Privacy Policy
Updated November 2026
This page stays out of search results until the final policy is published.
Scope
This page describes what this version of the site stores. It is not a finished privacy policy from a lawyer. It stays out of search results until that policy is published.
What This Version Stores
Public pages read a directory database: business name, address, phone, hours, source, and the other fields shown on the page. KAL does not run a parent account system. The activity picks form stores the email, ZIP, and city, plus a name when one is given, and sends them to the Beehiiv list. The city is sent as the custom field kal_city. A checked newsletter box on a question form stores the same kind of signup. The claim page creates an owner login with an email code. A question typed on a listing is not saved. The saved question keeps the parent name, email, phone, age range, listing path, time, and a privacy consent flag. The newsletter opt-in is stored only when the parent checks that box. It is off by default. There is no field for the question, a child name, or medical notes. Parent reviews store a name, the review text, and an optional rating, and they stay hidden until KAL approves them.
Phone Numbers
When a phone is on the listing, the page can hide it behind a Show phone control. With no Turnstile site key configured, the number is in the page HTML inside that control. When a site key and secret are set, the number stays off the listing until a Turnstile check succeeds, and the reveal is written to the audit log. The number is still the public number for that business.
Cookies and Scripts
Public pages load an analytics script from privatusstats.com. They do not load an advertising script. Unsold ad boxes are not shown. When Turnstile keys are set, Cloudflare’s Turnstile script loads on the claim page and on the phone reveal. A short-lived cookie then remembers that the phone check succeeded. Owner sign-in uses a session cookie.
Operators
The site is built to run on Cloudflare (Workers, D1, KV, and R2). This repository does not deploy itself. Session data uses KV. Listing photos use R2 when that bucket is connected. KAL does not sell personal information. There is no parent account. Owner logins exist for people who claim a listing.