What we keep, and what we never do with it.

If you leave your email address

The form on /join asks you for one thing. Here is everything the row it writes holds.

• Your email address — lowercased, so one address cannot quietly become two rows. Nothing else about you: no name, no phone number, no postal address.
• A tag for the link that brought you — a few letters, like bk24. It tells us which invitation you clicked and says nothing about you. A tag we do not recognize is thrown away rather than stored.
• A salted hash of your IP address, never the address — a hash is a one-way scramble, and what it buys is being able to tell that two signups came from the same place without keeping the place. The exact limit, because the honest version is more useful than the comforting one: nobody without our salt — a secret string mixed in before the scramble — can turn one of these back into an address, and somebody holding the salt can. There are only about four billion of the four-numbers kind of address, which is few enough for a computer to simply work through one at a time. We hold the salt. So the promise is not that the address is unrecoverable; it is that we do not look anyone up by it, and that the hash exists for one reason, which is to stop a single machine submitting thousands of addresses in an afternoon.
• The sentence you agreed to, and when — stored as its own text rather than as a pointer to whatever the page says now, so that rewording it later cannot rewrite what you were actually shown. The date it was worded is kept beside it for the same reason.
• A random unsubscribe token — thirty-two characters of randomness, made on our server at the moment the row is written and derived from nothing about you, not even your address or your position in the table. It is what lets the link in a message take you off the list without asking you to log in, and being random rather than derived is what stops anyone unsubscribing a stranger by counting upwards.
• The database's own bookkeeping — a row number, which is only the order rows were added; when the row was created and when it was last changed, both written by the database rather than by us; an empty slot for the day you opt out, filled in if you ever do; the day you confirm your address, which stays empty until you click the link we email you, and until then the address is never treated as verified and is sent nothing but that one link; the random code inside that link; and when the last confirmation email went out, so that we can refuse to send another to the same address for a day.

The firehouse lookup further down that page is a search box, and it does talk to the network — so here is exactly who hears what. A quarter of a second after you stop typing, the words in the box go from your browser to Mapbox, whose job is to turn a place name into coordinates. Mapbox sees the words, and — as with any request your browser makes of anyone — your IP address. If Mapbox has nothing for what you typed, or if our map key is missing, the same words come to our own server instead and we match them against the towns and ZIP codes of the stations we already hold. The one thing that leaves your machine for nobody is a bare state name: the fifty states are in the page already, so “Illinois” on its own is answered without asking anyone.

Then the coordinates come back to us. Picking a result asks our server for the stations near that point, with the latitude and longitude sitting in the web address. “Near me” does the same thing without the typing, using the position your browser offers — your device's, which can be accurate to within a block. Your browser asks your permission for that every time, and we never request it on page load.

None of it is attached to your row. The lookup is not connected to your email address, the station you looked at is not stored beside it, and there is nowhere in this database that records one person next to one firehouse. What coordinates in a web address do leave behind is an ordinary server log line — on our host and on Cloudflare in front of it, the same kind of line every request to every website on the internet writes. We do not read those logs to work out who searched for what, and nothing is copied out of them into anything of ours. And nobody at the station is told that you looked.

What we do with it, and what we never do

We write to you when the baking season opens, and a few more times across the season if there is something worth saying. That is the whole purpose of asking.

Being plain about the mechanism: mail goes out through Resend, a sending service. Exactly one email is automatic — a link to confirm your address, sent when you join, and never more than once a day to the same address. Everything after that is written by a person at Warmly and sent through Resend, to confirmed addresses only.

• Never sold, never shared — not to a partner, a sponsor, an advertiser or another organization. This is not a list we rent out, and it does not leave Warmly.
• Never shown to a fire station — and this one is a property of how the site is built rather than a promise we are asking you to take on trust. A station page publishes no list of the people following it, and for a station that has not claimed its page those counts are not published at all. There is nowhere on Warmly for a crew to see your name next to theirs.
• No tracking — no advertising pixel, no analytics product, no behavioral tracker anywhere in these pages. Four outside companies do see that a visit happened, because each one is doing a job the page needs; they are named one at a time below, and three of the four are involved in the page you are reading right now.

