Privacy policy
In short: we collect the minimum, never sell it, and delete your account with everything in it on request.
Revision of 11 September 2026. Where to Fly (www.bramverweij.com) is an information project about choosing travel destinations.
What data we process
- Email address — if you sign in to your account with a one-time code or subscribe to the newsletter. There is no password: we neither ask for one nor store one.
- The contents of your account — saved destinations, comparison lists and checklists. For a guest these stay in the browser and never reach the server.
- Technical request information — IP address, browser type, time of the request and the page address. We need it to protect against code guessing and for traffic statistics.
- Anonymised interface events — which pages and blocks are opened most often. These events are not linked to an individual.
We neither request nor store passport details, payment details or bank card data: no payments are taken on this site.
What we use it for
- So that one-time code sign-in works and your lists survive across devices.
- To send the emails you subscribed to — and not the ones you did not.
- To limit sign-in attempts and protect accounts from brute force.
- To understand which sections are useful and to improve the service.
Legal basis and consent
We process your email address on the basis of your consent, which you give with the checkbox on the sign-in page and when subscribing. Consent can be withdrawn: every email has an unsubscribe link, and an account can be deleted in the Profile section without contacting support.
Cookies and local storage
We use strictly necessary cookies: the session cookie kl_session after sign-in, plus CSRF protection. A guest’s favourites, comparison lists and checklists live in your browser’s localStorage and are removed together with the site data. We set no third-party advertising or tracking cookies.
Who we share data with
With no one, apart from the technical providers the service cannot run without: our hosting provider and the mail service that delivers the code emails. We do not sell or pass data to advertisers. Affiliate links lead to third-party sites, and once you follow one, that site’s policy applies, not ours.
How long we keep it
Account data — for as long as the account exists. One-time codes — minutes, until they expire. Technical logs — no longer than 90 days. Once an account is deleted its contents are erased beyond recovery, and backups are overwritten within 30 days.
Your rights
You can ask what data we hold about you, correct it, export it or delete your account entirely. Deletion is available on your own in the Profile section; for anything else write to support@bramverweij.com. We reply within 30 days.
Safety
The site works over HTTPS only, session cookies are marked httpOnly and Secure, and the number of code attempts is limited. No one can guarantee absolute security online, but we stick to data minimisation: what we never collected cannot leak.
Children
The service is not intended for children under 16, and we do not knowingly collect their data.
Changes to this policy
If the terms change we will update the revision date at the top of this page, and we will email subscribers about material changes. Previous revisions are available on request.
Contacts
Questions about this policy and data handling: support@bramverweij.com.