PRIVACY AND TRANSPARENCY
Privacy policy draft
Before launch, the operator must replace the bracketed details, choose and implement a retention schedule, and have this draft reviewed for the jurisdictions where the service will be offered.
Who operates this service
World Mood Weather is operated by [operator legal name], located at [operator business address and jurisdiction]. Privacy questions and requests can be sent to [privacy contact email].
What the service collects
A submitted check-in contains one selected mood and a server-generated timestamp. The service creates a random, opaque browser token to enforce a rolling 60-minute voting cooldown. The browser receives the token in a first-party HttpOnly cookie; the application database stores only its SHA-256 hash, not the token itself. The cookie is Secure in production, uses SameSite=Lax, and expires after one year. Clearing it or changing browsers can create a new anonymous identity, so the cooldown is not identity verification.
When trusted Cloudflare geolocation is explicitly enabled, the edge provider derives a two-letter country code from the request IP and forwards it to the application through a secret-checked header. The application stores the country code, not the raw IP address; without this configuration, location is recorded as unknown. The hosting, CDN, and edge providers necessarily process network addresses to deliver requests and may keep their own logs under their separate terms and retention settings.
The database records mood, country code, vote timestamp, and an internal visitor reference. City is currently always null. The service does not ask for browser geolocation, accounts, names, or email addresses.
Individual vote rows are intended to be removed after 90 days. Anonymous visitor records are intended to be removed 90 days after the last recorded vote (or record creation when no vote exists), only when no retained vote remains. The application does not record general page visits as visitor activity. Cleanup runs only when the operator schedules the retention command; records may remain longer if a run is delayed or fails. Backups may persist until their separately configured expiry. There is no long-term aggregate archive, so published history is limited to data still within the retention window.
How information is used and shared
The visitor hash is used to enforce the cooldown and associate votes with an anonymous browser identity. Public pages expose aggregate mood counts and percentages, with small country samples suppressed. These results describe participating website visitors only; they are not representative of a country’s population or a scientific survey. The application does not currently activate an analytics provider or load advertisements.
When enabled, Cloudflare Turnstile processes challenge and browser data to help assess automated requests. It is disabled in local development and is used for voting only when the operator requires it. Cloudflare handles that data under its own terms and privacy notice: [add the applicable provider privacy link before launch].
Map boundaries and the MapLibre worker are served from this site; the map does not request third-party map tiles. Font files are fetched from Google Fonts during the build through Next.js and then served as application assets. The operator’s hosting, database, CDN, and any configured geolocation provider process requests as needed to operate the service. [List the actual providers and applicable privacy links before launch.]
Retention and deletion
The intended cleanup defaults are 90 days for vote rows and 90 days after last visitor activity when no vote remains. The operator must schedule and monitor the cleanup command and define backup expiry. Application and edge log retention is controlled separately by hosting and logging providers and must be configured and disclosed.
Your choices and requests
Visitors can remove the first-party cookie in browser settings. For access, deletion, or other privacy requests, contact [privacy contact email] and include [instructions for locating a request without sending a cookie token]. The operator must document how requests are verified and handled before launch.
Legal review before launch
- Confirm the controller/operator identity, lawful basis, notices, and visitor rights in each launch jurisdiction.
- Review cookie notice or consent requirements, including whether the cooldown cookie is exempt.
- Set retention and backup-expiry periods and implement deletion for votes and visitor hashes.
- Review age restrictions, sensitive-inference risks, cross-border processing, processor contracts, and breach procedures.
- Confirm Cloudflare and hosting logs, IP processing, and any future Turnstile or analytics disclosures.