Who else sees a visit

Loading any page here, this one included, reaches four companies besides us — and the server it reaches runs on Render. None of them is told your email address, and none of them is on the page to watch you; each is there because something on the page needs it.

• Cloudflare — sits in front of warmly.us and passes every request through, so it sees the address you asked for, your IP address and which browser you are using. It is the part that keeps the site standing under load and absorbs attacks. The server behind it runs on Render, where the same ordinary request line is written again.
• Google Fonts — some of the typefaces are served by Google rather than by us. Every page asks fonts.googleapis.com for two stylesheets and fonts.gstatic.com for the font files themselves, while the page is still loading, so your IP address and browser reach Google on every pageview. Nothing about who you are on Warmly goes with that request — but it does happen, and it happened on this page.
• Clerk — handles accounts, and its code loads on every page rather than only the sign-in page, because the bar across the top has to know whether you are signed in before it can draw itself. If you have no account there is no session for it to find and nothing for it to carry.
• Mapbox — turns a typed place into coordinates for any search box here, and draws the actual map tiles on the pages that have a map: the front page once you search, and the station finder. On /join no map is ever drawn, so what Mapbox sees there is the search, not tiles.

One more company sees your email address, though never your visits: Resend, which sends Warmly's email. It is handed your address when the confirmation link goes out, and keeps it only if you confirm — so that it can deliver the season email, honour the unsubscribe link at the foot of it, and stop mailing an address that bounces or reports us as spam. When any of those happens, Resend tells us and we mark your row.

That is the whole list. If it gets longer, this page gets longer with it.

If you make an account

Signing in is handled by Clerk, an outside service that holds the login itself — your address and whatever you sign in with. Warmly never sees a password. When you sign up, Clerk tells our server and we keep a profile alongside it: the id Clerk knows you by, a display name, a URL-safe version of that name for your profile page, your email address, a link to your avatar picture, a short bio if you write one, which kind of member you are, the station you belong to and your role there if you are on a crew, whether a crew claim of yours has been checked by hand, whether you finished the sign-up steps, running counts of three things you have done here — stations followed, meals delivered, loaves recorded — and the same database bookkeeping as above.

What you post — a recipe, a thanks, a request for help — is visible according to where you posted it. Warmly keeps three zones: inside a station, between a station and its neighbors, and public. Nothing moves outward from a station on its own; somebody there has to choose it.

Photographs you upload are re-encoded before we store them, which drops all the metadata a camera writes into a file — including the GPS coordinates a phone records. A picture of a loaf on your kitchen counter does not arrive carrying your kitchen's location.

The fire station pages

Every fire station in the country already has a page here, built from public records — not from anything a station told us, and not from anyone's sign-up. Until someone at the station claims that page it carries public directory facts, and nothing on it speaks for the crew.

If you are at a station and want your listing corrected, or want it taken down, write to hello@warmly.us and we will do it. You do not need an account to ask.

Station location data: HIFLD Open

How to get out

• The link in any message we send — it needs no login. It opens a page with one button on it, you press the button, and that is the end of it.
• Or write to hello@warmly.us — a person reads that mailbox. Say what you want done and we will do it by hand; there is no form you have to go and find.

One thing worth saying plainly, because it sounds backwards: when you opt out we keep the row and mark it rather than deleting it. A deleted address can be added back by the next person importing a list, and then you would hear from us again after asking not to. A marked one cannot. The record is the thing that makes the promise keepable, and nothing is ever sent to a marked address. If you would rather the row were gone outright, say so in that email and we will remove it.

What this page is not

It is a description of how the site works, written by the people who built it. It is not a legal compliance statement, and we are not going to name laws we have not built a process for. There is no automated data-request portal here — there is a mailbox and a person. If you want to know what we hold about you, or want it changed or gone, write to hello@warmly.us and you will get an answer from someone.