Privacy Policy
Last updated 20 September 2026. Available in English only.
UNESCO Heritage Tracker is a hobby project, not an advertising business. We collect the minimum needed to run it, we do not sell your data, and we do not share it with advertisers or data brokers. This page says exactly what we hold, why, and how to get it back or get rid of it.
1. Who is responsible for your data
The operator of this site is the data controller for personal data processed through UNESCO Heritage Tracker. You can reach us through the contact form.
2. What we collect
If you only browse
- Server and network logs. Our host and our CDN record request details including IP address, user agent, requested URL, timestamp, and response status. These are used to keep the site up and to block abuse.
- Strictly necessary cookies. An anti-forgery token on pages with forms, and your cookie choice. See the Cookie Policy.
- Analytics — only if you agree. Nothing is measured until you accept analytics cookies.
If you create an account
- Email address and a hashed password. We never store your password itself.
- Display name and avatar image URL, if you set them.
- Account metadata: when the account was created, whether the email is confirmed, whether your profile is public, whether you opted in to news emails, and whether your welcome email has been sent.
- A random share token for your public profile link, which you can regenerate at any time.
If you sign in with Google
Google tells us your email address and basic profile information so we can create or match your account. We do not receive your Google password and we have no other access to your Google account. Google’s own handling of the sign-in is covered by Google’s Privacy Policy.
If you use the site while signed in
- Visits you log: which heritage site, whether in person, virtual, or want-to-visit, an optional date, optional notes, and when the record was created or changed.
- Comments you post, including replies, plus the votes you cast and any comments you report.
- Links you suggest for a heritage site.
- Badges you have earned, which are derived from your visits rather than stored separately.
If you contact us
The contact and feedback forms send us the name, email address, and message you type, so that we can reply. These arrive as email and are kept in our mailbox. Both forms are protected by Cloudflare Turnstile, which performs a bot check.
What we do not collect
- No payment or card details. Donations go through a third-party platform we never see into.
- No precise location. If you use a “near me” feature, your browser resolves your position locally and it is not sent to us or stored.
- No special-category data (health, beliefs, biometrics, and so on). Please do not put any in a comment.
- No advertising or cross-site tracking profiles.
3. Why we process it, and our legal basis
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Creating and running your account; saving your visits, comments, and settings | Account data, visits, comments | Performance of a contract — Art. 6(1)(b) |
| Account emails: confirmation, password reset, welcome message | Email address, display name | Performance of a contract — Art. 6(1)(b) |
| News emails when a post is published | Email address | Consent — Art. 6(1)(a); opt-in, off by default, withdraw any time |
| Analytics: understanding which pages get used | Analytics cookies and identifiers | Consent — Art. 6(1)(a); denied until you accept |
| Keeping the site up, secure, and free of spam and abuse | Logs, IP address, Turnstile bot check | Legitimate interests — Art. 6(1)(f) |
| Replying to you | Contact form contents | Legitimate interests — Art. 6(1)(f) |
| Meeting legal obligations and handling disputes | Whatever is relevant | Legal obligation / legitimate interests — Art. 6(1)(c), 6(1)(f) |
4. What is visible to other people
- Comments are public. Your display name, avatar, and comment text are visible to anyone visiting that heritage site’s page, signed in or not.
- Your profile is private by default. Nothing about your visits is public unless you switch on “public profile”, and even then it is reachable only through your share link, which is an unguessable token. Turn it off, or regenerate the link, at any time from your profile page.
- Your email address is never shown publicly. If you have not set a display name, comments fall back to showing your email, so set one before commenting if that matters to you.
5. Who we share it with
We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf:
| Provider | What it does | Where |
|---|---|---|
| Microsoft Azure | Hosting and database | United States |
| Cloudflare | CDN, DDoS protection, and the Turnstile bot check | Global edge network |
| Resend | Sending account and news emails | United States |
| Google (Analytics) | Usage measurement — only after you consent | United States |
| Google (Sign-in) | Optional authentication | United States |
| jsDelivr, unpkg | Serving front-end libraries; your browser requests them directly | Global edge network |
| flagcdn.com | Serving country flag images; your browser requests them directly | Global edge network |
| OpenStreetMap | Map tiles and the embedded map on site pages | Europe |
We may also disclose data if we are legally required to, or where it is necessary to protect our rights, our users, or the public.
6. International transfers
The site is hosted in the United States, so if you are in the UK, EEA, or Switzerland your data is transferred outside your country. Those transfers rely on the providers’ Standard Contractual Clauses and, where applicable, their certification under the EU–US and UK–US Data Privacy Framework.
7. How long we keep it
- Account data: until you delete your account.
- Visits, notes, and suggested links: deleted with your account.
- Comments: see section 8 — you choose what happens to them.
- Contact form messages: kept in our mailbox while the conversation is useful, then deleted — normally within 24 months.
- Server and CDN logs: short-lived, governed by our providers’ own retention settings, typically days to a few weeks.
- Backups: deleted data can persist in database backups for a short period before those backups roll off. It is not restored into the live site.
8. Deleting your account
You can delete your account yourself, at any time, from your profile page. No email to us, no waiting. Deletion is immediate and permanent.
Deleting your account removes:
- your email address, password hash, display name, avatar, and all account settings;
- every visit you logged, including dates and notes;
- your comment votes and any reports you filed;
- your public profile and share link, which stops working immediately.
Your comments are your choice. When you delete your account you can either delete your comments outright, or keep the text in place with your name detached from it, so that replies underneath do not become unreadable. If you choose to keep them, they are shown as written by a deleted account and can no longer be traced back to you through the site.
Content that other people quoted, or that has already been cached by search engines or archived by third parties, is outside our control.
9. Your rights
If you are in the UK, EEA, or Switzerland, the GDPR gives you the rights below. We extend the same rights to everyone, wherever you live.
- Access and portability. Download everything we hold on you as a JSON file from your profile page, instantly.
- Rectification. Correct your display name, avatar, and settings from your profile page, and edit or delete any comment you have posted from My comments; ask us about anything else.
- Erasure. Delete your account from your profile page.
- Withdraw consent. Change your cookie choice from the Cookie Policy; turn off news emails from your profile page. Withdrawal does not affect processing already carried out.
- Object and restrict. Object to processing based on legitimate interests, or ask us to restrict it, by contacting us.
- Complain. You can lodge a complaint with your local data protection authority. In the UK that is the ICO; in the EEA, your national authority.
If you are a California resident, you also have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we have no “Do Not Sell” link because there is nothing to opt out of.
10. Security
Traffic is encrypted in transit with HTTPS and HSTS. Passwords are stored as salted hashes via ASP.NET Identity. Administrative API keys are encrypted at rest. The site sets a Content Security Policy and related hardening headers, sits behind a CDN with DDoS protection, and restricts direct access to the origin. No system is perfectly secure, and we cannot guarantee absolute security — but if you find a vulnerability, please tell us before telling anyone else.
11. Automated decision-making
We do not make decisions about you by automated means that produce legal or similarly significant effects. Badges are awarded automatically from your own visit records, which affects nothing outside the site.
12. Changes to this policy
We may update this policy. The “last updated” date at the top reflects the current version, and material changes will be announced on the site. If a change affects how we use cookies, you will be asked for your choice again.
Parts of this policy are adapted from Basecamp’s open-source policies, used under CC BY 4.0.