Privacy

Last updated October 15, 2026

You can use every part of this map without an account. An account exists for one reason: to remember the places you save. This page says exactly what is stored if you make one, and how to take it back or delete it.

Who is responsible

Raw States is operated by Canary Street LLC, a Florida limited liability company, which is the data controller for everything described on this page. Postal address: 7901 4th St N, STE 300, St Petersburg, Florida 33702. Email: privacy@rawstates.com. Business hours are on the contact page.

What is stored

If you create an account, the database holds these things:

• Your email address. It is the name you sign in with. It is never shown to other people and never used for advertising. Two things may be sent to it. A sign-in link, only ever when you ask for one on the sign-in screen. And occasional email about new Raw States tools. If you create an account from the United States you are added to that list when the account is made, and the create-account screen says so above the button before you press it. If you create an account from anywhere else you are not added at all, and the switch in your account menu is how you join if you want to. Either way, every one of those emails carries a one-click unsubscribe that needs no sign-in and takes effect immediately, and the switch in your account menu turns them off at any time without sending anything. Those emails carry no tracking pixel, so nobody knows whether you opened one. A link in them does record that your account clicked it, and that is the only thing they report back.
• If you adopt a pin. The name you typed, the website if you gave one, and the email address Stripe reports as the payer are stored with the adoption, and the name and website are shown on the pin's card. Stripe holds the card details; this site never sees them. The adoption record is kept while the adoption is live and for the site's accounting after it ends.
• Whether you are on that list, and when that was decided. The database records the date and the exact sentence that was on screen, so there is a record of what you were told or asked. Withdrawing is recorded the same way. Two things never change: an address that has unsubscribed stays unsubscribed even if a brand new account is later made with it, and accounts created before 14 August 2026 were told that no mailing list existed, so none of them are on one and none can be added without asking again.
• What this page said before 2 September 2026. Until that date the email above went out “only if you ticked the box asking for it”, and the box “starts unticked, and leaving it alone means you never hear from us”. That box is gone, replaced by the notice described above for accounts created in the United States. The old wording is quoted here rather than deleted, because a promise that changed should be visible as a change and not simply disappear.
• A one-way hash of your password (PBKDF2-SHA256, 200,000 iterations, unique salt). The password itself is never written down anywhere, which is also why it cannot be recovered if you forget it.
• Which places you saved, and when you saved each one.
• When each sign-in began and was last used, so old sessions can expire.
• If you commented on a pin (comments were switched off on 15 October 2026; what was stored while they were on is kept as described here until you delete it or your account). The display name you pick, the comments you post (and earlier versions of any you edit), the comments you like, any comment you report and why, the commenters you block, and when you agreed to the community rules. Comments and display names are public; your email is never shown with them. Each comment is checked when it is posted by an automated safety filter that runs on Cloudflare, the same company that hosts the site, and the result is stored with it. To spot ban evasion, each comment also keeps a salted one-way hash of the network address it came from, never the address itself. Likes, reports and blocks are private: the person you block or report is never told. When someone replies to one of your comments, you get an email saying who replied, where, and the first few words of the reply (with any links taken out), at most once a day. Every one has a link to turn them off, and Account → Email me replies turns them off or back on.

That is the complete list. There is no real-name field (a comment display name is one you make up), no location history, no record tied to your account of what you looked at, and no profile built about you.

What is not stored

• No advertising identifiers. The advertising partners described below collect what they collect in your browser; none of it enters this database.
• Your name, your email and your saved places are never sent to any analytics service. The account database and the analytics are not joined and cannot be. What Google Analytics does receive is listed below.
• No IP addresses. Sign-in attempts are rate-limited to stop password guessing, and the counter stores a one-way hash of the address rather than the address, discarded within minutes.
• The account database is never given to an advertiser, an ad network or a data broker. What the advertising partners collect on their own, in your browser, and how to opt out of it, is under Advertising below.

Analytics

Two counters run here, and it is worth being exact about which does what.

