Privacy & cookie policy
Contact for anything privacy-related: contact@carbootmap.co.uk. Car Boot Map is the data controller.
Searching
We never store the postcode you type. For anonymous usage statistics we record only the postcode district (for example WD5, never the full postcode) or the town, plus the radius and filters you chose (see “Anonymous analytics” below). Postcodes or towns you type are sent to postcodes.io to look up a location, and your last search is kept in the page address so you can bookmark it. Map tiles load from OpenStreetMap.
Weekly newsletter
What we store: your email address, the postcode you choose and its approximate latitude/longitude (looked up via postcodes.io), your radius, optional sale type and days, the consent wording you agreed to, a one-way hash of your IP address at sign-up, the dates you signed up, confirmed and unsubscribed, and when we last emailed you. We also store random links (tokens) used to confirm, manage and unsubscribe.
Why (lawful basis): your consent (UK GDPR Art. 6(1)(a) and PECR). We use double opt-in: nothing is sent until you click the confirmation link, and unconfirmed sign-ups expire after 7 days.
What we send: one email every Friday listing car boot sales near your postcode for that weekend, with changed times and closures. No advertising profiles, no selling or sharing of your data.
Where it's held: Cloudflare (D1 database and Cloudflare Email Service), our processor. Data may be processed outside the UK under Cloudflare's standard contractual clauses.
How long: while you're subscribed. If you unsubscribe we keep only your email and unsubscribe date to make sure we never email you again; you can delete everything using “Delete my data” on the manage page linked in every email.
Your rights: access, correction, deletion, restriction, objection and data portability. Every email has one-click unsubscribe and a link to change your area or filters. Email contact@carbootmap.co.uk for anything else, or complain to the ICO (ico.org.uk).
Anonymous analytics (no cookies)
To learn which parts of the site are useful we use two cookieless tools. Cloudflare Web Analytics counts page views without cookies, local storage or fingerprinting. Our own first-party event log records actions such as a search (postcode district only, radius, filters, number of results), filter changes, clicks on a sale's website / phone / directions / Facebook link, use of the day planner, newsletter sign-ups, ad or featured-listing clicks, and pages viewed.
What we don't store: no IP addresses, no cookies, no device IDs, no full postcodes, no email addresses in this log. To count unique visitors per day we compute a one-way hash of your IP address and browser type combined with a random value (salt) that is replaced every day and then deleted, so visitors can't be recognised from one day to the next or identified. Your IP address is used only in memory for that calculation.
Why: our legitimate interest in improving the site (UK GDPR Art. 6(1)(f)); as nothing is stored on your device, no cookie consent is needed under PECR. Where: Cloudflare (Web Analytics and a D1 database). How long: event records are kept for up to 13 months, then deleted.
Cookies & ads
Before launch: add a consent management platform (Google-certified CMP required for AdSense in the UK/EEA) covering advertising cookies and analytics. No ad cookies are set until you accept.