Heritage Navigator – Privacy Policy Effective: 27 July 2026
This policy is available in English and Danish.
Flemming Berthelsen operates Heritage Navigator (the "Service") and is the data controller for the personal data described below.
Email: flemming.berthelsen+hn-privacy@gmail.com
We have not appointed a Data Protection Officer; write to the address above with any question about this policy or your data.
You can read, listen to and walk everything in Heritage Navigator without an account, without signing in and without telling us who you are. Your location never leaves your device, and your favourites, progress and settings are stored only in your own browser. What does reach a server is the ordinary technical traffic any website receives, optional analytics you can refuse, and anything you choose to write in the feedback form.
When you allow the browser to share your position, Heritage Navigator uses it to sort sites by distance, show you on the map and detect when you arrive at a stop on a walk.
sessionStorage (key heritage-nav-gps-cache, cleared when you close the tab) so the app does not have to ask the GPS again on every page.The following is kept in your browser's local storage. It stays on your device, is not transmitted to us, and you can delete all of it by clearing site data for this website in your browser.
| What | Why |
|---|---|
| Favourites | So your saved sites survive a reload |
| Visited sites and route progress | So a walk can be resumed and the Passport can be stamped |
| Audio playback position | So a narration resumes where you stopped |
| Filters, language choice | So the app looks the way you left it |
| Introduction cards already seen | So you are not shown the same onboarding twice |
| Whether you agreed to share your location | So you are not asked again unnecessarily |
| Downloaded narration audio (browser Cache API) | So a prepared walk plays without a connection |
Legal basis: these entries are necessary to provide the functionality you have asked for (GDPR art. 6(1)(b)/(f); ePrivacy: strictly necessary storage). They are not used for tracking or advertising.
Hosting and server logs. The Service is hosted on Netlify. Like any web host, Netlify processes your IP address, the requested address, timestamp, browser and operating system in order to deliver the pages and protect against abuse and attacks. Legal basis: our legitimate interest in operating and securing the Service (GDPR art. 6(1)(f)).
Content delivery. Text, images and audio narrations are stored with Supabase (PostgreSQL and object storage). When your browser fetches them, Supabase's servers see your IP address and the file requested. Visitors are anonymous — no visitor account exists and no visitor identifier is stored. Legal basis: art. 6(1)(f).
Technical error reports. If the app crashes or throws an unexpected error, it may send a short automatic report containing the error message, the technical stack trace, the address of the page, your browser's user-agent string and the interface language. Reports are stored in our database and used solely to find and fix bugs. They are not linked to a person and contain no location data. Legal basis: art. 6(1)(f).
Editorial accounts. The editorial team signs in with Supabase Auth, which stores an email address, a hashed password and a session cookie. This applies only to us, not to visitors.
In production, the Service uses Google Analytics 4 (measurement ID G-VRMW42J07F) to count visits and see which content is used.
Analytics is switched off by default: Google Consent Mode is initialised with analytics_storage, ad_storage, ad_user_data, ad_personalization, functionality_storage and personalization_storage all set to denied, and the consent banner from CookieYes asks you before anything changes. If you decline, no analytics cookies are set and no analytics measurement is performed. If you accept, Google processes cookie identifiers, IP-derived approximate location, device and browser information and the pages you view.
CookieYes stores your own choice so you are not asked on every visit.
Legal basis: your consent (GDPR art. 6(1)(a); ePrivacy). You can change or withdraw it at any time through the cookie banner or by clearing site data.
Some parts of the Service are fetched directly from other providers. Your browser contacts them itself, so they see your IP address and what you requested, and their own privacy policies apply:
youtube-nocookie.com) – embedded video on some sitesWe do not send them any information about you beyond what your browser sends when it requests the content.
The "Give feedback" link opens a form hosted by Jotform. What you enter — a rating, your message, the city you were looking at, and your email address if you choose to provide one — is stored by Jotform and forwarded to us. We use it to answer you and to improve the content; entries are recorded in an internal, non‑public log and may become a task in our private issue tracker.
Legal basis: your consent, given by submitting the form (GDPR art. 6(1)(a)), and our legitimate interest in improving the Service (art. 6(1)(f)). Submitting the form is entirely voluntary. Ask us and we will delete your submission.
The providers named above act as processors or independent controllers for the data described: Netlify, Supabase, Google, CookieYes, Jotform, GetYourGuide, the OpenStreetMap Foundation, Esri and the Wikimedia Foundation.
Several of them are established outside the EU/EEA, primarily in the United States, or may process data there. Such transfers take place under the data‑processing terms and EU Standard Contractual Clauses that these providers make available, and — where applicable — the EU‑U.S. Data Privacy Framework.
Under the GDPR you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of what was done before.
Write to flemming.berthelsen+hn-privacy@gmail.com and we will respond within one month. Note that for most of what the app does we hold no data that can identify you, so we may be unable to link a request to a specific person — that is by design.
You may also lodge a complaint with a supervisory authority, for example the Danish Datatilsynet (datatilsynet.dk) or the Portuguese CNPD (cnpd.pt), or the authority in your own country of residence.
The Service is not directed at children under 13 and we do not knowingly collect personal data from them.
We may update this policy. The date at the top always shows the current version, and material changes will be announced in the app.
Email: flemming.berthelsen+hn-privacy@gmail.com
See also our Terms of Service.