← Map🎃 Porchlight

Privacy policy

Effective 2 October 2026

Porchlight is a community map of houses handing out candy on Halloween: the Porchlight iPhone app and the Porchlight web app on this site. This policy explains what data they handle, why, who else is involved, and what you can do about it. It covers both the Swiss Federal Act on Data Protection (FADP) and, for people in the EU and EEA, the General Data Protection Regulation (GDPR).

The short version

  • No accounts, no names, no email addresses, no ads, no analytics, no tracking.
  • Your app or browser gets a random, anonymous ID so your pins, candy-level says and saved spots stay yours.
  • Pins are anonymous. We store which anonymous ID dropped a pin and each ID’s say on its candy level, never who you are.
  • A pin’s position, address, note and candy level are public. That is the point of the app.
  • Pins are deleted the morning after Halloween.
  • Your location stays on your phone, except when you use a feature that needs it (like dropping a pin or walking directions).
  • Area alerts and notifications can be turned off at any time.

1. Who we are

Porchlight is made by an independent developer based in Switzerland (“the Porchlight developer”, “we”). The Porchlight developer is the controller responsible for the personal data described here.

Questions, requests or complaints: gonikman@me.com.

2. What we collect and why

Anonymous identity

There are no accounts. The first time the app or this site talks to our server, the server creates a random ID and stores it in a cookie on your device. The cookie is signed so it cannot be forged, and it lasts one year. It is the only thing that connects the pins you dropped, your candy-level says, your saved spots and your alert area to you; it contains no name or device information. On our server we keep that ID with the times of your first and latest change (such as a pin, a say or a save).

We use it to show you which pins you dropped, to remember your saved spots and says, and to limit abuse (at most 15 pins per ID a year).

Browsing the map

To show pins, the app asks our server for the pins in the part of the map on your screen. Our server doesn’t store which area you looked at. The request itself does appear in our server logs (see Server logs).

Dropping a pin

Anyone can drop a pin on a house handing out candy, without an account. We store the pin’s position on the map, the nearest street address, the note you wrote for neighbors (if any), the allergy-safe, vegan and haunted-yard flags you picked, how much candy is left, when it was dropped and last changed, when it expires, and which anonymous ID dropped it. A pin has no name. The note is public like the rest of the pin and is deleted with it.

Pins go within 1 km of where you are, so dropping one needs your location: the app sends your current position along with the pin, our server checks the pin is within 1 km of it, and then forgets it. Your position is not stored or logged.

We use this to put the pin on the map for everyone, to show you the pins you dropped, to keep the same house from being pinned twice, and to alert people who asked to hear about new spots nearby or who added the pin to their route.

Candy-level says and saved spots

Anyone can say how much candy is left at a pin: plenty, low or all out (the person who dropped it says so first). We store each say with your anonymous ID and the time; saying again replaces your earlier say. The latest say from anyone becomes the pin’s level for everyone, and pins show only that level and how many people have said. When you add a pin to your route, the app also saves it to your saved spots on our server, so we can tell you if that spot runs low or out of candy. The route itself (its order and stops) is kept on your phone, or in your browser on the web.

Walking directions

When you ask for walking directions, the app sends your current position, the pins on your route and your preferred units (miles or kilometres) to our server, which asks the FOSSGIS Valhalla route planner for a walking route and passes it back. While you walk, the app asks again from your current position if you take a wrong turn. We don’t store these positions or routes.

Address lookups

While you place a pin, our server looks up the nearest street address for that point, and the apps let you search for an address. Our server sends the coordinates (rounded to about a metre) or your search text to OpenStreetMap’s Nominatim service. Nominatim asks its users to cache answers, so we keep each answer for 90 days, stored by coordinates or search text only, not by who asked.

Area alerts and notifications

If you turn on area alerts, we store the circle you chose (its centre and radius) and the address we deliver notifications to. In the iPhone app that is your device’s push token, a code from Apple that lets us send notifications to this app on this device. In the web app it is your browser’s push subscription: an address at your browser’s push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge) plus two encryption keys, so that only your browser can read the notifications we send. If you allow notifications when adding a pin to your route, we store the push token or subscription alone. The apps re-send it each time they open while notifications are allowed, because it can change.

We use these to notify you when someone drops a pin inside your circle, and when someone says a pin on your route is running low, all out or has plenty again. A notification carries the pin’s address and its position, plus its candy level for a route alert. In the app it is delivered by the Apple Push Notification service; on the web it is encrypted end to end and delivered by your browser’s push service, which cannot read it.

The iPhone app also reminds you about Halloween on 30 and 31 October. It schedules these reminders on the phone itself: nothing is sent to or from our server for them. The web app sends no Halloween reminders.

