Privacy Notice

Last updated: October 31, 2026. This notice is written with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules in mind.

Who we are

CrowdSense is operated by Oliver Kuy (the "operator"). For privacy questions or requests, email support@crowdsense.net and put "Privacy" in the subject line (attention: Data Protection Officer).

What CrowdSense does

CrowdSense shows estimated crowd levels and parking for places in Metro Manila. Estimates are predictions based on typical patterns, the calendar, weather and some publicly available information. They are not proof of real-time conditions.

The CrowdSense app

The CrowdSense app for iPhone and Android shows the same pages as this website and works the same way, so everything on this page applies to it too, with "your browser" meaning the app. Your phone asks for location permission for the app rather than for this site, and your location still stays on your phone. Links you share are made with your phone's own share menu. If you ask to be reminded before a place gets quiet, your phone schedules the reminder itself: the place and time stay on your phone and are never sent to us. To clear the app's data, delete the app or clear its storage in your phone's settings.

Help count crowds (the app only, off unless you turn it on). The app asks once, after you first turn on location, and you can switch it on or off at any time at the bottom of the page. While it is on and the app is open with location on, your phone checks whether you are at one of the places in CrowdSense (inside its outline, or within about 50 meters) and, once an hour at most, sends us only that place and a random code that your phone makes fresh every day, so the same phone counts once. Your location is not sent. The code is not your device ID for reports or your visitor-count code, and is not linked to your name, account, phone number or advertising ID. Our server counts how many different phones were at each place in each hour, keeps that number next to the estimate it showed, and forgets the codes when the hour ends. A phone that has been counted at the same place for three hours in a day stops being counted there that day. With it on, the app turns location on by itself when you open it, if your phone already allows it. Nothing is sent when the app is closed or in the background. The counts are used only to check and improve our estimates. While it is on, the app may also remind you to report: about 20 minutes after you were counted at a place, between 7 AM and 9 PM, your phone shows a notification asking how crowded it is, at most once per place a day and twice a day in all, and not if you have already reported there. The reminder is scheduled on your phone by the app itself; nothing about it is sent to us, and you can turn reminders off on their own at the bottom of the page or in your phone's settings.

What we collect and why

Your location (only if you allow it). If you tap "Use my location" and then Allow, your phone's location is used inside your browser to calculate the distance to each place and sort the list. Your location is not sent to our server and is not stored by us. It is gone when you close or reload the page, or when you tap "Stop using my location". Before you send a visitor report, CrowdSense asks for your location and checks on your phone that you are at the place (inside its outline or within about 50 meters of it, using outlines from OpenStreetMap that your browser downloads without sending anything about you; for a place without an outline, within about 300 to 800 meters, depending on its size) and that the phone's reading is precise enough. The same check is behind the "At … right now?" prompt on the list. Only the report is sent, not your location.
Visitor reports. If you submit a crowd or parking report, we keep the place, the level you chose and the time. We do not ask for your name or account. Reports stop counting after one hour.
Anonymous device ID. When you submit a report, your browser creates a random ID (no name, no account, not linked to your phone number or advertising ID) and stores it on your device. We send it with your report so we can tell whether separate visitors agree with each other, and so each device can report a place only once an hour. The ID is kept with your report for one hour. Separately, the server keeps three counters per ID for up to 30 days (saved on our server's disk): how many of its reports matched other visitors' reports, how many were compared, and how many different networks it matched (up to five). Which networks those were is held only in memory, as the scrambled daily network code described under Technical data, and forgotten when that code changes. These counters weight how much a report counts. They are not shared or sold.
Favorites and hints. Places you star, and a mark that the one-time Share tip was shown, are saved only in your browser on your device. They are never sent to us.
Visitor counting. To count visitors without cookies, your browser makes a random code that changes every day and keeps it on your device with a simple "visited before" mark. Each time you open CrowdSense, the code is sent with the kind of site you came from (for example Facebook or Google, never the full address), or that you opened the app; the server also notes whether you use a phone or a computer. The code is not linked to the device ID used for reports. The server keeps the day's codes only until the day ends (Manila time), then keeps only the day's totals. To limit how many visitors one network can add in a day, the server uses the same scrambled, daily-changing network code described under Technical data, in memory only. Automated browsers and the CrowdSense team's own devices are not counted. The daily totals are published at crowdsense.net/stats.
Help count crowds (app only, if you turn it on). A place and a daily random code, at most once an hour, while the app is open and you are at that place; see "The CrowdSense app" above. We keep only the number of phones per place and hour.
Accuracy checks. To measure how good our estimates are, we log a report next to the estimate shown at that time. These records contain only the place, the levels and the time (not the device ID), and for Help count crowds the number of phones. They are kept on our server's disk and in the host's logs to measure accuracy over time.
Error reports. If a page or the app breaks, a report of the error is sent to our server and passed on to Sentry (sentry.io), an error-reporting service, so we can fix it: what went wrong and where in our code, your browser or phone model and screen size, the page you were on, and the last few taps and requests inside CrowdSense. It never includes your location, your device ID or your IP address (Sentry sees only our server's). Reports are kept by Sentry for 90 days.
Technical data. To limit spam we briefly hold your IP address in the server's memory (not in a database) to rate-limit requests and reports. So that many reports from one network count as one, each report also carries a scrambled code made from your network address, using a secret key that is never saved and changes every day. We do not use it to find your address, and it is deleted with the report after one hour. Our hosting provider may also keep standard server logs, such as IP address and requested page. Requests for pages that do not exist are counted by the address asked for and the kind of program asking (for example a browser or an automated tool), without any visitor details, so we can spot attacks.

