Privacy policy

Account information. When you sign up, we store your email address, display name, and (if you set one) profile picture, on our own self-hosted authentication service - no third party holds this on our behalf. We also store the ID and name of every Party you're part of, so we can show your parties list when you sign back in on a new device. We use this to identify you, show you in your parties, and let you sign back in.

Profile pictures are public. If you upload a profile picture, we resize it, discard the original, and store the result in our database. It is served from a public address, so anyone who has that address can view it without signing in, and it may be visible to other members of your Parties. Please don't upload anything you wouldn't want the public to see. You can remove it at any time from your account page, after which we delete it. A picture supplied by a social sign-in provider isn't stored by us; we only keep a link to it.

Party data. Itineraries, member names, member heights, attraction interests, and (where you add them) member email addresses and profile pictures used for invites, join requests, and bans, are stored in a Party document. That document is cached on your own devices, in your browser's IndexedDB storage, and syncs between that Party's members via our own self-hosted sync server, which also keeps a persisted copy so a Party survives even if every member clears their browser storage. It isn't purely peer-to-peer, but only people you invite to a Party, or who hold its share link, can read or write the document.

Location. If you open a Party's interactive map, or tap Use my location on a Trip's Dashboard, your browser may ask permission to share your device's location, so we can show a "you are here" marker beside your itinerary's attractions or what's near you. Tapping Use my compass on the Dashboard may likewise ask to read which way your device faces. Both use your browser's own features entirely on your device - your coordinates and direction are drawn straight onto the page in your browser and are never sent to Ride Guide, saved in your Party document, or shared with anyone. You can decline or revoke either permission at any time in your browser without losing any other feature.

Usage analytics. We self-host Umami, a privacy-focused analytics tool, to understand which pages and features are actually used. Umami doesn't use cookies and doesn't build a profile of you across other websites. Because a Party's share link doubles as the key to read and write it, we strip those links out of any page URL before it reaches Umami, so a Party's data can never be reconstructed from analytics records.

Error reports. When something breaks, in your browser or on our server, a report is sent to our own self-hosted error tracker so we can fix it. A report holds the error message, where in our code it happened, the kind of page you were on (with Party IDs, query details and other links stripped out), and which version of Ride Guide was running. We don't attach your account, name, email address, IP address, browser details, cookies or Party data, and we mask anything that looks like an email address or invite token.

Live park data. Queue times, showtimes, and park schedules are fetched from the ThemeParks.wiki API on your behalf. No account or Party information is sent as part of these requests.

Anonymous feedback. If you send feedback, we store only your message, the page it was sent from (with any Party IDs and query details removed) and the time. We don't store your account, email, IP address or device details, so feedback can't be traced back to you - which also means we can't show it to you or delete it on request. Please don't include personal details in it.

We use your account to sign you in, and your Party's data to run its Itinerary, calendar, map and height checks. Analytics only count visits in total, to decide what to fix or build next; they never identify or follow anyone. Error reports are only used to find and fix bugs.

Party data is shared only with that Party's own members - it syncs directly between their devices through our own self-hosted sync server, and we don't read or otherwise use individual Party documents ourselves. Account information, including the list of Party IDs and names held against your account (see above), is held on our own self-hosted authentication service - we don't share it with a third party. Our analytics and live-data providers (Umami and ThemeParks.wiki) are described above; error reports stay on our own error tracker. We don't sell personal data to anyone, for any reason.

Account information, Party data, and our self-hosted analytics and error tracking all run on our own infrastructure in the UK; none of it is transferred to a third party outside the UK or EU. If that ever changes, we'll apply the appropriate safeguards (such as the UK's International Data Transfer Addendum or equivalent standard contractual clauses) and update this page.

We use a few cookies and browser storage entries of our own:

• A sign-in cookie, to keep you signed in.
• Your light or dark mode, colour theme and display settings, such as 12- or 24-hour time.
• A copy of your Party documents, so they open offline (see "Party data" above).

None of them track you on other websites.

Account information and your list of Party IDs are kept for as long as your account exists. Party documents persist on our own sync server and on the devices of anyone still in that Party until every member leaves or deletes it - we don't independently prune them. Umami analytics events are aggregated and can't be tied back to an individual visitor, so we keep them without a fixed expiry to compare trends over time. Error reports have no fixed expiry either: we keep up to about 10,000, and once that limit is reached the oldest and least useful are deleted automatically as new ones arrive. Anonymous feedback is kept until we have read and acted on it, and is then deleted.

You can remove a Party from your own account at any time, or ask a Party manager to remove a member's entry. You can download your data and delete your account from your account page - see how to delete your account and what happens to your data. If you're in the UK or EU, you have rights under GDPR (including access, correction, and erasure) - contact us to exercise any that aren't self-service.

Ban records. If a Party manager banned you and you then delete your account, we keep a one-way, salted hash of your email address (and nothing else - no name or account ID) against that Party, so the ban can't be avoided by re-registering. Our basis is legitimate interest in preventing abuse (GDPR Art. 6(1)(f)). A hash is still personal data; contact us if you want to object.

Ride Guide isn't directed at children under 13, and we don't knowingly collect information from them. A parent or guardian may of course add a child as a Party member without that child holding their own account.

We may update this policy as Ride Guide changes. Material changes will be reflected here with an updated date, so it's worth checking back occasionally.

Questions about this policy, or a request relating to your data, can be emailed to britishwerewolfdev@gmail.com.