The Floo Directory stores the account you create, the profile you fill in, the listings you save or mark as visited, the reviews you leave, and any feedback you send us. We also measure how visitors use the site, so we can see where it’s confusing and fix it. We don’t show ads on the site, and we don’t sell your data. One thing is worth knowing up front, and is explained below: profile photos are publicly readable.

The Floo Directory (“we”, “us”) is operated by Opheim Consulting, based in the United States. Opheim Consulting is responsible for the personal information described in this policy. You can reach us at peter.opheim@opheimconsulting.com.

Account details. When you sign up with an email address we store that address and a securely hashed password. We never see or store your password in readable form. Authentication is handled by Supabase, which acts as our data processor.

If you sign in with Google. Google shares your name, email address, and profile photo address with us, and confirms that you own that Google account. We use them to create your account and pre-fill your profile, and you can change your display name or photo afterwards. We don’t receive your Google password, contacts, or any other data from your Google account. Google’s handling of your sign-in is covered by the Google Privacy Policy.

Profile information. Anything you choose to enter on your profile: display name, bio, location, Hogwarts house, and a profile photo. All of these are optional except a display name, and you can edit or clear them at any time.

Your activity. Which listings you save and which you mark as visited, each with the time it happened, plus any star rating and review text you leave on a listing. Your reviews are private to your account and appear only on your own profile.

How you use the site. We use PostHog, a product analytics service, to record what happens on our pages: which pages you open, what you click, which listings you open or save, and whether you sign up. This includes session recordings, which replay how a page responded to your clicks and scrolling. Anything you type into a form, such as a city, email address, or password, is masked and never recorded, and neither is the location you choose on the map. PostHog works out your approximate city from your IP address and then discards the address. Before you sign in, this activity is tied only to a random identifier in your browser. When you sign in, we link it to your account so we can understand how people come to sign up.

How you found us. If you arrive from an ad or a link that carries campaign tags, we note which campaign, ad, and site sent you, the first page you saw, and whether you were in an app’s built-in browser. If you go on to create an account, we store this with it, so we can tell which ads and links bring people who find the site useful.

Site speed. Vercel Speed Insights measures how quickly pages load for visitors. It records anonymous timing figures and doesn’t use cookies or identify you.

Feedback. If you send us an idea or feedback from your profile settings, we store the message, the time you sent it, and which account sent it.

Approximate location. If you press “Use my location”, your browser asks your permission first. On the map, your coordinates stay in your browser and are used to sort nearby places. On the welcome page, the place you choose, rounded to about a kilometre, is sent to our server so it can open the map around it. If you type a city or ZIP code, it is looked up with Photon, run by Komoot, a place-search service. We don’t store your location. Dismissing the browser prompt leaves the rest of the site fully usable. When you don’t share your location, our hosting provider tells us your approximate city from your IP address, and we use it only to show places near you.

Technical information. Like any website, the servers that deliver The Floo Directory receive your IP address, browser type, and the pages you request. Our hosting and database providers keep this in short-lived logs to run and secure the service. We don’t use it to build a profile of you.

We use a small number of cookies and browser storage entries, all of are needed for the site to work, remember a choice you made, or measure how the site is used. We don’t use advertising cookies.

• Sign-in cookies keep you signed in between pages and visits. They are removed when you sign out.
• Your preferences— light or dark theme, miles or kilometres, and map style — are kept in your browser’s local storage.
• Saved and visited places are also kept in local storage while you are signed out, so they work without an account.
• Analytics— PostHog keeps a random identifier in a cookie and in local storage, so it can tell one visit from the next. It’s set on our own domain and lasts about a year.
• How you found us— a cookie holding the campaign tags described above. It lasts 90 days.
• Welcome page— a cookie that lasts until you close your browser. It stops us from showing you the welcome page again during the same visit.

Apart from the analytics identifier, nothing in local storage is sent to our servers or used to identify you. Clearing your browser’s site data removes all of it.

