Privacy notice
SoWhere collects what it needs to run the site and to send you the plans you ask for. This page says what that is, why, who else handles it and what you can do about it.
Who is responsible
SoWhere runs this site and decides how your data is used. You can reach us at hello@sowhere.io.
What we collect, and why
Browsing the guides needs no account and gives us nothing but what any website sees, described under server records below. We collect more only when you create an account or ask for a plan.
- Your account: your email address and a password, which we keep only as a one-way hash, so nobody at SoWhere can read it. You may add a display name and a home airport. If you turn on two-factor sign-in, we also keep the authenticator key and your recovery codes. Your units and theme choice are stored with the account. We use these to sign you in and run your account.
- Your plan requests: your email address and the trip you describe: places, month or exact dates, number of days, pace, who is travelling and how many, interests, and the page you started from. We use them to build your plan, email it to you, and tell you if we need something to build it. We also count requests to see how many people want plans.
- Our emails to you: account emails, such as confirming your address or resetting a password, and your plan. We send no newsletter unless you ask for one.
- Server records: like any website, our servers and Cloudflare see your IP address, your browser details and the pages you request. We use them to deliver the site, keep it secure and find faults.
We rely on three grounds: you asked for it (your account and plan), our interest in a secure, working site (server records and error reports), and your consent where we ask for it.
Cookies and local storage
- Sign-in cookie: keeps you signed in. If you turn on two-factor sign-in, a further cookie can remember this browser, and a short-lived one carries your sign-in from the password to the code.
- Status cookie: carries a short-lived message, such as "Your password has been changed", between account pages.
- Antiforgery cookie: protects our forms from being submitted by another site.
- Theme choice: your light, dark or automatic setting is saved in your browser's local storage, and in your account if you have one.
We set no analytics cookies and no advertising cookies, and we run no advertising trackers.
Who else handles your data
These services process data for us. We do not sell your data and we do not share it with advertisers.
- Hetzner: Hosts the site and its databases on servers in Germany.
- Cloudflare: Delivers the site and our photos and protects them from attacks. Every request to sowhere.io passes through it, so it sees your IP address and the pages you ask for.
- Amazon Web Services (SES): Sends our emails from its Stockholm region: account emails and your plan. It receives the recipient's address and the message.
- Sentry: Receives an error report when something on the site fails: the technical details of the failure and the page address and, when an error involves sending an email or signing in, the email address. We do not send it request bodies or cookies.
- Backblaze B2: Stores the site's photos and our database backups, in its EU region, and serves the photo on the sign-in pages directly, so it sees your IP address and browser details there.
Cloudflare, Amazon Web Services and Sentry are companies whose systems may process data outside the European Economic Area.
How long we keep it
- Your account: until you delete it.
- Plan requests: until you ask us to delete them; deleting an account whose email you confirmed deletes them too.
- Server records and error reports: only as long as we need them to deliver the site and fix faults.
Your rights
You can see what we hold about you, have it corrected, have it deleted, object to how we use it, and complain to your data protection authority.
- With an account: on Data & privacy in your account you can download your profile and plan requests as a file, and delete your account. Deleting removes your profile, your sign-in and the plan requests tied to your confirmed email address, immediately; copies in our backups expire after a set period.
- Without an account: write to hello@sowhere.io from the address you used, and we will send you your plan requests or delete them.
Children
SoWhere is not aimed at children, and we do not knowingly collect their data.
Changes to this notice
When we change this notice we change the date at the top. If a change affects how we use your data, we will say so on this page before it takes effect.