Privacy notice
Version 1.0, in effect from November 4, 2026.
1. Who we are
1.1 This notice covers the website fromtheairport.xyz and the addresses that redirect to it (fromtheairport.ca, www.fromtheairport.xyz, icebergroute.com, all checked 2026-11-04), the free embeddable route maps served from fromtheairport.xyz/embed/…, and the email addresses hello@, contribute@, routes@ and privacy@fromtheairport.xyz. We call all of this “the site”.
1.2 The site is run by From the Airport, a trade name of EventWeGo Inc.. Day-to-day work is done from Lewisporte, Newfoundland and Labrador, Canada.
1.3 Our privacy officer is the Privacy Officer, EventWeGo Inc. (the corporation behind Best Kind Stays, From the Airport and Print the Place). Reach them at privacy@fromtheairport.xyz.
2. The short version
2.1 The site has no user accounts and no database of visitors. Personal information reaches us one way only: email you choose to send us. What we then publish with your permission (your credit name and link, a photograph, a proof-board entry) lives in our code repository and on the site; everything else about visitors is anonymous statistics from our hosting provider.
2.2 When you view a map or live weather, your browser contacts outside services for the map tiles, terrain and weather data. They see your IP address the way any website you visit does. We never see your location.
2.3 We do not sell personal information, run advertising, or use tracking cookies.
3. What we collect, why, and where it goes
Each row below is something that actually happens on the site today. If we start doing something new, we will update this notice first (section 13).
3.1 Email you send us
| What | Your email address, your name if you give it, the name and link you want credited, your message, and any attachments. |
| Why | To answer you; to receive corrections, photographs, GPS tracks and route proposals; to keep a record of what you allowed us to publish and under what terms. |
| Legal basis (where one is required) | Consent, and our legitimate interest in running a contributor relationship you started. |
| Where it is held | Our mailbox at Proton AG (Switzerland; Proton keeps data in Switzerland, Germany and Norway); then filed as text on a computer of ours in Newfoundland and Labrador, Canada. Mail to hello@, contribute@, routes@ and privacy@ is forwarded to that mailbox through Cloudflare Email Routing (United States and worldwide edge). |
| Kept for | Correspondence about something we published: for as long as the item is published, then 2 years, because it is our record of your permission. Everything else: 2 years after the last message. |
3.2 GPS tracks (GPX files) you contribute
| What | A GPX recording contains timestamps, positions, speed and often the exact place you started and stopped — which can be your home. |
| Why | To verify that a route or trail was actually travelled. We publish only: which route, the date, and the credit name you chose. We never publish the file, the start or end point, or speeds. A one-way fingerprint (hash) of the accepted file is kept in our code repository so nobody can claim credit twice. |
| Legal basis | Consent (you send it for this purpose). |
| Where it is held | The raw file stays in the email described at 3.1 and on our computer in Newfoundland and Labrador. The published line entry lives in our code repository, which is private and kept only on our own computer in Newfoundland and Labrador and its backups, and on Cloudflare. |
| Kept for | Raw file: deleted 30 days after we accept or decline it. Published entry: for as long as the route is published, or until you ask us to remove your credit. |
3.2.1 Tip: most apps let you trim the start and end of a recording before exporting. You are welcome to do that.
3.3 Photographs you contribute
| What | The image, its embedded metadata (capture time and often GPS coordinates), the name you want credited, the link you want your name to point to, and your written licence or permission. |
| Why | To publish the photograph with your credit on route, trail and guide pages, and — for dated iceberg and wildlife photographs — in the sightings layer. |
| Legal basis | Consent: the permission you give in your email. |
| Where it is held | Web-size copies in our private code repository (see 3.2) and on Cloudflare (served worldwide). A photograph we decline is deleted 30 days after the decision. Originals in the email at 3.1. |
| Metadata | We remove all embedded metadata, including GPS coordinates, from every published copy; the original in your email is the only copy that keeps it. Every build of the site is checked, and fails, if a published image carries location or other embedded metadata. |
| Kept for | While published, then removed from the live site within 7 days of your request. Copies remain in the history of our private code repository unless you ask us to purge them. |
3.3.1 Your credit name and link are personal information you have asked us to publish. You can change or remove them at any time by emailing contribute@fromtheairport.xyz.
