Privacy

Who runs TimeToStep

TimeToStep is operated by TimeToStep. For any privacy question or request, contact contact@timetostep.com.

Your location

TimeToStep does not ask for or use your location. Anything you type into a search stays between you and the services described below.

Travel plans

When you plan a walking day, your choices (city, dates and hours, how far you'd like to walk, breaks, interests and the places you said yes, maybe or no to) are sent to TimeToStep's server to build the plan. They are not stored, except that each place you said yes or no to adds one to that place's count for the day (see Usage counts). They are kept in the address of the plan page, together with the walk itself, so that you can come back to it or share it: anyone you send that link to sees those choices and that walk. Your location is not used. If you tell us where you're staying, the address you choose is part of the plan and of its link too, so share the link only with people you'd tell where you're staying. Finding the address works like the place search below.

To draw the walk along real streets, TimeToStep's server sends the map positions of the plan's stops (and of where you're staying, if you told us) to a walking-route service based on OpenStreetMap data (routing.openstreetmap.de). The request comes from our server, so that service receives only positions: not your IP address or anything else about you. The lines it returns may be kept in server memory to avoid asking again, not linked to you.

Place search

The text you type into the place search is sent by TimeToStep's server to a geocoding service based on OpenStreetMap data (photon.komoot.io) to find matching places. The request comes from our server, so the geocoding service does not receive your IP address. To avoid repeating identical searches, results are kept in server memory for up to 10 minutes, keyed only by the search text and not linked to you.

Your IP address

• To protect the service from overload, TimeToStep's server keeps your IP address in memory for about 1 minute to count requests. It is never written to disk or logs.
• Signing in to the admin and using the content API are limited per address too. For those, only a keyed hash of the address is stored, never the address itself, and it is deleted after a day.
• The map is drawn from map tiles that your browser loads directly from tiles.openfreemap.org. Like any website, that service receives your IP address and the map area being shown.
• Photos of places, in city guides and travel plans, are loaded by your browser directly from where they are stored: Wikimedia Commons (upload.wikimedia.org) or our own file storage. Those services receive your IP address when a photo is shown, and Wikimedia's servers may set a cookie of their own (WMF-Uniq) when they send one. It comes from Wikimedia, not from TimeToStep, and is covered by Wikimedia's privacy policy; TimeToStep itself sets no cookies for visitors.
• The company hosting TimeToStep may record technical request logs, which include IP addresses, under its own privacy policy and retention period.

Editors

The people who edit TimeToStep's guides sign in to a private admin area. Signing in sets one strictly necessary, http-only cookie that keeps the editor signed in for up to 12 hours. Visitors never receive it.

Error reports and service logs

To keep TimeToStep working, our server records which features are used and how they perform: for example the city, the walking goal, how many stops were found, how long it took and any error. These records never contain your start, destination, location, search text, the places you chose or your IP address.

When something breaks, a technical error report (what failed, the page, and your browser and operating system versions) may be sent to our error-monitoring provider, Sentry. These reports exclude your IP address, locations and search text. Nothing is sent when everything works.

Usage counts

We count how often each part of TimeToStep is used, one number per day: how many walking days were planned in each city, how many times each guide, walk and place page was opened, and how many times each place was said yes to, said no to, or taken out of a plan. To count a page, it tells our server which page it is when you open it. The counts say nothing about who: no IP address, cookie, identifier or location is kept with them, a place's count doesn't record which plan or which other places it came with, and they can't be linked to you. We use them to decide which cities to keep most up to date and which guides to write.

Why this data is used

Search details, travel choices and IP addresses are used only to provide the plan you ask for and to keep the service secure and available.

Your rights

Under the GDPR you can ask for access to, correction or deletion of personal data about you, object to or restrict its use, and withdraw consent. Because TimeToStep stores no personal data, there is usually nothing to return or delete. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the data protection authority where you live.

Data sources

Map data and places are © OpenStreetMap contributors, available under the Open Database License. Photos of places come from Wikimedia Commons, each with its author and licence shown. How well known a place is comes from Wikidata and from Wikipedia's public page-view statistics. TimeToStep collects these on its own schedule; your visits play no part in them.