1. Summary
- We show no ads, use no tracking tools such as Google Analytics, and do not follow you across other websites. To count visits we use Cloudflare Web Analytics, which sets no cookies and does not identify you (section 3).
- That does not mean no data is processed when you visit. Like every website, ours is delivered through servers that see your IP address and basic technical details of each request. Section 7 explains exactly what happens to them.
- If you create an account, we keep your email address and display name. What you post (reviews, comments, vlogs) is public.
- Videos from YouTube and Vimeo load only after you press "Play video".
- We never sell personal data or share it for marketing.
2. Who is responsible
JourneyCities is the data controller (in Turkish law, veri sorumlusu) for the personal data described on this page. This policy is written to meet the information duties of the EU General Data Protection Regulation (GDPR, Article 13) and Türkiye's Personal Data Protection Law No. 6698 (KVKK, Article 10).
For any question or request about your data, write to [email protected].
3. What data we process
If you only read the site
- Technical request data, handled by Cloudflare when your browser loads a page or photo: IP address, date and time, the address requested, browser and device type (user agent), the referring page, and the approximate country derived from your IP.
- Items stored in your own browser, such as saved places and recent searches (section 5). These stay on your device and are not sent to us.
We do not run our own web servers, so we keep no access logs of our own. In Cloudflare's dashboard we can see only aggregated traffic figures, such as the number of requests per day and per country, which do not identify individual visitors.
We also use Cloudflare Web Analytics to see how many people visit and which pages they read. A small script sends Cloudflare the page address, the referring page, your browser type and how fast the page loaded. It sets no cookies, stores nothing in your browser, does not use your IP address to identify you, and does not follow you to other websites. We only see totals, never individual visitors.
If you create an account
- Account data: email address, display name and password. The password is stored only as a secure hash by Supabase; nobody at JourneyCities can read it.
- Login activity: Supabase records sign-ups, logins, password resets and logouts, with the IP address and browser type, to protect accounts from misuse.
- What you post: reviews and star ratings, vlog comments, and vlogs (video link, title, description, cover image). These are public and appear with your display name.
- Reports: if you report a vlog, the reason and any message you add.
- Trip plan: if you are logged in, your saved places and day by day plan are stored with your account so they appear on every device. If you choose "Share trip", anyone with that link can see the plan (without your name) until you press "Stop sharing".
You never have to give us personal data to read the site. An email address and display name are needed only to open an account; without them we cannot create one.
If you email us
Messages to our addresses at journeycities.com pass through Cloudflare Email Routing and are delivered to our mailbox at Microsoft. We use your address and message only to answer you.
4. Why we process it
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Delivering the website and photos | Technical request data | Legitimate interest, Art. 6(1)(f) / KVKK Art. 5(2)(f) |
| Counting visits and page views, in aggregate | Page address, referring page, browser type, page speed | Legitimate interest, Art. 6(1)(f) / KVKK Art. 5(2)(f) |
| Protecting the site from attacks, spam and abuse | Technical request data, login activity, reports | Legitimate interest, Art. 6(1)(f) / KVKK Art. 5(2)(f) |
| Running your account and publishing what you post | Account data, posts | Performance of a contract, Art. 6(1)(b) / KVKK Art. 5(2)(c) |
| Answering your emails and requests | Your email and message | Legitimate interest, or a legal obligation when you use your data rights (Art. 6(1)(c) / KVKK Art. 5(2)(ç)) |
| Playing vlog videos from YouTube or Vimeo | Data sent by your browser to those services | Your consent, Art. 6(1)(a) / KVKK explicit consent |
We make no automated decisions about you and do no profiling.
