on a score, we record the approximate geographic area of the scored address (rounded to a 35-mile grid cell) and a timestamp. We do not record who you are, your IP address, or the exact address. This data is used to understand where interest in surveillance transparency is growing.

Rate limit fingerprints: To prevent abuse of our API endpoints, we count requests per anonymized fingerprint. Your IP address is combined with a server-side secret that rotates every day and a short label for the endpoint, then hashed. Only the hash and a counter are stored. Your IP address is never stored, the hash cannot be correlated across days, and counters expire automatically.

Geocode cache: To avoid re-querying our geocoding provider for the same address, we keep a lookup table mapping an address to its coordinates. It is not a search history: there is no link to you, no IP, and no record of who searched or how often. One entry exists per unique address regardless of how many people look it up.

Server logs: Our hosting provider (Vercel) logs standard HTTP request data including IP addresses and request paths. These logs are retained per Vercel's own policy and are not used by us for tracking.

What we don't collect

We do not use tracking pixels, fingerprinting, or advertising profiles. We do not collect payment information. Aggregate share event data (described above) is the only usage data we retain, and it cannot be tied to an individual.

Third-party services

Running Outflock requires sending some data to third-party services. This is worth knowing, particularly for a privacy tool:

• Geocodio: Addresses you search are sent to Geocodio to convert them to coordinates. Geocodio's privacy policy governs how they handle this data.
• Supabase: Your account and saved searches are stored in a Supabase database hosted in the United States. Supabase is SOC 2 compliant.
• Vercel: Our web application is hosted on Vercel. Vercel processes HTTP requests and may log IP addresses.
• MapTiler: Map tiles are served by MapTiler. Your IP address is sent to MapTiler's servers when the map loads.
• OpenStreetMap / Overpass API: ALPR camera data is queried from the OpenStreetMap Overpass API in real time. Queries include a bounding box around the searched address.

Data retention

Your account data and saved searches are retained until you delete your account. Deleting your account permanently removes your email address and all saved searches from our database. This cannot be undone.

Your rights

You can delete your account and all associated data at any time from the Saved addresses page. If you have questions or requests that the app can't handle, email hello@outflock.io.

Changes to this policy

If we make material changes we'll update the date at the top of this page. We won't retroactively change how we handle data already collected.