Why your area is not your address

A site that helps you find books "two streets from here" has a problem it cannot dodge: to work, it must know where you are; to be safe, it must tell nobody. The two sound incompatible. They are not — but the answer is not the one most sites reach for, which is to show the exact point and hope for the best.

This page explains how it is solved here. It is worth reading even if you never sign up: these are the questions to put to any service that asks for your location.

The problem, stated properly

Picture a map with a dot showing where someone lending a book lives. The dot is their house. Anyone can open the map, zoom in and read the street number. You do not need to be a skilled attacker: you need a browser.

The first idea everyone has is "let's show an approximate point". Right — but the devil is in how you approximate, and there are two ways of getting it wrong that look harmless and are not.

Mistake 1: rounding

Trimming the decimals off a coordinate feels cautious, and instead it builds a grid: everyone inside the same square lands on exactly the same point. Knowing how the grid is built, you can work back to the original area. And anyone living somewhere sparsely populated is still identifiable, because that square contains one house.

Mistake 2: shifting randomly, every time

This is the treacherous one. If the point is moved in a random direction every time someone loads the page, it feels safer: the dot dances, it never settles. In fact it is far worse. Reload the page a hundred times and you collect a hundred points scattered around the real position — and the average of those hundred points is the real position. The longer you watch, the sharper the answer. An obfuscation redrawn on every glance does not protect you: it postpones.

How it works here

Serenlibrità moves the position once, and keeps it still.

A ring offset, between 150 and 300 metres

When you set where you are, the system picks a random direction — any angle between 0 and 360 degrees — and a distance between 150 and 300 metres. The point that gets stored is where that lands, not where it started.

The shape is a ring, not a filled circle, and the difference matters: with a filled circle the point could land two metres from your door, which is to say not moved at all. A ring guarantees a minimum. The radius, in turn, is not drawn evenly between 150 and 300: it is weighted so the point is equally likely to fall anywhere in the ring's area. Without that correction the points would bunch towards the inner edge — which is to say, towards you.

Computed once, not on every view

The offset is recomputed only if the real position actually changes. Updating your profile, reloading the page, being looked at by a thousand different people: the point stays put. That is the direct defence against the averaging attack above — a hundred observations of the same point give the same point a hundred times, and the average of a repeated number is that number.

The true coordinate is never stored

This is the part usually missing elsewhere. The real position goes into the function that computes the offset, is used for the calculation, and is discarded when the function returns. There is no database column holding it, it does not reach the logs, it is never sent back to the browser. The only thing that survives is the shifted point.

The practical consequence is that "what if someone got into the database?" has a short answer: they would find the same approximate positions you can already see.

Three more things worth knowing

Distances are shown in bands

Results never carry a number of metres. They carry a band — "within ~300 m", "within ~1 km". A precise figure would be a gift to anyone wanting to triangulate: three exact distances from three known points give you a position, which is exactly how GPS works. With bands, they do not.

Cover photos lose their hidden data

A photo taken on a phone contains far more than the image: date, device model and, if the camera's location service is on, the coordinates of where it was taken — which is nearly always your home. A cover photographed on the kitchen table is an address, if nobody cleans the file. Here the hidden data is stripped on upload, thumbnails included.

Consent is revocable, and takes effect immediately

Location is a separate consent, and withdrawing it is not a request that joins a queue: from the moment you revoke, your copies drop out of results and public pages. There is no cached version still circulating for a few hours.

What this does not do

No technique makes you invisible, and it is only fair to say where this one stops.

• If yours is the only house within a kilometre, an area three hundred metres across still contains one house. In the countryside the geometric protection is worth less than in a city: that is a property of geography, not of software.
• If you write your street name in a message, the system cannot unsay it.
• Whoever meets you for the exchange sees your face. That is the point of the exchange.

What the obfuscation guarantees is that the site does not reveal the address — not on a public page, not on a map, not in a data export, not in the database. The rest is yours to decide, conversation by conversation, and that is how it should be.

In short

• Rounding coordinates builds a reversible grid: that is not obfuscation.
• Redrawing the offset on every view is worse than not doing it: the average reveals the true point.
• Here: a 150–300 m ring, random direction, computed once.
• The real coordinate is never stored.
• Distances in bands, never metres; hidden photo data stripped; consent revocable instantly.