The first is this site's own, on this site's own servers, and every figure the site publishes about itself comes from it. The second is Google Analytics, added on 27 August 2026 for one narrow reason: advertisers and ad networks verify a site's audience through Google or they do not verify it at all, and a number this site reports about itself is not evidence to them. It measures the same readers the first counter measures, and it decides nothing about what you see here.

Session replay returned on 30 September 2026, through PostHog. On 19 August this page said, after Microsoft Clarity was removed, that session recording was “gone and not coming back”. That was true for six weeks, and it is quoted here rather than deleted because a promise that changed should be visible as a change. What it records: one visit in five, chosen at random, as a replay of what was on the screen and where it was tapped, so the map can be watched being used the way a person actually uses it. What it never records: anything typed into an email or password field, which is masked before it leaves your browser; any visit from the EU, the EEA, the UK or Switzerland, where the recorder is not even loaded; any browser with Global Privacy Control on; crawlers; or the site's own operator. A recording carries the same one-day visit identifier as the site's own counter and nothing else that names you: no account, no email, no saved places. Recordings are held by PostHog on servers in the United States, are looked at only by the site's operator, and are used to fix what is confusing about the map.

The site's own counter records which pins were opened, which filters were touched, roughly how long the tab was actually being looked at, the page you arrived from, and the country and region your connection appears to come from. Your IP address is never stored.

Visits are deliberately hard to string together. The identifier is rebuilt from scratch every day, so a visit today and a visit tomorrow cannot be joined into one person. That is a design choice, and it costs real detail on purpose.

One number is kept on your own device rather than on the server: how many times you have been here and roughly how long ago the last time was. Your browser works that out and sends only a summary, so the site can tell how many readers come back without anyone here being able to tell who. Nothing about it is shown to you, and clearing your browser storage erases it.

What Google receives: the address of each page and each pin you open here, the page you arrived from, and the ordinary things any web server is told, including your IP address, which Google uses to work out a rough location and then discards rather than storing. It is not told your email, your account, or anything you have saved. How Google handles what it receives is set out in Google's privacy policy. Google's advertising features are switched off at the source: ad storage, ad personalisation and ad-user-data are denied on every request and are never granted, so nothing collected here can be used to target advertising, here or anywhere else.

In the EU, the EEA, the UK and Switzerland, Google Analytics runs with storage denied. It writes nothing to your device and reads nothing from it, so it cannot recognise you on a later visit or join today to tomorrow. That is why there is still no consent banner: in the places consent would be required, nothing is being stored to ask about.

Google is also never loaded at all for anyone the site has already decided not to count: opted-out browsers, crawlers, automated tools, and the site's own operator. Both counters are fed by one decision, which is the only way two counts of the same audience can honestly agree.

You can refuse all of this at once with Global Privacy Control in your browser, which this site honours without asking, and which stops Google as firmly as it stops the counter next to it. A private window has the same effect. The map works identically either way, and nothing here is withheld from anyone who opts out.

Advertising

CMI Marketing, Inc., d/b/a Raptive (“Raptive”) is a service provider of this Site for the purposes of placing advertising on the Site, and Raptive will collect and use certain data for advertising purposes. To learn more about Raptive’s data usage, click here: https://raptive.com/creator-advertising-privacy-statement

Google AdSense was added on 25 September 2026. Its loader script is on every page; while Google reviews the site it shows nothing, and once ads run they are placed and chosen by Google, not by anything this site knows about you. This site's account database is not shared with Google and cannot be. When ads are served, Google and the vendors it works with may use cookies or device identifiers to show ads and measure them, under Google's advertising policies; you can adjust personalised advertising at adssettings.google.com. In the EU, the EEA, the UK and Switzerland, ads that store anything on your device are not shown without asking first.

