Your information stays close.
We store your shopping bag behind a secure HTTP-only cookie. Newsletter signups store your email, town, consent date, and unsubscribe status. Unsubscribe links use an opaque identifier stored as a hash.
When test checkout is configured, Stripe handles payment details. The server stores an order snapshot, and Printful receives the shipping information needed to create an unconfirmed test draft. Card numbers are not stored by this site.
To keep spam out of photo entries, votes and archive uploads, we use Cloudflare Turnstile, an invisible security check; its use is covered by Cloudflare’s Turnstile Privacy Addendum.
Community accounts
Looking around never needs an account. To share a photo, add a note or vote, you sign in with Google, Facebook or email. Entering the Photo of the Month also needs a confirmed email address on your account, so we can reach winners. New accounts can’t use throwaway (disposable) email addresses. Your account lives in our own database: a permanent internal ID, the display name you choose, how you want to be credited, and your email address if you sign in by email or add one.
With Google we receive your name and email address, and whether Google has verified it. If Google has verified the address and you already have an account here with that same confirmed address, signing in with Google opens that account. With Facebook we use your name and the ID Facebook gives our app; we don’t use the email address Facebook may send. We don’t keep Google or Facebook access tokens and we never post anything for you. Your email address and sign-in IDs are never shown publicly or to other members; our staff screens show only your display name and which sign-in methods you use.
Staying signed in. Signing in sets one secure, HTTP-only cookie on ourtownheritage.com and its town pages (for example carthagemo.ourtownheritage.com), so one sign-in works in every town. It keeps you signed in on that device until you’ve been away for 90 days; a visit extends it (at most once a day). “Sign out” ends it on that device and “Sign out everywhere” ends every session at once. Private browsing, or clearing cookies, signs you out. Staff sign-in uses a separate cookie that never leaves the main site.
While you sign in, an unfinished form (and the photo you chose) is kept only in your browser, for up to two hours, so you can pick up where you left off. Nothing is sent until you confirm.
Votes are linked to your account so each account gets one vote per day; we never show who voted for what. IP addresses are stored only as keyed hashes, and votes keep hashed network and device signals, to stop abuse and vote fraud.
Photos you share are recorded with who shared them and the exact rules you agreed to (the Contest Rules or the Photo Sharing Rules) and when. Agreeing lets us show the photo with credit on our website, our social media and the town’s archive. Prints or merchandise always need your separate yes, which we ask for first. Photos shared earlier keep the permissions chosen then.
Deleting your account
You can delete your account from the account menu (after signing in again), or by removing our app in Facebook, which sends us a deletion request; either way you get a confirmation code and a status page. Deleting signs you out everywhere and removes your sign-in methods and email address. Entries in a running contest are withdrawn. Your photos and notes come off our public pages within 30 days (usually right away). The one exception: if a product made from one of your photos has already sold, that product stays on sale, credited “A neighbor”. We keep the record of the permissions you gave (what you agreed to, for which photo, and when), moderation records, and prize records for winners, because we may need them to show a photo was shared with permission. Your votes stay counted for contests already under way, linked only to an anonymous ID with hashed network signals, and are kept 12 months to check for fraud, then deleted. Signing in again later starts a new account.
No newsletter delivery, advertising campaigns, or analytics integration is configured. The demo operator and contact arrangements need confirmation before production sales or email delivery begin.