5. Cookies and browser storage
JourneyCities itself sets no cookies. The site uses your browser's localStorage and, for one item, sessionStorage: small storage areas that only this website can read. They hold the items below. None of these items are used for advertising or tracking.
| Name | Set by | Purpose | How long |
|---|---|---|---|
sb-…-auth-token | JourneyCities (Supabase login) | Keeps you logged in | Until you log out; access tokens renew about every hour |
jc:auth-next | JourneyCities | Remembers which page to return to after login | Removed as soon as you are logged in |
jc:saved | JourneyCities | Places you save with the bookmark button (up to 200) | Until you remove them or clear site data |
jc:trip, jc:plan-at, jc:plan-synced | JourneyCities, on the Saved page | Your day by day trip plan, when it last changed, and which account it was last matched with | Until you clear the plan or clear site data |
jc:recent-search | JourneyCities | Your recent searches in the search box | Until you clear site data |
jc:video-consent | JourneyCities | Remembers that you chose to play YouTube or Vimeo videos | Until you clear site data |
jc:dest-heroes:v1 | JourneyCities | A copy of the addresses of destination cover photos, so new covers show without reloading the whole site | Replaced after 6 hours |
jc:install-dismissed | JourneyCities | The date you closed the "Install the app" bar, so it is not shown again | 30 days |
jc:story-draft, jc:story-socials | JourneyCities, only on the Create a vlog page | Your unsent vlog draft and the social links you typed, so you do not lose them | Until you publish or clear site data |
jc-wx:… (sessionStorage) | JourneyCities | The weather already loaded for a destination, so it is not requested twice | Until you close the browser tab |
mapbox.eventData.uuid:…, mapbox.eventData:… | Mapbox, only on pages with a map (the Atlas, destination, event and experience pages) | A random ID and date Mapbox uses to count map loads | Until you clear site data |
The browsers of site administrators also store working data for the admin tools. Visitors' browsers never receive these items.
Offline copies (app mode)
If your browser supports it, the site keeps copies of the pages you have opened and of its own design files in the browser's Cache Storage, so they still open without an internet connection and the site can be installed as an app. The copies stay on your device, contain nothing beyond what those pages show, and are replaced when the site updates. Login, account and admin pages are never stored. Clearing site data (section 11) removes them.
These items are needed for features you ask for, so under the EU ePrivacy rules they do not require prior consent. That is also why the site shows no cookie banner.
Cloudflare security cookies
With our current settings, a normal visit sets no Cloudflare cookies. Cloudflare may set one of the following only if its security systems need to check a request, for example during an attack. Cloudflare classes all of them as strictly necessary, and they are not used to track you across websites.
| Cookie | Purpose | How long |
|---|---|---|
__cf_bm | Tells people and automated bots apart | 30 minutes of inactivity |
cf_clearance | Records that you passed a security check, so you are not asked again | Set by the site's challenge setting, 30 minutes by default |
_cfuvid | Tells apart visitors who share one IP address when limiting excessive requests | End of the browser session |
Cloudflare also sends a "Network Error Logging" instruction with each page. If a page fails to load because of a network problem, your browser may send Cloudflare a short technical error report. This instruction is kept in your browser for up to 7 days. Successful page loads are not reported.
After you press "Play video"
From that point YouTube or Vimeo may set their own cookies and browser storage on their video player, under their own policies. YouTube videos use its privacy-enhanced mode (youtube-nocookie.com), and Vimeo videos use its "do not track" setting, which reduce but do not remove this.
6. Outside services
| Service | What it does for us | Data it receives | Role |
|---|---|---|---|
| Cloudflare (US company, worldwide servers) | Hosting, content delivery, photo storage, DNS, security, email forwarding | Technical request data of every visit; emails sent to our journeycities.com addresses | Processor acting on our behalf under its data processing agreement |
| Supabase (US company) | Database, accounts and login | Account data, login activity, posts, reports; technical data of requests your browser sends to it | Processor under its data processing agreement |
| Resend (US company, sending servers in Japan) | Sends account emails from [email protected]: address confirmation and password reset | Your email address and the content of those emails | Processor under its data processing agreement |
| Microsoft (USA) | The mailbox where your emails to us arrive | Your email address and message | Email provider under Microsoft's terms |
| Mapbox (USA) | Draws the maps on the Atlas, destination, event and experience pages; it loads only when a map comes into view | IP address, browser and device type, the page address, the map area and zoom you view, and map-load events with the random ID in section 5 | Also uses this data for its own purposes (billing, improving its service) under its own privacy policy |
| Open-Meteo | Weather box on destination pages | Your browser asks Open-Meteo directly, so it receives your IP address, browser type and the destination's coordinates (not your own location) | Independent provider under its own terms |
| YouTube (Google) and Vimeo (USA) | Play vlog videos, only after you press "Play video" | IP address, browser and device details, the page address, and what you do in the player. If you are logged in to Google or Vimeo, they may link this to your account | Independent controllers under their own privacy policies |
Our photos come from our own trips and from free photo libraries (Pexels, Unsplash and Wikimedia Commons, credited where the licence asks for it). They are stored and served from our own image address (img.journeycities.com), so viewing them sends nothing to those libraries.
