Privacy
Last updated: 25 October 2026
SILONG PH is designed to work without an account. This policy explains what is processed when you browse, choose a location, submit a correction, or sign in as an administrator.
Short version
When you choose a province, city, or municipality, the application stores the locality code in your browser's local storage so the dashboard remembers your choice. You can clear it by clearing site data in your browser. The application does not store your name, email address, or account details for ordinary browsing.
The progressive web app uses a service worker to cache pages, static assets, and an offline page. Cached content stays on your device until the cache is replaced or cleared. Weather API responses are not cached by the service worker; the interface labels stale server-side snapshots explicitly.
The “use my location” control requests browser geolocation only after you press it. The coordinates are used in your browser to find the nearest listed locality and to sort facilities by distance. SILONG PH does not send your precise coordinates to its own servers for storage. The weather request uses the selected locality's representative coordinates, not your exact GPS position. Your browser or operating system may ask for permission and may record the request according to its own policies.
If you submit a facility report, the application stores the report type, your description, any proposed place name, address, and locality code, the time of submission, and moderation status. Do not include personal information about other people. Reports are visible to authorised administrators and are not published automatically. The report form does not require an account or an email address.
To limit automated abuse, sign-in and report endpoints use rate limiting. The application derives a keyed, truncated hash from the request's IP address and uses that hash as the rate-limit key. Raw IP addresses are not written to the application database or to Redis by this code. If Redis is configured, the hash and a short-lived counter are stored there; otherwise they are held in process memory.
The hosting provider or reverse proxy may keep standard access logs (including IP address, user agent, and requested URL) under its own policy. The operator of this deployment is responsible for those logs and for configuring an appropriate retention period.
Administrator sign-in uses an email address and password. Passwords are stored as bcrypt hashes, never as plaintext. A successful sign-in sets an HttpOnly, SameSite=Lax session cookie that expires after eight hours; in production it is also marked Secure. Administrative actions such as creating or verifying a facility, moderating a report, or recording an official advisory are written to an audit log with the actor, action, entity, and time. The audit log may include a hashed IP value if one is supplied by the deployment.
The application makes requests to third parties to provide its core functions. Those providers receive technical information such as your IP address and user agent as part of a normal web request:
The application does not include third-party advertising, social-media pixels, or analytics scripts in this release.
Facility reports are retained while they are needed for moderation, correction, and audit. Audit records are retained to support accountability and security. Administrator sessions expire automatically. The operator of this deployment should configure a documented retention schedule and delete records that are no longer needed. This code does not automatically delete reports or audit entries.
Administrative routes require a valid session and server-side role check. Mutating requests verify the request origin. Security headers restrict framing, MIME sniffing, and unnecessary browser permissions. No system is perfectly secure; do not submit sensitive personal information through the correction form.
The Philippine Data Privacy Act of 2012 (Republic Act No. 10173) provides rights in relation to personal data, including the right to be informed, to object, to access, to rectify, to erase or block, to damages, and to lodge a complaint with the National Privacy Commission. Because ordinary browsing does not create an account, the application may not be able to identify you from a report unless you provide contact details voluntarily.
To ask about a report or an audit record, contact the operator. If no contact address is configured, use the report form on a facility page and state that your message is a privacy request. Do not include unnecessary identity documents.
The application is intended for a general audience and is not directed at children under 13. Do not submit a child's personal information through the correction form. If a child needs help, an adult should contact the local government or emergency service.
This policy may be updated when the application changes. The “last updated” date at the top of this page shows the current version. Material changes should be announced by the operator.
No public operator contact address is configured for this deployment. For data corrections, use the report form on a facility page. For emergencies, contact 911 or your local DRRMO.