Privacy

What the server keeps

The site's own server keeps no account, no login and no list of pages a person read. The web server (Caddy) writes no access log; its error messages go to the system journal and can include the address and page of a failed request. The API's log files, kept 14 days, hold errors and processing steps, not visits or addresses. The API holds your address in memory only, to limit request rates. Cloudflare sits in front of the site and Google Cloud hosts the server; both see your address and the page you ask for, and may keep their own logs.

Counting visits

Every page and the map count one page view without cookies or stored ids, even if you decline: PostHog's cookieless mode, a hash that changes every day, made on arrival from your browser and network address and not kept. It records the kind of page, the site you came from, your browser, operating system, device type, screen size, language and time zone, and your country, from a header Cloudflare adds. On the election, status, tension, situation and guide pages, taps are counted the same way.

A bar asks "Allow analytics cookies?". If you accept, PostHog (EU) sets a cookie and local storage to recognise a return visit and records clicks, searches, where the map looks, errors, load times and a recording of the session with text fields masked. Google Analytics also loads, with Google signals and ad personalisation off. If you decline, none of that loads.

None of this runs on other sites, or when your browser sends Do Not Track or Global Privacy Control, which also stops the cookieless view. The address in each count is sent without anything after a ? or #.

To withdraw, open the map's information menu and choose Turn off usage statistics. That stores a no, stops the recording and removes PostHog's cookie and storage and Google's _ga cookies.

What stays in your browser

The site's server sets no cookies, and none came from Cloudflare in a check on 13 November 2026, though it can set a security cookie of its own. Local storage holds these values, none with a name or an email address.

sitrep.analytics

Your answer to the consent bar, yes or no.

sitrep.theme, sitrep.hours, sitrep.side, sitrep.media, sitrep.keys, sitrep.chrome, sitmap.highlights, sitrep.lastVisit, sitrep.seenOrigins

Map choices (theme, time range, panel, picture blur, shortcuts, layout) and what you last saw.

sitmap.tz, sitmap.favs.v1, sitmap.watch.v1, sitmap.last, sitmap.news.seen, sitmap.xpop.until, sitmap.nudge.until

Election pages: your time zone, saved states and races, and what you last saw or dismissed.

sitmap.ab.order, sitmap.ab.nudge, sitmap.ab.news, sitmap.ab.xstyle, sitmap.ab.xpop, sitmap.ab.alabel

The A/B test version you were shown on the election pages. Stored without asking, and can be sent with the page counts.

sitrep.exp

Your draw in an A/B test on the map and the status, tension and situation pages. Stored only after you accept.

After you accept, PostHog adds entries whose names start with ph_, and Google Analytics adds _ga cookies. The service worker (/sw.js) only shows alerts you ask for and caches nothing.

Alerts and forms

Alerts

On the election pages, Get alerts gives the server an address from your browser's push service, two keys and your topics, nothing else about you. Turning alerts off deletes them, as does the push service reporting the address gone.

Rating challenges

The form on Sources keeps what you write, with no end date. Any contact you give is deleted 30 days after you send it. No address or browser detail is stored.

Crowd reports

The API takes anonymous reports; the site has no form for them. It keeps the text and any link, place, time and name you add. Your address is kept only as a shortened hash. The name and hash are removed after 30 days, the text stays.

Other companies

A page's security policy allows these hosts besides this site; a page uses some of them.

PostHog (EU)

z.sitmap.live, eu.i.posthog.com, eu-assets.i.posthog.com. Visit counts and, after you accept, the events above. z.sitmap.live is this site's proxy to it.

jsDelivr

cdn.jsdelivr.net. The PostHog library, pinned by a hash, and on map pages the map library.

Google Analytics

www.googletagmanager.com, *.google-analytics.com, *.analytics.google.com. Only after you accept.

Cloudflare

static.cloudflareinsights.com, cloudflareinsights.com. Its Web Analytics beacon counts page views without cookies. The consent bar does not control it.

OpenFreeMap

tiles.openfreemap.org. Map tiles.

Google AdSense

pagead2.googlesyndication.com. The advertising script, below.

Google advertising

The Google AdSense script is on the live map, the methodology page, the US elections page, the guides, the areas hub and the area reports, the situation pages, About, Privacy and Contact. It loads before you answer the consent bar, and whatever you answer, because the bar covers analytics and not this script. Do Not Track and Global Privacy Control do not stop it either.

No ad is shown today. The site's security policy blocks Google's ad servers other than the script's own, so the script cannot fetch an ad. In a check on 13 November 2026 the script set no cookie and stored nothing in the browser.

When ads are shown, third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this and other sites on the internet.

You can opt out of personalised advertising in Google Ads Settings, and of some other vendors' personalised advertising at aboutads.info. How Google uses data from sites that use its services.

Your choices and requests

• To have data about you deleted, write to hi@sitmap.live, saying what you sent or stored, such as a challenge, a crowd report or the id in your PostHog cookie. Counts that carry no id cannot be looked up.
• To report a security problem, write to hi@sitmap.live with Security in the subject.
• The site has no accounts, takes no payment and never asks for an age. It shows war reports, some with pictures, and is not made for children.