7. IP addresses and logs
- Why: an IP address is needed to send a page to your device at all. It is also used to detect and block attacks, spam and repeated failed logins, and to route you to a nearby server.
- Cloudflare processes the IP address of every request. It keeps its request logs for a limited time under its own policy; we receive only the aggregated figures described in section 3.
- Supabase keeps technical logs of requests to our database (including IP address) for 1 day on our current plan. Login activity records with IP address are kept as security records while your account exists and are deleted with it on request.
- We do not use IP addresses to identify, profile or advertise to you.
8. Transfers outside the EU and Türkiye
The services in section 6 are based in, or process data in, the United States and other countries. For people in the EU, these transfers rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, which these providers use. For Türkiye, transfers abroad are made under KVKK Article 9, on the basis of the safeguards these providers offer and, for video playback, your explicit consent when you press "Play video".
9. How long we keep data
| Data | How long |
|---|---|
| Account data and posts | Until you delete them or ask us to, or until we remove a post that breaks our Terms of use |
| Login activity | While your account exists |
| Vlog reports | While we review them, and afterwards only as long as needed to deal with repeated abuse |
| Supabase request logs | 1 day |
| Cloudflare request data | A limited period under Cloudflare's policy |
| Emails you send us | As long as needed to answer you and keep a record of data requests |
| Browser storage (section 5) | Until you log out, remove the item or clear site data |
10. Your rights under GDPR and KVKK
Depending on where you live, you can ask us:
- whether we process your personal data, and for a copy of it;
- for what purpose we process it and whether it is used for that purpose;
- who it has been shared with, in Türkiye or abroad;
- to correct it if it is wrong or incomplete, and to inform those we shared it with;
- to delete it, or to limit how we use it;
- to receive it in a common, machine-readable format (data portability);
- to stop processing that is based on our legitimate interest (objection);
- to withdraw consent at any time, for example for video playback, without affecting what happened before;
- to object to a result against you that is based only on automated analysis (we make no such decisions);
- for compensation if you suffer damage from unlawful processing (KVKK Article 11).
How to apply: email [email protected], if possible from the address you use on JourneyCities so we can confirm it is you. Requests are free of charge, and we answer within 30 days at the latest.
Complaints: you can also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (kvkk.gov.tr), in the EU the authority of your country, and in the UK the Information Commissioner's Office.
11. Deleting your data
Your account and posts
Email us from the address you signed up with and say what you want deleted. We delete the account, its login records and, if you ask, all your reviews, comments and vlogs, then confirm by email. Copies may remain in Supabase and Cloudflare backups and caches for a short time before they are overwritten.
What is stored in your browser
- Log out to remove your login session.
- Chrome and Edge: click the icon to the left of the web address, open "Cookies and site data" (Edge: "Cookies and site permissions") and delete the data for journeycities.com.
- Firefox: click the padlock next to the address, then "Clear cookies and site data".
- Safari: open Settings, then Privacy, then "Manage Website Data", search for journeycities.com and remove it.
Clearing site data also removes your saved places and your video choice.
12. Security, children and changes
Security. All connections to the site are encrypted (HTTPS). Access to the database is limited by per-user rules: other members cannot see your email address, and only we can see account emails and reports.
Children. Accounts are only for people aged 18 or over, as set out in our Terms of use. If you think a child has created an account, let us know and we will delete it.
Changes. If we add something new, such as analytics or advertising, we will update this page and its date first, and ask for your consent where the law requires it.