3.4 Visitor statistics (Cloudflare Web Analytics)
| What | Every page includes a small script from Cloudflare that records the page viewed, the referring site, browser type, country, and technical timing. Cloudflare receives your IP address to deliver the page and the script; Cloudflare states that Web Analytics uses no cookies or other client-side state, collects the minimum needed, and does not track individual visitors across sites. The beacon is not loaded inside embedded maps (section 12). |
| Why | To count visitors and see which sites send them, and to show partners and sponsors aggregate referral figures. No individual is ever identified. |
| Legal basis | Legitimate interest (aggregate audience measurement). |
| Where it is held | Cloudflare, Inc. (United States, with a global network). |
| Kept for | As long as Cloudflare keeps Web Analytics data under its own terms; Cloudflare does not publish a fixed period. We see only totals. |
3.5 Hosting logs
3.5.1 The site is served by Cloudflare Pages. Like every host, Cloudflare processes your IP address and request details to deliver pages and defend against abuse, and keeps standard edge logs for as long as its own privacy policy says is consistent with its business purposes; it publishes no fixed period. Our plan gives us no access to those logs. We do not have a server of our own and do not keep access logs ourselves.
3.6 Maps and live conditions from outside services
3.6.1 When a page with a map loads, your browser fetches map tiles from OpenFreeMap (tiles.openfreemap.org), run by Hyperknot Software Kft. in Hungary, which may serve them through Cloudflare. Its policy says its server logs leave out IP addresses by default and are deleted after 7 days. Maps that show terrain also fetch elevation tiles from Amazon Web Services (s3.amazonaws.com, the public Terrain Tiles dataset, United States). When a page shows live weather or sea temperature, your browser fetches it from Open-Meteo (api.open-meteo.com, marine-api.open-meteo.com), run by OpenMeteo GmbH in Switzerland. Its policy says its web server logs may hold IP addresses and the coordinates asked for, and are deleted after 90 days.
3.6.2 These services see your IP address and browser details, as any website you visit does. The weather request contains the coordinates of the destination on the page, never your own location. We do not ask for or receive your device location anywhere on the site.
3.6.3 We do not control these services and they do not report anything back to us. Their own privacy notices apply to them.
3.7 Things stored in your own browser
3.7.1 The site stores two small preferences in your browser’s local storage: by-off (whether the dialect voice is switched off) and fta-maps-app (which map app the Directions buttons open). A trip plan lives in the page’s address, so it goes where you share the link and nowhere else; a start date you type travels in that link only if you add it. None of this leaves your device unless you share it.
3.7.2 The site registers a service worker that caches pages and map data on your device so that a route still opens with no signal on the road. If you press “keep offline” on a page, that page is saved on your device on purpose. Nothing is uploaded; there is no server to upload to. You can clear all of it through your browser’s site-data settings.
3.7.3 The site sets no cookies of its own, and its pages arrive with none (checked 2026-11-04).
3.8 Links to map apps and other sites
3.8.1 Buttons that open Google Maps, Apple Maps, Waze, OsmAnd or Organic Maps are plain links. Nothing is sent until you tap one; from then on, that app’s privacy terms apply. The same goes for every outbound link on the site (Parks Canada, 511NL, NAV CANADA, Wikimedia Commons, contributors’ own pages, and so on).
3.9 Business listings taken from open data
3.9.1 Eating, stay and venue pages show business names, phone numbers and locations drawn at build time from OpenStreetMap, Overture Maps and town directories, and places to stay from Best Kind Stays’ public directory, which is run by the same people. Some of those businesses are sole proprietors, so a listing may be a person’s name and number. We publish this as business contact information for the purpose of contacting the business, which PIPEDA permits without consent. If you are listed and want the listing corrected or removed, email hello@fromtheairport.xyz; because the source is open data, we may also point you to the source so the correction sticks everywhere.
3.10 Seasonal iceberg email
3.10.1 The site offers a sign-up for one or two iceberg-season emails a year, on /icebergs and at the foot of most pages.
3.10.2 The list runs on MailerLite, which holds subscriber data in the European Union (Germany and the Netherlands). Sign-up is double opt-in: nothing counts until you click the confirmation email. Every message carries an unsubscribe link. We use the address for the iceberg email only, and it is kept until you unsubscribe.
3.11 What we do NOT collect
3.11.1 No accounts, passwords, payment details, precise device location, advertising identifiers, social-media pixels, or third-party analytics beyond section 3.4. A template contact form (Web3Forms) exists in the code but is not wired to any page and has no key.
4. Who we share personal information with
4.1 Service providers that process data for us: Cloudflare (hosting, DNS, email forwarding, analytics; United States/global); Proton (email; Switzerland, Germany, Norway); MailerLite (the iceberg email; EU). Our code repository has no outside host. Each is bound by its own published terms; we do not have negotiated data-processing agreements with them.
4.2 The public, only where you asked us to: your chosen credit name and link next to your photograph or on the proof boards.
4.3 Sponsors and partners receive only aggregate figures (page views, referrals). Never email addresses, never individual visitor data.
4.4 Legal requirements: we will disclose information if a law, court order or lawful request obliges us to, and will tell you where the law lets us.