What an advertising partner collects is collected in your browser, by its own code, when a page with ads on it loads: the page address, the ordinary things any web server is told, and the cookies or identifiers described under Advertising cookies below. Under California law and the laws of several other US states, letting an advertising partner collect that can count as a “sale” or “sharing” of personal information, or as targeted advertising, even though no money changes hands for it. You can opt out of it at any time: turn on Global Privacy Control in your browser, which this site honours as an opt-out without asking; use the privacy choices link or notice the advertising partner shows on the site where your state requires one; or write to the contact below and say which browser you use. Opting out never changes what the map shows you.

Cookies

Two kinds, and only the first is set without asking.

Strictly necessary: no consent, cannot be declined

• acm_s, a cookie holding a random session token (not your email, not your password), which exists only to keep you signed in. HttpOnly so scripts cannot read it, Secure so it only travels over HTTPS, SameSite=Lax so other sites cannot use it. Thirty days, or gone the moment you sign out.
• acm_o, a ten-minute cookie that exists only during a Google sign-in, to prove the trip to Google and back was one you started.
• Browser storage on your own device, holding your choices: the filters you set, whether the AI search box is on, your recent searches, and whether you dismissed the Dark Mode strip. None of it is sent to us.

These are exempt from consent under the ePrivacy Directive's Article 5(3) because they exist to deliver something you asked for. They are listed here because being exempt from asking is not the same as being exempt from telling.

Analytics cookies

The site's own counter sets one, acm_r, holding four numbers and nothing else: the day this browser first came, the day of the visit before the latest one, the latest visit, and how many different days it has come. It exists so the owner can see whether readers come back. It names nobody, cannot be joined across devices or to an account, never leaves this site, and expires after 400 days. It is set by the server rather than by a script, because Safari erases script-written storage after seven days and a reader back on day eight was being counted as new. It is not set in the EU, the EEA, the UK or Switzerland, not set when the region cannot be told, and not set when Global Privacy Control is on.

Until 10 September 2026 this paragraph said the site's own counter set no cookies, and never had. That was true: the same four facts were kept in the browser's own storage instead. Moving them into a cookie the server sets is the whole change, and it is recorded here as one.

Google Analytics sets one, _ga, holding a random number and nothing else, so that two pages you open a few minutes apart can be recognised as one visit rather than two strangers. It is first-party, it names nobody, and it expires after two years. It is not set at all in the EU, the EEA, the UK or Switzerland, where storing it would require consent this site does not ask for.

PostHog, the session replay described under Analytics, keeps one identifier in your browser's own storage on your device, not a cookie, so that the pages of one visit are stitched into one replay. It is not written in the EU, the EEA, the UK or Switzerland, not written when Global Privacy Control is on, and clearing your browser storage erases it.

Until 27 August 2026 this section said there were no analytics cookies here of any kind, and that a third party would be asked about before it loaded. Google Analytics is that third party and it is not asked about, because in every place a browser is asked, it is instead denied storage outright. The old wording is quoted here rather than deleted, since a promise that changed should be visible as a change and not just disappear.

Advertising cookies

Set by the advertising partners named under Advertising above, not by this site, and only once ads are actually being served. None are set while the site is under review, none are set in the EU, the EEA, the UK or Switzerland without consent, and Global Privacy Control opts you out of the ones that would count as a sale or sharing of your data.

Why it is stored (lawful basis)

Under the UK and EU GDPR, the basis is performance of a contract (Article 6(1)(b)). You asked the site to remember your saved places, and it cannot do that without an account to attach them to. The rate-limiting counter rests on legitimate interests (Article 6(1)(f)) in keeping accounts from being broken into.

Both analytics rest on legitimate interests (Article 6(1)(f)): understanding how the map is used, and being able to show an advertiser what this site's audience is without asking them to take its word for it. Neither identifies you, and in the UK, EU, EEA and Switzerland neither stores anything on your device or reads anything from it, so the ePrivacy consent requirement for storage does not arise. You can object at any time, and Global Privacy Control is the one-switch way to do it.

No processing here relies on consent, and none of it involves special-category data.