Tips

Tips in the iPhone app are In-App Purchases handled by Apple. Tips on the web are paid on a payment page run by Stripe: the tip button takes you to Stripe, which processes your payment and card details under its own privacy policy, and then back to this site. We receive nothing about the payment from the app side, and our server is not told whether or how much you tipped.

Stored in your browser (web app)

The web app keeps some things only in your browser’s local storage, the way the iPhone app keeps them on your phone: your route (its stops and their order), the pins you hid from your map, and similar settings. They are not sent to our server. Clearing this site’s data in your browser deletes them.

Reports and moderation

Anyone can report a pin, with an optional reason. We store the report, the reason and the anonymous ID that sent it. Three reports hide a pin automatically. The developer reviews reported pins and can hide, restore or delete them; restoring a pin clears its reports. Pins you hide from your own map are listed on your phone or in your browser only; we are not told.

Abuse protection

To stop spam, we count how often each anonymous ID does certain things (dropping pins, saying how much candy is left, saving, reporting, looking up addresses, asking for directions, changing alerts): we record the action and the time, nothing else. That is how each ID is held to 15 pins a year.

Server logs

Our hosting provider, Cloudflare, records a log entry for each request to our server: the time, the address that was requested (for map requests, that includes the map area shown) and technical details about the request and response. Cloudflare processes your IP address to deliver every request. Our own code logs errors and delivery problems, not the contents of your requests. We use logs only to keep the service running and to investigate problems.

Legal bases (GDPR)

We process this data to provide the features you choose to use (Art. 6(1)(b) GDPR) and, for abuse protection, moderation, security and logs, on the basis of our legitimate interest in running a safe and reliable service (Art. 6(1)(f) GDPR). Location access and notifications rely on the permission you give in iOS or your browser, which you can withdraw at any time.

3. What we don't collect

  • No accounts and no sign-in, so no Apple or Google Account details and no passwords.
  • No names, email addresses or phone numbers (unless you email us).
  • No advertising, and no advertising identifiers.
  • No analytics, tracking or advertising SDKs in the app, and no tracking on this site.
  • No third-party cookies. This site sets only the anonymous identity cookie.
  • No contacts, photos or camera. The flashlight button uses the torch without camera access.
  • No location in the background.
  • We don’t sell or share your data for advertising, and we don’t track you across other apps or sites.

4. Your location

The app asks for location access only while you are using it (“While Using the App”). It never asks for background location. Your location is used on your phone to show where you are, how far each pin is, and to open the map near you.

It leaves your phone only in these cases:

  • Walking directions: your current position goes to our server and on to FOSSGIS Valhalla to plan the route, and again if you need rerouting. Not stored.
  • Dropping a pin: your current position goes to our server with the pin, to check the pin is within 1 km of you. Not stored or logged. The drop point goes to our server for an address lookup (Nominatim, see above) each time you move it, and is stored only if you drop the pin.
  • Browsing the map: when the map is centred on you, the area it shows reveals roughly where you are to our server (not stored, but visible in logs) and to OpenFreeMap, which serves the map images directly to your device.

Your alert area is a circle you pick on the map, not your live location. In the web app, your browser asks before sharing your location, and the web app uses it the same way, in your browser.

Nominatim and Valhalla receive requests from our server, never your IP address or your anonymous ID.

5. What is public

A pin is public by design. Anyone using the app or this site can see for each pin:

  • its exact position on the map and its address;
  • the note its dropper wrote for neighbors, if any;
  • the allergy-safe, vegan and haunted-yard flags and the candy level;
  • how many people have said how much candy is left, when someone last said so, and when the pin was dropped and last updated.

Each pin also has a shareable web page. People with area alerts around a pin get a notification with its address. Others never see your anonymous ID, which pins you dropped, who said what about a pin, which pins you saved, or your alert area. Nothing on the map ties a pin to the person who dropped it.

6. Services we rely on

  • Cloudflare, Inc. (USA) hosts our server, database, notification queue and logs. It processes every request to our server, including your IP address. Privacy policy
  • OpenStreetMap Foundation (UK) runs Nominatim, which receives address lookups from our server. Privacy policy
  • FOSSGIS e.V. (Germany) runs the public Valhalla route planner, which receives walking-route requests from our server. Privacy policy
  • OpenFreeMap (Hyperknot Software Kft., Hungary) serves the map images and fonts directly to your device, so it receives your IP address and the map areas you view. Privacy policy
  • Apple delivers notifications through the Apple Push Notification service, which receives your push token and the notification content. Privacy policy
  • Apple also processes tips you leave in the app (In-App Purchase). Apple handles the payment; we receive no payment details, and the app doesn’t tell our server whether or how much you tipped. Privacy policy
  • Your browser’s push service delivers web notifications: Google (Chrome, Android), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge), depending on your browser. It receives your push subscription address and the notification encrypted so that only your browser can read it. Google, Mozilla, Apple, Microsoft
  • Stripe processes tips you leave on the web, on its own payment page. Stripe handles the payment and your card details; we receive nothing about it from the web app, and our server is not told whether or how much you tipped. Privacy policy

We don’t share data with anyone else, unless the law requires us to.

