What this site collects

Every page loads Google Analytics and Vercel Web Analytics. Every page except the plate lookup and the contact form also loads the ad code of one network, Journey by Mediavine, which decides where its ads go. That is the complete list of tracking scripts we put on this site. There is no session recorder, no A/B testing tool, and no retargeting pixel of our own; what Mediavine and its advertising partners collect is covered under Advertising below. The map is the one page that reaches further in other ways: it draws its background from one outside service and answers searches from another, and each sees your IP address the way any web request does. Both are named in full under What the map loads below. The plate lookup is another exception: your browser sends our server only a short hash of the plate you type, and our server asks Have I Been Flocked?, an independent collection of released Flock search logs, for matching records, as set out under The plate lookup. And if you use the contact form, your message is delivered to our inbox by an email service, as described under The contact form, along with the invisible bot check that the form and the plate lookup both run.

There is nothing to sign up for. No accounts, no logins, no newsletter, no comment box. The only places you can type anything are the search box on the map, the plate lookup, and the contact form, and what happens to each is described below. We do not sell, rent, or trade anything about visitors ourselves, and there is no visitor database to sell; what Mediavine collects, and shares with advertisers, on its own account is set out under Advertising.

Google Analytics 4 loads on every page from googletagmanager.com. Its configuration is a short inline snippet you can read in this page’s source — four statements that initialize the tag and send the page view. The one other thing we send it is page-speed measurements: how quickly each page drew, how quickly it responded to a tap or click, and whether its layout jumped, labelled with the kind of page (a city page, an article, the map). We use them to check that ads are not slowing the site down. We set no user identifiers, attach no advertising features, and pass it no other content of our own. It collects what Google collects by default for any site — the page URL and referrer, an approximate location derived from your IP address, and your device and browser — under Google’s own terms, not ours.

Vercel Web Analytics runs alongside it and reports aggregate page views and traffic sources for the site. Vercel documents it as cookieless and non-identifying; the only thing our code does is include it.

We look at both for one reason: to see which explainers and which city pages people actually use, so the reporting and the data go where they are read. Nothing in our own code changes based on who you are, because we do not know.

The site is served by Vercel, which — like any host — processes the requests needed to deliver a page, including your IP address and browser. That is true whether or not analytics loads.

Finding Flock pays for itself with display advertising managed by Journey by Mediavine. Mediavine decides how many ads a page carries, where they sit — between sections of a page and, on some screens, in a bar along the bottom edge — and which ads appear. We sell no placements directly, and no advertiser has any say in what we publish. We do not review individual ads, and an advertiser’s own page is theirs, not ours. If you see an ad that is misleading, offensive, or pretends to be part of this site, write to us with the page it appeared on.

Two pages never load Mediavine’s code: the plate lookup, whose promise that only a hash of the plate leaves your browser would not survive ad code running beside it, and the contact form, which takes your name and message. Opening either one always loads a fresh page, so ad code from a page you read before is never left running on them.

Everywhere else, Mediavine’s script runs within our pages with the same access as our own code: it can read the page address, what the page shows, and what you type into the map’s search box. Mediavine and its advertising partners collect your IP address, approximate location, device and browser, and the pages you view, and use cookies and similar technologies to show ads based on your interests, to measure them, and to detect fraud. Mediavine says it shares and sells that information to advertisers through the real-time auctions that decide which ad you see. Mediavine’s privacy center and its notice below set out the details, and its partners are listed at mediavine.com/ad-partners. To ask Mediavine to access, correct or delete what it holds about you, write to privacy@mediavine.com. We pass Mediavine nothing ourselves — no identifiers, no search terms, nothing from the map — but its code can read anything a script on these pages can, including the Google Analytics cookie.

You can say no. Visitors in the EU and UK see a consent banner and can reject personalized ads there. If your browser sends Global Privacy Control, Mediavine treats it as an opt-out of the sale and sharing of your information, and where US state law requires it, a “Do Not Sell or Share My Information” link appears at the bottom of the home page. Opting out does not remove the ads: you still see them, but not chosen from your browsing. Any content blocker stops the ads entirely; nothing on the site depends on them.

Mediavine requires every site it serves ads on to explain how it handles visitors’ information. This is that notice, in our words; it covers Mediavine’s own collection, not ours, which is described in the rest of this page.

