1. Who we are
Travel Story Maker is operated by an independent team. This Privacy Policy explains how we collect, use and protect your personal data when you use our website and the related Service.
2. Data we collect
We collect only what is necessary to operate the Service:
- Account data: email address, hashed password (or OAuth identifier when you sign in with Google), display name.
- New-account notification: when an account is created by email or Google, its display name, email address and sign-up method are sent to the site's administrative mailbox through Resend for account administration. Passwords and verification tokens are not included.
- Account activity and retention: the most recent authenticated activity date and the status and deadline of an inactivity warning. We do not record a browsing history for this purpose.
- Usage data: anonymous metrics such as page views, browser type, locale and performance timings.
- Crawler observations: when enabled, we classify declared automated requests by user-agent and store only daily totals by crawler family and sanitized page group, with a last-observed timestamp. We store no IP address, raw user-agent, query string or visitor identifier in these aggregates. Article identifiers and unknown paths are grouped. These unverified observations help monitor discoverability; they are retained for 30 UTC calendar days.
- Passport and postcard generation statistics: after a complete generation requests its download, we record the creation type, selected side(s), number of PNG files, interface language, timestamp and coarse country supplied by the host. This does not send your photos, messages, traveler name, recipient address, account identity or IP address to the statistics table. Counts describe download actions, not unique people or confirmed files saved on disk.
- Content data: travel routes, photos and animations, as well as passports and postcards (photo included), that you create and save to your account.
- Administrative review of saved routes: authenticated site administrators can consult the creator's account email, save dates, route title, active stops and their coordinates, transport modes and estimated distances and travel times in a private, read-only catalogue. This catalogue does not include your media files, notes, budgets or animation settings, and does not collect unsaved browser drafts. It reads the existing saved routes without creating a separate historical copy; deleting a saved route or its account removes it from this catalogue.
- Live location sharing (opt-in): the latest approximate position (coordinates rounded to four decimal places, accuracy and timestamp) is shared with anyone holding the read-only link, along with a snapshot of stop names and coordinates. No position history is stored. Tracking runs only while the sharing dialog remains open; closing it requests deletion of the position. You can stop sharing or revoke the link; links become inaccessible after seven days and account deletion removes them. A browser or network interruption can leave the last known position visible until you stop or revoke sharing, or the link expires. Expired rows are removed when live shares are next managed.
- Made with TSM gallery (opt-in): a route preview, stop names and coordinates, title, optional caption and first name (or “A traveller”) are submitted for moderation. Approved entries are public and can be remixed. Photos, videos, notes, budgets and account emails are not published. Submissions remain until you withdraw them, an administrator deletes them, or you delete your account.
- Link sharing: after confirmation, a snapshot of the trip (including photos, logo, notes and planning details) is stored on our servers. Anyone with the link can view it without an account. Your account email is not returned to the recipient. Imported audio and video files are not transferred.
- Technical logs: short-lived server logs (IP address, request path, status code) kept for security and debugging.
- Error reports: when a page, a feature or a server fails, we record the page involved, the error message, browser and operating system (with advertised versions when available), device type, viewport and screen dimensions. Browser reports may also include language, pixel density, touch support, reported processor count and approximate memory, JavaScript heap usage/limit, connection category and data-saving mode, and the availability of graphics/video APIs and isolated or secure execution contexts. These limited diagnostics help reproduce failures, especially map and video export issues; they are not a complete hardware inventory. No IP address, location, raw user-agent, device fingerprint, file contents or form values are collected as device diagnostics. If a server session identifies you, your account name and email are attached for troubleshooting. Server-only errors may have less context, and some browsers withhold or reduce technical values.
- Newsletter (only if you subscribe): email address, language, date and origin of the subscription (footer, newsletter page, sign-up, or an administrator recording your request), date of confirmation or unsubscription. This list is separate from your account: you can subscribe without an account, and unsubscribe without deleting your account. Use the unsubscribe link in an email, or the Newsletter section in My account when signed in to stop newsletters for your account email address. An administrator can record your subscription or unsubscription on request; a manual subscription is identified as an admin action and does not itself send a campaign.
- Contact requests: the name, email address, subject and message you submit are sent to the team to handle your request. Do not include passwords, identity documents or other sensitive information.
- Testimonials: the publication name, optional location, rating and message are submitted for moderation. If approved, these details and the submission date are displayed publicly.
We do not sell your personal data. We do not use third-party advertising trackers.
3. Legal basis
We process your data on the following legal bases (GDPR):
- Contract - to provide the Service you signed up for;
- Legitimate interest - to keep the Service secure, prevent abuse and improve quality;
- Consent - for optional cookies or features where consent is required. The newsletter option on the account registration page is preselected and can be cleared before submitting the form; this preselection does not itself constitute explicit consent. The newsletter is sent at most once a month, and every email has an unsubscribe link.
4. Cookies
We use a minimal set of cookies:
- a session cookie for authentication (strictly necessary);
- a preference cookie to remember your language and theme;
- a temporary cookie (15 minutes) that keeps your newsletter choice while you sign in with Google, then is deleted.
No advertising or cross-site tracking cookies are set.
5. Map and export providers
Map tiles are loaded from MapTiler and OpenStreetMap. Sign-in is provided by Google OAuth. These providers process technical data (IP, user-agent) as independent controllers, under their own privacy policies.
When network routing is enabled, stop coordinates are sent to FOSSGIS for walking and cycling routes, and to the public OSRM server for road routes. FOSSGIS stores requests in its server logs; see its privacy policy. Photo, video and audio files are not sent to these routing services.
