Privacy

What gets stored, and where

What	Where it lives	Why
Your first name	Our server, attached to that one plan	So the group can see who voted for what
Which times you tapped	Our server	It’s the whole point of the plan
Whether you said you’re coming	Our server	So whoever shops knows how much to buy
What you claimed to bring	Our server	So two people don’t both buy the meat
The plan’s title, city, times and costs	Our server	It’s the plan
Comments and poll answers you post on a plan, how many guests you’re bringing, and who marked a payment as done	Our server, attached to that one plan	Everyone with the plan’s link sees them. Deleted with the plan
Photos you add to a plan after the event	Our server, attached to that one plan	Everyone with the plan’s link can see and save them. Made smaller on your phone first, with the location and camera details taken out (and taken out again on our server). Not listed in search engines. You or the organizer can delete one at any time; the rest are deleted with the plan
How you’re getting there: the town you’re coming from, driving or riding, seats offered or taken, electric or not, your mpg and toll choice	Our server, attached to that one plan	So the group can share cars and split the cost of each. A town, never a street address. Everyone with the plan’s link sees it. Deleted with the plan
Dietary needs you pick on a plan (vegetarian, gluten-free, a nut allergy and so on)	Our server, attached to that one plan	So the shopping list allows for them. Only if you pick them, and everyone with the plan’s link sees them. Tap one again to remove it. Deleted with the plan
Your location, if you tap “Near me” on the places page	Your own phone only	To sort places by distance. It’s used in the page and never sent to us or anyone
Who you plan with (with kids, high school, college, 21 and over), what you’re into, what you saved, and which kinds of plans you’ve made	Your own phone only	To suggest things first and leave out bars and 21-and-over venues for high school and families. Never sent to us, never on a plan, never seen by a venue. Clear it on /my-plans
An organizer’s private notes	That organizer’s own browser only	Never sent to us
The plan’s town, when its page asks for the weather	Sent to the National Weather Service (a US government agency)	To get that day’s forecast. Only the town’s map point goes, never anyone’s name
Your name again, and a list of plans you’ve opened	Your own browser only	So you’re not asked twice, and can find plans again
Venue listings and photos	Our server	Submitted deliberately by the venue, to be public
A venue’s email address, and a sign-in cookie	Our server, and that venue’s browser	Only for people who run a venue, so they can come back and edit their own listing, and so we can check a claim is really theirs. Never shown on the site
Taps through from a place’s page	Our server	A count and a time for that place’s counter, no name, no address, nothing about who tapped
A message you send through the contact form, and a reply address if you give one	Our server	So the person who runs WHERE can read it and answer. Never published
The places on a plan, in order (its “stops”), with any time or note the organizer adds, and the first name of whoever added each one	Our server, attached to that one plan	So the group sees the whole day. Everyone with the plan’s link sees them. Deleted with the plan
A review of a place: would you go again, the tags you tap, any words you write, and a name if you give one	Our server, attached to that place	Public on the place’s page, so the next group can decide. Your browser also sends a random number with it so one phone counts once (posting again replaces your earlier review). We can hide a review that breaks the terms
Photos you add to a place’s Wall, with an optional caption and name	Our server, attached to that place	Public on the place’s page. Checked automatically on our own server for explicit content before anyone else sees it (no outside service), and by a person if it’s borderline or reported. Location and camera details are removed. Ask and we’ll delete it
Your internet address	Our server’s memory, for up to an hour	Only when you create or change something, so one script can’t flood the site. Never shared. The one exception: wrong passwords on our own admin sign-in are written down with the address they came from for 15 minutes, to stop password guessing
Who’s on the site right now: a short code made from your random number, the page you’re on, and phone or computer	Our server’s memory only, for 30 minutes	So the person who runs WHERE can see the site working. Never written to disk, gone when the server restarts

We don’t store your email unless you’re a venue and typed one in, and we don’t store payment details because no money goes through WHERE at all.

Who can see it

Anyone with the plan link. That’s deliberate, the link is how people are invited, and requiring an account to open it would defeat the point. A link is a long random string that isn’t listed anywhere and is kept out of search engines, but treat it the way you’d treat the group text you’re pasting it into: anyone you send it to can forward it.

