July 2026 Transparency Report

Why this exists

Same deal as June, May, and April: every month I publish a plain-language log of what changed on the data and platform side — what we collect, what we removed, who we rely on, and any government or legal request we received (this month: none). If a number or a third party shows up that should not be there, you will see it here first.

This one is late. July's report should have gone out in early August and did not; it is being published on August 30 alongside the public API work. The period covered is still July 1 – July 31, and nothing from August is folded in — August gets its own report.

July was the opposite of June's single-ship month. Two release lines landed inside four days — v4.3 on July 10 and v4.4 on July 11 — plus a lot of deletion. The Privacy Policy was updated July 10; this report is the companion piece. After July 16 the month went quiet apart from dependency merges.

Headlines

• Web marketing line at end of July: 4.4. The iOS project was bumped to 4.3 (build 22) on July 13, up from 4.0 / build 21 at the end of June.
• Full-text meet search. Migration 0031 enables pg_trgm and adds a GIN full-text index plus a trigram index on meet titles. The new public meets.search procedure does typo-tolerant search over the whole published catalog, rate-limited to 80 requests / minute / IP. No new stored fields — the indexes are computed over meet columns that were already public.
• Anonymous flyer upload. POST /api/submit/flyer-upload lets a submitter attach a flyer image without an account: the server mirrors it to Catbox and hands back the hosted URL, which rides along as suggestedCoverUrl. Images only, 10 MB cap, 6 requests / minute / IP, and it turns off with the submissions kill switch.
• Saved meets can now clean themselves up. Past saved meets are auto-removed after a retention window you pick, default 1 day after the meet ends (end of day Eastern). The preference and the purge both live .

Release timeline (from git)

The month in ship order, for anyone diffing the repo against June's report.

What we collect, in plain English

Everything from the June report still applies unless noted below. There is still no anonymous telemetry beacon and no third-party analytics SDK.

New or expanded in July

Search queries. The public meets.search procedure receives whatever you type into the search bar (capped at 120 characters) and runs it against Postgres. Queries are used to build the result set and are not written to an application table, attached to your installation id, or profiled. Like any HTTP request they can appear in short-lived Vercel access logs. The search indexes themselves store no new personal data — they index meet title, venue, address, and description, all already public.

Anonymous flyer uploads. When you attach a flyer on /submit, the image goes to our server, which validates type and size and mirrors it to Catbox. We keep the resulting files.catbox.moe URL on the submission for moderators; the upload is not tied to an account, and the only identifier involved is the request IP used for rate limiting. Catbox's own terms apply to the hosted file.

Saved-meet retention preference. Your chosen auto-removal window (default 1 day after a meet ends) is a local preference, and the purge runs on your device against your local saved list. When anonymous cloud sync is on, the resulting saved-state change syncs like any other save or unsave — we do not run a server-side deletion job against your saved rows.

Last-known drive-time cache. Meet detail may keep the most recent drive-minutes integer on your device so the estimate still renders offline. Coordinates stay on device; the value is a single integer, not a location history.

Appearance: base-color palette. Alongside theme and true-black OLED, you can pick a shadcn base-color palette. Stored in local storage only — not mirrored to us, not used for analytics.

Admin stats aggregates. /admin/stats (site administrators only) reads SQL COUNT aggregates over meets, submissions, staff accounts, active push devices, and audit rows, plus stored push dispatch counters. It does not expose individual visitor records, installation ids, or IP addresses.

Unchanged commitments worth repeating

• Near me / map distance sorting: approximate coordinates stay in-memory on the device; we do not log your live location to Postgres for sorting.
• Push device records: still no email, name, or IP in the push row.
• Submitter contact details: stored for moderation, visible only to administrators, never shown publicly.
• Orphaned sync rows: if you reset the app or clear site data, server rows keyed to the old installation id still do not auto-expire on a schedule. Inbox rows do (90 days). July did not add an orphan retention window — still on the list.
• Map tiles: still CARTO + OpenStreetMap via MapLibre — not Mapbox, not Google Maps tiles.

What we removed in July

Map reach mode and the related-meets rail (24e898f)

The "Can I make it?" map filter and the related-meets rail on meet detail are gone, along with the orphaned helpers and components behind them. The FEATURE_ETA_CONFIDENCE flag and its env entries were deleted with them. This is a straight reduction in what the map path computes about your position.

Map tile cache budget control

The Menu no longer exposes a tile-cache budget slider. Tile caching still happens with a default on-device budget; only the control was removed. Disclosed in the July 10 Privacy Policy update.

Nothing else material on the render path

April's deletion of runtime Nominatim geocoding on map/home is still in force. July did not bring it back, and added no analytics SDK, ad network, or new render-path third party.

What we added in July

v4.3 (July 10)

• Full-text search (0031) — pg_trgm, a GIN FTS index over title/venue/address/description, and a trigram index on title; public meets.search capped at 80 req/min/IP.
• POST /api/submit/flyer-upload — anonymous flyer mirror to Catbox; images only, 10 MB, 6 req/min/IP, gated by the submissions feature flag.
• Saved-meet auto-purge — on-device retention window, default 1 day after a meet ends (end of day Eastern).
• Offline ETA — last-known drive-minutes retained on device for offline meet detail.
• Tabbed meet-form wizard with preview-before-save for staff; redesigned support page; sharper Instagram prefill with visible AI and cover-mirror failures.
• Playwright e2e suite and a PR check workflow in CI.

v4.4 (July 11)

• Admin Stats page — aggregate operational overview, site administrators only.
• Staff password minimum aligned to 8 characters across the change-password UI and the shared constant.
• Runtime Live Activities kill switch — FEATURE_LIVE_ACTIVITIES=false stops client starts, ends active activities via /api/config/native-shell, and skips server push-to-start sweeps, all without an App Store rebuild. (Live Activities were removed outright in August; that lands in the next report.)
• Fixes: Live Activity stacking on relaunch, keyboard zoom on form inputs, address suggestions staying above the keyboard, toast styling, true-OLED black, and saved-meets calendar export on iOS.