We do not sell your data, use it for advertising, or build profiles of individuals.

Legal basis and your consent

Location is used only with your consent. Your phone asks for permission, and CrowdSense also asks before it does. Help count crowds is a separate choice: it stays off unless you turn it on, and you can turn it off at any time at the bottom of the page in the app. You can refuse and still use every other feature. You may withdraw consent at any time by tapping "Stop using my location" or by changing the location permission for this site (or for the app) in your browser or phone settings.

Who else handles data

Hosting: Render (render.com) runs the server. Render protects every site it hosts from attacks using Cloudflare (cloudflare.com), so each visit passes through Cloudflare's network on its way to our server. Cloudflare sees your IP address and the pages you request, and may keep standard security logs.
Fonts: served by CrowdSense itself. No outside font service is contacted.
Error reports: Sentry (sentry.io) receives error reports from our server as described above, and from the server itself when it hits an error. It does not receive your location, device ID or IP address.
Weather and holidays: Open-Meteo and Nager.Date are contacted by our server only. They do not receive your details or location.
Foot-traffic forecasts: BestTime (besttime.app) is contacted by our server only, with the names and addresses of selected places. It does not receive your details or location.
Road traffic: TomTom (tomtom.com) is contacted by our server only, with the map coordinates of the places we list. It does not receive your details or location.
Backup copy: once a week our server sends a copy of its saved records to a private repository on GitHub (github.com), so they survive if our host loses them. The copy holds the daily visitor totals, the accuracy records (each report's place, level and time, without the device ID, and the number of app phones at a place each hour) and what the server has learned about places. It never includes device IDs, device counters, visitor-count codes or network codes. Earlier weekly copies are kept.

Some of these providers operate outside the Philippines, so technical data may be processed abroad.

How long we keep data

Location: not kept. Visitor reports: one hour (saved briefly on the disk so a restart does not lose them). Device reliability counters: up to 30 days, saved on our server's disk so they survive restarts. Visitor-count codes: until the end of the day (Manila time); after that only daily totals are kept. Help count crowds codes: until the end of the hour; after that only the number of phones per place and hour is kept. IP addresses used for rate limiting: up to one hour, in memory only. Hosting logs follow the host's own retention. The weekly backup copy (see "Who else handles data") keeps daily totals, accuracy records and learned place data, none of which identify you, for as long as the service runs.

Security

The site uses HTTPS, and administrative functions are protected by a secret token. No system is perfectly secure, but we limit what we collect so there is little to protect.

To trace copies of our estimates, the scores sent to each network carry a tiny variation in their last digit, worked out from the network's address and a secret kept on our server. It never changes the level, the tags or the chart you see, and we store nothing about your network for it.

Resetting your device ID

You can clear this site's data in your browser settings at any time. That removes your device ID and favorites, and a new anonymous ID is made if you report again.

Your rights

Under the Data Privacy Act you have the right to be informed, to object, to access and correct your personal data, to erasure or blocking, to data portability, to damages, and to file a complaint. Because we keep so little, a request will usually be answered by confirming that nothing about you is stored. Contact us at support@crowdsense.net with "Privacy" in the subject line.

You may also complain to the National Privacy Commission (privacy.gov.ph).

Children

CrowdSense is not directed at children. If you are a minor, please ask a parent or guardian before using location features.

Changes

If we change what we collect, we will update this page and the date above. If we add anything that uses your location on our server, we will ask for your consent again first.