4.5 We do not sell personal information and do not share it for advertising.
5. Where your information goes (cross-border)
5.1 We are in Canada. Our providers store and process information in the United States (Cloudflare; Amazon for terrain tiles), Switzerland (Proton, Open-Meteo), Germany and Norway (Proton), and the European Union (MailerLite in Germany and the Netherlands; OpenFreeMap in Hungary). Information held outside Canada is subject to the laws of that country, and authorities there may be able to access it under those laws.
5.2 For visitors in the EU, EEA and UK: transfers to Canada rely on the European Commission’s and UK’s adequacy decisions for PIPEDA-covered organisations; onward transfers to the United States rely on the provider’s participation in the EU-US Data Privacy Framework or standard contractual clauses; Cloudflare states that it complies with the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
6. How long we keep it
6.1 The periods are set out row by row in section 3. In general: permission records last as long as the thing you permitted is published, plus a buffer; everything else is deleted 2 years after the last message. We review the mailbox and filed correspondence once a year.
7. How we protect it
7.1 Filed correspondence is kept on one computer in Newfoundland and Labrador. Its disk is not encrypted; it sits on an isolated network segment, is reachable only from our own devices over a private network, is kept up to date, and is backed up. Automated tools we run file incoming email on it. The mailbox itself is Proton’s, encrypted at rest. Our code repository is private and kept on that computer.
7.2 No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, keep a record of the breach, and — for EU/UK residents — notify the relevant supervisory authority within 72 hours where the GDPR requires it.
8. Your rights
8.1 Everyone, everywhere, can ask us to:
- (a) tell you what personal information we hold about you and give you a copy;
- (b) correct it;
- (c) delete it, or stop using it, where we do not need to keep it for a legal reason;
- (d) withdraw consent for anything based on consent — for example, remove your credit or take down your photograph. Withdrawal works from that day forward; it does not undo publication that already happened, and (for Creative Commons licences) it does not revoke copies others lawfully made before then;
- (e) unsubscribe from any email list we run, with one click or one reply.
8.2 Write to the privacy officer at cl. 1.3. We answer within 30 days (PIPEDA), or one month (GDPR/UK GDPR), and will tell you if we need longer and why. We will ask you to confirm your identity in a proportionate way — usually by replying from the same email address.
8.3 Complaints. You can complain to us first, and at any time to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, 1-800-282-1376, priv.gc.ca. EU/EEA residents may complain to their national supervisory authority; UK residents to the Information Commissioner’s Office (ico.org.uk).
9. Visitors in the EU, EEA and UK
9.1 The “controller” is the corporation named at cl. 1.2. We have no EU or UK establishment.
9.2 Our lawful bases are stated row by row in section 3: consent (email, contributions, any mailing list), and legitimate interests (answering correspondence, aggregate audience measurement, serving pages securely). You may object to any legitimate-interest processing by writing to us.
9.3 In addition to section 8 you have the rights to restrict processing, to data portability (for what you gave us with consent — we will send it back in the format you sent it), and to object. Nothing on the site involves automated decision-making about you.
9.4 We do not knowingly set non-essential cookies or similar identifiers. The local-storage preferences and the offline cache at 3.7 exist only to make the site work without signal; nothing in them identifies you or leaves your device. The Cloudflare analytics beacon at 3.4 is our only audience measurement.
10. Visitors in Quebec (Law 25)
10.1 The person in charge of the protection of personal information is the Privacy Officer, EventWeGo Inc., reachable as at cl. 1.3.
10.2 We collect personal information only through email you send and the anonymous statistics described above. We do not use technology that identifies, locates or profiles you. The map and weather requests at 3.6 are made by your browser to obtain content you asked for, not to locate you.
10.3 Personal information may be communicated outside Quebec, to the places listed at cl. 5.1. We have assessed the privacy factors involved, in writing, and review that assessment once a year.
10.4 You may complain to the Commission d’accès à l’information du Québec.
11. Children
11.1 The site is a travel-planning reference. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you are under 18, please ask a parent or guardian to send any contribution on your behalf. If we learn we hold a child’s information without a guardian’s consent, we will delete it.
12. Embedded maps on other websites
12.1 Businesses and towns may embed our route maps on their own sites in an iframe. When you view one, our site delivers the map to your browser as described in sections 3.5 to 3.7. The analytics beacon at 3.4 does not load in an embed, and an embed carries no contributed photographs. The website you are visiting is responsible for its own privacy notice. We receive no information from the host site about you.
13. Changes to this notice
13.1 We will post any change here with a new version number and effective date, and keep every earlier version: email hello@fromtheairport.xyz and we will send the text that applied on any date. If a change means we would collect or use personal information in a new way, we will make that change before the new collection starts and, where consent is required, ask for it.
14. Contact
14.1 Privacy officer: cl. 1.3. General: hello@fromtheairport.xyz. Contributions and takedown: contribute@fromtheairport.xyz.