Privacy Policy

1. Data Controller

Name: Csaba Dániel

This website is designed, developed and maintained by the DCode web development team.

2. Purpose of the website

TravelTheWorld.hu is a travel website providing interactive map features — enabling users to track visited countries and UNESCO World Heritage Sites, create personal maps, and share them.

3. Data stored — browser (localStorage)

The site stores the following data in your browser's local storage (localStorage). This data exists only on your device and is not sent to a server:

Key	Contents	Consent required
`ttw_visited_v2`	Marked countries and territories (ISO alpha-2 codes)	No
`ttw_heritage_v1`	Marked UNESCO World Heritage Sites (IDs)	No
`ttw_lang_v1`	Language preference (hu / en)	No
`ttw_sidebar_open`	Sidebar state	No
`ttw_cookie_consent`	Consent status (accepted / declined)	No
`ttw_owner_token`	Unique browser identity token — the basis of access to your personal maps	Yes
`ttw_active_map`	ID (UUID) of the most recently edited map	Yes
`ttw_cognito_session_v1`	If signed in with a Google account: session data (authentication tokens, email address, account identifier, name) — see point 14	Yes

If you withdraw consent, ttw_owner_token, ttw_active_map and ttw_cognito_session_v1 can be deleted via your browser settings. Signing out of your Google account (see point 14) automatically clears ttw_cognito_session_v1 as well as your local map data.

4. Data stored — server (DynamoDB)

After giving consent, when you mark your first country a personal map is automatically created on our server. Data stored server-side:

Map unique identifier (UUID)
List of marked countries and territories
List of marked UNESCO World Heritage Sites
Map name (if you set one)
Creation and last-modified date
View count
SHA-256 hash of the owner token (the raw token is never stored)
The origin of the request that created/modified the map (Origin header, e.g. traveltheworld.hu) and the browser's User-Agent string
The visitor's country code, if available (ISO alpha-2 country code)
If you linked the map to your account via Google sign-in: the unique Cognito identifier tied to your Google account — this map record does not store your email address, which is kept separately in the Cognito user profile (see point 14)

These three fields (origin, User-Agent, country) are stored solely for abuse detection and debugging, are never returned by the API, and have no dedicated lookup interface. No raw IP address is stored.

Data is stored in the AWS eu-central-1 (Frankfurt) region. Server-side data is automatically deleted after one year of inactivity.

Via the share link (traveltheworld.hu/map/…), map contents are accessible to anyone who has the link.

5. Emailing the manager link

On the Manage My Maps page you can request the manager link (which grants access to all of your maps) by email — this requires entering an email address.

We do not store the email address you provide — only its SHA-256 hash is recorded server-side, solely to prevent sending too many emails (max 5 emails per manager link per 24 hours). The raw email address may briefly appear in technical operational logs during delivery (e.g. logs of the email delivery service — Amazon SES — and the server); these logs are not public and are not stored in a separate, searchable database.

Legal basis: consent (GDPR Article 6(1)(a)) — by using this feature (entering an email address and clicking send) you consent to us emailing the manager link to that address.

6. Purpose, legal basis and statistical use

Personal map storage: the purpose is to sync maps across devices and enable sharing. Legal basis: consent (GDPR Article 6(1)(a)).

Statistical use: marked countries and UNESCO sites may be used in aggregate, non-identifiable form for statistical and development purposes (e.g. most-visited destinations). Unique identifiers are never used for such analysis.

Technical logs: technically necessary data (IP address, browser type) may be processed to ensure the secure operation of the site. Legal basis: legitimate interest (GDPR Article 6(1)(f)).

Request origin, User-Agent and country for maps: the origin, User-Agent, and country code recorded when a personal map is created/modified are used to detect abusive (e.g. automated, bulk) use and for debugging. Legal basis: legitimate interest (GDPR Article 6(1)(f)).

7. Cookies, Google Analytics, Instagram and YouTube embeds

The site activates statistical cookies (Google Analytics) only with the visitor's prior consent. GA cookies allow Google Ireland Limited to collect usage statistics; in some cases data may be transferred to the USA.

Some blog posts embed an Instagram post. Instagram's embed script (Meta Platforms Ireland Ltd.) may set cookies, so it is likewise only loaded after the visitor's prior consent — without consent, a notice is shown in place of the post, letting the visitor accept cookies if they choose.

Some blog posts and country descriptions embed a YouTube video. The video player (Google Ireland Limited, youtube-nocookie.com) may set cookies, so it is likewise only loaded after the visitor's prior consent — without consent, a notice is shown in place of the video, letting the visitor accept cookies if they choose.

8. Data processors and third-party services

Amazon Web Services EMEA SARL — hosting, database, outbound email delivery and Google account sign-in (AWS S3, DynamoDB, Lambda, Amazon SES — for emailing the manager link, Amazon Cognito — for Google sign-in; eu-central-1 region).

Cloudflare, Inc. — CDN and network traffic management. Privacy policy: cloudflare.com/privacypolicy.

Google Ireland Limited — analytics (Google Analytics), embedding YouTube videos in some blog articles / country descriptions, and providing authentication data for Google account sign-in — all consent-only.

Meta Platforms Ireland Ltd. — embedding Instagram posts in some blog articles, consent-only. Privacy policy: privacycenter.instagram.com/policy.

CARTO (CartoDB Inc.) — map tiles on country pages. Privacy policy: carto.com/privacy.

jsDelivr (Prospect One) — Flag Icons CSS library CDN. Privacy policy: jsdelivr.com/privacy-policy.

9. Data retention

Server-side map data (including request origin, User-Agent, and country): automatically deleted after 1 year of inactivity. On withdrawal of consent, map deletion can be requested via the My Maps menu or by email.

Technical logs: retained for the minimum period necessary for operations.

Google Analytics data retention is governed by GA system settings.

Data stored in the Cognito user profile (email address, account identifier, name) is retained until the account is deleted, or until deletion is requested by email at [email protected].

10. Your rights

You have the right to access, rectify, erase, and restrict processing of your data, to object to processing based on legitimate interests, to withdraw consent, to data portability, and to lodge a complaint with a supervisory authority.

11. Complaints

National Authority for Data Protection and Freedom of Information (NAIH) — naih.hu

12. Data security

The website is accessible via HTTPS. The owner token is never stored in plain text — only its SHA-256 hash. The data controller applies appropriate technical and organisational measures to protect data.

13. Disclaimer

AI-generated content: Some country pages and blog posts contain content generated with the assistance of artificial intelligence. All information on this site is provided for general guidance only. While we strive for accuracy, errors and inaccuracies may occur. The data controller accepts no liability for any direct or indirect loss arising from inaccurate information.

Data loss: Map data stored on this site (visited countries, sites, map titles) may be lost due to technical failure, service outage, device change, or deletion of the browser identifier. The data controller accepts no responsibility for data loss; users are responsible for backing up their own data.

14. Signing in with a Google account

In addition to the existing manager-link access, you can optionally sign in with a Google account via Amazon Cognito. Sign-in happens through Google's own, independent authentication flow (OAuth) — we never see or store your password.

On successful Google sign-in, the following is stored in the Cognito user profile: your email address, a unique (non-reversible) identifier tied to your Google account, and — if granted — your name. This identifier is used to identify the maps linked to your account, as a parallel, convenience alternative to the manager-link method; the two identification methods work side by side, neither excluding the other.

Legal basis: consent (GDPR Article 6(1)(a)) — by initiating sign-in (selecting a Google account) you consent to storing your email address and account identifier.