Don’t put anything sensitive in a plan, not a home address you wouldn’t give out, not anything you wouldn’t say in the group text.

What we don’t do

• No advertising trackers, no Facebook pixel, no Google Analytics.
• We don’t sell, rent or share your information with anyone.
• No marketing email. There’s no list to be on.
• No profiling. WHERE’s picks suggest places from what a plan says (the kind of outing, the budget, the times, any diets people marked) and nothing else about you. They are suggestions; your group decides.
• No cookies for tracking. The only cookies are sign-in ones: for people who run a venue, and for the person who runs WHERE.
• Map buttons go to Google Maps or Apple Maps only when you tap them, and carry only the place’s name and address. What happens after that is under Google’s or Apple’s privacy policy.
• We count visits ourselves. Your browser keeps a random number (not your name, not your phone) so we can tell how many people use WHERE rather than how many pages were loaded. With each page view we receive that number, the page, and the site that linked you here. We never keep your IP address. Everything else stored on your device stays in your browser.
• To make the site work better on phones we also count, only as totals: whether a visit was on a phone, tablet or computer, the system and browser, the screen width rounded to a range, the phone’s language and light or dark mode; how long a page took to load and any error it hit; how long a page was on screen and how far down it was scrolled; what was typed into a search box on Places or Towns and how many results it found; and which place photos failed to load. None of it is kept against you or your random number: it is added to a count for that day (“iPhone, Safari: 12”) and that is all we have.
• Each day’s visit totals are kept. The list of random numbers behind a day’s count is deleted after 13 months, leaving only the number.

No outside services load on these pages. The typefaces are served from our own server rather than Google Fonts, so nobody else sees that you visited. The only links that leave the site are ones you tap yourself, your messages app, a map, a venue’s own website.

Getting rid of it

On your device: clearing your browser’s site data for this site removes your saved name and your list of plans immediately. Nothing else on your device is touched.

On our side: use the contact form, paste the plan link and say what you want. You can ask what we hold about you, have it corrected, have it deleted, or get a copy, and we’ll do it. Indiana’s consumer data privacy law, in effect since January 1, 2026, gives residents rights like these against larger businesses; we give them to everyone, whatever our size.

Automatically: a plan is deleted 12 months after its deadline, with everything on it, names, votes, the bring list, photos and the link itself. Group requests to venues go 12 months after they were made. The only thing kept is a count for the venue a plan named (how many plans, how many people came), with no names in it. If you want a plan gone sooner, ask.

Keeping it safe

Everything travels over HTTPS. Plan links are long random strings that aren’t listed anywhere. Only the person who runs WHERE can open the admin side, with a password stored only as a scrambled hash (nobody can read it back), and every change made there is logged. The site’s pages run only our own code, so text someone types into a plan, a review or a comment can’t run as a program on anyone else’s phone. Requests to change things are only accepted from WHERE’s own pages.

No system is perfect. If something we hold about you is ever exposed, we’ll say so on the site and tell anyone we can reach, as Indiana law requires.

Your rights

Whoever you are and wherever you live, you can ask us to: tell you what we hold about you, correct it, delete it, or give you a copy. We don’t sell personal information, don’t share it for advertising, and don’t use it to profile you, so there’s nothing to opt out of; if your browser sends a Global Privacy Control signal, we treat it as that opt-out anyway. Ask through the contact form; we answer within 45 days, and if we can’t do something we’ll say why, and you can ask us to look again.

Because WHERE keeps no accounts, the way to point at “your” data is the plan link, the place, and the name you used. We may ask a question to make sure a request is really yours before deleting or handing over anything.

Who runs WHERE

WHERE is run by Logan Howat in Indianapolis, Indiana, who decides what is collected and why. Reach him through the contact form. WHERE’s server is rented from a hosting company in the United States, which stores it for us and does nothing else with it.

Children

You must be 13 or older to use WHERE, and to post a review or a photo (under 13, only with a parent or guardian; see the terms), and we don’t knowingly collect anything from children under 13. A plan records how many kids are coming as a number, for working out how much food to buy, no names, no details. “With kids” is for a grown-up planning a family outing. “High school” asks for no birthday and no age, only that choice, and it stays on the phone. In that mode WHERE suggests no bars, puts no drinks on the bill and leaves out anything a venue marks 21 and over.