Privacy Policy

Who we are

The Cotswolds App ("we", "us", "our") is a visitor guide to the Cotswolds region, operated from the United Kingdom. Our website is thecotswoldsapp.com.

For any privacy-related enquiries, please contact us at hello@thecotswoldsapp.com.

What data we collect

We collect the following personal data:

• Email address — required to create an account. We use it to send one-time sign-in codes and service-related messages. We do not store passwords.
• Profile details — an optional display name, profile photo, distance unit preference (kilometres or miles), and optional entries for your dogs (each with a name and optional photo) that you can add from your account page.
• Reviews you write — sheep rating (overall), optional wheelchair / accessibility rating, optional dog-friendly paws, and review text you submit against a place, displayed publicly alongside your display name and profile photo.
• Photos you upload — community photos you submit against a place, displayed publicly once approved, alongside your display name.
• Saved places and trips — places you tag (e.g. visited or wishlist), itineraries you create, and a short history of places you have recently viewed while signed in.
• Enquiry details — any information you choose to include when you email us (for example, to correct a listing or register a business).
• Listing contact suggestions — if you sign in and suggest a phone number, address, or postcode for a place, we store that text and your account id so we can review it and update the public listing. We do not show your email on the place page.
• Idempotency records — when you submit a review, upload a photo, or create an itinerary item, we store a short-lived idempotency key alongside the server's response in a request_idempotency table. This ensures that a retried submission (for example, after a dropped network connection while offline-sync flushes your outbox) does not create a duplicate row. Records auto-prune after 7 days and are removed immediately if you delete your account.

We do not collect any special category data (e.g. health, ethnicity, political opinions).

How we use your data

We use the personal data you provide for the following purposes:

• To create and manage your account, including sending one-time sign-in codes to your email.
• To display your reviews, community photos, and display name on the places they relate to, once any required moderation has completed.
• To store the places you have tagged, the itineraries you have created, your recently viewed history, and any dog names or photos you save on your account page, so you can access them when signed in and use them in other parts of the app where that feature is available.
• To moderate user-submitted content (reviews and photos) and enforce our Terms of Use — for example, hiding or removing content that is reported or breaches the rules.
• To respond to enquiries you send us, including correction requests and business listing queries.

Reviews you submit, once approved by our moderators, are embedded as structured data on the place's public page so search engines can display them as rich snippets. Your review appears in this structured data as "Cotswolds visitor" — we do not include your name, email address, or user ID alongside the review.

We process your data on the basis of consent (you actively create an account and submit content), performance of a contract (providing the account features you have signed up for), and legitimate interest (moderating content, keeping the service secure, and responding to your enquiries).

Community-submitted listings

Signed-in visitors can propose new places to add to our directory. When you submit a place, we store the information you provide — the place's name, description, location, optional address, postcode, website, opening hours, and an optional photo — along with your user account ID for moderation and abuse-prevention purposes. Your name or email address is not publicly displayed on places you submit; submissions appear anonymously once published.

We use this information to review your submission, publish it to the directory if approved, and hold you to our community standards (see the Terms). Moderators and admins can see which account submitted any particular listing.

Business claim

Verified business owners can claim their listing using a 6-digit code sent to their business email. We log every claim attempt in place_claims (kept indefinitely as a record of who claimed what and when).

Messages and notifications

Signed-in visitors can message claimed businesses, and either side can reply inside the app. The reply loop is kept in-app deliberately so that your email address is never shared with the business, and the business's email is never shared with you. We send each side an email summary when a new message lands (so owners can see urgent enquiries without opening the app), but the From: address is always noreply@thecotswolds.app and there is no Reply-To header — emailed replies bounce.

Messages, participation state, and read receipts live in conversations, conversation_participants, and conversation_messages. Soft-deleted messages are hard-deleted after 90 days; conversations where every participant has archived are removed 180 days after the last activity.

Moderation outcomes (submissions approved, claim verified, reviews moderated, photos approved or rejected, co-owner requests), plus admin announcements, surface as notifications in your in-app inbox. Read notifications are deleted after 90 days; unread ones after 180 days. The Cotswolds App team can broadcast announcements to all active users, owners only, or every user; each recipient receives an in-app notification, and an email summary only if the admin explicitly opts in per broadcast.

If a message is reported by three different users within 30 days we may temporarily suspend that account's ability to send new messages while a moderator reviews the reports. Reports are recorded against the message id in content_reports.

Cookies and analytics

We use only strictly necessary cookies and similar storage to keep you signed in and remember small bits of UI state. We do not use advertising cookies, third-party analytics, or cross-site tracking.

Full details are set out in our Cookie Policy.

Service worker and on-device caches

The app registers a small service worker at /sw.js so the site can be installed as a progressive web app and so previously-visited pages and place images load instantly on revisit. The worker stores no personal data, does not track your browsing, and does not communicate with any third party.

The worker keeps three caches on your device: place images from our self-hosted bucket (kept for up to 90 days), recently-visited page HTML (kept for up to 7 days), and a single-row staleness marker used to decide when to refetch the directory. All three are managed by your browser's site storage and can be cleared via the browser's site-data controls.