What Mediavine collects

Mediavine may collect your IP address; your approximate location (country, state and city); your operating system, browser, and device details such as hardware, platform and carrier; and the language of the page or your browser. It uses cookies and similar tools, such as pixels and tags, to record what you do on this site and on other sites you visit, across your devices: the pages you view, the ads you are shown and how you interact with them. It uses that to show you ads based on your interests, to remember which ads you have seen, and to measure how ads perform. Mediavine also collects email addresses through newsletters it manages for some sites; this site has no newsletter.

Whether Mediavine shares or sells it

Yes. Mediavine says it uses, shares, licenses, sells or otherwise discloses your personal information to its partners so they can show you interest-based ads on this site. Each ad space is sold in a real-time auction, the bidstream: Mediavine sends advertisers the ad’s position, what the page is about and your personal information, they bid, and the winner’s ad is shown to you. Mediavine and its partners may also attach a shared identifier to your browsing to target ads more closely, combine what they learn here with information about you from other sources into a profile of your interests used across devices, browsers and apps, and license information from partners to add to those auction requests. Its partners are listed at mediavine.com/ad-partners.

How to opt out of interest-based ads

• EU and UK visitors see a consent banner on their first visit and can refuse cookies there. To change your choice later, use the privacy settings link at the bottom of the home page.
• Cookies: your browser can block new cookies, warn you about them, or clear the ones it holds; All About Cookies explains how. Blocking cookies can change how a site behaves, and cookies a site needs in order to work cannot be turned off.
• Industry opt-out tools: the Digital Advertising Alliance’s WebChoices tool, the Network Advertising Initiative, the EDAA’s Your Online Choices, the DAAC’s AdChoices and AppChoices tools (AppChoices covers mobile apps), and Global Privacy Control.
• Residents of certain US states have the right to opt out of the sale or sharing of their personal information; where that applies, a “Do Not Sell or Share My Personal Information” link appears at the bottom of the home page.

Opting out, or disabling cookies, does not stop ads from appearing on this site. It means the ads you see are not chosen from your browsing and interests.

Your rights, and where the data goes

Under data protection laws in the EU, the UK and some US states, you may have the right to access, get a copy of, correct or delete your personal information. For what Mediavine holds through its work for this site, write to privacy@mediavine.com. Mediavine processes and stores the data in the United States, and protects transfers from the EU and UK with Standard Contractual Clauses in its agreements with vendors and partners. It applies technical and organizational security measures suited to the risk, though no transmission over the internet is completely secure, and it keeps processing data for interest-based advertising until you ask it to stop. Questions about this notice go to Mediavine at privacy@mediavine.com or 159 W. 25th St., Suite #427, New York, NY 10001.

Our own code never sets or reads a cookie, and it stores nothing in your browser’s local storage. Google Analytics does set cookies of its own — the _ga pair — which is how it tells a returning visitor from a new one. Mediavine and its advertising partners set their own too, as described under Advertising, including some stored under this site’s domain, because Mediavine’s code runs within our pages. Block either script and its cookies never appear.

The map runs in your browser and pulls from a few outside services. Each one necessarily sees your IP address, the way any web request does, and each keeps its own logs under its own policy:

OpenFreeMap (tiles.openfreemap.org) serves the background map — the roads, water, and labels underneath the camera dots.

The camera layer is a single pre-built tile file served from this site or its storage host. It contains camera locations only; nothing about you is sent to fetch it.

Photon (photon.komoot.io) turns what you type in the map’s search box into coordinates. When you type at least two characters and pause, the map sends that text there and nowhere else. We do not log searches, store them, or send them to analytics.

Mediavine supplies the map’s ads, as described under Advertising. As on the reading pages, its code runs within the page, so it can read what any script on the map can — including what you type in the search box and the map position in the page URL. We send it nothing ourselves. A content blocker keeps it off the map entirely.

OpenStreetMap is contacted only if you click through from a camera’s panel to view or edit its underlying record.

One consequence worth stating plainly: as you pan the map, the coordinates and zoom level are written into the page URL so the view can be linked and reloaded. While Google Analytics is loaded, the page URL is part of what it records — so the area you were looking at can be visible to it, and to Mediavine’s code. Blocking those scripts, or clearing the lat, lng, and zoom parameters, ends that.

When you send the contact form, your name, email address, topic, and message go to this site’s server, which passes them straight to Resend, an email delivery service, to be sent to our inbox at info@findingflock.com. Nothing is written to a database or kept on the server, and our code logs only whether a send failed, never who wrote or what they said. Vercel, our host, records the request itself (your IP address and browser) as it does for every page, but not what you wrote. To keep the form from being flooded, the server counts recent sends from each sender, holding only a salted hash of the IP address in memory for ten minutes and never writing it down.

