Privacy Policy
1. Data controller
The controller within the meaning of the GDPR is the operator of this website. Name, address and contact details are listed in the imprint.
2. Data we collect
- Email address — required for the magic-link login. Used solely for sign-in and transactional notices.
- POI ratings — which place, which rating (loved / liked / not for me / haven't been), timestamp.
- Derived data — per-tag and per-category scores plus the resulting travel archetype. All derived values are removable at any time (account deletion).
- Server logs — IP address, user-agent, timestamp, path. Automatically deleted after 7 days and used solely to mitigate abuse.
3. Purpose and legal basis
Processing is required to provide the service (Art. 6(1)(b) GDPR — performance of a contract). Server logs are stored on the basis of legitimate interest in stable operation (Art. 6(1)(f) GDPR).
4. Photos you share
When you contribute a photo publicly to a place, it helps other travellers get a better sense of it. By creating your account, you grant us the right to show such publicly shared photos within TravelType and to use them when presenting the project – both digitally and in print. This use stays entirely within TravelType: we do not pass your photos to third parties for their own purposes, and we do not use them outside this project. You keep the rights to your photos, can delete them at any time, and photos you upload privately stay visible to you only. Legal basis: your consent given on account creation (Art. 6(1)(a) GDPR).
5. Your rights
You have the following rights against the controller:
- Information about the data stored about you (Art. 15 GDPR).
- Correction of inaccurate data (Art. 16 GDPR).
- Erasure ("right to be forgotten", Art. 17 GDPR).
- Data portability as a JSON export (Art. 20 GDPR).
- Objection to processing (Art. 21 GDPR) and the right to lodge a complaint with a supervisory authority.
In Settings → Data you can deactivate your account yourself at any time — your profile is then hidden everywhere and can be reactivated by signing in again. Full, permanent deletion of all data (Art. 17 GDPR) as well as data access/portability (Art. 15 + 20) are handled on email request — we respond within 30 days.
6. Third-party services
- Hetzner Online GmbH (Falkenstein, Germany) hosts the application and database. Location: Germany.
- Cloudflare is used solely as a CDN/reverse proxy for static assets; no tracking is performed.
- OpenFreeMap (community-hosted OpenStreetMap tiles) powers the map on POI detail pages. The map only loads after you explicitly click; your IP address is then transmitted to OpenFreeMap. Legal basis: Art. 6 (1) (a) GDPR (consent).
7. Cookies
Only strictly necessary cookies are set — no advertising or tracking cookies, hence no consent banner under TTDSG.
- Better-Auth session cookie — keeps you signed in, expires after 30 days of inactivity.
- NEXT_LOCALE — stores your chosen language (DE / EN), pure convenience.
8. Retention period
Account-related data is retained as long as your account exists. Deleting your account permanently removes all personal data (cascade delete including ratings, tag scores and archetype). Server logs: 7 days.
9. Do-Not-Track
We honour the Do-Not-Track header. Since no tracking is in place this currently has no additional effect — the notice remains relevant in case optional analytics are added in the future.
10. Contact
We respond to privacy requests at the email address listed in the imprint within 30 days.
Last updated: 2026-06-21.