Preserving anonymity of recurrent location-based queries