Profile photos are public. Avatars are stored in a publicly readable bucket, which means anyone with the image’s direct address can view it, whether or not they have an account. Only you can upload, replace, or remove your own photo. Please don’t upload anything you would not want to be public.

To sign you in, to show you your own saved and visited places and reviews, to display your profile, to read and act on feedback you send, to respond when you contact us, and to keep the service running and secure. We use analytics to find where the site is confusing or slow, to improve it, and to measure which of our own ads and links bring people to it. We don’t use your information to target ads at you, and we don’t sell or rent it.

We use a few service providers to run The Floo Directory. They process information on our behalf and only as needed to provide their service:

• Supabase hosts our database, authentication, and file storage, and sends account emails such as sign-up confirmation and password reset.
• Vercel hosts the website and serves its pages, and measures page speed (Speed Insights).
• PostHog provides our product analytics and session recordings, described above, and stores them in the United States.
• Komoot (Photon) looks up the city or ZIP code you type on the welcome page.
• Googleprovides “Continue with Google” sign-in, if you choose to use it.

Some content is loaded straight from other servers, which therefore see your IP address when your browser fetches it: map tiles come from CARTO, and some listing photos are loaded from the venue’s or a third party’s own site.

We otherwise share personal information only when you ask us to, when it is needed to protect the rights, safety, or property of our users or others, where we are legally required to (for example, in response to a valid court order), or as part of a transfer of the service to a new owner, who would remain bound by this policy.

Listing pages may link out to third-party sites such as official venue pages or booking services. Those sites have their own privacy policies, and this one does not cover them.

You can edit or clear your profile details, including your photo, at any time from Edit Profile. You can remove any saved listing, visited mark, or review. Location access can be revoked in your browser’s settings.

Deleting your account. You can delete your account yourself from your profile’s account settings. This immediately and permanently removes your account, profile, photo, saved and visited places, and reviews. If you can’t sign in, email us from the address on the account and we’ll delete it for you.

Getting a copy of your data, or correcting it. Email us at peter.opheim@opheimconsulting.com. We may need to confirm that the request comes from the account’s owner, and we aim to respond within 30 days.

Depending on where you live, including California and several other US states, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, and to have it deleted. We honour these requests for everyone, wherever they live, using the options above. We will not treat you differently for exercising them.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Because we don’t track you across other sites, there is nothing for a browser’s “Do Not Track” or Global Privacy Control signal to turn off.

You can make a request yourself or through an authorised agent. If we decline a request, you can ask us to reconsider by replying to our response.

Your account and its associated profile, saved listings, visited marks, and reviews are kept for as long as your account exists. Deleting your account removes them, including your uploaded photo.

Feedback messages are kept so we can act on them. When you delete your account, any feedback you sent stays but is no longer linked to you. Server logs held by our providers are kept only for a short period, under their own retention schedules.

Analytics events and session recordings are kept by PostHog under its retention limits for our plan. Deleting your account doesn’t remove them automatically. Email us and we’ll delete the analytics linked to your account.

Connections to the site are encrypted, passwords are stored only as secure hashes, and database rules ensure each account can read only its own saved places, visited marks, and reviews. No service can be perfectly secure, but if we learn of a breach that affects your information we will tell you as the law requires.

The Floo Directory is run from the United States, and your information is stored and processed there by us and our service providers. If you use the service from outside the United States, your information will be transferred to the United States, where data protection laws may differ from those in your country.

The Floo Directory is not intended for children. You must be at least 16 years old to create an account, and we don’t knowingly collect information from anyone younger. If you believe a child has given us their information, contact us and we’ll remove it.

If this policy changes, we’ll update the date at the top of this page. If a change meaningfully affects how we use your information, we’ll also let you know in the app, and by email where we hold an address for you, before it takes effect.

Questions about this policy or your information can be sent to Opheim Consulting at peter.opheim@opheimconsulting.com.