Optional: from the Offline storage page (accessible from the avatar menu when signed in) you can download the directory — place names, locations, descriptions, categories, and route geometries — into your browser's IndexedDB, in a database called cotswolds-directory. Four scopes are available: the whole directory or just places within 25 km of your current location, each with or without images. This data is only used to render pages you visit while offline and is never sent back to us. You can clear it at any time from the same page.

Optional: from the same page you can also download an offline basemap of the Cotswolds — a single PMTiles file (approximately 200 MB) stored in your browser's IndexedDB under the same cotswolds-directory database, in an object store called pmtiles. The file is used solely to render maps in /map, /near-me, place detail pages, and the itinerary editor while you are offline or on a slow connection. It is never uploaded to us. You can remove it at any time from the Offline storage page. In addition, a small service-worker cache (map-tiles-v1, capped at 50 entries, 180-day TTL) transparently stores individual map tile requests you have made while online, so recently visited map areas load instantly on revisit.

Geolocation. The two "Near me" download buttons use your browser's Geolocation API once, at the moment you tap the button, to find the 25 km radius. The coordinate is used in-browser only and is never sent to us.

The directory's Near me radius filter asks the browser for your location when you tap one of the radius pills. Your coordinates are sent with a single search request and never stored in your browser, written to our database, or kept in server logs. A URL like ?within=25 shares the intent ("within 25 km of me"), not your actual position.

Cotswolds cleanup prompt. If you have offline data cached, the app checks your location periodically (roughly hourly, in the background) to detect when you have likely left the Cotswolds. When you have been outside the area for at least 24 hours, we show a small dismissible banner offering to free up space on your device. Nothing leaves your browser — the check is run against a bounding box stored locally, and only a tiny record of "when did you first go outside" plus your "don't ask again" preference is persisted in the same IndexedDB database. You can disable it permanently by clicking "Don't ask again" on the banner.

When a new version of the app is released, the service worker detects this and we show a small banner at the bottom of the page letting you apply the update now or dismiss the notice. If you dismiss it, we store the version identifier in your browser's local storage (key cotswolds:sw-update-dismissed-version) so we do not re-prompt you for that same version. The next release re-prompts. This setting stays on your device.

cotswolds:manual-offline — a single on/off flag remembering your "Go offline" choice so it survives page reloads. Set from the avatar menu or the Offline storage page, it lets you simulate being offline even when your network is connected — useful for testing cached content before travelling. Stored only on your device; clearing your browser storage resets it to off.

Third-party services

We use the following third-party services that may process your data:

• Supabase (database, authentication, and file storage) — your account, profile, reviews, itineraries, and other data are held in a Supabase-hosted PostgreSQL database, and your profile photo, optional dog photos from your account page, and any community photos you upload are held in Supabase Storage. Supabase also handles authentication, including issuing the one-time sign-in codes sent to your email. Supabase's servers are located in the EU/EEA. See Supabase's privacy policy.
• SMTP2GO (email delivery) — delivers the one-time sign-in codes and any service emails we send to your address. SMTP2GO processes the recipient email address and message content solely for delivery. See SMTP2GO's privacy policy.
• Netlify (website hosting) — serves the website and may process server logs containing IP addresses. See Netlify's privacy policy.
• Ticketmaster Discovery API (event listings) — when you view events near a place, near you, or during an itinerary, the data shown is fetched from Ticketmaster's Discovery API on a scheduled basis (every six hours) and stored on our servers. We retrieve event metadata only — name, date, venue, image, category, and the upstream URL — no information about you or your activity is sent to Ticketmaster. Clicking an event card opens ticketmaster.co.uk in a new tab, where Ticketmaster's privacy policy applies. See Ticketmaster's privacy policy.
• Open-Meteo (weather forecasts) — when you view a place detail page, the current conditions and three-day forecast shown under the mini map are fetched from Open-Meteo's free public API. The request is made server-side from our origin; your browser never contacts Open-Meteo directly. Only the place's coordinates, rounded to two decimal places (approximately a one-kilometre grid), are sent — no information about you or your activity reaches Open-Meteo. See Open-Meteo's terms.

We do not sell, rent, or share your personal data with any other third parties.

International transfers

Some of our third-party service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions recognised by the UK Government, in accordance with UK GDPR.

How long we keep your data

We retain your account and the data associated with it (profile details, optional dog entries, reviews, community photos, tagged places, itineraries, and recently viewed history) for as long as your account remains active. If you delete your account, we remove your profile details, saved places, itineraries, recently viewed history, dog entries (including stored dog photos), and any idempotency records held against your user ID.

Reviews and community photos you have published may be retained in anonymised form (with your display name and profile photo removed) so that sheep ratings, accessibility ratings, and imagery attached to a place remain available to other visitors. You can request full removal of specific reviews or photos at any time.

Email correspondence (including enquiries and business listing queries) is retained for as long as is reasonably necessary to handle the matter, and deleted on request.

Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to our processing of your data.
• Withdraw consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please email hello@thecotswoldsapp.com. We will respond within one month.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this page periodically.