Draft based on actual designed practices
Privacy policy
This draft describes how the website is built to handle information. Items marked as launch-configuration details must be confirmed by the operator before the site is presented as publicly launched.
Last updated: November 7, 2026. Status: operator draft, not legal advice.
Concho Lakeland Community Portal is an independently operated community information resource. It is not an official government website and is not affiliated with or endorsed by any government agency or property owners association unless expressly stated.
Who operates this website
The website is designed to be operated independently by the site administrator for Concho Lakeland Community Portal. It is not operated by Apache County or any other government agency, and it is not an HOA or property owners association portal unless the operator later obtains and expressly publishes such authorization.
Launch configuration: replace this sentence with the operator’s public contact method, such as the contact form or a dedicated email address that you are willing to publish. Do not leave a private personal address in source control if you do not want it archived.
Information you provide through the contact form
If the contact form is disabled, the site does not collect contact-form submissions because the fields cannot be sent anywhere.
If the administrator enables the form, the site is designed to collect:
- Name
- Email address
- Subject
- Inquiry type
- Message contents
- Technical anti-spam signals, including a Cloudflare Turnstile token, a hidden honeypot field, and the time elapsed while completing the form
Those values are submitted to a separately deployed contact service (documented as a Cloudflare Worker) that validates the input on the server and, if the submission is accepted, forwards it to the administrator through a configured email provider. Email-provider secrets are not stored in the static website files.
The worker is designed not to expose your message back to other visitors. The operator should not add public logging of message bodies.
Cookies and local storage
The static website itself does not set analytics cookies and does not use a client-side analytics package in this version.
Necessary or functional cookies may still appear depending on how the site is hosted:
- If the public site is reached through Cloudflare DNS and Cloudflare Tunnel, Cloudflare may set security or bot-management cookies according to the operator’s Cloudflare settings. Whether those cookies appear is a launch-configuration detail.
- The website does not use advertising cookies in this version.
Analytics
No first-party analytics service is included in this version of the source code. Server or tunnel logs on the Raspberry Pi, and logs available in a Cloudflare account, may record technical information such as IP address, user agent, requested path, and time of request. Those logs are a consequence of operating a public website and a tunnel, not an analytics product added by the frontend.
Launch configuration: decide how long you keep Caddy, system, and Cloudflare logs, and whether you will later add a privacy-respecting analytics tool. If you add analytics, update this policy before enabling it.
Third-party map services
The maps page can load tiles from the OpenStreetMap standard tile servers at tile.openstreetmap.org. When that happens, your browser requests map images from OpenStreetMap’s infrastructure. Those requests typically include your IP address, a browser user agent, and a referrer identifying this website. Use of OSMF services is subject to the OpenStreetMap Foundation privacy policy and tile usage policy.
The map also includes links to official Apache County, federal, and state websites. If you follow those links, the destination site’s own privacy practices apply.
Cloudflare Turnstile
When the contact form is enabled, Cloudflare Turnstile may load scripts and frames from challenges.cloudflare.com to distinguish people from automated abuse. Cloudflare then processes the challenge according to its own terms and privacy policy. The contact worker verifies the Turnstile token on the server before accepting a message.
Data retention
Contact messages delivered by email are retained according to the administrator’s email account and any retention settings of the chosen email provider. This source package does not include a message database on the Raspberry Pi.
Launch configuration: document how long you keep contact emails, who can read them, and how you handle deletion or correction requests.
Children
The website is a general community information resource. It does not knowingly ask children to create accounts, and version one has no public registration.
How to contact the operator about privacy
Use the contact form when it is enabled, or the operator-published method added before launch, to ask a privacy question or request a correction.