Privacy policy

Last updated: 27 October 2026

This page explains what data Dolomites Planner collects when you visit, plan a route, or create an account, and how we use it. It is maintained by the site owner and reflects current practice, not an independent audit.

1. Who runs this site

Dolomites Planner is run by SIA EBDS (registration no. 42103100012, Riga, Latvia), which is the data controller. For privacy questions or data requests, write via our contact page.

2. Data we collect

If you only browse

  • Standard request logs such as IP address, user-agent, requested URL, and timestamp, kept for about 30 days for abuse prevention.
  • With your consent (cookie banner), Google Analytics 4 usage statistics such as pages viewed, referrer, device type and country. Without consent, none of this runs.
  • Anonymous, aggregate counts of a few actions: which huts get clicked through to, how often a shared route link is opened, and which hut names searched in the planner found no hut. These store only a count, a date, and which hut, link or search text it was, with no identifier of any kind, so they cannot be traced back to you and do not depend on the cookie banner.
  • A visit log that runs without consent, as essential measurement of our own site: one row when you arrive and one when you first plan a route, holding a random session key your browser keeps for this purpose, the page you arrived on, the referring site and campaign tags, and your country. If the visit comes from Meta's network or a cloud data centre (Amazon, Google Cloud and the like), the row also names that network, so automated visits can be told from people; home and mobile providers are never recorded. No IP address and no name; the key is used only to attribute a later sign-up to its source.

If you create an account

  • Email address and a hashed password, or your OAuth provider identifier.
  • Account creation date, last sign-in, and your saved routes or preferences.
  • Product activity linked to your account: which hut and guide pages you open, and planning actions such as routes solved, saved or booking statuses you set. We use this only to understand what signed-in users need and to improve the planner; never for advertising, never shared.

If something crashes

  • An error log with the error message, stack trace, URL, and your user id if signed in, used only to fix bugs.

3. What we do NOT collect

  • No analytics or marketing before you agree: Google Analytics, Clarity and ad tags stay completely off until you accept them in the cookie banner, and you can withdraw via the "Cookies" link in the footer. The visit log above and the request logs are the only things that run before that.
  • No payment information, because we do not currently sell anything.
  • No precise location tracking. The planner only uses coordinates you explicitly enter or click.

4. Third-party processors

  • Supabase: hosts account, auth, and saved routes.
  • Cloudflare: hosts the site and routes traffic; like any host it sees request metadata such as your IP.
  • OpenStreetMap, OpenTopoMap, Waymarked Trails: map tiles; these servers see your IP when the map loads.
  • BRouter: computes trail paths between waypoints; only coordinates are sent.
  • Brevo: sends transactional email such as password resets (EU-based).
  • Google Tag Manager / Google Analytics 4: with consent, loads analytics/marketing tags; Google may process this data in the US under the EU-US Data Privacy Framework.
  • Microsoft Clarity: Microsoft Clarity: with your consent (cookie banner), anonymized session replays and heatmaps that show us where the interface confuses people. Typed input is masked by Clarity by default.
  • Meta Pixel: only with consent and only while our ad campaigns run; measures whether our ads led you here.
  • OpenAI Ads pixel (ChatGPT): only with consent and only while our ads run in ChatGPT; measures whether those ads led you here. If you are signed in and have accepted marketing cookies, a SHA-256 hash of your email address and of your account ID is sent with those measurements so a sign-up can be matched to an ad without a click ID; the plain values are never sent.
  • Reddit Pixel: only with consent and only while our ad campaigns run; measures whether our Reddit ads led you here and lets us show follow-up ads on Reddit to people who visited.
  • Microsoft Advertising (Bing UET): only with consent and only while our ad campaigns run; measures whether our Bing ads led you here.
  • Google: only if you sign in with Google; then Google's own privacy policy also applies.

5. Cookies and local storage

Essential local storage keeps you signed in, remembers your cookie choice and your unsaved route draft; this is required for the site to function. With your consent we additionally load Google Tag Manager with Google Analytics 4 (usage statistics) and, when our ad campaigns run, the Meta Pixel (ad measurement). You can change your choice at any time via the "Cookies" link in the footer.

6. How long we keep data

  • Account data: until you ask us to delete your account. Write to info@dolomitesplanner.com from your account email, or use the link in your dashboard, and the account with its routes and favourites is deleted within 30 days.
  • Request logs: about 30 days.
  • Error logs: 90 days.
  • Aggregated analytics: indefinitely, without personal identifiers.

7. Your rights (GDPR)

If you are in the EU, EEA, UK, or Switzerland, you can request access to, correction of, or deletion of your personal data; object to processing; and lodge a complaint with your local data authority. Email us via our contact page.

8. Children

The service is not directed at children under 16 and we do not knowingly collect their data.

9. Changes

We may update this policy. Material changes will be flagged on the homepage for at least 14 days. The date above always shows the current version.