Privacy

This page explains how Have & Seek handles your information.

Who runs this

Have & Seek is a project of VFR Solutions, which operates it.

The mobile app

The Have & Seek app uses the same account and data described on this page. It keeps your sign-in session in secure device storage and may temporarily cache images. Camera access is requested only when you choose to take a photo; choosing an existing image uses the system photo picker. The app does not request your device location: you choose a city, ZIP or area yourself. Website analytics described below apply to browser pages, including pages you open from the app.

What is stored

• Your sign-in email address. It is not shown publicly or on your profile, and other members cannot see it. Admins and the operator can see it in the admin user list, and our service providers handle it to sign you in and deliver sign-in emails. If you continue with Google, we receive your Google account’s email address and whether Google has verified it.
• Your display name, optional profile image, optional general area (city/ZIP center) and member-since date.
• Posts, photos, saved posts, messages, blocks and reports you create.
• Basic sign-in records kept by our database and authentication provider (Supabase).
• An activity log of account and site actions (for example: signed up, signed in, post created, edited or status changed, photo added, message sent, post saved, member blocked, report filed, profile updated). Each entry records only the kind of action, when, which account, who performed it and internal item IDs; never message or post text, search terms or locations. Entries are kept for 90 days; older entries are deleted as new activity is recorded.
• Anonymous visit measurements on public pages, described under Site analytics below.

Contact messages and operator alerts

VFR Solutions receives an email when a new account is created, containing the account email address, signup time and member ID. Contact form messages include the name, reply email and message you provide; they go privately to the operator so we can respond.

The operator also receives usage alerts. When a member publishes a Listing or Quest for the first time, the alert contains the post type, its title, the publication time and the post's public link. Edits, pausing, resuming or republishing the same post do not send another alert. When members send each other private messages, the operator receives only a count of messages sent across the whole site in a fixed 15-minute window, with the window and first/last times. These messaging alerts never include message text, snippets, attachments, conversations or links to them, or the names, emails or IDs of the people involved, and reading messages does not trigger them. Accounts used for testing, demonstrations and directory review are excluded.

Cloudflare processes these emails. Delivery records and queued content are kept privately; successfully delivered queue entries are removed after 30 days. Email copies remain in the operator's mailbox. Contact messages and operator alerts are not published or included in analytics.

Who can see what

• Anyone, signed in or not, can see published and closed posts, their photos and approximate city or ZIP, the author’s display name, profile image (if they added one) and member-since date, and the author’s other published posts. Search engines may index the home page, the About, Help and Safety pages and published or closed posts; other pages ask not to be indexed, but pages can still be viewed and shared.
• Your optional general area on your profile is shown only to signed-in members.
• Drafts, paused and archived posts are visible only to you (admins can review posts that were published).
• Posts hidden by an admin, and posts by removed accounts, are not shown to the public.
• Message content is visible only to the two members in the conversation. Admins can see that a message was sent and when, but not what it says or who received it.
• Other members cannot see your saved posts or blocks; admins can see in the activity log that you saved a post or blocked a member. Reports and the admin audit log are visible only to admins.
• Admins can see account details for every account (email, display name, access status, whether the email is verified, sign-up and latest sign-in times, and how many Listings and Quests it has) and the activity log described above.
• Blocking someone stops messages between you in both directions and hides their posts from your signed-in map results. It does not make your published posts private: anyone, including a person you blocked or a removed account, can see published posts while signed out.

Photos

Photos are stored privately and shown through links that expire after about a minute. Photos of published and closed posts can be viewed by anyone; photos of drafts, paused, archived or hidden posts cannot. Uploaded photos are re-encoded on our server, which drops embedded metadata such as camera GPS location.

Profile images

A profile image is optional and never required to post or message. We do not copy your Google account picture. If you add one, it is public: anyone, signed in or not, can see it on your profile and next to your posts. It is cropped to a square, re-encoded on our server (dropping embedded metadata such as camera GPS location), stored privately and shown through links that expire after about a minute. When you replace or remove it, or your account is removed from the site, it stops being shown; a link handed out just before can keep working until it expires, and anyone who already saved the image keeps their copy. Profile images are not used in search-engine previews or site analytics.

Site analytics

The cross-site comparison also keeps a minimal page counter: time, public page path, a recognized AI referral category when present, a random reference for that one page opening, and an optional internal/testing label. It creates no additional browser or session identifier. Records are retained indefinitely. Measurement preferences can stop counting or mark an owner/test browser for one year; these choices apply to this browser and site.

To understand how the site is used, VFR Solutions runs its own first-party analytics. There is no advertising or third-party tracking code, and analytics data is not sold or shared for advertising.

• Which pages: only the unfiltered home page, the About, Help and Safety pages, and published or closed post pages. Searches, filters, sign-in, account, saved posts, your posts, messages, member profiles, posting and editing, admin and error pages are never measured.
• What is recorded: the page address without any query string (for a post, only its ID, not its title or text); the website that linked here (external domain or approved public page path on this site, without queries) and campaign tags in the link; time actively on the page and how far it was scrolled; screen and window size, browser language, device type, browser and operating system family; page load timing; and clicks on links to other public pages, sign-in, posting, email or phone links, other websites (domain only), approved downloads, video milestones and when a form is started, submitted, confirmed or returns an error (which form, never what was typed). Approximate location (country, region, city, postal area, timezone and network location when available) comes from our hosting provider’s network lookup.
• What is not recorded: your name, email, account or member ID, messages, post titles or descriptions, search terms, map areas, form contents, sign-in links or codes, full IP addresses or full browser identification strings.
• Cookies: two random analytics identifiers set by this site and not readable by page scripts: one for the browser (kept up to 180 days) and one for the visit (expires after 30 minutes of inactivity). They are not linked to your account. Opting out sets a preference cookie for 2 years.
• AI and search crawlers: when a recognized automated agent (for example ChatGPT, Claude or Googlebot) requests a public page, we note the agent’s name, its stated purpose, the page and the time.
• Where and how long: measurements are sent from our server to VFR Solutions’ analytics service on Cloudflare and stored in a database separate from member data. They are retained indefinitely and viewed only by the operator.
• Your choices: nothing is recorded when your browser sends Global Privacy Control or Do Not Track. You can also turn analytics off for this browser.

