What this site collects, and what it does not

• No accounts. You never sign up or log in.
• No ads, and so no advertising cookies and no ad trackers.
• No database of visitors or of messages.

“Use my location” asks your browser for your position, and your browser asks you first. If you agree, the page gets your coordinates and uses them on your own device to find the mapped cameras closest to you. They are not sent to us.

To do that, and whenever you look at the map, your browser downloads map tiles for the area in view. Each request is for one part of the map, so whoever answers it can tell roughly which area was asked for, along with your IP address. The camera tiles come from this site. The background map comes from an outside tile service.

Once you move the full-screen map, the address in your browser’s address bar keeps the area in view, rounded to within about half a mile, so that a link copied from it opens the same area. That part of the address stays in your browser: it is not sent to this site, to analytics or to any other site, and it is cleared when you close the map. If you located yourself first, a link you share can show roughly where you were.

Some cameras on the map carry a photo that a mapper linked to. Opening one of those loads the picture from the photo site that hosts it, which then sees your IP address.

Picking a town or a state from the suggestions under the search box sends nothing you typed anywhere: that list comes from a file this site serves. The place you pick is then shown like any other part of the map, so your browser downloads the camera data for that area from this site and, on the home page, background map tiles from the outside tile service, as described above. Text you submit without picking a suggestion, such as a street address, is sent to Photon, a geocoding service run by Komoot, to be turned into coordinates. Photon receives the text and your IP address.

A spot you choose on the home page is passed to the Near me page in the page’s memory only. It is never saved in your browser’s storage or put in a web address, and it is forgotten once that page has used it, after ten minutes, or when you close or reload the page.

If you would rather not send an address anywhere, you can browse by state instead.

This site uses Google Analytics to count visits and to see how fast pages load. Google’s script runs in your browser on every page. It sets cookies of its own, with names that begin _ga, so that it can tell one browser from another, and Google receives your IP address and details of your browser and device, as it does from any site that uses its analytics. Google’s privacy policy covers what it does with them.

What the site itself reports is limited:

• The page address, cut down to the site and the path. If the link you followed carried campaign tags (parameters whose names start with utm_), those stay, so the visit is credited to that link; the rest of the query string and anything after a # are never included.
• The title of the page.
• What Google’s script notes by itself: the address of the page that sent you here, as your browser passes it on (from another page of this site, only the site’s own address); how long the page is open and in use; reaching the end of a page; and the name of any data file you download.
• Five measurements of how fast the page loaded and responded (the Core Web Vitals and two related timings), along with the kind of page they were taken on and how the home page map was loaded.

Nothing on the site depends on it. If a content blocker stops Google Analytics, every page still works.

The form on the contact page sends your name, your email address, the topic and your message to this site’s server. The server checks them and passes them on once, as a plain-text email to the team’s inbox, through Resend, an email delivery service (Resend’s privacy policy). Your address goes in as the reply-to so that we can answer.

The server keeps no copy. If a send fails, the log records that it failed and the mail service’s status code, not who wrote or what was said. After that your message is an email in our inbox like any other.

To limit floods, the server holds a salted one-way hash of the sender’s IP address in memory for a short time, so that it can cap how many messages one sender sends in a row. It is never written to disk.

The contact page also runs a bot check, Vercel BotID. When the page opens, your browser quietly works through a challenge, and the result travels with the form so that the server can turn away scripts before it reads a word of the message. The check is used for the contact form only.

The site is hosted by Vercel. As with any website, the host’s servers receive every request your browser makes, with your IP address, the address asked for and your browser’s description of itself, and the host keeps logs of them under Vercel’s privacy notice.

This site’s own code writes one kind of line to those logs: a note that a contact message could not be sent, with no name and no text in it.

Pages here link to OpenStreetMap and to other sites. Once you follow a link, what happens next is up to the site you land on.

Ask through the contact page.