March to November 2026 Transparency Report

This report covers everything else since the project started, so it's the whole history in one place: what we collect, what we removed, who we rely on, and any government or legal request we received.

The period is March 25, 2026, the day of the first commit, to November 1, 2026.

If you're curious about a specific month or any other period, I'm happy to provide a report for it at any time.

Headlines

• First commit on March 25, 2026, with a public beta notice on the site the next day. The app launched on the App Store on April 22 at version 2.1. The web product has been through 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 4.3, 4.4, and 4.5. The iOS project is at 4.4 (build 23) and Android at 4.4 (versionCode 2), which hasn't shipped to a store.
• One third party joined the render path (Open-Meteo, proxied through our server). One left it (Nominatim geocoding on every map page render, deleted in April).
• Live Activities and the iOS background location permission were added in May and deleted on August 30, along with the tokens and the table behind them. The "Can I make it?" map mode and the related-meets rail were removed in July.
• Three off-render-path vendors were added: Instagram fetches and Vercel AI Gateway for flyer prefill in May, and Upstash QStash for leave-by alerts in August.
• The Privacy Policy didn't name QStash until October 6, five weeks after the feature shipped. That was my miss.
• 0 government, law-enforcement, or civil legal requests. 0 account or content disclosures. 0 takedown notices. 0 data breaches. 0 ad networks. 0 analytics SDKs.

What changed, month by month

The period is 186 commits: 39 in March, 73 in April, 25 in May, 9 in June, 30 in July, 9 in August, 1 in September, and none since. Hashes are from the repo, in case you want to diff it yourself.

March (39 commits, first commit March 25)

April (73 commits, version 2.1 to 3.1)

May (25 commits, versions 3.2, 4.0, and 4.1)

June (9 commits, version 4.2)

July (30 commits, versions 4.3 and 4.4)

August (9 commits, version 4.5)

September to November 1 (1 commit)

What we collect, in plain English

There's no anonymous telemetry beacon and no third-party analytics SDK in the app or on the site. That was true at the start of May and it's true now. This is the full list of what the server receives, as of November 1.

From everyone who visits

Standard web request data that any server sees: IP, user-agent, the page you asked for, and the referrer if your browser sent one. Vercel keeps it in short-lived access logs. We don't aggregate it, sell it, or build a profile from it. Cookies are limited to what staff login needs, like CSRF protection. No advertising or third-party cookies.

From people who enable push notifications

An opaque APNs device token, an opaque installation identifier we generate on first launch, the platform, and your permission state. No email, name, IP, or device fingerprint.

From people whose install syncs saved meets

Each install gets its own identifier. With sync on, the server stores saved meet ids and when you saved them, your reminder choices, a small snapshot copied from the public listing so saved meets render offline, a last-seen time, the platform, and an app version string. Since June sync is on by default in current builds, though operators can switch it off.

Sync was never cross-device by default. Two devices are two unrelated installs. Since May 21 you can copy a sync ID from one device and paste it into another, but nothing links installs unless you do that yourself.

Since May, with sync on, the server also holds inbox rows (kind, title, body, deep link, optional meet id, read time) and in-progress submit drafts, both keyed to your installation id. Inbox rows older than 90 days are deleted every night.

From people who open a meet with a weather card

Your device asks our own /api/weather endpoint, and our server asks Open-Meteo for the forecast at the meet's coordinates and start time. Open-Meteo sees our IP and the meet's location, never yours.

From people who tap a push notification

One short call records the notification id, its category, and an opened time. It isn't attached to your installation id.

From errors

When a page crashes inside the React error boundary, the browser posts the error message, error name, a short digest, a truncated stack, and the page URL to /api/report-client-error, which writes it to our server logs. No DOM contents, form data, cookies, headers, or IP address are in the payload.

From the native app on launch

One call to read the minimum supported build number. It sends no identifiers.

From people who use leave-by alerts

When you save a meet and turn on leave-by alerts, your device sends an integer for estimated drive minutes. Never coordinates. Since August 30, we use that number to schedule two delayed jobs through Upstash QStash, one early alert and one urgent alert. Each job carries your installation id, the meet id, and which alert it is. QStash calls a signature-verified route on our server when the job comes due and we send the push through Apple. We keep the two QStash message ids on your leave-by row so a fresh drive time can cancel the old jobs.

From people who submit a meet or use the API

Public submissions without an account started April 30 (3.1), with a honeypot, rate limiting, and a kill switch. Submitter contact details are stored for moderation, visible only to administrators, and never shown publicly. Your IP is used only as a short-lived rate-limit key and isn't stored with the submission (see the audit section below for when that wasn't true). If you attach a flyer, our server mirrors it to Catbox, so Catbox sees our IP and not yours. The public status lookup at /submit/status returns rows that match the contact detail or sync ID you type in, so treat those like lightweight credentials.

Search queries (capped at 120 characters) are run against Postgres and not written to any table. The public API at /api/v1 returns only fields that are already public on the site. We don't issue API keys, so there's no account to tie requests to.

