WildKit
Menu
FrançaisFREN Pack my bag

Home Legal notice and privacy

Legal notice and privacy

Who publishes WildKit, who hosts it, and what the site does with your data. It's all here, in plain words.

Who publishes WildKit

Who hosts the site

What stays on your device

WildKit has no accounts and no database. What you put together stays in your browser, in its local storage:

If you share your kit as a link, its contents are written into the link's address, after the # sign: they go wherever you send that link. That part of the address is never sent to the wildkit.fr server when the page opens. To wipe everything, clear the site data for wildkit.fr in your browser settings.

What goes online

Nothing goes online without a reason: serving the page, or answering what you ask for in the app. For each recipient, here is what it receives, why, on what basis, and how long it keeps it when it says so. Like any request on the internet, each one carries your device's IP address.

The host: Cloudflare

The site is served by Cloudflare, Inc. (San Francisco, United States), which acts as a processor under its data processing addendum. As with any website, your browser sends it requests, and its servers, spread around the world, receive these requests with your IP address and answer them from a data centre near you. Cloudflare publishes no retention period for these request logs. For transfers from the European Union, Cloudflare says it relies on the European Commission's standard contractual clauses, which that addendum incorporates, and on its participation in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission. Legal basis: the publisher's legitimate interest in keeping the server secure and running properly (Article 6(1)(f) GDPR).

The weather: Open-Meteo

When you look up a place and pick your dates in the app, your browser calls Open-Meteo directly (OpenMeteo GmbH, Bürglen, Switzerland), which therefore receives your IP address: it sends the place name you type, to find it, then the latitude, longitude and dates of your trip. When the place search knows the altitude of the place you picked, it also sends that altitude, rounded up to the next multiple of 50 m, and the latitude and longitude are then rounded to 2 decimals (about 1 km). The altitude at which you say you sleep, including one you correct, is never sent to it: it stays in your browser and is used to size your night. If you import a GPX file without picking a place, the central point of your track serves as the place: it is sent as is, with its exact latitude and longitude, as long as the altitude of the place is unknown. The places where you sleep are sent to it too: one point per night, placed along your route, with its latitude and longitude rounded to 2 decimals and the altitude of your route at that spot, rounded up to the next multiple of 50 m, to forecast the temperature of each night. According to Open-Meteo, its server logs, which may contain these coordinates, are deleted after 90 days. Switzerland is covered by an adequacy decision of the European Commission. Legal basis: the publisher's legitimate interest in providing the service you ask for, the weather for your trip (Article 6(1)(f) GDPR).

The place name of a GPX track: Géo API (geo.api.gouv.fr)

Only if you import a GPX file: your browser calls the Géo API (geo.api.gouv.fr), a public service of the French State (Mission Etalab, DINUM) whose host, according to its legal notice, is OVH SAS, a French company (head office in Roubaix), and sends it the latitude and longitude of the central point of your track, rounded to 2 decimals (about 1 km), to find the municipality. The file itself is read in your browser and is not sent: what goes to Open-Meteo is the central point of your track, which serves as the place for the weather, and the places where you sleep, rounded (see the weather section). This service only covers France: for a track located elsewhere it answers nothing, no name is suggested and you type the place yourself. According to its terms of use, the data sent to the API may be kept to improve the service; no retention period is published. French public service, French host: no transfer outside the European Union is announced. Legal basis: the publisher's legitimate interest in providing the service you ask for, finding the place name of your track (Article 6(1)(f) GDPR). If you would rather nothing be sent to the Géo API, do not import a GPX: type the place name instead.

The only other service called is audience measurement, described just below, which you can opt out of. Fonts and images come from wildkit.fr.

Audience measurement

WildKit counts its visits with Cloudflare Web Analytics, to know which pages are useful and whether they load fast. That is its only use: statistics on visits to wildkit.fr, for WildKit alone. The controller of this measurement is the site's publisher (see above).

Who provides the service

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States, which acts as a processor under its data processing addendum. The measurements therefore go to the United States. For transfers from the European Union, Cloudflare says it relies on the European Commission's standard contractual clauses, which that addendum incorporates, and on its participation in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission.

What is measured

When a page shows, and only if you have not opted out (see below), the site loads a small script from static.cloudflareinsights.com. It measures how the page loads with the browser's own measuring tools (the Performance API) and sends Cloudflare the address of the page viewed, the site you came from if any, and the load times. WildKit's dashboard shows these visits by country, device type, browser and operating system.

What Cloudflare says it does not do, and where it says so:

How long

According to Cloudflare, detailed measurements are kept for 7 days, then reduced to a sample of around 10%, and the dashboard gives access to the previous six months.

On what basis

WildKit's legitimate interest in knowing how much its site is visited and how fast it is (Article 6(1)(f) GDPR). It is a measurement exempt from consent within the meaning of the CNIL guidelines (the French data protection authority): limited to measuring the audience of wildkit.fr on behalf of WildKit alone, reduced to statistics, with no tracking from one site to another and no cross-referencing with other data, and WildKit passes these statistics to no one. That is why the site shows no banner. One caveat: Cloudflare publishes no retention period beyond the six months that can be viewed, while the CNIL recommendation aims for twenty-five months at most. You can object to the measurement at any time, just below.

Opt out of the measurement

Your browser does not run JavaScript: the measurement cannot load, so no measurement takes place. The setting needs JavaScript, but without it there is nothing to opt out of.

Your choice applies to this browser and is remembered (key "wildkit.audience" in local storage) until you change it here or clear the site data. This page itself is never measured. Blocking static.cloudflareinsights.com, for example with a content blocker, works too: the site works exactly the same.

Your rights

The General Data Protection Regulation (GDPR) gives you the right to access, correct, erase, restrict and object to the use of data about you. To use these rights, or for any question about this site, write to contact@thanaelfontaine.eu. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

For audience measurement, you exercise your right to object directly with the setting above, or with your browser's GPC signal.

Updated .