Analytics for this browser is currently on (unless your browser sends a privacy signal). Turn analytics off for this browser. Clearing this site’s cookies removes the choice.

Location preference and approximate location

If you choose a location on the location page or the board, this site stores one first-party preference cookie for about 180 days: hs_area for a named region’s code (or us for All United States), or hs_place for a town or ZIP you chose with its distance, stored as that place’s reference code and a whole number of miles (never coordinates). Saving one clears the other. These cookies are not readable by page scripts, are not linked to your account, and are not used to decide what you may do or for analytics. They only fill in the location when you open the board without a location in the link; links you share always carry their own location. Clearing this site’s cookies removes them.

Without a remembered choice, a member’s profile home place is the starting center. Otherwise our hosting provider’s approximate network (IP) location for the request is used, on the server only, to look up a nearby town in our public place list and the region it is in; it is shown as “approximate”. It is often imprecise and can be wrong, for example on a VPN or mobile network. The coordinates are not stored, logged, sent to your browser or used for analytics, and nothing is suggested outside the United States. Choose any location or All United States to replace the suggestion. The site never asks for your device location.

To name the region of a place, the site looks up that place’s public reference center; region outlines are static files and are never combined with your account.

AI assistant connections

You can use Have & Seek from an AI assistant such as ChatGPT or Claude through our connector (see Connect AI assistants). Connecting your account is optional: an assistant can search and read published content without it.

• Without connecting, the assistant receives only public information: published and closed posts, their photos (through links that expire after about a minute), approximate city or ZIP centers and distances, public member profiles, categories, places and regions.
• If you connect your account, you sign in on haveandseek.com and approve the app on our consent page. When you ask it to, the assistant can then use its tools to read your account summary and profile (display name, home place, member-since date, profile image link), your posts in every status including drafts, your post photos, saved posts, blocked members, and your conversations and messages, including what the other member wrote to you. It can also update your profile, create, edit, publish, pause, close or archive your posts, delete drafts and post photos, send messages, save posts, block members and file reports for you. Photos and profile images can only be uploaded on the website.
• Never through the tools: your password, sign-in links or codes, admin or moderation data, the activity log, reports (including ones you filed), or other members’ drafts, messages, saved posts and blocks. The tools do not return your email address. The access token our authentication provider (Supabase) issues to the connected app carries standard sign-in details, which can include your account email address.
• Whatever the assistant receives is handled by its provider (for example OpenAI or Anthropic) under that provider’s own terms and privacy policy, including how long it keeps your conversations. We do not control those copies. See the OpenAI privacy policy and Anthropic privacy policy.
• Supabase keeps a record of each app you approve (the app’s registration and when you approved it), including after you disconnect it. Actions an assistant takes for you are recorded in the same activity log, and kept for the same 90 days, as actions on the website. Connector requests are not included in site analytics.
• You can disconnect an app at any time under My account → Connected apps. That stops it from renewing its access straight away; an access token it already holds can keep working until it expires (up to about an hour). Disconnecting does not remove posts, messages or other changes the assistant already made, and does not remove copies the assistant provider already received.

How long member data is kept

• Your account, profile, posts, photos, saved posts, blocks, messages and reports are kept while your account exists. Apart from the activity log and operator email queue limits described above, there is no automatic age-based deletion of member data.
• You can delete drafts, post photos and your profile image, and remove saved posts and blocks, at any time. Pausing or archiving a published post takes it out of public view but keeps it stored; closed posts stay public. Members cannot delete published posts, messages or reports themselves.
• If an admin removes an account’s access, its posts are no longer shown to the public. You can delete your account and its data yourself on the account deletion page (no app or sign-in needed). A 6-digit code sent to the account’s email confirms ownership; the account then loses access at once and deletion finishes automatically, including every file in the account’s folders. Conversations you are part of are deleted for both members. That page lists what is deleted and what is kept, including retained audit and ban records and a private deletion record. While deletion is in progress, that record holds the account’s email addresses; they are erased at completion, and the rest (former account ID, times and status) is kept for 90 days after completion.
• Site analytics records are retained indefinitely, as described under Site analytics above.

Service providers

Data is hosted with Supabase (database, authentication, file storage) and the site is served by Vercel. Sign-in emails are sent through the authentication provider. If Google sign-in is offered, Google handles that step. If a security check is shown on the sign-in page, it is provided by Cloudflare Turnstile. Site analytics are stored by VFR Solutions on Cloudflare, as described above. There is no advertising or third-party tracking code and no data is sold.

Provider privacy information: Supabase, Vercel, Cloudflare and Google.

Maps load map tiles from OpenFreeMap (tiles.openfreemap.org), so your browser shares its IP address and the map area being viewed with that service. Maps are centered on the chosen city or ZIP center only; the site never asks for your device location.

OpenFreeMap privacy information.

Your choices

You can edit your profile, replace or remove your profile image, archive or delete drafts, and remove photos at any time. To have your account and data removed from the site, delete your account; it is verified with a code sent to your account email and completes automatically. Site analytics can be turned off above.