Privacy Policy

Who is responsible

For privacy questions and requests to exercise your rights, write to [email protected].

What we do not do

It is worth stating plainly, because it is unusual:

• An account is optional. Buying, reading and listening work without signing in.
• There is no analytics package of any kind — no Google Analytics, no pixel, no heatmap, no session recording.
• There is no advertising and no profiling, and nothing about you is sold or shared for marketing.
• We set no advertising, analytics or tracking cookies. The two cookies we do set are needed for the audio to work and are listed in the cookie policy.

What is stored on your device

The guide keeps a few things in your browser’s local storage and cache so that it works as you expect. This information stays on your device. It is not transmitted to us and we cannot read it.

• Which tours you have purchased, so the audio plays without asking again.
• Which stops you have listened to, so your progress survives closing the page.
• Your language and playback-speed preferences.
• Downloaded audio, the app and a bounded city map for offline walking. Online street tiles may also be cached, but are not part of the offline city-map download.

If you sign in to restore a purchase

A purchase kept only in one browser is lost when that browser is cleared. So there is one optional feature that involves us holding anything at all: signing in with Google to get a purchase back on a new device.

What we store on our own server is a one-way hash of the email address that paid, and the list of tours it bought. A hash cannot be turned back into an address. It lets us answer “has this address bought something”, which is the only question we need to ask, without keeping a list of our customers’ email addresses.

Signing in itself is handled by Netlify Identity and by Google. Netlify holds an identity record for you — your email address and the fact that you signed in with Google — under its own terms as our processor. Google sees that you signed in to this site. Neither happens unless you press the button.

You never have to. It is not needed to browse, to read, to listen to the free stops, or to buy. If you would rather we held nothing, do not sign in, and write to us with your receipt instead.

Location

If you turn on the guided walking mode, your browser asks for permission to use your location. Your position is used only on your device, to work out which stop you are near and to move the map. It is never sent to us and never sent to anyone else. Turning the feature off, or refusing permission, stops it immediately and the rest of the guide continues to work.

Data collected automatically by others

Some things cannot be done without your browser contacting another company, and that company will see your IP address as a result. These are the only ones:

• Netlify, our host, which serves every page and keeps standard server logs (including IP address and browser type) for security and troubleshooting. Netlify is based in the United States and transfers are covered by its data processing terms and the European Commission’s standard contractual clauses.
• OpenFreeMap and the OpenStreetMap Foundation, which serve the map tiles. Your browser requests tiles directly from them when you open a map, and they receive your IP address in doing so.
• Netlify Identity and Google, only if you choose to sign in to restore a purchase. Google authenticates you and tells Netlify your email address; nothing about your walking, listening or progress is involved.
• Stripe, if and when you make a payment. Stripe handles the payment itself — your card details are entered on Stripe’s own pages and never reach this site or our servers. Stripe acts as an independent controller for that processing under its own privacy policy.

Why we are allowed to do this

Under the GDPR, storing what you have purchased and what you have listened to is necessary to provide the service you asked for, so the legal basis is performance of a contract with you, and for the free parts of the guide, our legitimate interest in making the site work. Server logs are kept on the basis of our legitimate interest in keeping the site available and secure. Payment records are kept because tax and accounting law requires it.

How long anything is kept

What is stored on your device stays until you clear it — you can remove all of it at any time from the About page, or by clearing site data in your browser. Netlify’s server logs are kept for a short period under their retention policy. Payment records held by Stripe and by us are kept for as long as tax law requires, which in Malta is generally ten years.

Your rights

Under the GDPR you have the right to ask what personal data we hold about you, to have it corrected or erased, to restrict or object to how it is used, and to receive it in a portable form. Unless you have signed in to restore a purchase, we will usually hold nothing that identifies you at all, and we will tell you so. If you have, write to us and we will delete the identity record and the purchase hash — bear in mind that deleting the hash also deletes your ability to restore that purchase, so we will say so before doing it.

To make a request, write to [email protected]. If you are not satisfied with the response, you may complain to the Office of the Information and Data Protection Commissioner in Malta (idpc.org.mt), or to the supervisory authority in the country where you live.

Children

This guide is not aimed at children and we do not knowingly collect anything about them. It is a walking tour of a city; children are very welcome to listen to it with an adult.

Changes

This policy was last updated on 1 October 2026. If it changes materially, the date at the top of this page changes with it.