Privacy, in plain language.

Last updated October 23, 2026. This notice describes the free Spook & Sparkle community app.

What you share

Reports can include a display name, address, public viewing pin, holiday, dates, description and optional photo. Approved display information and photos become public. Your account email, saved places and recorded visits are private to your account and authorized staff. You can browse and send a community find or visitor update without creating an account.

Location is your choice

We ask for your browser's location only when you choose a location button. Quick Add uses that position as the proposed viewing point, which is stored with your report and may become public after review. You can use the full form to enter a viewing point yourself instead.

A nearby visitor check uses your coordinates, accuracy and timestamp to assess proximity. It stores the result and observation time, rather than your raw visitor coordinates. We do not collect a continuous location trail. Declining a nearby check still lets you send an update for review.

Accounts, cookies and security

You can sign in with an email code or Google. With Google sign-in, our account service receives your Google account identifier, email address and the profile information Google supplies, such as your name and profile image. Signing in does not make your account email public.

Cookies are small pieces of information stored by your browser. Session cookies keep you signed in. A guest receipt cookie helps you access or claim your reports; it lasts up to 30 days and can be renewed when you contribute. A temporary Google sign-in cookie remembers where to return you for up to 10 minutes. A sign-in cooldown cookie lasts one minute and helps prevent repeated email-code requests.

We also use browser storage for unfinished forms, demo saves and partner briefs. The full submission form can restore a temporary draft in the same browser tab for up to 24 hours. These browser-stored drafts are separate from drafts you explicitly save to your signed-in account. Clearing site cookies or storage may sign you out, remove access to guest receipts or discard unfinished work. Your browser settings let you manage this storage; blocking it can affect these features.

Our hosting and security services receive technical information such as IP addresses, browser details and request logs. The app also uses hashed network identifiers, receipt identifiers and activity records to limit abuse, retry submissions safely and investigate problems. Hashing does not make this information anonymous.

Understanding reliability and usage

We count page categories, form starts, directions clicks and browser-error categories to improve the app. These events contain no account ID, email, entered address, photo, GPS coordinates or error-message text. They do not use analytics cookies or a persistent visitor identifier. Browser measurement respects Do Not Track and Global Privacy Control signals. Hosting services still process technical request information. Counts can be incomplete and do not represent unique people.

Services that help run the app

Supabase provides accounts and database storage. Cloudflare hosts the app, processes and stores photos, and provides security services. Resend delivers sign-in email. Google provides optional Google sign-in under its own privacy practices. Geoapify receives address searches and map or viewing-point requests to provide suggestions, maps and address lookup. Support email uses Porkbun forwarding to a monitored Gmail inbox. Opening directions takes you to an external mapping service with its own privacy practices.

These services may process information outside your country. Authorized staff can review reports, photos, visitor updates and removal requests. Eligible visitor updates may be accepted automatically using proximity and conflict checks; other updates require staff review. Acceptance is not a guarantee that a report is correct. The current free pilot does not use behavioral advertising or sell personal information.

Photos and public information

Photos are optional. We process uploads before publication and remove image metadata. Share only images you have permission to use; avoid recognizable people, license plates and private areas. Automated photo categorization is currently disabled for the hosted pilot. Public information may be copied by others outside our control.

Retention and your choices

Account records, contributions, moderation history and photos can remain stored until they are reviewed for deletion. There is currently no automatic deletion deadline for every category. Hiding a listing removes it from public discovery but does not immediately erase private records or backup copies. Some records may be retained to handle abuse, prevent repeat publication after a privacy removal, or meet legal obligations.

You can remove saved places and private visits in the app. To request access, correction or deletion of account information, contact support. We may need to verify that you control the account. Account deletion requests require confirmation after a recent sign-in and administrator review; there is no immediate self-service delete-account button.

For a property concern, use the correction or removal link on its display page without signing in. See support and removal requests for details.

Contact and changes

Contact support@spookandsparkle.com with privacy questions. We will update this notice as the service changes and show the latest revision date here.