Privacy

Cookies: one thing, and you can refuse it

This site loads Google Analytics 4, which sets cookies in your browser (_ga and one named for this site's measurement ID) to tell repeat visits apart. That is the only thing here that stores anything in your browser.

In the EU, EEA, UK and Switzerland it is off until you accept it. A bar appears on your first visit with two equally sized buttons; nothing is stored and nothing is sent until you choose. Decline and we delete any _ga cookies already present. Your choice is remembered in a cookie called wem_consent for six months — delete that cookie and you will be asked again.

Elsewhere Analytics runs by default, which is the common practice in those jurisdictions. You can still turn it off, from anywhere: the Cookie choices link in the footer of every page opens the same bar, whatever country you are in. A declined choice is honoured everywhere, not only where we are obliged to ask — the same switch, the same effect.

Two other routes work without relying on anything we built: set the wem_consent cookie to denied yourself, or block cookies for this site in your browser settings. We honour a declined choice in every country, not only in the ones where we are obliged to show the bar.

The price data on this site works identically either way. Nothing here is gated behind analytics, and refusing costs you no feature.

No advertising, and the signals to prove it

This site carries no advertising, no ad pixels and no affiliate links. Beyond that, the analytics tag denies Google's three advertising consent signals — ad_storage, ad_user_data and ad_personalization — for every visitor in every country, not just where consent is required. Those three signals are the switches Google itself documents as governing advertising cookies, ad data and personalisation — including its cross-device "Google Signals" feature, which Google documents as collecting nothing while ad_storage is denied.

Note the shape of that sentence. We can show you what we send, and you can check it in dataLayer. What Google then does inside its own systems is Google's to answer for, under its privacy policy. We would rather point at the mechanism than make a promise on someone else's behalf.

You do not have to take our word for it: open your browser console on any page and inspect dataLayer. The consent defaults are the first thing the page pushes, before the analytics script loads.

This page used to say the site set no cookies at all. That was true until Google Analytics was added; the page was rewritten the same day, and the change is listed in the corrections log.

Who is responsible for your data

The organisation responsible for this site — the data controller, in the language of the GDPR — is HMK Inc., PO Box 77403, Markham, Ontario L3P 0C8, Canada. The same company operates Easy Travel Data.

To ask anything about this page, or to make any of the requests below, use the contact form. It reaches the people who run the site; there is no separate privacy desk.

What the built-in counter records

We do count how the site is used, because otherwise we cannot tell whether it is worth maintaining. It works by requesting a 1×1 image from this same domain with a few parameters in the URL. Those parameters are:

• that a page was opened, and how many countries it had;
• which country was opened, and whether it came from the map, the index, the shortcut row or the keyboard;
• that a source link was clicked, and to which provider.

There is no identifier of any kind — no cookie, no fingerprint, no account, no session ID. Two visits by you and one visit each by two people are indistinguishable to us. We can see what happened, never who did it.

Server logs, and why they do not contain your IP

Requests are recorded in a normal web-server log: time, path, status code and browser user-agent string.

The IP address in those logs is not yours. This site sits behind Cloudflare, and the server is deliberately not configured to restore the original visitor address, so what gets written down is Cloudflare's edge server — the same handful of addresses for everyone. Your own IP address never reaches our machine and is never stored by us.

Logs are rotated daily and kept for 14 days, then deleted.

Cloudflare

Cloudflare delivers this site and therefore does see your IP address, as any network between you and a website does. Their handling of it is governed by Cloudflare's privacy policy. We do not receive that data.

Leaving this site

Every price links to the provider's own page. Once you click through you are on their site under their privacy policy, and they may well set cookies and track you. We have no control over that and receive nothing back from it — there are no affiliate links here, so no click of yours is tagged or attributed to us.

Your rights over the analytics data

Google Analytics is the only thing on this site that sends anything about you anywhere, and only where it runs — or where you accepted it. (What it sends is what we can show you; what Google keeps is answered by Google.) Where the GDPR or UK GDPR applies you can ask us to confirm what is held, to give you a copy, to correct it, to erase it, to restrict or object to its use, and to withdraw consent at any time. Under Canadian federal law (PIPEDA) you can ask for access to it and challenge its accuracy.

• The fastest way to stop it is to decline in the consent bar, or delete the wem_consent cookie and decline when asked again. That deletes the _ga cookies too.
• Legal basis: your consent in the EU, EEA, UK and Switzerland; our legitimate interest in knowing whether the site is used, elsewhere.
• Retention: our own server logs are deleted after 14 days. In Google Analytics, event data is kept 2 months — the shortest the standard product allows — and user-level data 14 months. Those are the figures read off the property, not a characterisation of them.
• No advertising link: this property is not connected to a Google Ads account, and Google Signals — the cross-device feature that would associate visits with signed-in Google accounts — is disabled on it.
• Where it goes: Google processes it, and may do so outside your country.

Everything else on this page still holds: the site's own counter has no identifiers at all, there are no accounts, no forms and no newsletter, so outside Analytics there is genuinely nothing about you for us to export or erase. Ask us anything through the contact form; we will also tell you if a request concerns data we simply do not have.