Privacy Policy

Who is responsible

For privacy questions and requests to exercise your rights, write to [email protected].

What we do not do

It is worth stating plainly, because it is unusual:

• An account is optional. Buying, reading and listening work without signing in.
• There is no advertising pixel, no heatmap and no session recording. Google Analytics is not loaded unless you say yes to it.
• There is no advertising and no profiling, and nothing about you is sold or shared for marketing.
• We set no advertising or tracking cookies. The two cookies we set ourselves are needed for the audio to work; Google Analytics sets its own only with your consent. All of them are listed in the cookie policy.

What is stored on your device

The guide keeps a few things in your browser’s local storage and cache so that it works as you expect. This information stays on your device. It is not transmitted to us and we cannot read it.

• Which tours you have purchased, so the audio plays without asking again.
• Which stops you have listened to, so your progress survives closing the page.
• Your language and playback-speed preferences.
• Downloaded audio, the app and a bounded city map for offline walking. Online street tiles may also be cached, but are not part of the offline city-map download.

Visitor statistics

We want to know which pages people read and how they find the site, so that we can make the guide better. Two services tell us, in different ways.

Cloudflare Web Analytics counts visits for every visitor. Our domain is served through Cloudflare, which tallies page views, the page you came from, your country and your type of device. It sets no cookies, stores nothing on your device, does not use your IP address to recognise you and does not follow you across visits or across other sites. We see totals, never individuals.

Google Analytics runs only if you choose “Allow analytics” in the banner. If you do, Google records the pages you open, the page or search that brought you here, the general area you are in (worked out from your IP address, which Google Analytics does not store), your device and browser, and how you move between pages, linked by a random identifier kept in a cookie. Google Ireland Limited processes this for us as our processor; it may be handled in the United States under the EU–US Data Privacy Framework. We do not use it for advertising and have not linked it to Google’s advertising products. You can change your answer at any time on the cookie policy page, and turning it off removes Google Analytics’ cookies from this site.

If you sign in to restore a purchase

A purchase kept only in one browser is lost when that browser is cleared. So there is one optional feature that involves us holding anything at all: signing in with Google to get a purchase back on a new device.

What we store on our own server is a one-way hash of the email address that paid, and the list of tours it bought. A hash cannot be turned back into an address. It lets us answer “has this address bought something”, which is the only question we need to ask, without keeping a list of our customers’ email addresses.

Signing in itself is handled by Netlify Identity and by Google. Netlify holds an identity record for you — your email address and the fact that you signed in with Google — under its own terms as our processor. Google sees that you signed in to this site. Neither happens unless you press the button.

You never have to. It is not needed to browse, to read, to listen to the free stops, or to buy. If you would rather we held nothing, do not sign in, and write to us with your receipt instead.

Location

If you turn on the guided walking mode, your browser asks for permission to use your location. Your position is used only on your device, to work out which stop you are near and to move the map. It is never sent to us and never sent to anyone else. Turning the feature off, or refusing permission, stops it immediately and the rest of the guide continues to work.

Data collected automatically by others

Some things cannot be done without your browser contacting another company, and that company will see your IP address as a result. These are the only ones:

• Cloudflare, which carries all traffic to this domain on its way to our host and protects it from attacks. Like any network in the path, it sees your IP address and the page requested, and it produces the cookieless visit counts described above. Cloudflare is based in the United States and is certified under the EU–US Data Privacy Framework.
• Google, only if you allow Google Analytics, as described above.
• Netlify, our host, which serves every page and keeps standard server logs (including IP address and browser type) for security and troubleshooting. Netlify is based in the United States and transfers are covered by its data processing terms and the European Commission’s standard contractual clauses.
• OpenFreeMap and the OpenStreetMap Foundation, which serve the map tiles. Your browser requests tiles directly from them when you open a map, and they receive your IP address in doing so.
• Netlify Identity and Google, only if you choose to sign in to restore a purchase. Google authenticates you and tells Netlify your email address; nothing about your walking, listening or progress is involved.
• Stripe, if and when you make a payment. Stripe handles the payment itself — your card details are entered on Stripe’s own pages and never reach this site or our servers. Stripe acts as an independent controller for that processing under its own privacy policy.

Why we are allowed to do this

Under the GDPR, storing what you have purchased and what you have listened to is necessary to provide the service you asked for, so the legal basis is performance of a contract with you, and for the free parts of the guide, our legitimate interest in making the site work. Server logs and Cloudflare’s cookieless visit counts are kept on the basis of our legitimate interest in keeping the site available and secure, and in knowing which pages are read. Google Analytics is used only on the basis of your consent, which you can withdraw at any time. Payment records are kept because tax and accounting law requires it.

How long anything is kept

What is stored on your device stays until you clear it — you can remove all of it at any time from the About page, or by clearing site data in your browser. Netlify’s server logs are kept for a short period under their retention policy. Cloudflare’s visit counts are totals with nothing in them that identifies you. Google Analytics keeps its detailed records for the retention period set in our account, at most fourteen months, and its cookies last up to two years unless you turn analytics off or clear them. Payment records held by Stripe and by us are kept for as long as tax law requires, which in Malta is generally ten years.

Your rights

Under the GDPR you have the right to ask what personal data we hold about you, to have it corrected or erased, to restrict or object to how it is used, and to receive it in a portable form. Unless you have signed in to restore a purchase, we will usually hold nothing that identifies you at all, and we will tell you so. If you have, write to us and we will delete the identity record and the purchase hash — bear in mind that deleting the hash also deletes your ability to restore that purchase, so we will say so before doing it.

To make a request, write to [email protected]. If you are not satisfied with the response, you may complain to the Office of the Information and Data Protection Commissioner in Malta (idpc.org.mt), or to the supervisory authority in the country where you live.

Children

This guide is not aimed at children and we do not knowingly collect anything about them. It is a walking tour of a city; children are very welcome to listen to it with an adult.

Changes

This policy was last updated on 1 November 2026, when visitor statistics were added. If it changes materially, the date at the top of this page changes with it.