7. International transfers

Our database is stored by Cloudflare in Europe. Cloudflare runs a global network, so your requests are handled at a Cloudflare data centre near you, which may be outside Switzerland and the EU, and Cloudflare, Apple, Google, Mozilla, Microsoft and Stripe are based in, or process data in, the USA. Where data goes to a country without an adequate level of data protection under Swiss or EU law, we rely on the safeguards these providers offer, such as the EU and Swiss standard contractual clauses or their certification under the EU–US and Swiss–US Data Privacy Framework.

8. How long we keep data

  • Pins: until the morning after the Halloween they were dropped for (06:00 local time, roughly; a pin dropped after that morning lasts until the next Halloween). They leave the map then and a daily cleanup deletes them within a day; a moderator can delete one sooner. Deleting a pin also deletes its note and the candy-level says, saves and reports about it.
  • Your candy-level says and saved spots: until the pin they are about is deleted; you can remove a saved spot sooner. Saying again on the same pin replaces your earlier say.
  • Your reports: until the pin is deleted or a moderator restores it, which clears its reports.
  • Your alert area: until you turn alerts off. It is also deleted when Apple or your browser’s push service tells us the push token or subscription no longer works, when the same device or browser registers under a new anonymous ID (for example after reinstalling), or when it hasn’t changed for 45 days and the device is no longer registered.
  • Your push token or web push subscription: until Apple or your browser’s push service tells us it no longer works, or 45 days after the app last sent it.
  • Abuse-protection counts: deleted by a daily cleanup once they no longer count toward a limit: after a year for the pins you dropped (the 15-pins-a-year limit), after at most a day for everything else.
  • Address lookup cache: 90 days.
  • Server logs: kept by Cloudflare for at most 7 days.
  • Notifications: queued only until sent (messages that keep failing are set aside and deleted automatically within days); Apple and the web push services drop an undelivered notification after one hour.
  • Your anonymous ID: the cookie on your device expires after one year. Our record of the ID (with the times of your first and latest change) is not deleted automatically; ask us and we will delete it.
  • Backups: our database provider keeps a rolling restore history, so deleted data can remain in it for up to 30 days.

9. Security

All traffic between the app and our server is encrypted (HTTPS). The identity cookie is signed with a secret key, can’t be read by scripts on the page, and is sent only over HTTPS. Only the developer can access the database, and moderation tools run only on the developer’s computer, not on this site. Request limits make bulk abuse harder. No system is perfectly secure, but we keep what we hold to the minimum the features need.

10. Your rights

Under the FADP and the GDPR you can ask what data we hold about you, ask us to correct or delete it, object to or restrict its processing, and receive a copy of data you provided. You can withdraw any permission at any time. Most of this you can do yourself in the app:

  • Correct a pin: on its sheet, under “Still candy here?”, say Plenty, Running low or All out; the latest say counts for everyone. Pins can’t be edited or deleted in the app; email us to have one you dropped removed before it expires.
  • Your home is on the map and shouldn’t be: report the pin (“Report pin…”, “Private home, please remove”), or email us.
  • Stop area alerts: open area alerts and tap “Turn off”. This deletes your alert area.
  • Remove saved spots: remove the pin from your route.
  • Stop all notifications: turn off notifications for Porchlight in iOS Settings, or for this site in your browser’s settings. Your push token or subscription is then deleted from our server as described above.
  • Stop location access: iOS Settings → Privacy & Security → Location Services → Porchlight.

Deleting the app removes the identity cookie and your route from your phone; on the web, clearing this site’s data in your browser does the same. Pins you dropped stay on the map until they expire, with nothing left that links them to you.

For anything else, email gonikman@me.com. We don’t know your name or email address, so we can’t find your data by them: the only link between you and your data is the anonymous ID in your app or browser. Tell us which pin or data you mean, and we may ask you to do something from the app (for example, add that pin to your route) so we can confirm it is yours. We answer within 30 days.

You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU or EEA, the authority where you live or work.

11. Children

Porchlight is made for parents and other adults planning a trick-or-treat route or marking houses with candy. It is not directed at children, it asks for no information about children, and we don’t knowingly collect any. If you believe a child has dropped a pin or published other information, email us and we will remove it.

12. Changes to this policy

If the app or our services change in a way that affects your data, we will update this page and its effective date. Significant changes will be called out at the top of this page.

Contact: the Porchlight developer, gonikman@me.com.