A small public attack surface, described plainly.

The current site has no user accounts, application database, payment flow, or server-side form storage. Public guide records are intentionally delivered to visitors. Saved events, display preferences, and similar controls stay in the visitor's browser storage.

Public guide data is mapped through an explicit public event shape before it reaches a browser. Internal source notes remain in the server-side canonical dataset and are excluded from client component payloads. Google Sheets access, when configured, uses a read-only scope.

Production responses use HTTPS enforcement through HSTS, a Content Security Policy, framing restrictions, MIME-sniffing protection, a restrictive permissions policy, and a strict referrer policy. External event links are limited to HTTP and HTTPS URLs during normalization.

Vercel Analytics runs across the website, and the Peninsula Guide can use PostHog when configured. Those providers receive technical request information such as IP-derived location and device or browser details. Our analytics code excludes guide search text and form values and does not create identified visitor profiles. See the Privacy page for the current details.

Labels such as invite, application, private, or paid describe an event's attendance policy; they are not access controls for this public website. A future private deployment would require separate, verified authentication and authorization controls before private data could be published.

Please report a suspected vulnerability privately using the contact details on this site. Include the affected route, what you observed, and reproduction steps; do not include personal data that is unrelated to the report.