Privacy Policy

The short version: lodomap is a travel guide, not a data business. We record enough to understand how the site is used and to keep it working, we never sell your personal information, and the one place money changes hands — affiliate links — is described plainly below and on our Affiliate Disclosure page.

What we collect when you just read the site

You don't need an account to use lodomap, and we don't ask for one. For every visitor we store:

• Your IP address, together with the first and most recent time it visited and which calendar days it visited on. We use this to count unique visitors rather than raw page loads.
• An approximate location — country, region and city — derived from that IP address. Where our host provides this on the request itself we use that; otherwise we look the address up with ip-api.com. It is city-level at best, never a precise position, and we do not use your device's GPS. The site never asks for browser location permission.
• Where you arrived from, reduced to a source label such as "google" or "instagram" — not the full referring URL.
• How long a visit lasted, in coarse buckets, and what was searched for in our site search. Search terms are stored as text; please don't type anything private into a travel search box.

We do not build advertising profiles, we do not track you across other websites, and we do not sell or rent any of this to anyone.

Affiliate links and the partner script

lodomap earns commission when a reader books a flight or a hotel through a partner link. This is the one part of the site with a commercial relationship attached, so it gets the most detail here.

• Our destination guides and articles carry links to Aviasales (flights) and Booking.com (hotels), provided through the Travelpayouts partner network. Every page that carries such a link shows an affiliate disclosure on the page itself, above the link.
• Those same pages load a Travelpayouts script, which is how a booking gets credited back to us. It can set cookies or similar identifiers in your browser and can read the links on the page in order to attach our partner ID to them.
• That script runs on every page of the site, which is how the partner network requires it to be installed. So every page carries an affiliate disclosure too — a short line in the footer everywhere, and a fuller notice at the top of the guides and articles where the booking links actually live. No page here is monetized without saying so.
• If you are signed in and have saved a travel plan for a place you then search for, the hotel link on that search page is built with the month you told us, so the booking site opens on roughly the right dates instead of an empty calendar. Your plan stays on lodomap; those dates reach our partner only if you click the link, in its address, exactly as if you had typed them on their site. Nothing is sent while you are simply reading the page, and deleting the plan removes it.
• What happens after you click a partner link is governed by that partner's own privacy policy, not this one. Clicking is entirely optional, and prices are the same either way.

Under California law, sharing data with an advertising partner in this way can count as "sharing" for cross-context behavioral advertising. If you would rather it didn't happen, don't click the partner links — without a click there is nothing to attribute — or use your browser's tracking protection, which we do not attempt to detect or work around. You can also email us at the address below to ask us not to share your information, and we will honor that.

Google Analytics, and where it does not run

We use Google Analytics 4 to see which pages people read and how they arrived. It records page addresses, referrers and coarse device and location information, and it sets cookies in your browser.

Because it sets cookies, we do not load it at all for visitors in the EU, the EEA, the UK or Switzerland. Not a banner, not a deferred script — the tag is simply never sent to those pages. Rather than ask for consent with a pop-up, we chose not to do the thing that would need consenting to. If we cannot tell where a visitor is, we leave the tag off as well.

It is also switched off on parts of the site where measuring would cost more than it is worth:

• Pages whose address contains a token — email verification links, email-change confirmations, and shared-map links. Analytics records full page addresses, and those tokens are effectively keys; they stay out of anyone else's system.
• Your own account pages — profile, friends and saved places, whose addresses can contain your username.
• Our admin pages, which are our own traffic and not yours.

Cookies and similar storage

We keep this deliberately small:

• A session cookie (__sid), set only if you log in or submit a form that needs one. Anonymous reading sets no session cookie at all.
• Security cookies from Cloudflare Turnstile, used on forms to tell a person from a bot.
• Partner cookies from Travelpayouts on the affiliate pages described above.
• Google Analytics cookies, on the pages and in the regions described above — never in the EU, EEA, UK or Switzerland.
• Local browser storage for small conveniences such as remembering that you dismissed the translation banner.

If you create an account

An account stores the username, email address and password you provide (the password is hashed — we never see or store the plain text), plus whatever you choose to add: an avatar, an about-me note, saved places, pins, travel plans and passport stamps. That content is yours. You can edit or delete it, and you can delete the whole account from your profile — which removes it, not merely hides it. If you subscribe to the newsletter we store your email address and confirmation status, every email carries a one-click unsubscribe, and deleting your account asks separately whether you want to stay subscribed.

Services we rely on

Running the site means data passes through other companies. Hosting is Vercel; the database is MongoDB Atlas; Cloudflare sits in front for security and analytics; Mapbox serves the interactive maps; Google Analytics measures readership outside the regions named above; email is sent over SMTP by our mail provider. Some content is fetched by our servers rather than your browser — weather from Open-Meteo, reference text from Wikipedia, headlines from Google News — which means those services see our request, not you. Each of these has its own privacy policy.

How long we keep things

Visitor and analytics records are kept while they remain useful for understanding traffic, and are not tied to a name or an account. Account data is kept until you delete the account. Newsletter subscriptions are kept until you unsubscribe.

Your choices

You can browse without an account, block or clear cookies, use tracking protection, unsubscribe from any email in one click, delete your account and its content at any time, and ask us what we hold about you or ask us to delete it. Depending on where you live — California, other US states, the UK or the EU — you may have a formal right to access, correct, delete, or opt out of the sharing described above. We apply those rights to everyone who asks, wherever you are, rather than checking your jurisdiction first.

Children

lodomap is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will remove it.

Changes and contact

If this policy changes we will update the date at the top of this page. Questions, requests, or anything here that seems wrong — please use our contact page. You can also read our Terms of Service and our Affiliate Disclosure.