Privacy Policy

• Account data (only if you create an account): your email address and a password. The password is stored as a cryptographic hash by our authentication provider — we never see or store it in plain text.
• Your trip data (only if you are signed in): the places you add to your trip, and any trips or city walks you save — trip name, dates, days, stops and overnight towns. This is the product working, not profiling.
• Analytics — only with your consent: if you press Accept on the cookie banner, we load Google Analytics 4, which records pages visited and features used (searches, filters, planner actions). Before you make a choice, or if you decline, analytics stays off: the only analytics-related items on the page are a small inactive script snippet and its loader, served from our own domain through our CDN (Cloudflare), which we use as a first-party intermediary for these scripts. Before you make any choice, that inactive script sets no cookies and collects no analytics data; our CDN may perform a single technical verification request (a health check) to Google's servers, which carries no cookies and no data about you beyond standard connection metadata. Measurement only begins after you press Accept — from that point on, requests are made to Google services and analytics cookies are set.
• Abuse protection: our map-photo proxy records your IP address with a per-minute counter to rate-limit abuse. These records serve no other purpose and old entries are periodically cleaned up.

This site sets no cookies of its own. The only cookies come from Google Analytics (the _ga family) and only after you press Accept. You can change your decision at any time via "Cookie settings" in the footer — declining after accepting reloads the page and stops all analytics.

We also use your browser's local storage (which, unlike a cookie, is not automatically sent with every request): your trip selection when you are not signed in, your cookie decision, your sign-in session, and small interface preferences (dismissed tips and banners). It stays on your device until you clear it.

No advertising. No ad networks load, no marketing cookies are set, and nothing about you is sold or shared for advertising. If we ever introduce advertising, we will ask for your separate consent first — the current Accept covers analytics only.

Affiliate links. Some links to travel services are affiliate links: if you book through one, we may earn a commission at no extra cost to you. They are ordinary links — no tracking script of theirs runs on this site, and clicking one is what sends you (and your browser's usual request data) to them. Any page with such links says so on the page itself. The partners are:

• Northbound — car and campervan rental. Links carry a partner ID so they can attribute the booking.
• Stay22 — accommodation. Their link forwards you to a booking site (Booking.com, Expedia, Vrbo or Hotels.com, chosen by them), so you end up on a third party we do not pick.
• GetYourGuide — tours and experiences.

eSIMpass is not one of them. We recommend it and we earn nothing from it — there is no affiliate programme and no commission. We know the people who run it, and we would rather say so than leave you to find out: a declared conflict of interest is worth more than a hidden one. Those links carry no partner ID.

• Supabase — hosts our database and authentication, in the EU (Stockholm, Sweden). This is where account and trip data live.
• Cloudflare — serves the website (hosting and CDN), and acts as the first-party intermediary that serves our analytics scripts from our own domain (see section 2).
• Google Maps — powers the maps on the planner, saved routes, curated route and city walk pages. Google may set its own cookies when a map loads on those pages.
• Esri (ArcGIS Online) and OpenTopoMap — hiking trail pages load their map imagery directly from these services, so your browser sends them the usual web request (including your IP) when you open a trail page.
• Google Fonts — the site's fonts are served by Google, which means your browser sends your IP address to Google's servers when a page loads.
• Google Analytics 4 — only with your consent, as above.
• Resend — delivers our emails (see section 6). The only personal data it handles is your email address.
• NOAA (US space weather service) — the aurora forecast widget fetches forecast data from NOAA directly from your browser. No cookies; NOAA sees the request like any web server does.

Only transactional email tied to your account: a one-time welcome email when you sign up, and account emails (address confirmation, password reset). There is no newsletter and no marketing email.

• Change your cookie decision: "Cookie settings" in the footer, any time, one click each way.
• Delete your account: My Routes → "Delete account". You confirm by typing your email; deletion is immediate and removes everything — profile, saved trips, city walks and trip places. It cannot be undone.
• Access, correction, portability, objection: email info@icelandloop.com and we will handle it. If you are in the EU/EEA, these are your GDPR rights, and you can also complain to your local data protection authority.

Account and trip data are kept until you delete your account. The anonymous trip selection lives only in your browser. Rate-limiting IP records are cleaned up within hours. Analytics data, when you have consented, is processed by Google Analytics under Google's privacy policy. All traffic is encrypted (TLS); passwords are hashed; database access is protected by row-level security, so no other user can ever read your data.

When our practices change, this page changes with them, and the date at the top is updated. The page always describes what the site actually does.