-- Shared pins: city level only. No free text; city/country come from the server's own reverse geocoding.
CREATE TABLE IF NOT EXISTS pins (
  id         TEXT PRIMARY KEY,           -- random id
  token_hash TEXT NOT NULL,              -- sha-256 of the owner's secret (the secret itself only lives in their browser)
  lat        REAL NOT NULL,              -- rounded to 0.1° (~11 km)
  lng        REAL NOT NULL,
  city       TEXT NOT NULL,
  country    TEXT NOT NULL,
  cc         TEXT NOT NULL,              -- ISO country code
  created    INTEGER NOT NULL            -- unix ms
);
CREATE INDEX IF NOT EXISTS pins_city ON pins (cc, city);
-- Rate limit: hashed IP (with a secret salt), expires after a few minutes. Nothing else about the visitor is stored.
CREATE TABLE IF NOT EXISTS ratelimit (k TEXT PRIMARY KEY, until INTEGER NOT NULL);
-- Server-side reverse-geocode cache per rounded position (keeps Nominatim traffic tiny)
CREATE TABLE IF NOT EXISTS geocache (k TEXT PRIMARY KEY, city TEXT, country TEXT, cc TEXT, created INTEGER NOT NULL);