Your data, and how we handle it

Account information. When you sign up, our authentication provider stores your email address, display name, and (if you sign in with a third-party provider such as Google) your profile picture. We also ask it to hold the ID and name of every Party you're part of, so we can show your parties list when you sign back in on a new device. We use this to identify you, show you in your parties, and let you sign back in.

Party data. Itineraries, member names, member heights, attraction interests, and (where you add them) member email addresses and profile pictures used for invites, join requests, and bans, are stored in a Party document. That document is cached on your own devices, in your browser's IndexedDB storage, and syncs between that Party's members via our own self-hosted sync server, which also keeps a persisted copy so a Party survives even if every member clears their browser storage. It isn't purely peer-to-peer, but only people you invite to a Party, or who hold its share link, can read or write the document.

Location. If you open a Party's interactive map, your browser may ask permission to share your device's location so we can show a "you are here" marker alongside your itinerary's attractions. This uses your browser's own geolocation feature entirely on your device - your coordinates are drawn straight onto the map in your browser and are never sent to Ride Guide, saved in your Party document, or shared with anyone. You can decline or revoke this permission at any time in your browser without losing any other feature.

Usage analytics. We self-host Umami, a privacy-focused analytics tool, to understand which pages and features are actually used. Umami doesn't use cookies and doesn't build a profile of you across other websites. Because a Party's share link doubles as the key to read and write it, we strip those links out of any page URL before it reaches Umami, so a Party's data can never be reconstructed from analytics records.

Live park data. Queue times, showtimes, and park schedules are fetched from the ThemeParks Wiki API on your behalf. No account or Party information is sent as part of these requests.

We use account information to run your sign-in, and Party data to run the itinerary, calendar, map, and height-checker features you add members and rides to. We use analytics in aggregate, to prioritise fixes and new features - never to identify or track an individual visitor.

Party data is shared only with that Party's own members - it syncs directly between their devices through our own self-hosted sync server, and we don't read or otherwise use individual Party documents ourselves. Account information, including the list of Party IDs and names held against your account (see above), is held by our authentication provider on our behalf. Our analytics and live-data providers (Umami and ThemeParks Wiki) are described above. We don't sell personal data to anyone, for any reason.

Our authentication provider operates outside the UK and EU. Where that happens, we rely on the safeguards it puts in place for international transfers (such as the UK's International Data Transfer Addendum or equivalent standard contractual clauses). Party data and our self-hosted analytics run on our own infrastructure; if that ever moves outside the UK and EU, we'll apply the same kind of safeguards.

We use a small number of first-party cookies and browser storage entries to run the app itself: our authentication provider's sign-in cookies (so you stay logged in), remembering your light/dark mode and colour theme, your display preferences (such as 12/24-hour time), and caching your Party documents for offline access (see "Party data" above). None of these are used to track you across other websites, and none require consent under UK/EU cookie rules because they're strictly necessary to sign you in or to remember settings you've explicitly chosen.

Account information and your list of Party IDs are kept for as long as your account exists. Party documents persist on our own sync server and on the devices of anyone still in that Party until every member leaves or deletes it - we don't independently prune them. Umami analytics events are aggregated and can't be tied back to an individual visitor, so we keep them without a fixed expiry to compare trends over time.

You can remove a Party from your own account at any time from the sidebar, or ask a Party manager to remove a member's entry. There's no self-service way to delete your account yet - email us using the details below and we'll remove your sign-in and profile information from our authentication provider. If you're in the UK or EU, you have rights under GDPR (including access, correction, and erasure) - contact us to exercise them; a self-service data export is also planned.

Ride Guide isn't directed at children under 13, and we don't knowingly collect information from them. A parent or guardian may of course add a child as a Party member without that child holding their own account.

We may update this policy as Ride Guide changes. Material changes will be reflected here with an updated date, so it's worth checking back occasionally.

Questions about this policy, or a request relating to your data, can be emailed to britishwerewolfdev@gmail.com.