Privacy

The publisher named in the legal notice is the data controller for everything described here, and is established in France. There is no data protection officer: the operation is not the size that requires one. Write to the address in the legal notice and a person reads it.

This is the whole list. It is short enough to print in full rather than summarise.

Your purchase, your access, your progress and the running of the service are processed because they are necessary to perform the contract you entered into — Article 6(1)(b) of the GDPR. Without them there is nothing to deliver.

The record of your checkout confirmation is kept because the law puts on us the burden of proving that you gave it, and because we may need it to answer a claim: Article 6(1)(f), our legitimate interest in being able to evidence a consumer's consent, and Article 6(1)(c) where a rule obliges us to keep it.

Server logs are kept for security and abuse prevention, Article 6(1)(f). The text-size cookie is stored because you asked for it, and only then.

We do not rely on consent for anything else, because there is nothing else.

Two companies process data for us because the service cannot run without them, and two more see the address your request came from because your browser fetches a file from them.

Stripe processes the payment and is the merchant of record for it. It holds the card details we never touch, your email address, the amount and the tax. Stripe is an independent controller of that data and its own privacy policy governs what it does with it.

Cloudflare hosts the site, the database and the narration files, and its network carries every request. It processes on our instructions.

The typefaces come from Google Fonts and the map tiles from OpenFreeMap. Neither runs a script here — this site's security policy forbids third-party script outright — but a browser asking for a font or a tile necessarily tells the host who is asking, which means an IP address and the fact that the request was made for this site. Google is a United States company. OpenFreeMap is a free service operated from the European Union. Serving both from our own domain would end even that, and it is on the list.

Nobody else. No analytics provider, no advertising network, no email marketing tool, no chat widget, no A/B testing service. We have never sold personal data and will not.

We are in France, and data stays in the European Union wherever the platform allows it. Stripe and Cloudflare both belong to groups with United States parents, so a transfer can happen: for support, or because a global network routes a request through the nearest city rather than the nearest country. The same is true of the font request your browser makes to Google.

Where it does, it is covered by the European Commission's standard contractual clauses, and by the EU–US Data Privacy Framework in the case of a provider certified under it. Ask us and we will tell you what is in place for a particular provider.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing we base on a legitimate interest. Where a right is limited — we cannot delete an accounting record the law obliges us to keep — we will tell you which rule applies rather than simply refuse.

Write to the address in the legal notice, and say which email address you bought with. That is how we find you: there is no account and no password, so it is the only handle we have. We answer within one month.

You can also complain to a supervisory authority. Ours is the CNIL in France, at cnil.fr, and you may equally go to the authority of the country where you live.

Two cookies, and no more. Neither one is for us, which is the whole reason there is no banner.

The first is called “text”. It holds the word “easy” or “normal”, and it exists because you pressed the button in the header that makes the type larger. It lasts twelve months and goes nowhere except back to us on your next request, so that the page arrives already in the size you asked for.

The second appears only when you do something that has to be remembered — buy a tour, start a hunt. It is called “octt_device”, it holds a random identifier and a signature proving that identifier is yours, and your access hangs on it. It is the thing standing in for the account and password we decided not to make you create. It lasts up to four hundred days from its last use and is renewed every time you come back.

Neither can be read by a script: both are HttpOnly, and this site serves no script at all except the map. Neither is used to build a profile, and neither is shared with anyone.

That is why there is no consent banner. Under the ePrivacy rules, storage strictly necessary to provide a service the user has explicitly requested does not require consent. The French regulator names interface-preference cookies — a language choice, a display choice — as exempt where the personalisation is an intrinsic and expected part of the service, and treats an authentication cookie the same way. Pressing “Larger text” and being given larger text is the first case; buying a tour and being recognised afterwards as the person who bought it is the second. A banner asking permission for either would be theatre, and would train you to click through the ones that matter.

Nothing else is stored: no local storage, no session storage, no fingerprinting, no pixel. Pressing “Normal text” sets the first back to normal rather than removing it. To be rid of either, clear this site's data in your browser — knowing that the second is the key to what you paid for, and that getting access back afterwards means writing to us with the email you paid with.

Everything travels over TLS. The site refuses to be framed and refuses third-party script outright; the only JavaScript it serves anywhere is the map, and that comes from our own domain rather than a CDN. Access tokens are stored hashed. Paid material is checked against a live entitlement on every request rather than trusted from a session. A hunt's answers never leave our server, which is also why a hunt cannot be solved by reading the page source.

This is a product for adults buying a walk. We do not market it to children, we do not knowingly sell to them, and we ask for no data beyond what a purchase needs. If you believe a child has bought something here, write to us: we will refund it and delete the record.

When the service changes, this page changes with it and the date at the top moves. If a change means we start doing something materially different with data we already hold, we will say so here plainly, before it takes effect.