How long it is kept

• Account and saved places: until you delete the account. Then they are gone.
• Comments: if you delete your account, the comments you posted stay up, without your name, shown as from "[deleted account]", unless you tick Also delete my comments when you delete it, in which case their text is erased. Either way your display name, the edit history of your comments, your likes, reports and blocks, and the network hash on your comments are deleted with the account. You can also delete any single comment yourself at any time.
• Comments removed by moderation: kept for 90 days in case of an appeal or a repeat, then their text is erased.
• A ban from commenting: if an account is banned from commenting, a one-way keyed fingerprint of its email address (never the address) is kept for two years, so the ban still applies to a new account made with the same address. Nothing else reads it.
• Sessions: 30 days from last use, then deleted automatically.
• Rate-limit counters: minutes.

Your rights, and how to use them

Both of these are buttons in the account menu. Neither requires emailing anybody or waiting.

You also have the right to correct inaccurate data, to object to processing, and to portability, the export above is a machine-readable format and satisfies portability. To change your email address, or for anything else, use the contact below.

If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon or another US state with a privacy law, the same rights apply and the same buttons serve them: the right to know what is held about you (Download my data), the right to delete it (Delete account), the right to correct it (write to the contact below), and the right to opt out of the sale or sharing of your personal information and of targeted advertising (Global Privacy Control, the advertising partner's privacy choices notice, or the contact below, as described under Advertising). You will not be treated differently for using any of them. If a request is refused you can appeal it by replying to the refusal, and the appeal will be answered by a person.

If you think this site has mishandled your data you can complain to your national data protection authority; in the UK that is the Information Commissioner's Office.

Where it is stored

Accounts live in a Cloudflare D1 database and the site is served by Cloudflare Workers. Cloudflare acts as a data processor, as does Google for the analytics described above. Depending on the network, data may be processed on servers in the United States; Cloudflare's transfer safeguards are described in its own GDPR documentation.

Children

This site is not directed at children and does not knowingly hold accounts for anyone under 18. If you believe a child has made an account, use the contact below and it will be deleted.

Public information

The number of people who have saved a place is shown publicly on that place's card. It is a count and nothing else. Nobody can see who saved what, including the site's operator, without reading the database directly. Your saved list is visible only to you.

Changes

If this policy changes in a way that affects what is collected or why, the date at the top changes and the change is described here rather than quietly applied.

15 October 2026. Comments were switched off for everyone. Nothing new can be posted and earlier comments are no longer shown. The comment data described under "What is stored" and "How long it is kept" is unchanged by this: it stays until you delete it, and Account → Delete account with Also delete my comments still erases it.

15 October 2026. The operator was named. Until this date the page said "the site's operator" without saying who that is; it is Canary Street LLC, under "Who is responsible" above. Nothing about what is collected or why changed.

9 October 2026. The minimum age for an account was corrected to 18, matching the sign-up screen. This page and the Terms of Service said 13 until this date.

9 October 2026. Reply emails for comments were added, described under "If you comment on a pin".

8 October 2026. Comments on pins were added: what is stored when you comment, what stays up when you delete your account, and how long moderation records are kept are described under "What is stored" and "How long it is kept". Until this date the page said there was “no name field”; a comment display name is now one.

30 September 2026. Session replay returned, through PostHog, at one visit in five and never in Europe or under Global Privacy Control; see Analytics. The sentence of 19 August that said it was not coming back is quoted there.

28 September 2026. Raptive was added as an advertising partner, alongside Google AdSense. Until this date the page said that nothing here was “sold, rented, or shared with anyone for marketing”. That was true of the account database and still is, but California law counts an advertising partner collecting data in your browser as a sale or sharing of it, so the sentence was rewritten to say exactly which data that applies to and how to opt out. The Terms of Service gained an arbitration agreement, a consent-to-data-collection clause and a limitation of liability on the same day.

Contact

Questions about your data, corrections, or a copyright concern about anything published on the map: privacy@rawstates.com.

← Back to the map How the map is made