YOUR INFORMATION
Privacy notice
This notice describes the information used to run Blessing Box Finder, an independent, noncommercial community location directory.
Browsing and device location
You can browse without an account. If you press “Use my location,” your browser asks for permission to share an approximate or precise position. The application uses it to center the map and does not save a history of your movements.
For contributions, the directory saves the box position you explicitly submit. It does not save your separate, unsubmitted device position.
Directory activity totals
The directory counts page views and direction clicks as daily totals. These measurements contain an event type and date, with no account, listing, search, device position, or browsing-history fields. Measurement requests omit account cookies and page referrers. Short-lived abuse identifiers limit repeated events; they are not stored with the totals. Successful contribution totals are calculated from saved revisions. These counts are approximate and do not identify individual visitors.
Optional Google Analytics
On the production site, you can choose whether to allow Google Analytics using the analytics settings in the footer. No Google Analytics script or measurement request loads before you allow it. Declining does not affect browsing or contributing. This choice is stored in your browser and is separate from the daily directory totals described above.
If you allow analytics, Google receives visits to broad public page categories, a fixed page label, and general browser and country-level information. All listing pages are grouped together, and community pages are grouped together. We do not send listing IDs, addresses, locality names, precise coordinates, searches, query strings, page referrers, usernames, email addresses, account identifiers, or form contents. Account, sign-in, administration, editing, and reporting pages do not load Google Analytics.
Consented analytics uses first-party browser identifiers to recognize visits and sessions. Its dedicated cookies expire after 60 days without refreshing that expiry on each visit. Google processes technical information such as your network address when receiving requests; this is different from the anonymous daily totals maintained by the directory. Advertising features, Google signals, and automatic enhanced measurements are disabled. We do not connect analytics to your account.
You can turn optional analytics off in the footer at any time. This removes the analytics cookies and reloads the page to stop the Google tag. The change also applies to other open tabs. It stops future collection; it does not erase measurements already received by Google. Google Analytics event retention is set to two months. See Google’s Privacy Policy for its processing practices.
Your account and contributions
Registration uses an email address, password, and public username. Supabase handles authentication. Your username is public; your email address, authentication details, and account status records are not included in public directory responses.
When you add or change a listing, its information, your username, and the database-generated update time are displayed publicly. Previous listing content and edit explanations are retained privately for moderation and correction. Please do not include personal information about yourself or other people in a listing.
Private reports and abuse controls
Problem reports are available only to administrators. A report may be linked privately to your account when you are signed in. We do not ask anonymous reporters for an email address.
Short-lived abuse-control identifiers help limit automated or repeated submissions. Abuse records are retained for up to 24 hours, and request-retry records for up to 7 days. Resolved or dismissed reports are retained for up to 90 days. Moderation audit records are retained for up to 12 months, subject to necessary privacy correction and recovery records.
Service providers
The site uses Vercel for hosting, Supabase for the database and accounts, and a transactional email provider for account messages. Google Maps supplies the map. Bot protection may use Cloudflare Turnstile. These providers process technical information needed to deliver their services, according to their own policies.
Loading the map connects your browser to Google. See Google’s Privacy Policy. Directions links open Google Maps separately.
Authentication uses necessary session cookies. Non-secret form drafts may be kept in your browser to help recover an interrupted edit. The directory does not require advertising trackers or collect information about people who use the listed structures.
Deleting an account or correcting private information
You can request account deletion from your account page after confirming your identity. Editing access is disabled and account removal is queued. Community listings and necessary contribution history remain, with public attribution shown as “Deleted contributor.”
Listing revisions are retained as needed to maintain the directory. An administrator can remove accidentally submitted personal information from current content and historical revisions through a controlled privacy process.
Encrypted backups use a 7-day daily rotation. Deletions or redactions may take time to leave older backups. A separate encrypted privacy recovery journal records the changes needed to prevent deleted information from returning during a restoration, and is retained while affected backups remain recoverable.
Contact
For a privacy request or a question about this notice, email josh@shacklesproductionstudio.com. You can also report a privacy concern directly from a listing.