Privacy

Account: email, display name, session. Favourites, in-app messages and contact forms (name, email, topic, body, optional passport/destination) are stored so we can reply, and forwarded to [email protected].

Captcha and sign-in guards keep challenge codes and throttle buckets (IP and email hashes) to block brute force — not for marketing. Passport-photo tools run in your browser; photos are not uploaded.

Analytics: we use Google Analytics 4 to see which pages are visited, where visitors come from and how often features such as alerts or poster downloads are used. IPs are anonymised and nothing is used for advertising. Visitors in the EEA, UK and Switzerland get no analytics cookies unless they choose “Allow”; clearing site data withdraws the choice. Visa-alert emails are used only to send those alerts, and every email has a one-click unsubscribe.

We do not sell personal data or turn the contact form into an ad list. RSS does not collect email.

Hosting and the database sit on the deploy platform. HTTPS, same-site checks and captcha reduce abuse.

Signed-in users can manage saves and in-app messages. To correct or delete an account or a letter, email [email protected] with the address you used.