Privacy notice
Updated: October 6, 2026. This notice describes the site's implemented data flows. Visiting the site is not consent to optional Google Analytics. These disclosures are not a promise of GDPR compliance, legal certification, or verified business registration. Privacy questions and requests can be sent to [email protected].
Optional accounts and submitted information
Basic lookup does not require registration. An account supplies a username, email, and password; the server stores a password hash. Registration also sends the signup page, referrer, and browser user-agent. Account features can store favourites with locations and dates, weather notes, and voluntarily submitted timeline or memory content. Logged-in requests use a JWT bearer token; account activity can update server activity records. Do not post information you would not want others to see.
Browser storage
Local storage holds the JWT as wz_token, username and interface account state, language choice wz_lang, recent search history, display preferences, and cached translations. The analytics identifier wz_session can persist across visits. The consent manager stores its choice under wr_consent_v1. These are not all cookies and do not all have a verified automatic expiry. See the cookie and storage policy.
First-party server analytics
The existing analytics code sends visit events containing a session identifier, page, referrer, and user-agent; click events include an element and page. Search events can include place, date, lookback, and country, while result-summary events can include coordinates and weather metrics. The server stores analytics records and exposes aggregate activity and rankings. A persistent identifier and detailed search record are not necessarily anonymous, even when a public table is aggregated.
Visit and search country lookup can send the visitor IP address from the server to ipwho.is. Hosting and network infrastructure also receive IP addresses and request metadata. No verified log-retention schedule is asserted here. Google Analytics consent should not be assumed to govern every first-party analytics event; the deployed event-handling code determines that behaviour.
Third-party requests and location
- Weather: Open-Meteo receives query coordinates, date ranges, and requested variables. Browser requests also expose IP address and network metadata to the provider.
- Place search: OpenStreetMap Nominatim receives typed queries or coordinates for reverse lookup. A query can itself contain personal information; avoid searching a private address if you do not want to transmit it.
- Geolocation: where location detection is offered, the browser asks permission before sharing device location. Denying it still allows manual place selection.
- Translation: automatic translation can send visible page text and the target language to Google's translation endpoint. The response may be cached locally; translations may contain errors.
- Assets: map tiles, externally hosted libraries, fonts where used, and avatar services receive network requests. The current initials avatar service can receive the username as part of its request.
Provider terms and privacy practices apply separately. References include Open-Meteo terms, OpenStreetMap privacy, and Google privacy. API requests are not accurately described as sending “no personal data” merely because no email is included.
Optional Google Analytics and paused advertising
Google Analytics is opt-in through the shared consent manager, using the choice saved under wr_consent_v1. Cookie settings in the footer lets you revisit that choice. Google may process identifiers and usage information once enabled; withdrawing consent does not retroactively delete already transmitted records.
Direct AdSense loaders are removed from these pages. Ad scripts remain paused pending a Google-certified CMP and applicable publisher requirements. The basic site consent manager is not represented as that certified CMP, and advertising approval is not guaranteed.
Controls, retention, and requests
You can log out, clear local site data, change consent, and deny geolocation. Clearing browser history or storage does not delete server accounts, stored searches, backups, or third-party records. No exact retention period, 30-day deletion operation, or guaranteed response deadline is asserted without verification. Contact the published address for access, correction, deletion, or other applicable privacy-rights requests; identity checks and applicable legal limits may be relevant. You may also contact the appropriate data-protection authority where applicable.