Coordinates needed to calculate elevation are sent to Open-Meteo. Received heights may be retained in the browser's local cache for 30 days to avoid repeated requests. They are not stored with photo files. See Open-Meteo's terms and privacy policy.
Emails (account confirmation, inactivity warnings, account deletion confirmation and farewell, newsletter and contact requests) are sent through Resend, which processes the information needed to send them on our behalf as a processor.
6. Data retention
Optional surveys store your selected choice and an IP fingerprint specific to each survey (HMAC with a server-side secret). This is pseudonymisation, not absolute anonymity. The survey tables contain no raw IP, name, email or account identifier. We use the fingerprint to limit responses to one per survey and IP. A shared network may share this limit; changing IP or using a VPN may allow an additional response. Administrators see aggregate results, not fingerprints. Answers cannot be changed and remain until the administrator deletes the survey, which also deletes its response records. Closing a survey keeps these records; deleting an account does not remove them because they are not linked to accounts. To ask about your survey data, use the Contact link below and name the survey.
Favorite templates store a stable template identifier, the private account identifier and the date added. Favorites are private, separate from votes and available across devices after sign-in. They remain until you remove them or delete the account; they contain no copy of your trip or photos.
Template votes store the template identifier, the private account identifier and the vote date. Public scores show totals, never voter identities. A signed-in account can withdraw each vote; deleting the account removes its votes.
Signed-in testimonials and quick feedback votes carry a private link to the stored account for activity tracking. Guest and older submissions are not linked by name or IP matching. Account identifiers and emails are not included in public review responses. Changing a signed-in feedback vote replaces the current vote, including from another device. Deleting the account removes its private submission links; published review content and feedback totals remain independent and can be the subject of a removal request through Contact.
Quick feedback can include an optional private message of up to 1,000 characters. The message is sent only when you press Send message, not when you select a thumb. Only the latest message for each feedback record is kept, together with its sending date. Administrators can read it; the public feedback API never returns messages, including to guests sharing an IP address. No message draft is saved in browser storage. Deleting a linked account clears its message while keeping the unattributed vote. Please avoid personal or sensitive information.
- Account data is kept as long as the account exists. You can delete your account at any time from My account, available in your profile menu: your account, saved routes, passports and postcards, and the share links you created are then erased. Drafts kept in your browser and your newsletter subscription are not affected.
- Saved routes, animations, passports and postcards remain until you delete them or the inactivity policy below applies.
- Saved plannings include the trip's stops, dates, tasks, notes, budgets and activity photos. They remain until you delete the planning or account, or the inactivity policy below applies.
- After three calendar months without authenticated account activity, accounts with saved items receive a service email warning. Saved routes and creations (including passports, postcards and plannings) may be deleted only after a further 30-day notice period, with the deadline stated in the email. Signing in or using an existing authenticated session before deletion cancels the pending deletion and restarts the inactivity period. The account, newsletter subscription, favorites, votes and existing shared snapshots are not deleted by this policy; downloaded files and browser drafts are not affected. Administrator accounts are excluded. Accounts predating activation receive a new three-month grace period because historical login dates are not inferred. Warning and deadline metadata is cleared when authenticated activity resumes or the saved items are purged.
- Anonymous daily totals of account deletions may be retained for service statistics. These totals contain no names, email addresses or user identifiers and cannot restore an account.
- For 30 days after an account is deleted through the site, a private administrative record retains its email address, deletion and expiry dates, whether the user or an administrator initiated it, language and the status of the one-time confirmation email. No name, password, authentication token or saved creation is retained in this record. It supports handling the closure and its confirmation, not marketing. A voluntary deletion triggers one confirmation and farewell attempt; it does not subscribe you to the newsletter. Expired records are excluded from reads and automatically purged; the scheduled purge runs every five minutes. Earlier anonymous deletions cannot be identified. This limited retention is shown before you confirm deletion.
- Shared snapshots are independent of the original project: editing or deleting it does not change existing links. They do not expire automatically; request deletion of a shared link, including the link in your message. Copies already downloaded by recipients cannot be withdrawn.
- Server logs are kept up to 30 days.
- Error reports are erased automatically after 30 days. Account deletion requests removal of both your name and email from these reports; if the log storage is temporarily unavailable, the 30-day retention limit still applies.
- Newsletter data is kept until you unsubscribe. The confirmation link expires after 7 days; without confirmation, we send no newsletter. When you subscribe with the email address of your signed-in account, that address is already verified and no extra confirmation is requested. The Newsletter section in My account lets you subscribe, resubscribe, confirm a pending subscription or unsubscribe. Subscribing there records your new consent and interface language and takes effect immediately; simply visiting the page does not subscribe you. After you unsubscribe, we keep only the address and the unsubscribe date so we don't write to you again; you can ask us to delete them.
- Deletion requests are processed within 30 days.
7. Your rights
Under GDPR you have the right to:
- access your personal data;
- correct inaccurate data;
- request deletion ("right to be forgotten");
- export your data in a portable format;
- object to or restrict certain processing;
- lodge a complaint with your local data-protection authority (CNIL in France).
To exercise these rights, contact the team about your data. State the request and, if relevant, the shared link or testimonial concerned. No additional account is required. Do not send a password or identity document through this form. See also the legal notice.
8. Security
We host the Service on Microsoft Azure. Traffic is encrypted in transit (HTTPS/TLS). Passwords are stored hashed with industry-standard algorithms. Access to production data is restricted to authorized maintainers.
9. Children
The Service is not directed to children under 13. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.