Privacy Policy

This policy explains what Traveloonie collects, why, who else handles it, how long we keep it, and how to get it corrected or deleted. It describes what the site actually does — where a feature is switched off, we say so rather than list it.

1. Who we are

Traveloonie (traveloonie.com) is an independent travel site operated by MT, an individual, who is responsible for your data (the "controller"). For anything in this policy, email hello@traveloonie.com or use the contact form.

2. What we collect, and why

• Contact form — your name, email, topic and message, so we can reply.
• Newsletter — your email address, so we can send The Loonie Letter you asked for. Nothing else is required.
• Comments — the name you give (shown with your comment), your comment, and an optional email (never shown, used only to reply). Comments are reviewed before they appear.
• Story submissions — your name, email, destination, travel dates, story and an optional photo link. We only publish with the consent you tick on the form, and never publish your email.
• Contributor accounts (invite only) — your email, display name, optional profile details and the drafts you write, so you can sign in and be credited.
• Page views — our own counter records the page, the referring site's address without its query string, any campaign (utm_*) tags, and a coarse device and browser class such as "mobile Safari". It sets no cookie and does not store your IP address or the full browser identification string.
• Affiliate clicks — when you click a partner link, we record which link, which article, the referring page without its query string, and the same coarse device class. We do not learn whether you bought anything.
• Google Analytics — only if you click Accept on the cookie banner (see section 4).

We do not sell or rent your personal data, we do not "share" it for cross-context behavioural advertising, and we do not run ads.

3. Legal basis

Where the GDPR or UK GDPR applies: replying to you, sending a newsletter you signed up for, and running a contributor account are done because you asked (contract or consent); Google Analytics runs only on your consent; the page-view and click counters, spam protection and security logs rely on our legitimate interest in running and protecting a small website, kept to the minimum described here.

4. Cookies, tracking and browser storage

• Google Analytics — the Google Analytics script is not loaded at all until you click Accept. If you accept, it sets analytics cookies (_ga, _ga_*) with IP anonymisation and Google Signals switched off. Your choice is remembered for 12 months, and you can change it at any time with Cookie settings at the bottom of every page; choosing Reject also deletes the analytics cookies already set.
• Spam protection — forms may use Cloudflare Turnstile, which checks that a visitor is human without tracking you across sites. It is strictly necessary for the form it protects.
• Browser storage that never leaves your device — your theme (theme), your cookie choice (cookie_consent), saved posts (traveloonie-saved-*), posts you have read and badges you have earned (traveloonie-visited-posts, traveloonie-badges), and when the newsletter pop-up was last shown (traveloonie-exit-popup-shown). Contributors also keep an unsaved copy of their draft and a few interface preferences in the browser. Clearing your site data removes all of it.

We do not use advertising cookies, social-media pixels, or session-recording tools.

5. Services that handle data for us

• Cloudflare — hosting, delivery, the site's API and Turnstile spam protection. Like any web host it processes your IP address to deliver pages and stop abuse. Cloudflare Privacy Policy
• Supabase — our database: comments, contact messages, story submissions, page-view and click counts, and contributor accounts. Supabase Privacy Policy
• Kit — sends the newsletter, if you subscribe. Kit Privacy Policy
• Resend — sends account and editorial emails to contributors. Resend Privacy Policy
• Google — Google Analytics (only if you accept), and "Sign in with Google" for contributors who choose it. Google Privacy Policy
• GitHub — "Sign in with GitHub" for contributors who choose it. GitHub Privacy Statement
• Affiliate partners (for example Booking.com or SafetyWing) — when you follow a partner link you leave our site, and the partner's own privacy policy applies. We send them nothing about you.

Some of these providers are based in the United States, so your data may be processed outside your country. They are bound by their own data-protection terms.

6. How long we keep it

• Page views and affiliate clicks: 13 months.
• Contact messages: 24 months.
• Story submissions we do not publish: 24 months. Published stories stay while they are on the site.
• Comments that are never approved: 24 months. For approved comments, the email address is deleted after 24 months; the comment stays.
• Newsletter: until you unsubscribe (every email has a one-click link).
• Contributor accounts: until you ask us to close the account.

Deletion runs automatically every week. You can ask us to delete your data sooner at any time.

7. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it;
• delete it;
• stop using it for a purpose, or withdraw a consent you gave (cookie choices take effect immediately via Cookie settings).

Email hello@traveloonie.com with your request. We reply within 30 days, may ask you to confirm the request comes from the email address concerned, and never charge for it. If you are in the EU or UK you can also complain to your data-protection authority.

8. California privacy rights

If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for exercising these rights.

• Categories we collect: identifiers (name, email address), the content you send us (messages, comments, stories), and internet activity limited to the page-view and click records described in section 2 — plus Google Analytics data if you accept it.
• Sources: you, and your browser.
• Purposes: those listed in section 2.
• Disclosure: only to the service providers in section 5, for those purposes.
• We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. There is therefore nothing to opt out of.
• We do not use sensitive personal information.

To make a request, email hello@traveloonie.com. You may use an authorised agent.

9. Children

Traveloonie is written for adults planning trips, including trips with children, but it is not directed to children, and we do not knowingly collect personal data from anyone under 13 (or the higher age your country sets). If you believe a child has sent us personal data, email us and we will delete it.

10. Security

The site is served only over HTTPS, forms send data over encrypted connections, access to stored data is limited to the people who need it, and contributor sign-in is passwordless. Our security page explains how to report a vulnerability.

11. Changes

When this policy changes we update the date at the top. If a change affects how we use data you have already given us, we will say so on this page before it takes effect.