SITE POLICIES / PRIVACY
Privacy notice.
This notice describes the current Flock Uprising data flows. The hosting, map, human-check, and public-source providers may separately process connection and service data under their own policies.
Map and search
City, ZIP, and street-address searches are sent to the U.S. Census Bureau TIGERweb or Geocoder service to return an approximate place or address-range center. Search text and returned coordinates are not saved in this project’s database. Census systems may process them under Census service terms. Map backgrounds are requested from the OpenStreetMap tile service; public ALPR point tiles are read by byte range from the Finding Flock archive provider. Those services receive normal network request metadata such as an IP address, user agent, and referring site when your browser sends them.
The interactive map software (MapLibre GL JS and PMTiles) and the human-check script (Cloudflare Turnstile) load from Cloudflare’s and unpkg’s public distribution networks. The Turnstile token is sent to this project and validated by the server with Cloudflare Siteverify. The project does not store the token after validation. Map, tile, CDN, geocoding, Turnstile, Cloudflare Pages, and network providers have their own privacy policies and operational logs.
Community camera reports
If you publish a community report, the database stores the reported latitude/longitude, city, state, system type, vendor if known, optional public-source URL, publication status, and timestamps. Those fields are immediately public on the map as Community reported · unverified after human screening and input validation. Do not include a name, email, private residence, personal data, license plate, device identifier, or photograph of a person. Do not submit an observation that would expose a specific private or safety-sensitive location.
The form does not ask for your name or email. Cloudflare Turnstile screens for automated abuse. A successful challenge is not proof that a report is honest or accurate. The server limits reports to three per network address per UTC day by computing a keyed HMAC; the raw address is not stored in the report table. The keyed value is cleared by daily cleanup once the report is at least two days old, usually within three days; a missed scheduled Worker run can extend that retention. The public database response never includes this keyed value. An owner may hide or restore a report after publication; the publication/status event remains in private history.
Private corrections
Corrections to source records are sent to the owner console’s private queue and are not published automatically. The correction record stores a public-record reference, the submitter’s description, a public evidence URL, a timestamp, a status, and a temporary keyed address hash for the three-per-day limit. It does not ask for a name or email. The hash cleanup follows the same retention period above; the correction itself and its private review history may remain so the owner can resolve the request.
Visitor counter and aggregate dashboard stats
The footer shows an approximate count of distinct network addresses per UTC day across visits. The counter uses an HMAC of the network address and UTC date to avoid writing the raw address to the project database. Daily keyed values are deleted after two days; only aggregate totals and day-level statistics remain. Basic user-agent and request metadata help exclude likely automated traffic. Bot detection is best effort and can misclassify requests. Detailed daily request and bot-filter totals appear only in the private owner console.
Public source records
The upstream layer contains public OpenStreetMap ALPR report points from Finding Flock. The project stores daily archive-level metadata such as the checked file version, ETag, feature count, and check time; it does not copy the full point archive into its D1 database. Community reports are stored separately and are not part of the upstream OpenStreetMap data. The site does not collect plate reads, vehicle histories, Bluetooth identifiers, Wi-Fi identifiers, or camera system feeds.
Owner security and changes
The owner console and its APIs are intended to require Cloudflare Access and an allowlisted owner identity. The GitHub repository is intended to remain private. No public page exposes source-code editing. This notice will be revised if the service adds a new data flow or provider. It is plain-language information, not legal advice or a guarantee of provider retention practices.
Use the correction page to request review of a record. Read the source notes and terms.