Privacy policy
What happens to your location, what is kept, and for how long. Written to describe the code that is actually running.
Last reviewed
The short version
- Your location is never requested until you press the detection button.
- We do not store your precise position, and we never write it to a log.
- There is no account, no profile and no advertising on this site today.
- Optional cookies are off until you switch them on.
Your location
Nothing on this site asks for your location on page load. The browser permission prompt appears only after you press the detection button, and if you decline, nothing is sent anywhere.
If you allow it, your browser works out a latitude and longitude using GPS, Wi-Fi and mobile signals, and the page sends that pair to our own server to be converted into a postal code. The reply contains the postal code, city, state and country, and nothing else.
What we send onward
We have no postal code database. To turn coordinates into a postal code we pass them to LocationIQ, a third-party geocoding service. To be plain about it: the coordinates sent to that provider are at the precision your browser reported, not a coarsened version, because a postal code lookup needs that precision to be correct near a boundary. The provider processes them under its own privacy terms.
Where the provider offers a way to suppress its own logging of a query, we use it. For OpenCage that is the no_record parameter, which we always set.
What we keep
One thing, and it is deliberately blunt: a rounded version of the coordinates, used as a cache key so an identical lookup does not have to be repeated. The coordinates are rounded to three decimal places, which is roughly a 110 metre square, and stored in the form 30.267:-97.743 alongside the postal code it resolved to.
That record contains no IP address, no browser identifier, no account and no timestamp of your request beyond the one the expiry mechanism needs. Nothing links it to you, and the same entry serves everyone who later looks up a point in the same square.
Your full-precision position is never written to our database and never written to a log file. The server-side diagnostics we do keep record whether a lookup succeeded or failed and why — never where it was.
Cached entries are deleted automatically after 2 days. That figure is set by what our geocoding provider’s terms permit us to cache, and the shorter of our setting and their limit always wins.
Abuse prevention
The lookup endpoint is rate limited to 20 requests a minute per visitor, to stop it being scraped. To count those requests we take your IP address, combine it with a secret value and store only the resulting hash — the database holds no readable IP addresses. Those counters are deleted automatically within an hour.
This is not anonymisation and we will not claim it is: an IP address is short enough that a hash of it could be reversed by someone determined. It does mean we are not keeping an address log, and that the counters are useless to anyone who obtained them.
Cookies and local storage
Three things may be stored in your browser. None is used for advertising.
| Name | What it is for | Kept for |
|---|---|---|
gmpc_consent_v2 | Your answer to the cookie notice, in local storage, so you are not asked again | Until you clear your browser data |
gmpc_geo | A two-letter country code from our hosting platform, used only to offer you your country’s page | 30 days |
gmpc_country_banner | That you dismissed or accepted that suggestion, so it stops reappearing | 180 days |
You can change your choice at any time using the Cookie preferences link in the footer.
Our notice is a simple one that we built, not a certified consent management platform. Before any advertising is introduced for visitors in the United Kingdom or the European Economic Area, it will be replaced with a Google-certified platform.
Analytics
No analytics are running on this site. The code to load Google Analytics 4 exists and is wired to the cookie notice, but no measurement id is configured, so nothing is loaded regardless of what you choose. This section will be updated, and the notice will ask you first, if that changes.
Images
Images used in our guides are delivered by Cloudinary, a third-party image host. Loading one means your browser contacts Cloudinary directly, so Cloudinary can see your IP address and user agent as part of serving that request. We do not pass them anything about you.
Advertising
There is no advertising on this site and no ad network code is loaded. The layout reserves empty space where advertising may go later, which is why you may notice gaps. If advertising is introduced, this policy will be updated first, and consent will be collected through a certified platform where that is required.
Server logs
Our hosting platform records standard request information — IP address, timestamp, the path requested, the user agent — as every web server does. We use it to keep the site running and to investigate faults. Coordinates are never part of it.
What we do not do
- We do not have accounts, so there is nothing to sign in to and no profile to build.
- We do not sell or share your data.
- We do not track you between visits or across other sites.
- We do not keep a history of the places you have looked up.
Retention summary
| Data | Retention |
|---|---|
| Precise coordinates | Not stored at all |
| Rounded cache key and its postal code | 2 days, then deleted automatically |
| Hashed IP rate-limit counter | Within an hour |
| Your cookie choice | Until you clear it or change it |
Your rights
Depending on where you live you may have the right to ask what personal data is held about you, to have it corrected or deleted, or to object to its processing.
In practice there will usually be nothing to return. We hold no account, no contact details you have not sent us, and nothing that identifies you against a location. You are welcome to ask anyway, and we will tell you honestly what we find.
Children
This site is not directed at children, and we do not knowingly collect anything from them. There is nothing to sign up for and no profile to create.
Changes
The review date at the top of this page is the date this text last changed. Where a change affects what is collected or how long it is kept, it will be made before the change goes live, not afterwards.
Contact
For any privacy question, write to contact@getmypostalcode.com and put “privacy” in the subject line.