Privacy Policy

Who is responsible for your data

Roberto Salodini is the data controller for GardaDay. Questions or requests about your data can be sent to hello@gardaday.com.

What we collect

If you register an account:

• Your email address and password (password is stored encrypted, never in plain text)
• The date you registered

If you submit an event, a correction, or a cover image:

• Your email address, linked to the submission, so we can follow up if needed
• The content of the submission itself
• The date and time of submission

If you send us feedback:

• Feedback is sent directly to our email via your own email client (a "mailto" link). We don't store feedback submissions in our database — it goes straight to our inbox, the same as any email you'd send us directly.

Automatically, as part of running the site:

• Standard hosting logs (e.g. IP address, browser type, pages visited) collected by our hosting provider for security and performance purposes. We don't use this data for tracking or advertising.

If you click an outbound link to a tour or ticket partner:

• We record that the click happened, together with the name of the activity and the town, so we can see which recommendations are useful. This isn't linked to your identity or your account.

Analytics and advertising

We use Cloudflare Web Analytics, a cookieless, privacy-focused tool that doesn't use cookies and doesn't collect personally identifiable information — it gives us aggregate traffic numbers (like how many people visited a page), not information about you individually.

We also use Google Analytics 4 to understand how the site is used — which pages are visited, from what kind of device, and roughly where in the world visitors are. Google Analytics sets cookies and processes this data on Google's servers, including in the United States. We have not enabled Google's advertising features or ads data sharing on it, and we don't use it to identify you.

Some pages show display ads through Google AdSense. Google may set cookies to limit how often you see an ad and, where you have consented, to personalise the ads. In the EEA and the UK, Google shows its own consent message before setting non-essential advertising cookies; you can change your choice at any time through that message.

We don't sell your data to anyone, for any reason. The "How GardaDay is funded" page has more on the ads and affiliate links.

Why we collect it

• Account email/password: so you can log in and submit events or corrections under your own name.
• Submission email: so we can moderate submissions responsibly and contact you if there's a question about something you submitted.
• Hosting logs: to keep the site secure and running properly.
• Analytics: to understand, in aggregate, which parts of the site are useful and where visitors come from.
• Advertising: display ads on some pages help fund the site.

The legal basis is your consent (for registering, submitting content, and for the non-essential analytics and advertising cookies) and our legitimate interest in running a functioning, moderated, self-funded platform.

Where your data is stored

The site runs entirely on Cloudflare:

• Cloudflare Workers — site hosting
• Cloudflare D1 — event and submission data
• Cloudflare R2 — user accounts and uploaded images

Cloudflare processes this data on our behalf under its own security and compliance standards; we don't share your data with it for any purpose beyond running the site. Google receives the analytics and advertising data described in the section above.

International data transfer: Cloudflare and Google are US-based companies, so your data may be processed in the United States as well as the EU. Both rely on the EU Standard Contractual Clauses as the legal safeguard for this transfer — the standard mechanism recognized under GDPR for exactly this situation.

Cookies

GardaDay's own code sets one cookie: a session cookie that keeps you logged in after you register or sign in. It's strictly necessary for the site to function and doesn't track you across other sites.

Third-party services set additional cookies: Google Analytics (analytics cookies) and, on pages that carry ads, Google AdSense (advertising cookies). In the EEA and the UK, Google's consent message handles your choice about the non-essential ones before they're set. Cloudflare Web Analytics sets no cookies.

Location ("Near me" feature)

If you tap "Near me" to sort events by distance, your browser asks your permission and, only if you grant it, reads your device's location. That location is used entirely on your device, in your browser, to calculate distance from the towns on the map — it is never sent to our servers, logged, or stored anywhere. It's discarded the moment you close or reload the page.

How long we keep your data

We keep account and submission data for as long as your account is active, or as long as the submission remains relevant to the site. If you ask us to delete your account, we'll remove your personal data within a reasonable time, except where we're required to keep records for legal reasons.

Your rights

If you're in the EU (or covered by similar data protection law), you have the right to:

• Ask what data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data
• Object to how we're processing your data

To exercise any of these rights, email hello@gardaday.com. We'll respond as promptly as we can.

You also have the right to lodge a complaint with your national data protection authority. In Italy, this is the Garante per la Protezione dei Dati Personali (garanteprivacy.it).

Children's privacy

GardaDay isn't directed at children, and we don't knowingly collect data from anyone under 16.

Changes to this policy

If we change what data we collect or how we use it, we'll update this page and change the "Last updated" date above.

Contact

Questions about this policy or your data: hello@gardaday.com