This policy explains how calmbeach.day (https://calmbeach.manossmar.workers.dev) handles personal data. It is written to be readable; the short version is: we do not collect your location, we have no accounts, and we keep almost nothing.
Who is responsible
The controller is Manos Smarianakis. Contact: ineeda@calmbeach.day.
Your location
When you press "Find calm beaches near me", your browser asks for permission. If you agree, your coordinates are used only inside your browser, to work out which island you are on and how far each beach is. They are never sent to our server, never stored and never shared. If you refuse, nothing is lost: you can pick an island or tap the map instead. Tapping the map or choosing a place also stays in your browser.
What our servers and CDN process
The site is served through Cloudflare, Inc. and our own web server. When you load a page, the technical data your browser sends (IP address, browser type, requested address, time) is processed to deliver the site, keep it secure and prevent abuse. Our web server keeps access logs for a short period (up to 30 days). The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor; see Cloudflare's privacy policy.
The map, its fonts and the weather data are all served from our own servers, so your browser does not contact any other company to show them.
Data stored on your device
When you first visit, a cookie banner asks what you allow. We keep your answer in your browser's local storage (cbt-consent) for 12 months so we do not ask on every page; this is strictly necessary and involves no tracking. Only if you allow "Preferences" do we also store cbt-prefs: the travel time and transport you last chose, so the page remembers them, and cbt-photo-round: a number that goes up by one on every visit, so the beach photos take turns and you do not see the same one twice in a row. Without "Preferences" nothing is stored for this: the photos are simply picked at random on each visit. All of these stay on your device and you can delete them in your browser settings. You can change your choice at any time with the "Cookie settings" link in the footer; withdrawing "Preferences" deletes cbt-prefs and cbt-photo-round straight away. When you rate a beach, we also keep cbt:voter (a random code, no name or account) and cbt:my-ratings (your own stars) in your browser so that voting again replaces your earlier vote and the page can show what you gave; these are needed for the rating you asked for and are stored together with your stars on our server, never with anything that identifies you.
Links to other services
The "Directions" button opens Google Maps (or Apple Maps on iPhones) in a new tab. Only the beach's coordinates are put in that link, never your position. What happens next is governed by that service's own privacy policy.
Your rights
Under the GDPR you have the right to access, rectify or erase your data, restrict or object to processing, data portability and, where processing is based on consent, to withdraw it at any time. To use a right, write to ineeda@calmbeach.day. You may also complain to the Hellenic Data Protection Authority (dpa.gr) or to your local supervisory authority.
Ratings, suggestions and listing statistics
When you rate a beach we keep the stars you give, the language of the page and the conditions the card showed at that moment (calm score, wind, waves). A random code kept in your browser (cbt:voter) lets you change your own rating later; it is not linked to your name. When you send a suggestion we keep your message, its topic, the page address and language, and a link or e-mail address only if you add one (we use the e-mail address only to reply to you). For both, and to limit abuse, we store a shortened, salted hash of your IP address, never the address itself. We keep ratings and suggestions while they are useful for the site, and delete yours on request (ineeda@calmbeach.day).
When you see a business listing, or press its Call, Directions, Website or WhatsApp button, we add one to an anonymous daily counter for that business and beach; no visitor code or address is stored with the counter. When a suggestion arrives, a short alert (its topic and page, never your message or e-mail address) is sent to the site owner's phone through an external push-notification service.
Business listings
If you ask us to list a business, we keep what you send in the form (business name, kind, position, phone, e-mail, website, your message) to check, publish and update the listing. The phone numbers, e-mail addresses and websites you ask us to publish are shown publicly; the rest stays with us. We keep it while the listing exists and delete it when you ask. Listings imported from OpenStreetMap contain only what contributors have published there. To show businesses how their listing performs, when a listing is displayed or one of its buttons is pressed we add 1 to a daily counter for that business and beach. No cookie is set and nothing about you (no address, no device identifier) is stored with the counter; visitors who send Do Not Track or Global Privacy Control are not counted. To correct or remove yours, write to ineeda@calmbeach.day or use the form.
Affiliate links
Affiliate links are ordinary links: our page loads no script or cookie from the partner. When you press one, you leave this site and the partner's own privacy policy and cookies apply from then on. The link carries our partner id and the name of the page you were on (a beach code or island), so the partner can tell us which pages lead to bookings; it carries nothing about you. We also count how often a link is shown and pressed, as an anonymous daily total per partner and page, with the same method as the listing statistics above (no cookie, nothing about you stored; visitors who send Do Not Track or Global Privacy Control are not counted).
Children
The site is not directed at children under 16 and does not knowingly collect personal data from them.
Changes
If this policy changes, the new version is published on this page with a new date.