Content and presentation

• Woodward Dream Cruise joined Grand Prix as a community-pick partner, with the partner presentation system refactored into an extensible list.
• Blog posts categorized as story or update, and the AI flyer story published on July 16.

Privacy Policy (July 10)

Disclosed the on-device base-color appearance preference, the optional saved-meet auto-removal window, and the on-device last-known drive-time cache; updated the tile-cache disclosure to match the removed control. Accordion history on the Privacy Policy page.

Third parties we currently rely on

Full list as of July 31, 2026. Render path = what loads when a typical visitor browses meets, map, or detail without submitting a form or opting into extra features.

On the render path (unchanged from June):

• Vercel — hosting, serverless functions, short-lived access logs. No Vercel Analytics / Speed Insights enabled.
• Neon Postgres — meets, organizers, push tokens, sync rows, inbox, live-activity sessions, leave-by push targets, rate-limit buckets, announcements.
• Apple Push Notification service (APNs) — push, Live Activity start/update/end, push-to-start, leave-by alerts.
• Apple App Store — distribution, crash reports (Apple's policy applies).
• Open-Meteo — weather card, server-proxied (meet coordinates only).
• Catbox — cover image hosting; server-to-server uploads.
• Cloudflare — DNS and edge for detmeets.com.
• OpenStreetMap + CARTO — map basemap tiles via MapLibre, *.basemaps.cartocdn.com. Direct tile fetch from your device; we do not pass installation or sync ids to CARTO.
• GitHub — source + deploy workflow for featured-blog push dispatch.

Off the render path — only when you take a specific action:

• Catbox (public flyer upload) — new in July: your flyer image is mirrored server-side when you attach one on /submit. Your IP is not sent to Catbox; our server's is.
• OpenStreetMap Nominatim — /api/address-suggest when you type in submit or the admin meet form; one-shot geocode at organizer publish; not on map/home page load.
• Instagram (instagram.com) — our server fetches public post HTML/images when you use paste-from-link prefill (your IP is not sent to Meta; our server IP is).
• Vercel AI Gateway — when vision prefill runs, caption + flyer image go to the gateway; no vision calls on browse/map/home.
• Apple Maps / Google Maps / Waze — only if you tap an external directions link; we send venue name + address, no device ids.

We do not use:

• Google Analytics or any analytics SDK.
• Meta / TikTok / Twitter / LinkedIn pixels.
• Sentry, LogRocket, FullStory, or session replay.
• Mixpanel, Amplitude, Posthog, Segment.
• Any ad network or data broker.
• Mapbox or Google Maps tiles in production.

Government and legal requests in July

• Law-enforcement requests received: 0
• Subpoenas, search warrants, or court orders received: 0
• National security letters received: 0
• Civil discovery requests received: 0
• Account or content disclosures made: 0
• Takedown notices received: 0
• Takedowns honored: 0

If we receive any of the above in a future month, the next report will say so. If we are ever gagged from saying so, the canary block above will simply not be repeated.

Security in July

• Vulnerability disclosures received from researchers: 0
• Confirmed data breaches: 0
• Confirmed unauthorized access: 0
• Flyer upload hardening — no auth by design, so the gate is strict validation (image MIME types only, 10 MB ceiling, Catbox-URL verification on the way back) plus 6 req/min/IP and the submissions kill switch.
• Search rate limit — public meets.search capped at 80 req/min/IP, query length capped at 120 characters.
• Stats page scoped down — shipped behind a stats.view permission, then restricted to site administrators the same day.
• Staff password floor — minimum length aligned to 8 characters through a shared constant instead of scattered literals.
• Live Activities kill switch — lets us disable a client feature server-side without waiting on App Store review.
• e2e coverage in CI — Playwright specs for home, map, meet detail, and submit now run on pull requests.
• Structured server logging — still reportError / reportEvent JSON lines to Vercel function logs only; not shipped to Sentry or any vendor.

If you find a security issue, message @alex.30mm on Instagram.

Numbers (light)

• Posts published in July: 4 (4.3 changelog, 4.4 changelog, June transparency report, AI flyer story).
• Web marketing version at end of July: 4.4. iOS project version: 4.3 (build 22).
• Privacy Policy effective dates in July: 1 (July 10).
• Database migrations applied in July: 1 (0031).
• Notable endpoints added in July: /api/submit/flyer-upload.
• Render-path third parties added: 0. Removed: 0.
• Feature flags removed: 1 (FEATURE_ETA_CONFIDENCE).
• Inbox retention: 90 days (nightly prune) — unchanged.
• Orphan sync retention: still none scheduled.

Closing

June was quiet and operational. July was two releases in four days, and the part I am happiest about is the subtraction: reach mode gone, the related rail gone, a dead flag gone, and a tile-cache control that existed mostly to be fiddled with gone. What got added — search, flyer upload, saved-meet auto-purge, offline ETA — either stores nothing new or stores it on your device. Still no ads, no analytics SDKs, no new render-path vendors.

Apologies for the late publication. If something is wrong, missing, or you want a category tracked next month, message @alex.30mm on Instagram.

Effective: July 31, 2026 · Period covered: July 1 – July 31, 2026 (published August 30, 2026)

Privacy Policy · Terms · June 2026 Transparency Report · Detroit Meets on the App Store