Privacy Policy

This privacy policy explains what data we collect, what we don't, and how it's handled. Last updated: 2026-05-27.

1. What we collect on our servers

Standard server logs include your IP address, browser user-agent, referring page, and a session identifier — the data any website receives when you visit. We use this for security monitoring, debugging, and aggregate analytics. Logs are retained for up to 90 days.

2. Location data

When you click the locate button and grant permission, your browser sends your coordinates to our reverse-geocoding proxy. Before any logging or caching, the proxy truncates coordinates to ~100 metre precision (three decimal places). Your precise position never reaches our database.

3. Location history — stored on your device only

For your convenience, the site can remember up to 10 of your most recent location lookups. This data is stored ONLY in your browser (using local storage or, as a fallback, a first-party cookie). It is never transmitted to our servers and never shared with anyone. You can disable the feature, view all stored entries, delete individual entries, or clear all of them at any time from the "Recent locations" panel. If your browser sends a "Do Not Track" signal, the feature is automatically disabled.

4. Cookies & consent

We use a minimal set of first-party cookies, split into two categories. STRICTLY NECESSARY (always on, no consent required under EU ePrivacy Directive Art. 5(3)): theme preference, theme variant, location history (browser-only, opt-in), and the consent record itself. ANALYTICS (off until you grant consent via the banner): a 2-year visitor UUID cookie and a 30-minute session cookie set by our self-hosted analytics on tracker.whatismylocation.ai. No advertising cookies. No third-party analytics cookies. No cross-site tracking. No data sold or shared. You can change your consent any time via "Cookie settings" in the footer.

5. Third-party services we proxy

Reverse geocoding uses OpenStreetMap Nominatim. Elevation and weather use Open-Meteo. Map tiles come from OpenStreetMap. IP-based fallback uses ipwho.is or ipapi.co. We send minimal data — typically just truncated coordinates — to these services, and we attribute them clearly in the UI. Fonts (Inter, Inter Tight, Fraunces, JetBrains Mono) are self-hosted from our own origin — no requests are made to Google Fonts or other font CDNs.

6. Data sharing and sale

We do not sell user data. We do not share user data with advertisers. Aggregate, anonymised usage statistics may be referenced in case studies or blog posts, but never tied to identifiable individuals.

7. GDPR rights (European Economic Area & UK visitors)

If you are in the EEA, UK, or Switzerland, the GDPR (and UK GDPR) gives you the following rights with respect to any data we hold about you: (a) the right to access — request a copy of your data; (b) the right to rectification — correct inaccurate data; (c) the right to erasure ("right to be forgotten") — ask us to delete your data; (d) the right to restrict processing; (e) the right to data portability; (f) the right to object; (g) the right to withdraw consent at any time. To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Legal basis for processing (GDPR Art. 6)

We process the limited data described above on the following lawful bases: (a) Legitimate interest — for security, fraud prevention, and operating the service (Art. 6(1)(f)); (b) Consent — for optional features like location history and the locate button itself (Art. 6(1)(a)); (c) Legal obligation — when required to comply with law (Art. 6(1)(c)). You can withdraw consent at any time, and we will not use that withdrawal against you.

9. Data controller and contact

The data controller for this service is the operator of whatismylocation.ai. For any privacy or data-protection question, email [email protected]. If you prefer to write to a postal address, request one via email.

10. Data retention

Server logs: up to 90 days. Analytics records: up to 180 days. Truncated coordinates in geocode cache: 24 hours. Location history (in your browser): until you clear it, capped at 10 entries. Theme preference cookie: 1 year or until cleared by you.

11. International transfers

Our servers and third-party services may process your data outside your country of residence. When data leaves the EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions to ensure equivalent protection.

12. Children

This service is not directed at children under 13 (under 16 in some EU jurisdictions). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on the site. The "Last updated" date at the top reflects the current version. Continued use of the service after changes constitutes acceptance.