In short
- No ads, no analytics tools, no data sold or shared.
- No accounts for visitors: your trips and favourites stay in your browser. You can export or erase them from My space.
- No cookie for visitors, hence no consent banner. Only the site's administrators get a session cookie.
Data controller
Maxence Bonnici, publisher of the site, reachable through the contact form (opens in a new tab).
Data processed, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Administrator account (the site's publisher only): email address, Google name and identifier, language | Run the shared trips gallery | Legitimate interest (GDPR art. 6.1.f) | As long as the address is on the administrators list |
| Trips published in the gallery by the publisher (stops, dates, pinned places) | Offer itineraries to everyone | Legitimate interest (art. 6.1.f) | Until they are removed |
| Communes and coordinates of the stops you search | Compute the route and look for places | Legitimate interest in providing the service (art. 6.1.f) | Not linked to your account; in-memory technical cache from 10 minutes to 24 hours |
| IP address, date, requested page, browser | Security, abuse prevention, troubleshooting | Legitimate interest (art. 6.1.f) | Server logs with automatic rotation; 15-minute in-memory anti-abuse counter |
| Messages sent through “Feedback” (GitHub issue or the mbonnici.fr contact form) | Reply, fix bugs, improve the service | Legitimate interest (art. 6.1.f) | GitHub issues: public, according to your choices on GitHub. Contact form: according to the mbonnici.fr privacy policy |
Recipients and processors
Your data is never sold or shared. Only the following are involved:
- Cloudflare, Inc. (USA): content delivery and protection; processes IP addresses. Transfers covered by the EU–US Data Privacy Framework.
- FOSSGIS e.V. (Germany), operator of the OSRM server: receives the stop coordinates from our server to compute the route. Your IP address is not sent.
- OpenFreeMap: map tiles are fetched by our server (proxy); your browser does not contact this service.
- Google LLC (USA), only for administrator sign-in: identity verification (OAuth 2.0 / OpenID Connect).
- GitHub, Inc. (USA), only if you choose to open a public issue from “Feedback”.
Security
Encrypted connection (HTTPS); no visitor accounts, hence no passwords to protect; administration restricted to a list of Google addresses (OAuth 2.0 with PKCE), revocable at any time; HttpOnly session cookie, request-origin checks, rate limiting and a content security policy (CSP).
Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection. The server keeps no account data about visitors: your trips and favourites are in your browser, and My space lets you export or erase them. For any other request, use the contact form (opens in a new tab): you will get an answer within a month.
You can lodge a complaint with the French data protection authority (CNIL): cnil.fr/plaintes (opens in a new tab).