Privacy policy
No accounts. No names. No ad tracking. Here's everything this site does with data, in plain language.
Last updated: July 7, 2026
The short version
- Reporting a pothole stores its location, an approximate street address, your description, and a timestamp — nothing about you.
- Your IP address is one-way hashed the moment a request arrives and is used only to stop duplicates and abuse. The raw IP is never stored or logged by this app.
- Photos have all hidden metadata (EXIF, GPS tags) stripped on the server before anything else happens to them.
- Everything expires: most operational records are automatically purged within 90 days.
- The pothole record itself — location, status, how long it took to fill — is a permanent public dataset. That's the point of the site.
What we collect, and why
When you report a pothole we store its GPS coordinates (rounded to roughly 11 m before storage), a street address looked up from those coordinates, the severity and description you provide, and timestamps. This is what appears on the public map. None of it is tied to an identity.
To stop one person from confirming their own report over and over, or flooding the site, we need to tell devices apart. Your IP address is immediately converted to an HMAC-SHA-256 hash using a server-side secret; only the hash is stored, and only for duplicate-prevention and rate-limiting. The raw IP is never written to disk or logged by this application, and the hash can't be reversed without the secret.
Uploaded photos are processed server-side before storage: all embedded metadata (EXIF, GPS tags, comments) is stripped, then the image is screened by an automated moderation service and held for review. Photos are never shown publicly until a site administrator explicitly publishes them.
If you turn on push notifications, we store the anonymous delivery endpoint your browser generates — no email, no phone number. Per-pothole "notify me when filled" subscriptions are deleted as soon as the notification is sent.
What stays on your device
The site sets no cookies for visitors. (Site administrators receive session cookies after logging in.) A few entries live in your browser's local storage and are never used to track you:
fth-home-intro-dismissed— remembers you've closed the homepage intro.fillthehole_watchlist— the list of reports you've submitted, so the site can show you their status. Stored only in your browser; the IDs are sent to the server only to look up current statuses and are not stored there.hit:<id>andfill-notify:<id>— remember which potholes you've flagged or subscribed to, so buttons show the right state.
How long we keep things
Retention isn't a promise in a document — it's enforced by automated nightly purge jobs in the database:
- Pothole records (location, address, description, status, dates) — kept indefinitely as the public accountability record.
- Published photos — kept with their pothole record; administrators can remove them.
- Confirmation records (hashed IP) — purged 90 days after a pothole is filled or expires.
- "I hit this" signals, action logs, rate-limit records — purged after 90 days.
- Push subscriptions — purged after 180 days without use; fill-notification subscriptions are deleted when the notification is sent.
- Administrator sign-in attempts — purged after 90 days; the admin audit log is kept 24 months to support breach investigation.
Services we rely on
The site runs on a small set of infrastructure and data services. Here's each one and exactly what it receives:
- Supabase — hosts the database and photo storage described above.
- Netlify — serves the website. As the hosting provider it processes network traffic (including IP addresses) to deliver pages, under its own policy.
- OpenStreetMap — your browser loads map tiles directly from OSM's servers, which see your IP and the map areas you view.
- Nominatim — street-address lookups. Requests go through our server, so Nominatim receives coordinates and search text but never your IP.
- Esri ArcGIS — on pothole pages we check Kitchener's 311 system for a matching repair request. Our server sends only the pothole's rounded coordinates.
- SightEngine — uploaded photos (already metadata-stripped) are screened for inappropriate content before an administrator reviews them.
- Sentry — if something breaks, a technical error report (page, browser type, stack trace) is sent so bugs get fixed. We don't attach names or identifiers.
- Browser push services — if you enable notifications, delivery goes through your browser vendor's push service (Apple, Google, or Mozilla) using the anonymous endpoint your browser created.
- Open-Meteo — regional weather history for the stats page's freeze–thaw chart. Requests use a fixed region-wide coordinate; no user data is involved.
- Bluesky — confirmed potholes and fills may be auto-posted to a public feed. Only already-public map data is posted.
Your rights
Under Canada's federal privacy law (PIPEDA) you can ask what information an organization holds about you, ask for corrections, and challenge how it's handled. Honest caveat: because this site stores no identities and IP hashes are one-way, we usually cannot link any report to a person — which protects you, but also means we can't prove who submitted what. We'll still act on any reasonable request to correct or remove a report or photo. Open an issue on GitHub or use the contact options there.
Security & breaches
Traffic is encrypted in transit (HTTPS). The database enforces row-level security, admin accounts require multi-factor authentication, and administrative actions are audit-logged. If a breach ever creates a real risk of significant harm, we follow a documented incident-response process, including notifying the Office of the Privacy Commissioner of Canada and affected people as PIPEDA requires.
Changes
This policy is version-controlled with the site's open-source code — every change to it is public, diff-able, and dated. Significant changes will be announced on the What's new page.