From organizers and staff

Organizer accounts are username-only, with no email or real name required. Sign-in runs on Better Auth in our own database. Staff accounts can carry permission flags and internal notes that only administrators see. The admin stats page shows SQL counts, not individual visitor records.

What stays on your device

Near me and map distance sorting keep approximate coordinates in memory on the device. We don't log your live location to Postgres. Saved-meet auto-removal, the last-known drive-time cache, your theme and palette, and the offline tile cache are all local to your device. Sunset and golden-hour times are computed on the device from public venue coordinates.

What we removed

• Runtime Nominatim geocoding (April 29). The home and map pages used to send a meet's venue address to OpenStreetMap whenever coordinates were missing. Geocoding now happens once, when an organizer publishes, and the result is stored. A meet without coordinates just doesn't get a pin.
• The clear-must-change-password endpoint (April). A Better Auth database hook does the same job server-side, so there's one fewer endpoint.
• Alternate iOS app icons (May 14). They shipped and were pulled the same day.
• Map reach mode, the related-meets rail, and the FEATURE_ETA_CONFIDENCE flag (July 10).
• The tile-cache budget slider (July). Caching still happens with a default budget. Only the control went away.
• iOS Live Activities (August 30). Two Swift plugins, the push-to-start and per-activity APNs tokens, three API routes, a cron job, the session table, and the FEATURE_LIVE_ACTIVITIES kill switch. Migration 0032 dropped the table and the token column, so those records no longer exist on our side. I'd rather delete a feature than keep storing tokens for it.
• The iOS background location permission (August 30). It existed only for Live Activity drive-time refresh. The app can now read your location only while it's open, and the only background mode left is remote-notification, which push needs.
• The five-minute leave-by poller (August 30). The cron became an hourly backstop, because QStash handles scheduling, and in November it moved to once a day.

What we added

• Native apps and push (April). iOS and Android shells that render the same web content, with push through Apple. Android hasn't shipped to a store.
• Weather card (April). Open-Meteo, proxied through our server, sees only meet coordinates and start time.
• Public meet submissions (April 30). No account needed, with a honeypot, rate limiting, and a kill switch.
• MapLibre (May). Same CARTO and OpenStreetMap tiles, fetched by your device directly.
• Inbox, /status page, and health check (May). The status page and /api/health report aggregate probes only.
• Paste-from-link prefill (May). Our server fetches the public Instagram post and, if you ask for it, sends the caption and image to Vercel AI Gateway for prefill. Not used on browse, map, or home.
• Leave-by alerts without a Live Activity (June), then scheduled through QStash (August).
• Saved-meets calendar download (June). You POST public meet ids and get an .ics back. No installation id in the request.
• Editorial spotlight (June). Presentation only.
• Full-text search (July). Indexes over columns that were already public.
• Anonymous flyer upload (July). Images only, 10 MB cap.
• Public API v1 and /developers (August). Documented in the Terms under Section 6a.

Third parties we currently rely on

As of November 1, 2026. The render path is what loads when a typical visitor browses meets, the map, or a meet page without submitting anything.

On the render path:

• Vercel, for hosting, serverless functions, and short-lived access logs. Vercel Analytics and Speed Insights are off.
• Neon Postgres, for meets, organizers, push tokens, sync rows, inbox, leave-by targets, rate-limit buckets, and announcements.
• Apple Push Notification service, for push and leave-by alerts.
• Apple App Store, for distribution and crash reports under Apple's policy.
• Open-Meteo, for the weather card, through our server.
• Catbox, for cover images, through server-to-server uploads.
• Cloudflare, for DNS and edge.
• OpenStreetMap and CARTO, for map tiles from *.basemaps.cartocdn.com. Your device fetches them directly. We pass no installation or sync id to CARTO.
• GitHub, for source and the deploy workflow behind featured-blog push.

Off the render path, only when you do something specific:

• Upstash QStash, when you have a saved meet with leave-by alerts on. It gets your installation id, the meet id, and the alert kind, from our server.
• Catbox, when you attach a flyer on /submit.
• OpenStreetMap Nominatim, for address suggestions while you type in the submit or admin form, and a one-time geocode when an organizer publishes.
• Instagram, when you use paste-from-link prefill. Meta sees our server's IP.
• Vercel AI Gateway, when vision prefill runs on a flyer.
• Apple Maps, Google Maps, or Waze, only if you tap an external directions link.

We don't use Google Analytics or any analytics SDK, Meta, TikTok, Twitter, or LinkedIn pixels, Sentry, LogRocket, FullStory, or any session replay, Mixpanel, Amplitude, PostHog, or Segment, any ad network or data broker, or Mapbox or Google Maps tiles in production.

The QStash gap

The August 30 Privacy Policy described leave-by scheduling but never named Upstash or said what each scheduled job carries. It should have. The August and September reports both flagged it, and it was fixed on October 6, 2026: the Privacy Policy now names QStash in Section 9 and lists exactly what each job contains. It's the one Privacy Policy change in October.

