Privacy Policy

1. Who we are

Travel Story Maker is operated by an independent team. This Privacy Policy explains how we collect, use and protect your personal data when you use our website and the related Service.

2. Data we collect

We collect only what is necessary to operate the Service:

• Account data: email address, hashed password (or OAuth identifier when you sign in with Google), display name.
• Usage data: anonymous metrics such as page views, browser type, locale and performance timings.
• Content data: travel routes, photos and animations, as well as passports and postcards (photo included), that you create and save to your account.
• Link sharing: after confirmation, a snapshot of the trip (including photos, logo, notes and planning details) is stored on our servers. Anyone with the link can view it without an account. Your account email is not returned to the recipient. Imported audio and video files are not transferred.
• Technical logs: short-lived server logs (IP address, request path, status code) kept for security and debugging.
• Error reports: when a page, a feature or a server fails, we record the page involved, the error message, the browser, operating system, device type and screen size, so we can fix the problem. No IP address or location is recorded. If you are signed in, your account email is attached to the report to help with troubleshooting.
• Newsletter (only if you subscribe): email address, language, date and origin of the subscription (footer, newsletter page, sign-up), date of confirmation or unsubscription. This list is separate from your account: you can subscribe without an account, and unsubscribe without deleting your account.

We do not sell your personal data. We do not use third-party advertising trackers.

3. Legal basis

We process your data on the following legal bases (GDPR):

• Contract - to provide the Service you signed up for;
• Legitimate interest - to keep the Service secure, prevent abuse and improve quality;
• Consent - for any optional cookie or feature where consent is required, including the newsletter: we only send it if you asked for it (unchecked box by default, email confirmation), at most once a month, and every email has an unsubscribe link.

4. Cookies

We use a minimal set of cookies:

• a session cookie for authentication (strictly necessary);
• a preference cookie to remember your language and theme;
• a temporary cookie (15 minutes) that keeps your newsletter choice while you sign in with Google, then is deleted.

No advertising or cross-site tracking cookies are set.

5. Map and export providers

Map tiles are loaded from MapTiler and OpenStreetMap. Sign-in is provided by Google OAuth. These providers process technical data (IP, user-agent) as independent controllers, under their own privacy policies.

When network routing is enabled, stop coordinates are sent to FOSSGIS for walking and cycling routes, and to the public OSRM server for road routes. FOSSGIS stores requests in its server logs; see its privacy policy. Photo, video and audio files are not sent to these routing services.

Coordinates needed to calculate elevation are sent to Open-Meteo. Received heights may be retained in the browser's local cache for 30 days to avoid repeated requests. They are not stored with photo files. See Open-Meteo's terms and privacy policy.

Emails (account confirmation, newsletter) are sent through Resend, which processes your email address on our behalf as a processor.

6. Data retention

• Account data is kept as long as the account exists. You can delete your account at any time from your Dashboard: your account, saved routes, passports and postcards, and the share links you created are then erased. Drafts kept in your browser and your newsletter subscription are not affected.
• Saved routes, animations, passports and postcards are kept until you delete them.
• Shared snapshots are independent of the original project: editing or deleting it does not change existing links. They do not expire automatically; to request deletion, contact us with the link through the Legal page. Copies already downloaded by recipients cannot be withdrawn.
• Server logs are kept up to 30 days.
• Error reports are erased automatically after 30 days. If you delete your account, your email is removed from them immediately.
• Newsletter data is kept until you unsubscribe. The confirmation link expires after 7 days; without confirmation, we send you no email. After you unsubscribe, we keep only the address and the unsubscribe date so we don't write to you again; you can ask us to delete them.
• Deletion requests are processed within 30 days.

7. Your rights

Under GDPR you have the right to:

• access your personal data;
• correct inaccurate data;
• request deletion ("right to be forgotten");
• export your data in a portable format;
• object to or restrict certain processing;
• lodge a complaint with your local data-protection authority (CNIL in France).

To exercise these rights, contact us via the Legal page.

8. Security

We host the Service on Microsoft Azure. Traffic is encrypted in transit (HTTPS/TLS). Passwords are stored hashed with industry-standard algorithms. Access to production data is restricted to authorized maintainers.

9. Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.