Privacy

What we collect today: nothing

No account system, no sign-in, no email capture, no contact form, no comments. The Journey Planner runs in your browser and the plan is never sent anywhere. My Europe stores your saved places in your own browser's local storage, which we cannot read.

There is no third-party analytics script on this site, no advertising network, no social tracking pixel, no embedded video, no web font loaded from someone else's server and no map tile provider. Every byte served comes from this domain. You can verify that in your browser's network tab in about ten seconds, which is a better assurance than this paragraph.

What a server necessarily sees

Serving a page means the host receives the request: an IP address, a user agent, the path, a timestamp. That is true of every website and cannot be opted out of by us or by you. Our intent is that these logs are kept short and never joined to anything.

What will change, and what will not

• Accounts will need an email address and a password hash, a lawful basis, a retention period and working access, export and erasure. None of that exists yet, which is the reason accounts do not.
• Analytics, when it exists, will use a session identifier that rotates daily and is never joined to a person, with no cross-site identifier. The event list is published in the specification in the repository before any of it is collected.
• Business accounts will hold company details, which are commercial rather than personal data for the most part — but the named contact is a person.
• We will not sell personal data, run behavioural advertising, or load a third-party tracker. That is a product decision, not a legal minimum.

Your rights under the GDPR

Access, rectification, erasure, restriction, portability and objection. They apply to a controller; there is not one yet. When there is, this page will name it, give an address, and give a working route to exercise each right rather than an invitation to email a mailbox nobody reads.