Privacy Policy and Terms changes

Privacy Policy updates are dated April 1 (iOS app and Vercel hosting), April 20 (Catbox uploads), April 22 (App Store launch, CCPA statement, Neon named), April 23 (push notifications), April 28 (sync and Open-Meteo), April 30 (public submissions), May 6 (staff permissions and internal notes), May 13 and 14 (Live Activities, leave-by alerts, inbox, rate limits, share extension, health endpoints), May 21 (sync linking, submit status, address suggestions on the public form), June 2 (leave-by without Live Activity, calendar download), July 10 (appearance preference, saved-meet auto-removal, drive-time cache, tile cache), August 30 (Live Activities removed, leave-by scheduling, public API), October 6 (QStash named), and November 1 (public flyer uploads, search, and Cloudflare disclosed, plus retention and deletion requests). The Terms changed on April 22, April 23, April 30, May 13, May 21, August 30, and November 1. The full history is in the accordion on the Privacy Policy page.

Government and legal requests, March through November 1

• Law-enforcement requests received: 0
• Subpoenas, search warrants, or court orders received: 0
• National security letters received: 0
• Civil discovery requests received: 0
• Account or content disclosures made: 0
• Takedown notices received: 0
• Takedowns honored: 0

If we receive any of the above, the next report will say so. If we're ever gagged from saying so, this block will simply stop appearing.

Security, March through November 1

• Vulnerability disclosures received from researchers: 0
• Confirmed data breaches: 0
• Confirmed unauthorized access: 0

What changed:

• Server-side HTML sanitization went in on April 2.
• Rate limits went onto /api/push/register (40 a minute per IP) and /api/report-client-error (24 a minute) in April.
• The April 24 featured-push workflow replaced a Vercel cron with a deploy-completion GitHub Actions workflow and a bearer secret, which removed a standing endpoint anyone could hit.
• Later limits: sync writes (60 a minute), meet search (80), the calendar download (30), flyer upload (6), the prefill endpoint (12), and the public API (60) as those shipped.
• The May 11 audit capped sync batches at 500 entries, made push unregister check the token, switched cron secret checks to a timing-safe comparison, and added a baseline content security policy.
• The QStash delivery route only accepts requests signed with our QStash keys, so nobody else can trigger a leave-by push by calling it.
• Deleting Live Activities removed a credential per device from our database.
• Better Auth went to 1.7 on September 1, with migration 0034 for staff sign-in.
• Server logging stays as JSON lines in Vercel function logs. Nothing is sent to an error-tracking vendor.

If you find a security issue, message @alex.30mm on Instagram.

What the November audit found

Before publishing this I audited the code against the Privacy Policy and this report. Everything below was fixed before this went out.

• Three disclosure gaps. Anonymous flyer uploads (July), the search bar (July), and Cloudflare weren't in the Privacy Policy. The November 1 update adds them. The flyer upload shipped about four months before the policy said anything about it.
• Submitter IPs were being stored. The Privacy Policy said the IP behind a meet submission was only a short-lived rate-limit key and never stored with the submission. That wasn't true. Every submission since April 30 saved the IP on its row. Rate limiting now uses the short-lived bucket the policy describes, and a migration deleted the column along with every stored IP. They were never shown anywhere in the app, publicly or to staff, and never shared.
• A server-side request forgery hole. The "Fill from link" feature would fetch any address you gave it, including our own internal ones. It now refuses private and internal addresses and checks every redirect.
• Out-of-date dependencies. Next.js, Better Auth, and the Capacitor iOS shell all had published security fixes we hadn't picked up. All three are upgraded.
• Orphaned installation rows. I said in April that I'd commit to a retention window for rows left behind when you reset the app or clear site data, and it took until now. Anything keyed to an installation id is now deleted automatically after 12 months with no sync or push activity. Inbox rows still go after 90 days.

Numbers

• Web version: 3.0 on April 29, 4.5 on August 30, unchanged since.
• iOS project: 2.1 (build 7) at App Store launch, 3.0 (build 19) at the end of April, then 4.0 (build 21), 4.3 (build 22), and 4.4 (build 23).
• Commits: 186. Database migrations: 35 (0000 through 0034): 11 in April, 17 in May, 3 in June, 1 in July, 2 in August, 1 in September.
• Monthly reports published more than a week late: 4 of 6 (June through September).
• Render-path third parties: 1 added (Open-Meteo), 1 removed (Nominatim on map and home). Off-render-path third parties added: 3.
• Inbox retention: 90 days, unchanged since May. Other installation data: 12 months without activity, starting November 2026.

Closing

Most of what I added since March stores nothing new or stores it on your device, and the biggest single change was a deletion. The vendor miss is the part I'd undo if I could. Still no ads, no analytics SDKs, and no sale or sharing of your information.

If something here is wrong or missing, message @alex.30mm on Instagram.

Effective: November 1, 2026 · Period covered: March 25 – November 1, 2026 (published November 1, 2026)

Privacy Policy · Terms · Detroit Meets on the App Store