The contact page also runs Vercel BotID, an invisible check against automated spam, and so does the plate lookup; no other page does. Your browser solves a small challenge sent by Vercel, and when you press Send message Vercel confirms the answer before the server reads the form. It shows no puzzle, sets no tracking cookie, and checks the browser, not what you wrote. It is the reason the form needs JavaScript; without it, you can email us instead.

Resend keeps a copy of each email it delivers for 30 days, under Resend’s privacy policy, and then deletes it. The message then sits in our inbox like any email you send us. We use your address only to reply; we never add it to a mailing list, and never share or sell it.

The plate lookup checks a license plate against Flock search records collected by Have I Been Flocked?, an independent project that gathers the audit logs agencies have released through public records requests. During a lookup, the plate itself never leaves your browser. Your browser tidies it (capital letters, no spaces or dashes), adds the look-alike versions a searcher might have entered instead (0 for O, 1 for I, and the reverse), and computes a SHA-256 hash of each, a one-way fingerprint of the text. Only the first eight characters of each hash are sent.

They go to this site’s server, which forwards them to Have I Been Flocked? and passes back the matching records; your browser shows the ones for your plate and its look-alikes. Have I Been Flocked? receives the request from our server, not from your browser, so it does not see your IP address. Our server keeps none of it: the prefixes and the records that pass through are not written to a database, cached, or logged, and our code logs only whether a lookup failed. Vercel, our host, records the request itself (your IP address and browser) as it does for every page, but not what it carries.

A prefix is not anonymous. It keeps the plate out of the request, but anyone who already has a plate, or a list of plates, can compute the same prefix, which is how the lookup finds matches at all. That is why nothing about a lookup is kept.

To keep the lookup from being overused, the server counts recent lookups from each visitor the way it counts contact-form sends, holding only a salted hash of the IP address in memory for ten minutes and never writing it down. The lookup page also runs Vercel BotID, described above. Our code sends nothing about a lookup to analytics, and the plate is never put in the page address, so Google Analytics does not record it.

After a lookup, the page can offer a button that opens Have I Been Flocked? in a new tab with your plate filled in, where you press Search yourself. It appears with results, and in their place when the lookup can’t reach its records. The button sends the plate from your browser straight to Have I Been Flocked?, in the address of the page it opens, under its privacy policy, which says it does not log what you search for. This site takes no part in that search and records nothing about it.

The records are Have I Been Flocked?’s, not ours. The lookup shows some of each record’s fields (the date, the agency, the reason given, and how many cameras were searched) and leaves out the searcher’s name and the case number. To have a plate’s records hidden from this site’s lookup, use the contact form and choose the plate lookup as the topic. Have I Been Flocked?’s redaction policy explains how to ask it to remove personal details from the records it publishes.

The locations on this site come from OpenStreetMap contributors, who document license plate readers they observe on public roads. It is a record of fixed public infrastructure — a pole, a camera, sometimes the manufacturer and the direction it faces. It contains no plate reads, no vehicle records, and no personal information about anyone, visitors of this site included. How it is gathered and how to correct it is documented on the methodology page, and the whole dataset is downloadable.

The plate lookup is the exception: the search records it shows concern a particular plate, and they come from Have I Been Flocked?, fetched when you ask and not kept here.

Any content blocker or browser tracking protection that blocks googletagmanager.com stops Google Analytics here, and Google publishes an official opt-out browser add-on that does the same across every site. Blocking works on this site without breaking it: analytics is not load-bearing, and every page, the map included, works with both analytics tools blocked. The same goes for the ads: block Mediavine’s code and every page reads exactly the same without it.

The map’s own third parties are a different matter, and worth knowing before you block them wholesale. The background map is drawn from OpenFreeMap, so blocking tiles.openfreemap.org leaves the map page without a map. Photon only answers the search box: block photon.komoot.io and search stops returning results, while the rest of the map behaves normally.

To be honest about the limits: our own code reads no privacy signal. Global Privacy Control and the consent banner are handled by Mediavine’s code, for advertising only. Nothing in our code reads Do Not Track, and Google Analytics still loads when Global Privacy Control is on, so for analytics, blocking the script is the route that actually works.

If a camera on the map is wrong, moved, or gone, the fix belongs in the underlying OpenStreetMap record — the methodology page explains how, and the change reaches this site with the next refresh. For anything about this page, or about the site generally, use the contact form or write to info@findingflock.com, the same address listed on the about page. If this page and the site’s behavior ever disagree, tell us and we will correct the page.