Privacy

Tour-list is a place to rank the spots you try. You can use it without an account. This page says what is stored, where, who handles it and how to delete it.

Without an account

Your lists are saved in this browser's local storage (tourlist_local_v2) and are never sent to the server. The browser also remembers which list tab you had open (tourlist_active_tab_v1), and, for the length of a visit, that you closed the banner on the lists page. Clearing your site data deletes all of it, and the lists with it.

With a Google account

• Your account record. Your Google account id, name, email address and a link to your profile picture, when the account was created, when you last signed in, and which of your lists have a share link.
• Your lists. Every list, item, rating, price, note, tag and place you enter, kept as one workspace that only you can read or change. Lists you made before signing in are added to it, and the copy in your browser is removed.
• Share links. A random code for each list you choose to share. Anyone who has the link can see that list's name and notes, and each item's name, place, rating, price, notes and tags, with your first name. They cannot change anything, and they do not see your email address or picture. Tour-list does not record who opens a link. Stopping sharing, or archiving or deleting the list, ends the link.
• Your browser. Nothing from your account is kept in local storage. Signed in, your lists are fetched from the server each time.

Cookies

Tour-list sets cookies only for signing in, and both are httpOnly. __tourlist_session keeps you signed in for up to 7 days and holds your account id, name, email and picture link. __tourlist_oauth_state lasts 10 minutes while you sign in and protects the sign-in from forgery. There are no analytics or advertising cookies and no trackers, and the fonts are served from this site.

Who handles your data

• Netlify hosts the site and stores the records described above.
• Google signs you in. Tour-list asks for the openid, email and profile scopes, nothing else, and does not keep Google's access token.
• Google Maps, for signed-in users only. When you open an item with a place, your browser asks Google for a map image of that place text. When you type in the location field, Google receives what you type to suggest places. Google also receives your IP address and browser details with those requests. Signed out, no request goes to Google Maps. The "Open in Google Maps" link only goes to Google when you click it.

Nothing is sold, and nothing is shared for advertising.

Deleting your data

• Your avatar, then Delete my account deletes your workspace, every share link and your account record, and signs you out. You can download your data first. This cannot be undone. If you are still signed in on another device, that session keeps working for up to 7 days; saving from it creates an empty workspace.
• Download my data in Settings saves your lists as a file at any time, signed in or not.
• Clearing your browser data removes the lists saved in local mode.

Contact

For a question, or a deletion you cannot do yourself, reach the site's owner through vzhny.com, linked in the footer.