Your information

A simple privacy note.

Your saved travels stay in your browser. Suggestions go privately to Alex. Cookie-free statistics help improve the site.

Updated 1 October 2026

Who is responsible?

The 100 Wonders Project is run by Alexander Brown (Alex), who is the controller of the personal information collected for this project. For privacy questions or requests, email alexander@ajbrownkc.co.uk.

Your browser data

My Top 100, Reserves, Been there, Want to visit, notes and travel plans are stored on your device using browser storage. There are no accounts or automatic cross-device synchronisation. You can export a backup or clear these choices in My Travels. They remain on that device until you remove them or clear your browser data. A shared-list link contains the list you choose to share; it does not include your private notes or Reserves. Anyone you give that link to can read the shared list.

Suggestions and replies

The Suggest form collects your place or page, message, suggestion type and any optional name, email address or source link you provide. You can submit without identifying yourself. An email address is needed only if you would like a reply. The check for an existing guide happens in your browser.

Alex uses submissions to review suggestions, correct guides and reply where appropriate. The lawful basis is legitimate interests: maintaining an accurate, useful travel website and responding to people who contact it. Submissions are not published automatically, used for advertising or added to a mailing list.

Where suggestions are held

Netlify, Inc., a US company, hosts the website and stores submissions in the private Netlify Forms inbox. A notification copy also goes to Alex’s email service. These service providers process information to deliver, protect and operate the service, including ordinary connection details such as IP addresses.

Netlify may process information in the United States and other countries where it and its service providers operate. Its Data Processing Agreement provides for UK transfers under the UK Extension to the EU-US Data Privacy Framework, with standard contractual clauses and the UK Addendum as fallback safeguards. The linked agreement describes these safeguards; you can also ask Alex for details. See Netlify’s privacy information.

How long suggestions are kept

Alex keeps a submission while it is being considered, then deletes its identifying details from the project’s Netlify inbox and email copies within 12 months of resolving it. A non-identifying editorial idea or correction may be retained. If a legal obligation or dispute requires a longer period, only the information needed for that purpose is retained.

Visitor statistics

Cloudflare Web Analytics measures page views, visits and loading performance. It does not use analytics cookies, browser storage or fingerprinting to identify visitors. Statistics include the pages visited, referring sites, broad country, device and browser categories, and performance timings. The site does not send your form entries, saved lists or travel notes as analytics events.

The analytics script connects to Cloudflare, a US company with global infrastructure. Cloudflare says it does not retain visitors’ IP addresses in Web Analytics. Analytics reports are available for up to six months; older results may be sampled. See how Web Analytics works and Cloudflare’s privacy policy.

Maps and external links

The clean maps use local boundary files. Choosing street maps sends ordinary connection information, such as your IP address, to OpenStreetMap’s tile service. Following an external link opens that provider’s website, which has its own privacy arrangements.

Your rights

You can ask Alex for access to your personal information, correction of inaccurate details, deletion or restriction of its use, subject to the applicable legal conditions.

You have the right to object to use of your information based on legitimate interests. Email alexander@ajbrownkc.co.uk, with enough information to identify your submission.

You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. There is no automated decision-making with legal or similarly significant effects.