Privacy

We count visits three ways. Cloudflare's traffic analytics runs on the server that sends the pages. That server also keeps its own tally of what it answers. And each page you open sends one small message to CiteMET, the site analytics service Mahmoud co-founded, so we can see which pages people use.

That message holds the page's address without your search words or any place you typed; the only extra it keeps is a campaign tag (such as utm_source) saying which shared link brought you. The first page you open also says which site linked you here. CiteMET adds your browser's standard details and your approximate location (about the city) from Cloudflare. It does not keep your IP address, and it sets no cookie.

If your browser sends Do Not Track or Global Privacy Control, no message is sent at all.

The server's tally counts requests by day: the kind of page or file, whether it was answered, and the kind of program that asked. A program is named only when it is a known search engine, AI service or tool, such as Googlebot or GPTBot; a person's browser is just "browser", and its page addresses are not kept. For automated programs the tally also keeps which pages they read. For the MCP server it keeps the tool called, any ids or codes it was given (a service id, a province), the length of any words it was given but never the words, and the country. It keeps no IP address and sets no cookie. Daily counts are kept for good, page lists for 180 days and MCP calls for 400 days.

Your browser works out the search results. Your search words, and any place you type, are part of the page address, like any link, so they reach the server that sends the page. Its request logs keep the full page address for up to 7 days, so we can fix problems.

The search page asks for your device's location only when you choose "Use my location" or search with words like "near me", "nearby" or "closest", and your browser asks your permission first. To name the town you are in, your browser sends the coordinates, rounded to about 100 metres, to our server, which asks Mapbox's geocoder. Like a page address, that request stays in the server's logs for up to 7 days.

The explorer map's "Show where I am" button also asks first. It only moves the map to you, and the map then loads the tiles for that area from Mapbox.

A city or postal code you type is part of the page address, so it reaches our server and its request logs. When the site does not know the place, our server asks Mapbox to find it.

The site saves the last place you searched from on your device, so it does not ask again. When you come back to the search page, your browser may send that saved point to our server, which asks Mapbox's geocoder to name it. The explorer saves your view settings on your device too. Clearing this site's data in your browser removes both.

Maps load only when you ask. Before a map loads, and before the search page looks up a place the site does not know, Cloudflare Turnstile runs a quick automatic check that you are a person. It rarely needs a click.

A place lookup can start without a tap: when you open a search link with a place in it, such as one someone shared with you, or when the search page names the place it saved from your last search. Then the check runs on its own too, and if it needs a click, a card at the foot of the page asks, with a Skip button.

Passing the check sets one cookie on this site for 12 hours. It proves the check passed, and holds a random number so we can limit how many place lookups one pass can make. It does not identify you and is not shared. Cloudflare's Turnstile privacy addendum covers what the check collects.

Maps come from Mapbox. Your browser loads map tiles from Mapbox's servers, and Mapbox's map library may send anonymous usage data and keep an anonymous ID in your browser. Mapbox's privacy policy covers what it does with them.

The API and the MCP server let other programs and AI assistants look things up here. To keep to the fair-use limit, they count requests from each IP address for one minute, and do not keep the count after that. The map check and place lookups count requests the same way.

If you email a correction to mahmoud@spaceandstory.co, we use your address only to reply to you.